neonctl 2.27.0 → 2.28.0

package/dist/api.js

@@ -0,0 +1,665 @@
+// Thin fetch-based client layer over `@neon/sdk` (the official, fetch-native
+// Neon SDK). neonctl was originally built on the axios-based
+// `@neondatabase/api-client`, whose generated `Api` object exposes one
+// positional method per endpoint and resolves to an `AxiosResponse`. This module
+// reproduces exactly the subset of `Api` methods neonctl uses, backed by the
+// tree-shakeable `@neon/sdk/raw` functions, and returns a small
+// `{ data, status, headers }` envelope the call sites destructure.
+//
+// On a non-2xx response (or a network/timeout failure) it throws a single typed
+// {@link NeonApiError}; every call site narrows failures with
+// {@link isNeonApiError} and reads `error.status` / `error.data`. There is no
+// axios anywhere in neonctl: requests go through the global `fetch`, and this is
+// the one place HTTP errors are shaped.
+import { Readable } from 'node:stream';
+import { EnvHttpProxyAgent, setGlobalDispatcher } from 'undici';
+import { createClient, createConfig } from '@neon/sdk/raw';
+import * as raw from '@neon/sdk/raw';
+import { log } from './log.js';
+import pkg from './pkg.js';
+// Node's global `fetch` (undici) ignores HTTP_PROXY / HTTPS_PROXY / NO_PROXY,
+// whereas the axios-based client neonctl used previously honored them. Restore
+// that behaviour by installing a proxy-aware global dispatcher — but only when a
+// proxy is actually configured, so the default (no-proxy) path stays untouched.
+// This covers every `fetch` neonctl makes, including the direct S3 upload.
+const PROXY_ENV_VARS = [
+    'HTTP_PROXY',
+    'http_proxy',
+    'HTTPS_PROXY',
+    'https_proxy',
+    'ALL_PROXY',
+    'all_proxy',
+];
+if (PROXY_ENV_VARS.some((name) => process.env[name])) {
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+}
+const DEFAULT_API_HOST = 'https://console.neon.tech/api/v2';
+const REQUEST_TIMEOUT_MS = 60000;
+const USER_AGENT = `neonctl v${pkg.version}`;
+/** Mirrors the api-client `ContentType` enum used by the `request()` escape hatch. */
+export var ContentType;
+(function (ContentType) {
+    ContentType["Json"] = "application/json";
+    ContentType["FormData"] = "multipart/form-data";
+    ContentType["UrlEncoded"] = "application/x-www-form-urlencoded";
+    ContentType["Text"] = "text/plain";
+})(ContentType || (ContentType = {}));
+/**
+ * The single error type thrown by the neonctl API layer. It carries the HTTP
+ * status and parsed body for a non-2xx response, or a `code` (e.g. `ETIMEDOUT`)
+ * for a network/timeout failure. Call sites narrow with {@link isNeonApiError}
+ * and read `status` / `data` rather than reaching into an axios-shaped object.
+ */
+export class NeonApiError extends Error {
+    constructor(message, init = {}) {
+        super(message);
+        this.name = 'NeonApiError';
+        this.status = init.status;
+        this.statusText = init.statusText;
+        this.data = init.data;
+        this.headers = init.headers;
+        this.requestPath = init.requestPath;
+        this.code = init.code;
+    }
+}
+/** Narrow an unknown error to a {@link NeonApiError}. */
+export function isNeonApiError(err) {
+    return err instanceof NeonApiError;
+}
+/** Extract a `message` string from a parsed error body, if present. */
+export function messageFromBody(body) {
+    if (body && typeof body === 'object' && 'message' in body) {
+        const message = body.message;
+        if (typeof message === 'string')
+            return message;
+    }
+    return undefined;
+}
+/** Extract a machine-readable `code` string from a parsed error body, if present. */
+export function codeFromBody(body) {
+    if (body && typeof body === 'object' && 'code' in body) {
+        const code = body.code;
+        if (typeof code === 'string')
+            return code;
+    }
+    return undefined;
+}
+/**
+ * Adapt a WHATWG `ReadableStream` (what `fetch` gives us as `response.body`) to
+ * a Node `Readable`, so callers can `pipeline()` the body straight to disk. Done
+ * by hand rather than `Readable.fromWeb` to sidestep the DOM-vs-`node:stream/web`
+ * `ReadableStream` type friction without an unsafe cast.
+ */
+function webStreamToNodeReadable(body) {
+    const reader = body.getReader();
+    return new Readable({
+        async read() {
+            try {
+                const { done, value } = await reader.read();
+                this.push(done ? null : Buffer.from(value));
+            }
+            catch (err) {
+                this.destroy(err instanceof Error ? err : new Error(String(err)));
+            }
+        },
+    });
+}
+function headersToObject(headers) {
+    const out = {};
+    headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+function isAbortError(err) {
+    return (err instanceof Error &&
+        (err.name === 'AbortError' || err.name === 'TimeoutError'));
+}
+/**
+ * Walk an error's `cause` chain to find the underlying socket/DNS `code` (e.g.
+ * `ECONNREFUSED`, `ENOTFOUND`) — `fetch` surfaces these as the `cause` of a bare
+ * `TypeError: fetch failed`. Preserving the code lets `isNetworkError` classify
+ * the resulting {@link NeonApiError} as a connectivity failure.
+ */
+function readSocketCode(err) {
+    let current = err;
+    for (let depth = 0; depth < 6 && current != null; depth++) {
+        if (typeof current === 'object' && 'code' in current) {
+            const code = current.code;
+            if (typeof code === 'string')
+                return code;
+        }
+        current = current.cause;
+    }
+    return undefined;
+}
+/** Build a {@link NeonApiError} from a non-2xx `Response` and its parsed body. */
+function httpError(response, body) {
+    let requestPath;
+    try {
+        requestPath = new URL(response.url).pathname;
+    }
+    catch {
+        // response.url may be empty in some runtimes; the path is best-effort.
+    }
+    return new NeonApiError(messageFromBody(body) ??
+        `Request failed with status code ${response.status}`, {
+        status: response.status,
+        statusText: response.statusText,
+        data: body,
+        headers: headersToObject(response.headers),
+        requestPath,
+    });
+}
+/**
+ * Translate a thrown `fetch` failure into a {@link NeonApiError}. A request
+ * timeout uses `ECONNABORTED` (matching the old axios behaviour, and excluded
+ * from `isNetworkError`'s connectivity codes so it's still reported as a
+ * timeout). A connection failure keeps its real socket code (e.g.
+ * `ECONNREFUSED`) so `isNetworkError` recognises it as a connectivity problem.
+ */
+function networkError(err) {
+    if (isAbortError(err)) {
+        return new NeonApiError('Request timed out', { code: 'ECONNABORTED' });
+    }
+    return new NeonApiError(err instanceof Error ? err.message : String(err), {
+        code: readSocketCode(err) ?? 'ENETWORK',
+    });
+}
+/**
+ * `fetch` with neonctl's request timeout applied (preserving any caller signal)
+ * and lightweight debug logging of the request line + response status — the
+ * fetch-native replacement for the old `axios-debug-log` wiring.
+ */
+const timedFetch = async (input, init) => {
+    const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const signal = init?.signal
+        ? AbortSignal.any([init.signal, timeout])
+        : timeout;
+    const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+    const url = input instanceof Request ? input.url : String(input);
+    log.debug('%s %s', method.toUpperCase(), url);
+    const response = await fetch(input, { ...init, signal });
+    log.debug('%d %s', response.status, response.statusText);
+    return response;
+};
+const RETRY_COUNT = 5;
+const RETRY_DELAY = 3000;
+/**
+ * Retry a call while the API answers 423 (Locked) — Neon's "a prior mutation on
+ * this resource is still in flight" signal.
+ */
+export const retryOnLock = async (fn) => {
+    let attempt = 0;
+    let errOut;
+    while (attempt < RETRY_COUNT) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            errOut = err;
+            if (isNeonApiError(err) && err.status === 423) {
+                attempt++;
+                log.info(`Resource is locked. Waiting ${RETRY_DELAY}ms before retrying...`);
+                await new Promise((resolve) => setTimeout(resolve, RETRY_DELAY));
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    throw errOut;
+};
+function buildUrl(apiHost, path, query) {
+    const url = new URL(`${apiHost.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`);
+    if (query) {
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined || value === null)
+                continue;
+            url.searchParams.set(key, String(value));
+        }
+    }
+    return url.toString();
+}
+async function readJsonBody(response) {
+    const text = await response.text();
+    if (text.trim() === '')
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        // Match axios' `responseType: 'json'` behaviour: a body that isn't valid
+        // JSON is surfaced as the raw string rather than coerced into an object, so
+        // callers' `body?.message` checks correctly see "no structured message".
+        return text;
+    }
+}
+export const getApiClient = ({ apiKey, apiHost }) => {
+    const baseUrl = apiHost ?? DEFAULT_API_HOST;
+    const client = createClient(createConfig({
+        auth: () => apiKey,
+        baseUrl,
+        fetch: timedFetch,
+        headers: { 'User-Agent': USER_AGENT },
+    }));
+    /** Await a raw call, unwrap to a `{ data, status, headers }` envelope, or throw {@link NeonApiError}. */
+    async function call(run) {
+        let result;
+        try {
+            result = await run();
+        }
+        catch (err) {
+            throw networkError(err);
+        }
+        const response = result.response;
+        if (!response) {
+            throw networkError(result.error ?? new Error('No response from Neon API'));
+        }
+        if (!response.ok) {
+            throw httpError(response, result.error ?? result.data);
+        }
+        return {
+            data: result.data,
+            status: response.status,
+            statusText: response.statusText,
+            headers: headersToObject(response.headers),
+        };
+    }
+    /**
+     * Low-level request used by the object-storage and functions helpers for
+     * endpoints not (yet) modeled as typed SDK functions. Mirrors the api-client
+     * `HttpClient.request()`: `format: 'json'` parses the body, `format: 'stream'`
+     * returns a Node `Readable`, and `type: ContentType.FormData` sends multipart.
+     */
+    async function request(params) {
+        const url = buildUrl(baseUrl, params.path, params.query);
+        const headers = { 'User-Agent': USER_AGENT };
+        if (params.secure !== false) {
+            headers.Authorization = `Bearer ${apiKey}`;
+        }
+        let payload;
+        if (params.body instanceof FormData ||
+            params.type === ContentType.FormData) {
+            payload = params.body;
+        }
+        else if (params.body !== undefined) {
+            headers['Content-Type'] = ContentType.Json;
+            payload = JSON.stringify(params.body);
+        }
+        let response;
+        try {
+            response = await timedFetch(url, {
+                method: params.method,
+                headers,
+                ...(payload !== undefined ? { body: payload } : {}),
+            });
+        }
+        catch (err) {
+            throw networkError(err);
+        }
+        if (!response.ok) {
+            // For a streamed download the error body arrives as a stream too; hand it
+            // back as a Node `Readable` so the caller can drain it for a message.
+            const errorBody = params.format === 'stream' && response.body
+                ? webStreamToNodeReadable(response.body)
+                : await readJsonBody(response);
+            throw httpError(response, errorBody);
+        }
+        let data;
+        if (params.format === 'stream') {
+            data = response.body
+                ? webStreamToNodeReadable(response.body)
+                : undefined;
+        }
+        else {
+            data = await readJsonBody(response);
+        }
+        return {
+            data: data,
+            status: response.status,
+            statusText: response.statusText,
+            headers: headersToObject(response.headers),
+        };
+    }
+    return {
+        request,
+        // ─── Account / user ──────────────────────────────────────────────────
+        getCurrentUserInfo: () => call(() => raw.getCurrentUserInfo({ client })),
+        getCurrentUserOrganizations: () => call(() => raw.getCurrentUserOrganizations({ client })),
+        getAuthDetails: () => call(() => raw.getAuthDetails({ client })),
+        getActiveRegions: () => call(() => raw.getActiveRegions({ client })),
+        // ─── Projects ────────────────────────────────────────────────────────
+        listProjects: (query = {}) => call(() => raw.listProjects({ client, query })),
+        listSharedProjects: (query = {}) => call(() => raw.listSharedProjects({
+            client,
+            query: {
+                ...(query.cursor !== undefined
+                    ? { cursor: query.cursor }
+                    : {}),
+                ...(query.limit !== undefined
+                    ? { limit: query.limit }
+                    : {}),
+                ...(query.search !== undefined
+                    ? { search: query.search }
+                    : {}),
+            },
+        })),
+        getProject: (projectId) => call(() => raw.getProject({ client, path: { project_id: projectId } })),
+        createProject: (data) => call(() => raw.createProject({ client, body: data })),
+        updateProject: (projectId, data) => call(() => raw.updateProject({
+            client,
+            path: { project_id: projectId },
+            body: data,
+        })),
+        deleteProject: (projectId) => call(() => raw.deleteProject({ client, path: { project_id: projectId } })),
+        recoverProject: (projectId) => call(() => raw.recoverProject({ client, path: { project_id: projectId } })),
+        listProjectOperations: ({ projectId, ...query }) => call(() => raw.listProjectOperations({
+            client,
+            path: { project_id: projectId },
+            query,
+        })),
+        // ─── Branches ────────────────────────────────────────────────────────
+        listProjectBranches: ({ projectId, ...query }) => call(() => raw.listProjectBranches({
+            client,
+            path: { project_id: projectId },
+            query,
+        })),
+        createProjectBranch: (projectId, data) => call(() => raw.createProjectBranch({
+            client,
+            path: { project_id: projectId },
+            ...(data !== undefined ? { body: data } : {}),
+        })),
+        getProjectBranch: (projectId, branchId) => call(() => raw.getProjectBranch({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateProjectBranch: (projectId, branchId, data) => call(() => raw.updateProjectBranch({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        deleteProjectBranch: (projectId, branchId) => call(() => raw.deleteProjectBranch({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        restoreProjectBranch: (projectId, branchId, data) => call(() => raw.restoreProjectBranch({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        setDefaultProjectBranch: (projectId, branchId) => call(() => raw.setDefaultProjectBranch({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        getProjectBranchSchema: ({ projectId, branchId, ...query }) => call(() => raw.getProjectBranchSchema({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            query,
+        })),
+        listProjectBranchEndpoints: (projectId, branchId) => call(() => raw.listProjectBranchEndpoints({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        createProjectEndpoint: (projectId, data) => call(() => raw.createProjectEndpoint({
+            client,
+            path: { project_id: projectId },
+            body: data,
+        })),
+        // ─── Databases ───────────────────────────────────────────────────────
+        listProjectBranchDatabases: (projectId, branchId) => call(() => raw.listProjectBranchDatabases({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        createProjectBranchDatabase: (projectId, branchId, data) => call(() => raw.createProjectBranchDatabase({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        deleteProjectBranchDatabase: (projectId, branchId, databaseName) => call(() => raw.deleteProjectBranchDatabase({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                database_name: databaseName,
+            },
+        })),
+        // ─── Roles ───────────────────────────────────────────────────────────
+        listProjectBranchRoles: (projectId, branchId) => call(() => raw.listProjectBranchRoles({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        createProjectBranchRole: (projectId, branchId, data) => call(() => raw.createProjectBranchRole({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        deleteProjectBranchRole: (projectId, branchId, roleName) => call(() => raw.deleteProjectBranchRole({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                role_name: roleName,
+            },
+        })),
+        getProjectBranchRolePassword: (projectId, branchId, roleName) => call(() => raw.getProjectBranchRolePassword({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                role_name: roleName,
+            },
+        })),
+        // ─── Data API ────────────────────────────────────────────────────────
+        createProjectBranchDataApi: (projectId, branchId, databaseName, data) => call(() => raw.createProjectBranchDataApi({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                database_name: databaseName,
+            },
+            body: data,
+        })),
+        updateProjectBranchDataApi: (projectId, branchId, databaseName, data) => call(() => raw.updateProjectBranchDataApi({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                database_name: databaseName,
+            },
+            body: data,
+        })),
+        deleteProjectBranchDataApi: (projectId, branchId, databaseName) => call(() => raw.deleteProjectBranchDataApi({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                database_name: databaseName,
+            },
+        })),
+        getProjectBranchDataApi: (projectId, branchId, databaseName) => call(() => raw.getProjectBranchDataApi({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                database_name: databaseName,
+            },
+        })),
+        // ─── VPC endpoints (project + organization) ──────────────────────────
+        listProjectVpcEndpoints: (projectId) => call(() => raw.listProjectVpcEndpoints({
+            client,
+            path: { project_id: projectId },
+        })),
+        assignProjectVpcEndpoint: (projectId, vpcEndpointId, data) => call(() => raw.assignProjectVpcEndpoint({
+            client,
+            path: {
+                project_id: projectId,
+                vpc_endpoint_id: vpcEndpointId,
+            },
+            body: data,
+        })),
+        deleteProjectVpcEndpoint: (projectId, vpcEndpointId) => call(() => raw.deleteProjectVpcEndpoint({
+            client,
+            path: {
+                project_id: projectId,
+                vpc_endpoint_id: vpcEndpointId,
+            },
+        })),
+        listOrganizationVpcEndpoints: (orgId, regionId) => call(() => raw.listOrganizationVpcEndpoints({
+            client,
+            path: { org_id: orgId, region_id: regionId },
+        })),
+        getOrganizationVpcEndpointDetails: (orgId, regionId, vpcEndpointId) => call(() => raw.getOrganizationVpcEndpointDetails({
+            client,
+            path: {
+                org_id: orgId,
+                region_id: regionId,
+                vpc_endpoint_id: vpcEndpointId,
+            },
+        })),
+        assignOrganizationVpcEndpoint: (orgId, regionId, vpcEndpointId, data) => call(() => raw.assignOrganizationVpcEndpoint({
+            client,
+            path: {
+                org_id: orgId,
+                region_id: regionId,
+                vpc_endpoint_id: vpcEndpointId,
+            },
+            body: data,
+        })),
+        deleteOrganizationVpcEndpoint: (orgId, regionId, vpcEndpointId) => call(() => raw.deleteOrganizationVpcEndpoint({
+            client,
+            path: {
+                org_id: orgId,
+                region_id: regionId,
+                vpc_endpoint_id: vpcEndpointId,
+            },
+        })),
+        // ─── Neon Auth ───────────────────────────────────────────────────────
+        getNeonAuth: (projectId, branchId) => call(() => raw.getNeonAuth({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        createNeonAuth: (projectId, branchId, data) => call(() => raw.createNeonAuth({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        disableNeonAuth: (projectId, branchId, data) => call(() => raw.disableNeonAuth({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        listBranchNeonAuthOauthProviders: (projectId, branchId) => call(() => raw.listBranchNeonAuthOauthProviders({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        addBranchNeonAuthOauthProvider: (projectId, branchId, data) => call(() => raw.addBranchNeonAuthOauthProvider({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        updateBranchNeonAuthOauthProvider: (projectId, branchId, oauthProviderId, data) => call(() => raw.updateBranchNeonAuthOauthProvider({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                oauth_provider_id: oauthProviderId,
+            },
+            body: data,
+        })),
+        deleteBranchNeonAuthOauthProvider: (projectId, branchId, oauthProviderId) => call(() => raw.deleteBranchNeonAuthOauthProvider({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                oauth_provider_id: oauthProviderId,
+            },
+        })),
+        listBranchNeonAuthTrustedDomains: (projectId, branchId) => call(() => raw.listBranchNeonAuthTrustedDomains({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        addBranchNeonAuthTrustedDomain: (projectId, branchId, data) => call(() => raw.addBranchNeonAuthTrustedDomain({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        deleteBranchNeonAuthTrustedDomain: (projectId, branchId, data) => call(() => raw.deleteBranchNeonAuthTrustedDomain({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        getNeonAuthAllowLocalhost: (projectId, branchId) => call(() => raw.getNeonAuthAllowLocalhost({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateNeonAuthAllowLocalhost: (projectId, branchId, data) => call(() => raw.updateNeonAuthAllowLocalhost({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        getNeonAuthEmailAndPasswordConfig: (projectId, branchId) => call(() => raw.getNeonAuthEmailAndPasswordConfig({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateNeonAuthEmailAndPasswordConfig: (projectId, branchId, data) => call(() => raw.updateNeonAuthEmailAndPasswordConfig({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        getNeonAuthEmailProvider: (projectId, branchId) => call(() => raw.getNeonAuthEmailProvider({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateNeonAuthEmailProvider: (projectId, branchId, data) => call(() => raw.updateNeonAuthEmailProvider({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        sendNeonAuthTestEmail: (projectId, branchId, data) => call(() => raw.sendNeonAuthTestEmail({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        getNeonAuthPluginConfigs: (projectId, branchId) => call(() => raw.getNeonAuthPluginConfigs({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateNeonAuthOrganizationPlugin: (projectId, branchId, data) => call(() => raw.updateNeonAuthOrganizationPlugin({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        getNeonAuthWebhookConfig: (projectId, branchId) => call(() => raw.getNeonAuthWebhookConfig({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+        })),
+        updateNeonAuthWebhookConfig: (projectId, branchId, data) => call(() => raw.updateNeonAuthWebhookConfig({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        createBranchNeonAuthNewUser: (projectId, branchId, data) => call(() => raw.createBranchNeonAuthNewUser({
+            client,
+            path: { project_id: projectId, branch_id: branchId },
+            body: data,
+        })),
+        deleteBranchNeonAuthUser: (projectId, branchId, authUserId) => call(() => raw.deleteBranchNeonAuthUser({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                auth_user_id: authUserId,
+            },
+        })),
+        updateNeonAuthUserRole: (projectId, branchId, authUserId, data) => call(() => raw.updateNeonAuthUserRole({
+            client,
+            path: {
+                project_id: projectId,
+                branch_id: branchId,
+                auth_user_id: authUserId,
+            },
+            body: data,
+        })),
+    };
+};

package/dist/cli.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { tryCurrentBranchFastPath } from './current_branch_fast_path.js';
+// Fast path for the offline `(config) status --current-branch` probe (used by shell
+// prompts): read the pinned branch from `.neon` without loading the full command tree,
+// api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
+// the heavy `index.js` is imported lazily and only when actually needed.
+if (!tryCurrentBranchFastPath(process.argv)) {
+    void import('./index.js');
+}

package/{commands → dist/commands}/auth.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { getApiClient } from '../api.js';
 import { auth, refreshToken } from '../auth.js';
+import { isCurrentBranchProbe } from '../context.js';
 import { CREDENTIALS_FILE } from '../config.js';
 import { isCi } from '../env.js';
 import { log } from '../log.js';
@@ -100,6 +101,12 @@ export const ensureAuth = async (props) => {
     if (props._.length === 0 || props.help) {
         return;
     }
+    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
+    // never refresh a token or pop a browser login. Skip auth entirely (the handler
+    // doesn't use an API client in this mode).
+    if (isCurrentBranchProbe(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if