neonctl 2.27.1 → 2.28.0

package/dist/commands/auth.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { getApiClient } from '../api.js';
 import { auth, refreshToken } from '../auth.js';
+import { isCurrentBranchProbe } from '../context.js';
 import { CREDENTIALS_FILE } from '../config.js';
 import { isCi } from '../env.js';
 import { log } from '../log.js';
@@ -100,6 +101,12 @@ export const ensureAuth = async (props) => {
     if (props._.length === 0 || props.help) {
         return;
     }
+    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
+    // never refresh a token or pop a browser login. Skip auth entirely (the handler
+    // doesn't use an API client in this mode).
+    if (isCurrentBranchProbe(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if

package/dist/commands/branches.js

@@ -1,4 +1,4 @@
-import { EndpointType } from '@neondatabase/api-client';
+import { EndpointType } from '../utils/api_enums.js';
 import { contextBranch, readContextFile } from '../context.js';
 import { writer } from '../writer.js';
 import { branchCreateRequest } from '../parameters.gen.js';
@@ -367,9 +367,12 @@ const setDefault = async (props) => {
 const deleteBranch = async (props) => {
     const branchId = await branchIdFromProps(props);
     const { data } = await retryOnLock(() => props.apiClient.deleteProjectBranch(props.projectId, branchId));
-    writer(props).end(data.branch, {
-        fields: BRANCH_FIELDS,
-    });
+    // A 204 (branch already gone) carries no body; only a 200 returns it.
+    if (data) {
+        writer(props).end(data.branch, {
+            fields: BRANCH_FIELDS,
+        });
+    }
 };
 const get = async (props) => {
     const branchId = await branchIdFromProps(props);

package/dist/commands/bucket.js

@@ -2,8 +2,7 @@ import { createReadStream, createWriteStream } from 'node:fs';
 import { stat, unlink } from 'node:fs/promises';
 import { basename } from 'node:path';
 import { pipeline } from 'node:stream/promises';
-import axios, { isAxiosError } from 'axios';
-import { retryOnLock } from '../api.js';
+import { isNeonApiError, retryOnLock } from '../api.js';
 import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
 import { log } from '../log.js';
 import { writer } from '../writer.js';
@@ -222,7 +221,7 @@ const deleteBucket = async (props) => {
         }));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(`Bucket "${props.name}" not found on branch ${branchId}.`);
         }
         throw err;
@@ -332,14 +331,42 @@ const objectNotFoundFallback = (key, bucket, branchId) => `Object "${key}" not f
 // misreported as a missing object; otherwise fall back to a clean default. Used
 // for the JSON (non-streamed) endpoints where the body is already parsed.
 const objectNotFoundMessage = (err, key, bucket, branchId) => {
-    if (isAxiosError(err)) {
-        const serverMessage = serverErrorMessage(err.response?.data);
+    if (isNeonApiError(err)) {
+        const serverMessage = serverErrorMessage(err.data);
         if (serverMessage !== undefined) {
             return serverMessage;
         }
     }
     return objectNotFoundFallback(key, bucket, branchId);
 };
+// Stream a file from disk as a WHATWG `ReadableStream` suitable for a `fetch`
+// request body, applying backpressure so we never read faster than the upload
+// drains. Uses the global `ReadableStream` (what `fetch` expects) directly, so
+// there's no Node-vs-DOM stream type bridging.
+const fileToWebStream = (path) => {
+    const source = createReadStream(path);
+    return new ReadableStream({
+        start(controller) {
+            source.on('data', (chunk) => {
+                controller.enqueue(new Uint8Array(chunk));
+                if ((controller.desiredSize ?? 0) <= 0)
+                    source.pause();
+            });
+            source.on('end', () => {
+                controller.close();
+            });
+            source.on('error', (err) => {
+                controller.error(err instanceof Error ? err : new Error(String(err)));
+            });
+        },
+        pull() {
+            source.resume();
+        },
+        cancel() {
+            source.destroy();
+        },
+    });
+};
 const getObject = async (props) => {
     const branchId = await branchIdFromProps(props);
     const { bucket, rest: key } = splitBucketTarget(props.target);
@@ -356,11 +383,11 @@ const getObject = async (props) => {
         });
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             // The download response is a stream, so a 404 body arrives as a stream
             // too; drain and parse it to recover the server's message (which
             // distinguishes a missing bucket from a missing object).
-            const serverMessage = await streamErrorMessage(err.response.data);
+            const serverMessage = await streamErrorMessage(err.data);
             throw new Error(serverMessage ?? objectNotFoundFallback(key, bucket, branchId));
         }
         throw err;
@@ -417,52 +444,56 @@ const putObject = async (props) => {
         }));
     }
     catch (err) {
-        if (isAxiosError(err)) {
-            const status = err.response?.status;
+        if (isNeonApiError(err)) {
+            const status = err.status;
             if (status === 404) {
                 throw new Error(objectNotFoundMessage(err, key, bucket, branchId));
             }
             // Any other HTTP error from the console (e.g. 403 when the caller lacks
             // write permission on the bucket) carries the same JSON `{ message }`
-            // body, so surface that rather than a bare axios message. When the body
-            // has no usable message, fall back to a clean status-bearing error.
-            const serverMessage = serverErrorMessage(err.response?.data);
+            // body, so surface that rather than a bare error. When the body has no
+            // usable message, fall back to a clean status-bearing error.
+            const serverMessage = serverErrorMessage(err.data);
             throw new Error(serverMessage ??
                 `Failed to presign upload for "${key}" in bucket "${bucket}" on branch ${branchId}${status !== undefined ? ` (HTTP ${status})` : ''}: ${err.message}`);
         }
         throw err;
     }
-    // Stream the file straight into the PUT body; never buffer the whole file.
-    // The presigned URL targets the branch S3 data-plane endpoint directly, so
-    // this PUT goes through a plain axios call rather than the console api-client.
+    // Stream the file straight into the PUT body via `fetch`; never buffer the
+    // whole file. The presigned URL targets the branch S3 data-plane endpoint
+    // directly, so this PUT bypasses the console API entirely.
     //
     // `presign.headers` carries the signature-relevant headers (e.g. host,
     // content-type); the server does not sign Content-Length, so we set it
-    // ourselves from the stat'd size to keep the upload streamed, not chunked.
-    // `maxRedirects: 0` ensures we never resend the file bytes and signed headers
-    // to a different host if the data-plane endpoint were to answer with a
-    // redirect.
+    // ourselves from the stat'd size. `redirect: 'error'` ensures we never resend
+    // the file bytes and signed headers to a different host if the data-plane
+    // endpoint were to answer with a redirect. `duplex: 'half'` is required by
+    // fetch when streaming a request body.
+    const upload = {
+        method: 'PUT',
+        headers: {
+            ...presign.headers,
+            'Content-Length': String(fileSize),
+        },
+        body: fileToWebStream(props.file),
+        redirect: 'error',
+        duplex: 'half',
+    };
+    let uploadResponse;
     try {
-        await axios.put(presign.url, createReadStream(props.file), {
-            headers: {
-                ...presign.headers,
-                'Content-Length': fileSize,
-            },
-            maxBodyLength: Infinity,
-            maxContentLength: Infinity,
-            maxRedirects: 0,
-        });
+        uploadResponse = await fetch(presign.url, upload);
     }
     catch (err) {
+        // A transport-level failure (DNS, connection reset, redirect when none is
+        // allowed). Surface a clean message without leaking the signed URL.
+        throw new Error(`Failed to upload "${props.file}" to "${key}" in bucket "${bucket}" on branch ${branchId}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!uploadResponse.ok) {
         // The upload targets the S3 data plane, whose error bodies are XML rather
         // than the JSON `{ message }` the console returns, so surface the status
-        // (and axios message) rather than leaking a raw error. Never include the
-        // presigned URL, which carries the signature.
-        if (isAxiosError(err)) {
-            const status = err.response?.status;
-            throw new Error(`Failed to upload "${props.file}" to "${key}" in bucket "${bucket}" on branch ${branchId}${status !== undefined ? ` (HTTP ${status})` : ''}: ${err.message}`);
-        }
-        throw err;
+        // rather than the body. Never include the presigned URL, which carries the
+        // signature.
+        throw new Error(`Failed to upload "${props.file}" to "${key}" in bucket "${bucket}" on branch ${branchId} (HTTP ${uploadResponse.status}): Request failed with status code ${uploadResponse.status}`);
     }
     log.info(`File "${props.file}" uploaded to "${key}" in bucket "${bucket}" on branch ${branchId}`);
 };
@@ -497,7 +528,7 @@ const deleteObject = async (props) => {
         }));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(objectNotFoundMessage(err, rest, bucket, branchId));
         }
         throw err;

package/dist/commands/checkout.js

@@ -1,4 +1,4 @@
-import { isAxiosError } from 'axios';
+import { isNeonApiError } from '../api.js';
 import chalk from 'chalk';
 import prompts from 'prompts';
 import { applyContext, contextBranch, readContextFile } from '../context.js';
@@ -206,7 +206,7 @@ const resolveOrgId = async (props, projectId) => {
         return data.project.org_id ?? undefined;
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 401) {
+        if (isNeonApiError(err) && err.status === 401) {
             throw err;
         }
         log.debug('checkout: could not resolve org id for project %s: %s', projectId, err instanceof Error ? err.message : String(err));
@@ -280,7 +280,7 @@ const tryAutoDetectProject = async (props) => {
         // `fillSingleProject` throws on "No projects found" / "Multiple projects
         // found" — both mean we can't pick a project automatically. Network/auth
         // errors are real and should surface to the user.
-        if (isAxiosError(err)) {
+        if (isNeonApiError(err)) {
             throw err;
         }
         log.debug('checkout: could not auto-detect a single project: %s', err instanceof Error ? err.message : String(err));

package/dist/commands/config.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { resolveConfig } from '@neondatabase/config';
 import { apply, createBranch as createBranchFromPolicy, inspect, loadConfigFromFile, plan, } from '@neondatabase/config-runtime';
 import { toNeonConfigView } from '../config_format.js';
+import { contextBranch, readContextFile } from '../context.js';
 import { log } from '../log.js';
 import { isCi } from '../env.js';
 import { loadEnvFileIntoProcess } from '../env_file.js';
@@ -93,6 +94,12 @@ export const builder = (argv) => argv
         type: 'boolean',
         default: false,
     },
+    'current-branch': {
+        describe: 'Print only the linked branch name from the local .neon file ' +
+            '(no network). Exits non-zero when no branch is pinned.',
+        type: 'boolean',
+        default: false,
+    },
 }), (args) => status(args))
     .command('plan', 'Show what `config apply` would change (dry run)', (yargs) => yargs.options({
     config: {
@@ -126,6 +133,21 @@ const loadConfig = async (props) => {
     return config;
 };
 export const status = async (props) => {
+    // `--current-branch` short-circuits here (before resolveBranchRef), so it wins
+    // over --config-json and ignores --output. See ConfigProps.currentBranch / isCurrentBranchProbe.
+    if (props.currentBranch) {
+        const branch = contextBranch(readContextFile(props.contextFile));
+        if (branch) {
+            process.stdout.write(`${branch}\n`);
+        }
+        else {
+            // No branch pinned: hint on stderr and exit non-zero (grep-style) so a prompt's
+            // `when` hides the segment cleanly instead of rendering a bare icon.
+            log.info('No branch pinned. Run `neonctl checkout <branch>` to pin a branch and pull its env vars.');
+            process.exitCode = 1;
+        }
+        return;
+    }
     const branch = await resolveBranchRef(props);
     // `--config-json` is a script-friendly mode that emits only JSON to stdout, so keep it
     // pristine; the regular human view gets the "which branch am I inspecting" guardrail.

package/dist/commands/connection_string.js

@@ -1,4 +1,4 @@
-import { EndpointType, } from '@neondatabase/api-client';
+import { EndpointType } from '../utils/api_enums.js';
 import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
 import { writer } from '../writer.js';
 import { psql } from '../utils/psql.js';

package/dist/commands/data_api.js

@@ -1,5 +1,4 @@
-import { isAxiosError } from 'axios';
-import { retryOnLock } from '../api.js';
+import { isNeonApiError, retryOnLock } from '../api.js';
 import { branchIdFromProps, fillSingleProject, resolveSingleDatabase, } from '../utils/enrichers.js';
 import { log } from '../log.js';
 import { writer } from '../writer.js';
@@ -222,7 +221,7 @@ const update = async (props) => {
             current = data.settings ?? undefined;
         }
         catch (err) {
-            if (isAxiosError(err) && err.response?.status === 404) {
+            if (isNeonApiError(err) && err.status === 404) {
                 throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`neonctl data-api create\` first.`);
             }
             throw err;
@@ -239,7 +238,7 @@ const update = async (props) => {
         await retryOnLock(() => props.apiClient.updateProjectBranchDataApi(props.projectId, branchId, database, body));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`neonctl data-api create\` first.`);
         }
         throw err;
@@ -258,7 +257,7 @@ const refreshSchema = async (props) => {
         await retryOnLock(() => props.apiClient.updateProjectBranchDataApi(props.projectId, branchId, database, {}));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`neonctl data-api create\` first.`);
         }
         throw err;
@@ -277,7 +276,7 @@ const deleteDataApi = async (props) => {
         await retryOnLock(() => props.apiClient.deleteProjectBranchDataApi(props.projectId, branchId, database));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}.`);
         }
         throw err;

package/dist/commands/databases.js

@@ -73,7 +73,10 @@ export const create = async (props) => {
 export const deleteDb = async (props) => {
     const branchId = await branchIdFromProps(props);
     const { data } = await retryOnLock(() => props.apiClient.deleteProjectBranchDatabase(props.projectId, branchId, props.database));
-    writer(props).end(data.database, {
-        fields: DATABASE_FIELDS,
-    });
+    // A 204 (database already gone) carries no body; only a 200 returns it.
+    if (data) {
+        writer(props).end(data.database, {
+            fields: DATABASE_FIELDS,
+        });
+    }
 };

package/dist/commands/functions.js

@@ -1,6 +1,6 @@
 import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { isAxiosError } from 'axios';
+import { isNeonApiError } from '../api.js';
 import { retryOnLock } from '../api.js';
 import { log } from '../log.js';
 import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
@@ -159,10 +159,8 @@ const emitDeployResult = (props, deployment, fn) => {
 };
 // A poll error worth retrying: a network error (no HTTP response), a 5xx, or a
 // 404 from eventual consistency. Anything else (e.g. 401/403) is surfaced.
-const isTransient = (err) => isAxiosError(err) &&
-    (err.response === undefined ||
-        err.response.status === 404 ||
-        err.response.status >= 500);
+const isTransient = (err) => isNeonApiError(err) &&
+    (err.status === undefined || err.status === 404 || err.status >= 500);
 const deploy = async (props) => {
     if (props.path !== undefined || props.entry !== undefined) {
         throw new Error('--path and --entry were removed. Use --src <dir>; the entry point ' +
@@ -206,7 +204,7 @@ const deploy = async (props) => {
         before = fn.current_deployment?.id;
     }
     catch (err) {
-        if (!(isAxiosError(err) && err.response?.status === 404))
+        if (!(isNeonApiError(err) && err.status === 404))
             throw err;
     }
     await retryOnLock(() => createDeployment(props.apiClient, props.projectId, branchId, props.slug, {
@@ -341,7 +339,7 @@ const deleteFn = async (props) => {
         await retryOnLock(() => deleteFunction(props.apiClient, props.projectId, branchId, props.slug));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             throw new Error(`Function "${props.slug}" not found on branch ${branchId}.`);
         }
         throw err;

package/dist/commands/index.js

@@ -19,6 +19,7 @@ import * as neonAuth from './neon_auth.js';
 import * as functions from './functions.js';
 import * as dev from './dev.js';
 import * as config from './config.js';
+import * as status from './status.js';
 import * as deploy from './deploy.js';
 import * as env from './env.js';
 import * as bucket from './bucket.js';
@@ -45,6 +46,7 @@ export default [
     functions,
     dev,
     config,
+    status,
     deploy,
     env,
     bucket,

package/dist/commands/link.js

@@ -1,4 +1,4 @@
-import { isAxiosError } from 'axios';
+import { isNeonApiError, messageFromBody } from '../api.js';
 import prompts from 'prompts';
 import { applyContext, contextBranch, readContextFile, setContext, updateContextFile, } from '../context.js';
 import { isCi } from '../env.js';
@@ -267,7 +267,7 @@ class LinkInputError extends Error {
         this.agentCode = agentCode;
     }
 }
-const httpStatus = (err) => isAxiosError(err) ? err.response?.status : undefined;
+const httpStatus = (err) => isNeonApiError(err) ? err.status : undefined;
 /**
  * Fetch a project, turning the common failure modes into clear, actionable
  * errors. 401 is rethrown so the global handler can refresh credentials;
@@ -803,13 +803,9 @@ const emitAgent = (response) => {
 // ----------------------------------------------------------------------------
 const ORG_KEY_LIMITED_FRAGMENT = 'not allowed for organization API keys';
 const isOrgKeyLimitedError = (err) => {
-    if (!isAxiosError(err))
+    if (!isNeonApiError(err))
         return false;
-    const data = err.response?.data;
-    if (data === undefined || data === null || typeof data !== 'object') {
-        return false;
-    }
-    const message = data.message;
+    const message = messageFromBody(err.data);
     return (typeof message === 'string' && message.includes(ORG_KEY_LIMITED_FRAGMENT));
 };
 const fetchOrganizations = async (props) => {
@@ -879,13 +875,10 @@ const toAgentError = (err) => {
     if (err instanceof LinkInputError) {
         return { status: 'error', code: err.agentCode, message: err.message };
     }
-    if (isAxiosError(err)) {
-        const status = err.response?.status;
-        const data = err.response?.data;
-        const apiMessage = typeof data === 'object' && data !== null
-            ? data.message
-            : undefined;
-        const message = typeof apiMessage === 'string' && apiMessage.length > 0
+    if (isNeonApiError(err)) {
+        const status = err.status;
+        const apiMessage = messageFromBody(err.data);
+        const message = apiMessage !== undefined && apiMessage.length > 0
             ? apiMessage
             : err.message;
         let code = 'API_ERROR';
@@ -968,8 +961,8 @@ const fetchRegions = async (props) => {
         }
     }
     catch (err) {
-        if (isAxiosError(err)) {
-            log.debug('getActiveRegions failed (%s), falling back to the static region list.', err.response?.status ?? err.code ?? err.message);
+        if (isNeonApiError(err)) {
+            log.debug('getActiveRegions failed (%s), falling back to the static region list.', err.status ?? err.code ?? err.message);
         }
         else {
             const message = err instanceof Error ? err.message : String(err);

package/dist/commands/neon_auth.js

@@ -1,7 +1,6 @@
-import { NeonAuthSupportedAuthProvider, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthEmailVerificationMethod, } from '@neondatabase/api-client';
-import { isAxiosError } from 'axios';
+import { NeonAuthSupportedAuthProvider, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthEmailVerificationMethod, } from '../utils/api_enums.js';
 import chalk from 'chalk';
-import { retryOnLock } from '../api.js';
+import { codeFromBody, isNeonApiError, retryOnLock } from '../api.js';
 import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
 import { writer } from '../writer.js';
 // Shared styled output helpers
@@ -453,7 +452,7 @@ const enable = async (props) => {
         })));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 409) {
+        if (isNeonApiError(err) && err.status === 409) {
             alreadyEnabled = true;
             ({ data } = await props.apiClient.getNeonAuth(props.projectId, branchId));
         }
@@ -492,7 +491,7 @@ const status = async (props) => {
         ({ data } = await props.apiClient.getNeonAuth(props.projectId, branchId));
     }
     catch (err) {
-        if (isAxiosError(err) && err.response?.status === 404) {
+        if (isNeonApiError(err) && err.status === 404) {
             printMessage('Neon Auth is not configured for this branch');
             return;
         }
@@ -546,9 +545,8 @@ const oauthProviderAdd = async (props) => {
         }));
     }
     catch (err) {
-        if (isAxiosError(err) &&
-            err.response?.data?.code ===
-                'INVALID_SHARED_OAUTH_PROVIDER') {
+        if (isNeonApiError(err) &&
+            codeFromBody(err.data) === 'INVALID_SHARED_OAUTH_PROVIDER') {
             throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\n` +
                 `Re-run with --oauth-client-id and --oauth-client-secret to provide them.\n` +
                 `Create an OAuth app at your provider and use those credentials.`);
@@ -579,9 +577,8 @@ const oauthProviderUpdate = async (props) => {
         }));
     }
     catch (err) {
-        if (isAxiosError(err) &&
-            err.response?.data?.code ===
-                'INVALID_SHARED_OAUTH_PROVIDER') {
+        if (isNeonApiError(err) &&
+            codeFromBody(err.data) === 'INVALID_SHARED_OAUTH_PROVIDER') {
             throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\n` +
                 `Re-run with --oauth-client-id and --oauth-client-secret to provide them.\n` +
                 `Create an OAuth app at your provider and use those credentials.`);

package/dist/commands/projects.js

@@ -4,7 +4,7 @@ import { writer } from '../writer.js';
 import { psql } from '../utils/psql.js';
 import { updateContextFile } from '../context.js';
 import { getComputeUnits } from '../utils/compute_units.js';
-import { isAxiosError } from 'axios';
+import { isNeonApiError, messageFromBody } from '../api.js';
 import prompts from 'prompts';
 import { isCi } from '../env.js';
 export const PROJECT_FIELDS = [
@@ -315,9 +315,9 @@ const handleMissingOrgId = async (args, cmd) => {
     }
 };
 const isOrgIdError = (err) => {
-    return (isAxiosError(err) &&
-        err.response?.status == 400 &&
-        err.response?.data?.message?.includes('org_id is required'));
+    return (isNeonApiError(err) &&
+        err.status === 400 &&
+        messageFromBody(err.data)?.includes('org_id is required'));
 };
 const selectOrg = async (props) => {
     const { data: { organizations }, } = await props.apiClient.getCurrentUserOrganizations();

package/dist/commands/psql.js

@@ -1,4 +1,4 @@
-import { EndpointType } from '@neondatabase/api-client';
+import { EndpointType } from '../utils/api_enums.js';
 import { fillSingleProject } from '../utils/enrichers.js';
 import { handler as connectionStringHandler, SSL_MODES, } from './connection_string.js';
 export const command = 'psql [branch]';

package/dist/commands/roles.js

@@ -56,7 +56,10 @@ export const create = async (props) => {
 export const deleteRole = async (props) => {
     const branchId = await branchIdFromProps(props);
     const { data } = await retryOnLock(() => props.apiClient.deleteProjectBranchRole(props.projectId, branchId, props.role));
-    writer(props).end(data.role, {
-        fields: ROLES_FIELDS,
-    });
+    // A 204 (role already gone) carries no body; only a 200 returns the role.
+    if (data) {
+        writer(props).end(data.role, {
+            fields: ROLES_FIELDS,
+        });
+    }
 };

package/dist/commands/schema_diff.js

@@ -3,7 +3,7 @@ import chalk from 'chalk';
 import { writer } from '../writer.js';
 import { branchIdFromProps } from '../utils/enrichers.js';
 import { parsePointInTime, } from '../utils/point_in_time.js';
-import { isAxiosError } from 'axios';
+import { isNeonApiError, messageFromBody } from '../api.js';
 import { sendError } from '../analytics.js';
 import { log } from '../log.js';
 const COLORS = {
@@ -68,10 +68,9 @@ const fetchSchema = async (pointInTime, database, props) => {
         return response.data.sql ?? '';
     }
     catch (error) {
-        if (isAxiosError(error)) {
-            const data = error.response?.data;
+        if (isNeonApiError(error)) {
             sendError(error, 'API_ERROR');
-            throw new Error(data.message ??
+            throw new Error(messageFromBody(error.data) ??
                 `Error while fetching schema for branch ${pointInTime.branchId}`);
         }
         throw error;

package/dist/commands/status.js

@@ -0,0 +1,40 @@
+import { fillSingleProject } from '../utils/enrichers.js';
+import { status } from './config.js';
+/**
+ * `neon status` is a top-level alias for `neon config status` — the most-reached-for
+ * config subcommand. It mirrors that command's options (including `--current-branch`,
+ * the offline branch probe) and delegates to the same `status` handler.
+ *
+ * Because it has a handler but no subcommands, `status` must also be listed in
+ * `NO_SUBCOMMANDS_VERBS` (see index.ts) so the help-fallback middleware doesn't
+ * intercept a bare `neon status`.
+ */
+export const command = 'status';
+export const describe = "Show the branch's live Neon state (alias of `config status`)";
+export const builder = (argv) => argv
+    .usage('$0 status [options]')
+    .options({
+    'project-id': {
+        describe: 'Project ID',
+        type: 'string',
+    },
+    branch: {
+        describe: 'Branch ID or name',
+        type: 'string',
+    },
+    'config-json': {
+        describe: "Print only the branch's live config as neon.ts-shaped JSON " +
+            '(services + branch tuning + preview), to stdout. Useful for ' +
+            'scripting or copying into a neon.ts.',
+        type: 'boolean',
+        default: false,
+    },
+    'current-branch': {
+        describe: 'Print only the linked branch name from the local .neon file ' +
+            '(no network). Exits non-zero when no branch is pinned.',
+        type: 'boolean',
+        default: false,
+    },
+})
+    .middleware(fillSingleProject);
+export const handler = (args) => status(args);

package/dist/context.js

@@ -8,6 +8,22 @@ import { log } from './log.js';
  * working.
  */
 export const contextBranch = (context) => context.branch ?? context.branchId;
+/**
+ * True when the invocation is the offline "current branch" probe:
+ * `(config) status --current-branch`. This mode only reads the pinned branch
+ * from the local `.neon` file (for shell prompts like starship), so it MUST
+ * NOT touch the network — several middlewares (auth, analytics, single-project
+ * resolution) consult this to early-return and skip their API calls / login.
+ *
+ * Gated on the exact command as well as the flag so an accidental
+ * `--current-branch` on an unrelated command (e.g. `config plan`, where the flag
+ * is undefined but non-strict yargs still parses it) can't silently skip
+ * auth/analytics. The probe is only `status` (the top-level alias) or
+ * `config status` (`_ = ['config', 'status']`).
+ */
+export const isCurrentBranchProbe = (args) => args.currentBranch === true &&
+    (args._[0] === 'status' ||
+        (args._[0] === 'config' && args._[1] === 'status'));
 const CONTEXT_FILE = '.neon';
 const GITIGNORE_FILE = '.gitignore';
 const wrapWithContextFile = (dir) => resolve(dir, CONTEXT_FILE);