neon 2.39.1 → 2.41.0

package/README.md

@@ -456,9 +456,55 @@ export default defineConfig({
 });
 ```
 
-Three sub-commands plus two top-level aliases drive it:
+### Getting a `neon.ts` (`config init`)
+
+`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is purely local — no auth, no API calls. In an interactive terminal it asks which services the policy should declare:
+
+```
+? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›
+◯   Managed Better Auth
+     Authentication with users and sessions stored in Postgres.
+◯   Functions
+     Long-running, without timeouts, and closer to your database.
+◯   Object Storage
+     S3-compatible blob storage that branches with your projects.
+◯   AI Gateway
+     All models, one API, one bill. Powered by Databricks. Not available on the Neon free plan.
+```
+
+Selecting nothing is a valid answer: you get the starter policy, which is also what a non-interactive run (CI, no TTY) writes. Pass `--services` to skip the prompt anywhere:
+
+```bash
+# Pick interactively (TTY) or take the starter policy (CI)
+neon config init
+
+# Declare services with no prompt
+neon config init --services auth,functions,storage,ai-gateway
+
+# Explicitly ask for the bare starter policy
+neon config init --services none
+
+# Scaffold but print the install command instead of running it
+neon config init --no-install
+```
+
+Choosing **Functions** also writes the handler the policy points at, since `source` is only resolved when `apply` bundles it — a declared function with no file on disk fails at deploy:
+
+```ts
+// hello.ts
+export default async function hello(): Promise<Response> {
+  return new Response('Hello from Neon Functions');
+}
+```
+
+An existing `neon.ts` (or `hello.ts`) is never overwritten.
+
+Four sub-commands plus two top-level aliases drive it:
 
 ```bash
+# Scaffold a neon.ts and install the config packages (local only)
+neon config init
+
 # Inspect the branch's live Neon state (read-only — never mutates)
 neon config status
 
@@ -591,11 +637,57 @@ neon snapshots schedule set --branch main --schedule '[{"frequency":"weekly","da
 
 All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
 
+## Profiles
+
+The CLI holds one Neon account by default. A profile adds another, and is nothing more than a pointer to a credentials file:
+
+```
+~/.config/neon/
+├── credentials.json          # this IS the DEFAULT profile
+├── credentials.work.json     # created by `neon auth --profile work`
+└── profiles.json             # created only once a second profile exists
+```
+
+```bash
+neon auth --profile work     # create it, or sign in again
+neon profile list
+neon profile remove work
+```
+
+```console
+$ neon profile list
+Profiles
+┌────────┬─────────┬──────────────────────┬──────────┬──────────────────────────────────────┐
+│ Active │ Name    │ Account              │ SignedIn │ Credentials                          │
+├────────┼─────────┼──────────────────────┼──────────┼──────────────────────────────────────┤
+│ *      │ DEFAULT │ me@example.com       │ yes      │ ~/.config/neon/credentials.json      │
+├────────┼─────────┼──────────────────────┼──────────┼──────────────────────────────────────┤
+│        │ work    │ me@work.example.com  │ yes      │ ~/.config/neon/credentials.work.json │
+└────────┴─────────┴──────────────────────┴──────────┴──────────────────────────────────────┘
+```
+
+Select one per invocation with `--profile`, or per shell with `NEON_PROFILE`. There is no `profile use` command and nothing is stored about which profile is "current", so what you type is always what runs.
+
+Entries in `profiles.json` are paths, and a path may point anywhere — which is how you adopt a directory you already have, without moving or re-authenticating anything:
+
+```json
+{
+  "version": 1,
+  "profiles": {
+    "DEFAULT": { "credentials": "credentials.json" },
+    "work": { "credentials": "../neonctl-work/credentials.json" }
+  }
+}
+```
+
+`neon profile remove` revokes the refresh token at the authorization server, not just locally. It deletes the credentials file only when the CLI created it: an adopted path like the one above is unlinked and left on disk, and the command says so. Removing the last named profile deletes `profiles.json`, returning you to the single-account layout. `neon profile remove DEFAULT` signs you out.
+
 ## Commands
 
 | Command                                                                    | Subcommands                                                                                                  | Description                        |
 | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------- |
 | [auth](https://neon.com/docs/reference/cli-auth)                           |                                                                                                              | Authenticate                       |
+| profile                                                                    | `list`, `remove`                                                                                             | Manage named sets of credentials   |
 | [projects](https://neon.com/docs/reference/cli-projects)                   | `list`, `create`, `update`, `delete`, `get`                                                                  | Manage projects                    |
 | [ip-allow](https://neon.com/docs/reference/cli-ip-allow)                   | `list`, `add`, `remove`, `reset`                                                                             | Manage IP Allow                    |
 | [me](https://neon.com/docs/reference/cli-me)                               |                                                                                                              | Show current user                  |
@@ -612,7 +704,7 @@ All sub-commands honor the [global options](#global-options), including `--outpu
 | checkout                                                                   |                                                                                                              | Pin a branch in `.neon`            |
 | diff                                                                       |                                                                                                              | Git-style schema diff vs a branch  |
 | [link](https://neon.com/docs/reference/cli-link)                           |                                                                                                              | Link a directory to a project      |
-| config                                                                     | `status`, `plan`, `apply`                                                                                    | Drive a branch from `neon.ts`      |
+| config                                                                     | `init`, `status`, `plan`, `apply`                                                                            | Drive a branch from `neon.ts`      |
 | deploy                                                                     |                                                                                                              | Alias for `config apply`           |
 | bootstrap                                                                  |                                                                                                              | Scaffold a project from a template |
 | bucket                                                                     | `create`, `list`, `delete`, `object list`, `object get`, `object put`, `object delete` (incl. `--recursive`) | Manage buckets and their objects   |
@@ -625,7 +717,8 @@ Global options are supported with any Neon CLI command.
 | Option                      | Description                                                 | Type    | Default                        |
 | :-------------------------- | :---------------------------------------------------------- | :------ | :----------------------------- |
 | [-o, --output](#output)     | Set the Neon CLI output format (`json`, `yaml`, or `table`) | string  | table                          |
-| [--config-dir](#config-dir) | Path to the Neon CLI configuration directory                | string  | `/home/<user>/.config/neonctl` |
+| [--config-dir](#config-dir) | Path to the Neon CLI configuration directory                | string  | `/home/<user>/.config/neon`    |
+| [--profile](#profile)       | Named credentials to use, from `profiles.json`              | string  | `DEFAULT`                      |
 | [--api-key](#api-key)       | Neon API key                                                | string  | ""                             |
 | [--analytics](#analytics)   | Manage analytics                                            | boolean | true                           |
 | [-v, --version](#version)   | Show the Neon CLI version number                            | boolean | -                              |
@@ -641,12 +734,27 @@ Global options are supported with any Neon CLI command.
 
 - <a id="config-dir"></a>`--config-dir`
 
-  Specifies the path to the `neon` configuration directory. To view the default configuration directory containing you `credentials.json` file, run `neon --help`. The credentials file is created when you authenticate using the `neon auth` command. This option is only necessary if you move your `neon` configuration file to a location other than the default.
+  Specifies the path to the `neon` configuration directory, which holds the `credentials.json` written by `neon auth`. The default is `$XDG_CONFIG_HOME/neon`, or `~/.config/neon`; run `neon --help` to see the resolved path. This option is only necessary if you keep your configuration somewhere else.
+
+  The directory was called `neonctl` before the CLI was renamed. An existing one is still read, and is used **in place** — nothing is moved or copied, so there is never a second credentials file to go stale. A directory you pass explicitly is used exactly as given and never falls back to the legacy name, so pointing a CI run at a scratch directory cannot pick up local credentials.
 
   ```bash
-  neon projects list --config-dir /home/dtprice/.config/neonctl
+  neon projects list --config-dir /home/dtprice/.config/neon
   ```
 
+- <a id="profile"></a>`--profile`
+
+  Selects a named set of credentials, for holding more than one Neon account at a time. A profile is a pointer to a credentials file, recorded in `profiles.json` next to it.
+
+  ```bash
+  neon auth --profile work        # create it, or sign in again
+  neon profile list               # names, accounts, and where each one's credentials live
+  neon projects list --profile work
+  NEON_PROFILE=work neon projects list
+  ```
+
+  Precedence is `--profile`, then `NEON_PROFILE`, then `DEFAULT`. `DEFAULT` is plain `credentials.json`, so an install with a single account needs no `profiles.json` and behaves exactly as before. See [Profiles](#profiles) to list or remove them.
+
 - <a id="api-key"></a>`--api-key`
 
   Specifies your Neon API key. You can authenticate using a Neon API key when running a Neon CLI command instead of using `neon auth`. For information about obtaining an Neon API key, see [Authentication](https://api-docs.neon.tech/reference/authentication), in the _Neon API Reference_.

package/dist/analytics.js

@@ -1,8 +1,7 @@
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
 import { Analytics } from "@segment/analytics-node";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { CREDENTIALS_FILE } from "./config.js";
+import { credentialsPath } from "./config.js";
 import { isCurrentBranchProbe } from "./context.js";
 import { getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
@@ -57,8 +56,7 @@ export const analyticsMiddleware = async (args) => {
         return;
     }
     try {
-        const credentialsPath = join(args.configDir, CREDENTIALS_FILE);
-        const credentials = readFileSync(credentialsPath, {
+        const credentials = readFileSync(credentialsPath(args.configDir), {
             encoding: "utf-8",
         });
         userId = JSON.parse(credentials).user_id;

package/dist/auth.js

@@ -38,6 +38,35 @@ export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, toke
     });
     return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
+/**
+ * Invalidate a refresh token at the authorization server (RFC 7009).
+ *
+ * Best-effort by design, and it returns a boolean rather than throwing: the usual reason to
+ * revoke is that a profile is being removed, and a revoke that fails — offline, token
+ * already dead, server unreachable — must not leave the local entry stranded. Deleting the
+ * file alone would only stop *us* using the token; this stops anyone.
+ */
+export const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+    const token = tokenSet.refresh_token;
+    if (typeof token !== "string" || token === "")
+        return false;
+    try {
+        const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+            timeout: SERVER_TIMEOUT,
+            execute: allowUnsafeTls
+                ? [client.allowInsecureRequests]
+                : undefined,
+        });
+        await client.tokenRevocation(configuration, token, {
+            token_type_hint: "refresh_token",
+        });
+        return true;
+    }
+    catch (err) {
+        log.debug("Token revocation failed: %s", err instanceof Error ? err.message : String(err));
+        return false;
+    }
+};
 export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
     log.debug("Discovering oauth server");
     const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {

package/dist/commands/auth.js

@@ -1,14 +1,26 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
 import { setAuthContext } from "../auth_context.js";
-import { CREDENTIALS_FILE } from "../config.js";
-import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { credentialsPath as defaultCredentialsPath } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe, isProfileCommand, } from "../context.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { assertValidProfileName, DEFAULT_PROFILE, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile, } from "../profiles.js";
 import { extendTokenSet } from "../utils/auth.js";
+/**
+ * The credentials file this invocation reads and writes: the selected profile's, falling
+ * back to plain `credentials.json` when no profile was named and none is declared. An
+ * unknown profile name is a hard error rather than a silent write to the default file —
+ * a typo must not authenticate the wrong account.
+ */
+const credentialsPathFor = ({ configDir, profile, }) => {
+    const name = selectProfileName(profile);
+    if (name === DEFAULT_PROFILE && !readProfiles(configDir))
+        return defaultCredentialsPath(configDir);
+    return resolveProfile(configDir, name).credentialsPath;
+};
 export const command = "auth";
 export const aliases = ["login"];
 export const describe = "Authenticate";
@@ -18,7 +30,7 @@ export const builder = (yargs) => yargs.option("context-file", {
 export const handler = async (args) => {
     await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, profile, }) => {
     const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
     if (!allowInteractiveAuth && isCi()) {
         throw new Error("Cannot run interactive auth in CI");
@@ -28,9 +40,19 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
         clientId: clientId,
         allowUnsafeTls,
     });
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+    // A named profile that doesn't exist yet is created here rather than erroring: `neon
+    // auth --profile work` is how you make one, so it must work before there is anything
+    // to look up.
+    const profileName = selectProfileName(profile);
+    const isNamed = profileName !== DEFAULT_PROFILE;
+    if (isNamed)
+        assertValidProfileName(profileName);
+    const credentialsPath = isNamed && !readProfiles(configDir)?.profiles[profileName]
+        ? newProfileCredentialsPath(configDir, profileName)
+        : credentialsPathFor({ configDir, profile });
+    let identity = {};
     try {
-        await preserveCredentials(credentialsPath, tokenSet, getApiClient({
+        identity = await preserveCredentials(credentialsPath, tokenSet, getApiClient({
             apiKey: tokenSet.access_token || "",
             apiHost,
         }));
@@ -39,22 +61,36 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
         log.error("Failed to save credentials");
         return "";
     }
+    if (isNamed) {
+        upsertProfile(configDir, profileName, {
+            credentials: credentialsPath,
+            ...(identity.email ? { label: identity.email } : {}),
+            ...(identity.id ? { userId: identity.id } : {}),
+        });
+        log.info('Saved profile "%s" (%s)', profileName, credentialsPath);
+    }
     log.info("Auth complete");
     return tokenSet.access_token || "";
 };
+/**
+ * Persist the token set and return the account it belongs to, so a named profile can be
+ * labelled with an email. The credentials file records only `user_id` — a UUID with no
+ * email — which is why identifying a stored profile offline is otherwise impossible.
+ */
 const preserveCredentials = async (path, credentials, apiClient) => {
-    const { data: { id }, } = await apiClient.getCurrentUserInfo();
+    const { data: { id, email }, } = await apiClient.getCurrentUserInfo();
     const contents = JSON.stringify({
         // Cast to a plain record: we intentionally spread the credentials object.
         ...credentials,
         user_id: id,
     });
-    // correctly sets needed permissions for the credentials file
+    // Owner-only. A credentials file needs read/write, never execute.
     writeFileSync(path, contents, {
-        mode: 0o700,
+        mode: 0o600,
     });
     log.debug("Saved credentials to %s", path);
     log.debug("Credentials MD5 hash: %s", md5hash(contents));
+    return { ...(id ? { id } : {}), ...(email ? { email } : {}) };
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     // Use existing access_token, if present and valid
@@ -113,6 +149,11 @@ export const ensureAuth = async (props) => {
     if (isConfigInit(props)) {
         return;
     }
+    // `profile` reads and edits credential files on disk. Authenticating first would mean
+    // a browser login just to list profiles, and would make a lapsed profile unremovable.
+    if (isProfileCommand(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if
@@ -141,7 +182,7 @@ export const ensureAuth = async (props) => {
         });
         return;
     }
-    const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
+    const credentialsPath = credentialsPathFor(props);
     // Handle case when credentials file exists
     if (existsSync(credentialsPath)) {
         log.debug("Trying to read credentials from %s", credentialsPath);
@@ -204,11 +245,17 @@ export const ensureAuth = async (props) => {
     });
 };
 /**
- * Deletes the credentials file at the specified path
- * @param configDir Directory where credentials file is stored
+ * Delete the credentials backing a profile — used by the 401 handler to clear a token the
+ * API has rejected, so the next command re-authenticates instead of failing again.
+ *
+ * @param configDir Directory the credentials live in
+ * @param profile Profile whose credentials to clear. Defaults to the selected one.
  */
-export const deleteCredentials = (configDir) => {
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+export const deleteCredentials = (configDir, profile) => {
+    const credentialsPath = credentialsPathFor({
+        configDir,
+        ...(profile ? { profile } : {}),
+    });
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);

package/dist/commands/config.js

@@ -5,6 +5,7 @@ import { apply, createBranch as createBranchFromPolicy, inspect, isPartialBranch
 import chalk from "chalk";
 import { getApiClient } from "../api.js";
 import { toNeonConfigView } from "../config_format.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, NEON_SERVICES, NO_SERVICES, parseServices, REQUIRED_PACKAGES, renderNeonConfig, } from "../config_template.js";
 import { contextBranch, readContextFile } from "../context.js";
 import { isCi } from "../env.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
@@ -15,6 +16,7 @@ import { renderAppliedChanges, renderBranchSettingConflicts, } from "../utils/co
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
 import { addDependenciesArgs, resolvePackageManager, runCommand, } from "../utils/package_manager.js";
+import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
 import { writer } from "../writer.js";
 import { autoPullEnvAfterPin } from "./env.js";
@@ -69,18 +71,6 @@ export const envPullFlag = {
     },
 };
 // ── `config init` ─────────────────────────────────────────────────────────────
-/**
- * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
- *
- * ⚠️ These ship to users the next time `neonctl` is released, so do NOT release
- * neonctl until `@neon/config` and `@neon/env` are published to npm — otherwise
- * `config init` would install packages that don't exist yet. (The libraries are
- * mid-migration from `@neondatabase/*`; track their publish before cutting a CLI
- * release.)
- */
-const CONFIG_PACKAGE = "@neon/config";
-const ENV_PACKAGE = "@neon/env";
-const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 /** package.json fields a dependency can be declared in. */
 const DEPENDENCY_FIELDS = [
     "dependencies",
@@ -92,28 +82,6 @@ const DEPENDENCY_FIELDS = [
 const NEON_CONFIG_FILENAMES = ["neon.ts", "neon.mts", "neon.js", "neon.mjs"];
 /** Whether `dir` already has a Neon config file the runtime would load. */
 export const hasNeonConfigFile = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
-/** Starter `neon.ts` written by `config init` when a project has none. */
-const NEON_CONFIG_TEMPLATE = `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
-
-export default defineConfig({
-  // Declare your Neon services here
-  auth: false,
-  // Branch policy: per-branch tuning
-  branch: (branch) => {
-    if (branch.isDefault) {
-      // Default branch: no overrides, uses project defaults
-      return {};
-    }
-    if (!branch.exists) {
-      // New non-default branches: auto-expire
-      // Run \`neon checkout <name>\` to create a new branch with these settings
-      return { ttl: "7d" };
-    }
-    // Existing branch: no changes
-    return {};
-  },
-});
-`;
 const isRecord = (value) => typeof value === "object" && value !== null;
 /**
  * The {@link REQUIRED_PACKAGES} not already declared in the project's package.json
@@ -143,6 +111,38 @@ const missingDependencies = (cwd) => {
     }
     return REQUIRED_PACKAGES.filter((pkg) => !declared.has(pkg));
 };
+/**
+ * Which services the scaffolded policy declares. `--services` always wins so a script or an
+ * agent gets the same result without a TTY; an injected picker is next (tests); the real
+ * picker only runs on an interactive terminal outside CI. Everything else scaffolds the
+ * starter policy, which is what `config init` has always written.
+ */
+const resolveServices = async (props) => {
+    if (props.services !== undefined) {
+        return parseServices(props.services);
+    }
+    if (props.pickServices) {
+        return props.pickServices();
+    }
+    if (isCi() || !process.stdout.isTTY) {
+        return [];
+    }
+    return pickServicesInteractively();
+};
+/**
+ * Write the hello-world handler the scaffolded `preview.functions` entry points at. An
+ * existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
+ * better outcome than overwriting a file the user wrote.
+ */
+const scaffoldFunction = (cwd) => {
+    const path = join(cwd, FUNCTION_FILENAME);
+    if (existsSync(path)) {
+        log.info("Found an existing %s — leaving it untouched; the %s function points at it.", FUNCTION_FILENAME, FUNCTION_SLUG);
+        return;
+    }
+    writeFileSync(path, FUNCTION_TEMPLATE);
+    log.info("Created %s — the source of the %s function.", FUNCTION_FILENAME, FUNCTION_SLUG);
+};
 /**
  * Scaffold a `neon.ts` policy and make sure the Neon config packages are
  * installed, so a project can go straight to `neon config plan` / `apply`.
@@ -151,14 +151,25 @@ const missingDependencies = (cwd) => {
 export const initCmd = async (props) => {
     const cwd = props.cwd ?? process.cwd();
     const run = props.run ?? runCommand;
-    // 1. Scaffold neon.ts unless the project already has a Neon config file.
+    // 1. Scaffold neon.ts unless the project already has a Neon config file. Resolving the
+    // services (which may prompt) happens only when there is something to write — asking
+    // which services to declare and then declaring nothing would be a lie.
     const existing = NEON_CONFIG_FILENAMES.find((name) => existsSync(join(cwd, name)));
     if (existing) {
         log.info("Found an existing %s — leaving it untouched.", existing);
     }
     else {
-        writeFileSync(join(cwd, "neon.ts"), NEON_CONFIG_TEMPLATE);
-        log.info("Created neon.ts with a starter policy.");
+        const services = await resolveServices(props);
+        writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+        if (services.length === 0) {
+            log.info("Created neon.ts with a starter policy.");
+        }
+        else {
+            log.info("Created neon.ts declaring %s.", services.join(", "));
+        }
+        if (services.includes("functions")) {
+            scaffoldFunction(cwd);
+        }
     }
     // 2. Make sure the config packages are installed.
     const missing = missingDependencies(cwd);
@@ -234,6 +245,12 @@ export const builder = (argv) => argv
         type: "boolean",
         default: true,
     },
+    services: {
+        describe: `Services the scaffolded neon.ts declares, comma-separated: ${NEON_SERVICES.join(", ")}. ` +
+            `Pass "${NO_SERVICES}" for the bare starter policy. Omitted: pick interactively on a ` +
+            "terminal, starter policy in CI or without a TTY.",
+        type: "string",
+    },
 }), (args) => initCmd(args));
 export const handler = (args) => {
     return args;

package/dist/commands/index.js

@@ -20,6 +20,7 @@ import * as link from "./link.js";
 import * as neonAuth from "./neon_auth.js";
 import * as operations from "./operations.js";
 import * as orgs from "./orgs.js";
+import * as profile from "./profile.js";
 import * as projects from "./projects.js";
 import * as psql from "./psql.js";
 import * as roles from "./roles.js";
@@ -30,6 +31,7 @@ import * as users from "./user.js";
 import * as vpcEndpoints from "./vpc_endpoints.js";
 export default [
     auth,
+    profile,
     api,
     users,
     orgs,

package/dist/commands/profile.js

@@ -0,0 +1,123 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import prompts from "prompts";
+import { revokeToken } from "../auth.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { DEFAULT_PROFILE, listProfiles, onlyDefaultRemains, profilesFilePath, readProfiles, resolveProfile, selectProfileName, } from "../profiles.js";
+import { writer } from "../writer.js";
+export const command = "profile";
+export const aliases = ["profiles"];
+export const describe = "Manage named sets of Neon credentials";
+export const builder = (argv) => argv
+    .usage("$0 profile <sub-command> [options]")
+    .command("list", "List profiles, the account each holds, and where its credentials live", (y) => y, async (args) => await list(args))
+    .command("remove <name>", "Revoke a profile's token and remove it", (y) => y
+    .positional("name", {
+    describe: "Profile to remove",
+    type: "string",
+    demandOption: true,
+})
+    .option("yes", {
+    alias: "y",
+    describe: "Skip the confirmation prompt",
+    type: "boolean",
+    default: false,
+}), async (args) => await remove(args))
+    .demandCommand(1, "Run `neon profile --help` to see the subcommands.");
+export const handler = (_args) => {
+    /* subcommands only */
+};
+const list = async (props) => {
+    const active = selectProfileName(props.profile);
+    const rows = listProfiles(props.configDir).map((p) => ({
+        active: p.name === active ? "*" : "",
+        name: p.name,
+        account: p.label ?? p.userId ?? "-",
+        credentials: p.credentialsPath,
+        signedIn: existsSync(p.credentialsPath) ? "yes" : "no",
+    }));
+    writer(props).end(rows, {
+        title: "Profiles",
+        fields: ["active", "name", "account", "signedIn", "credentials"],
+    });
+};
+const remove = async (props) => {
+    const { name } = props;
+    // Resolve before touching anything: an unknown name must fail having deleted nothing.
+    const profile = resolveProfile(props.configDir, name);
+    if (!props.yes) {
+        if (isCi()) {
+            throw new Error("Refusing to remove a profile without confirmation in CI. Pass --yes.");
+        }
+        const who = profile.label ?? profile.userId ?? "unknown account";
+        const { ok } = await prompts({
+            type: "confirm",
+            name: "ok",
+            message: `Remove profile "${name}" (${who})?`,
+            initial: false,
+        });
+        if (!ok) {
+            log.info("Cancelled.");
+            return;
+        }
+    }
+    // 1. Revoke upstream, so the token dies rather than merely becoming unreachable by us.
+    //    Best-effort: a profile is often removed precisely because its access already broke.
+    const revoked = await revokeStoredToken(profile.credentialsPath, props);
+    log.info(revoked
+        ? "Revoked the OAuth token"
+        : "Could not revoke the OAuth token — removing locally anyway");
+    // 2. Delete the credentials file only if we created it. A profile pointing outside the
+    //    config directory was adopted from elsewhere; unlink it and say so, because the
+    //    secret is still on disk and silence would imply otherwise.
+    if (existsSync(profile.credentialsPath)) {
+        if (isInsideConfigDir(props.configDir, profile.credentialsPath)) {
+            rmSync(profile.credentialsPath);
+            log.info("Deleted %s", profile.credentialsPath);
+        }
+        else {
+            log.info("Left %s on disk — not created by neon", profile.credentialsPath);
+        }
+    }
+    // 3. Drop the entry, and the file once nothing but DEFAULT is left — the mirror image
+    //    of creating it lazily, so a single-account install ends up with no profiles.json.
+    const path = profilesFilePath(props.configDir);
+    const file = readProfiles(props.configDir);
+    if (file?.profiles[name]) {
+        delete file.profiles[name];
+        if (onlyDefaultRemains(file)) {
+            rmSync(path);
+            log.info('Removed "%s" — no profiles left, deleted %s', name, path);
+        }
+        else {
+            writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, {
+                mode: 0o600,
+            });
+            log.info('Removed "%s" from %s', name, path);
+        }
+    }
+    else if (name === DEFAULT_PROFILE) {
+        log.info("Signed out of DEFAULT");
+    }
+};
+const revokeStoredToken = async (credentialsPath, props) => {
+    if (!existsSync(credentialsPath))
+        return false;
+    let tokenSet;
+    try {
+        tokenSet = JSON.parse(readFileSync(credentialsPath, "utf8"));
+    }
+    catch {
+        return false;
+    }
+    return await revokeToken({
+        oauthHost: props.oauthHost,
+        clientId: props.clientId,
+        ...(props.allowUnsafeTls
+            ? { allowUnsafeTls: props.allowUnsafeTls }
+            : {}),
+    }, tokenSet);
+};
+/** Whether a credentials file is one the CLI created, rather than an adopted path. */
+const isInsideConfigDir = (configDir, file) => `${resolve(file)}/`.startsWith(`${resolve(configDir)}/`);

package/dist/config.js

@@ -1,11 +1,29 @@
 import { existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { configDir, resolveConfigFile } from "@neon/config/paths";
 import { isCi } from "./env.js";
 export const CREDENTIALS_FILE = "credentials.json";
-export const defaultDir = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "neonctl");
-export const ensureConfigDir = ({ "config-dir": configDir, "force-auth": forceAuth, }) => {
-    if (!existsSync(configDir) && (!isCi() || forceAuth)) {
-        mkdirSync(configDir, { recursive: true });
+/**
+ * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
+ *
+ * The directory was called `neonctl` until the CLI was renamed. An existing one is still
+ * read — see {@link credentialsPath} — but it is never written to, moved, or deleted.
+ */
+export const defaultDir = configDir();
+/**
+ * Where this invocation's `credentials.json` lives.
+ *
+ * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
+ * directory is used **in place**: an install that predates the rename keeps working, and
+ * its credentials are never duplicated into a second location where one copy could go
+ * stale while another tool still reads it.
+ *
+ * A `--config-dir` the user actually passed is used exactly as given. Falling back out of
+ * an explicitly chosen directory would defeat the reason for choosing it — a CI run
+ * pointed at a scratch directory must never pick up a developer's real credentials.
+ */
+export const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
+export const ensureConfigDir = ({ "config-dir": configDirArg, "force-auth": forceAuth, }) => {
+    if (!existsSync(configDirArg) && (!isCi() || forceAuth)) {
+        mkdirSync(configDirArg, { recursive: true });
     }
 };

package/dist/config_template.js

@@ -0,0 +1,120 @@
+/**
+ * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
+ *
+ * ⚠️ These ship to users the next time `neonctl` is released, so do NOT release
+ * neonctl until `@neon/config` and `@neon/env` are published to npm — otherwise
+ * `config init` would install packages that don't exist yet. (The libraries are
+ * mid-migration from `@neondatabase/*`; track their publish before cutting a CLI
+ * release.)
+ */
+export const CONFIG_PACKAGE = "@neon/config";
+export const ENV_PACKAGE = "@neon/env";
+export const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
+/**
+ * A Neon service `config init` can declare in the `neon.ts` it scaffolds, spelled the way a
+ * user types it in `--services`. Kebab-case rather than the `neon.ts` field names (`aiGateway`,
+ * `buckets`) so the flag reads like a flag; {@link renderNeonConfig} owns the mapping.
+ *
+ * Postgres is absent because every branch has it, and `dataApi` is absent because enabling it
+ * with the default `authProvider: "neon"` requires `auth` — a pairing the picker would have to
+ * enforce rather than offer.
+ */
+export const NEON_SERVICES = [
+    "auth",
+    "functions",
+    "storage",
+    "ai-gateway",
+];
+/** `--services none`: declare nothing, i.e. scaffold the bare starter policy. */
+export const NO_SERVICES = "none";
+/** Slug, display name, and source path of the function scaffolded for `functions`. */
+export const FUNCTION_SLUG = "hello";
+export const FUNCTION_NAME = "Hello World";
+export const FUNCTION_FILENAME = "hello.ts";
+/** Name of the bucket scaffolded for `storage`. */
+export const BUCKET_NAME = "assets";
+/**
+ * Parse a `--services` value into a canonical service list: comma-separated
+ * {@link NEON_SERVICES} names, or {@link NO_SERVICES} on its own for none.
+ *
+ * Unknown names are rejected here rather than silently dropped — a typo'd service would
+ * otherwise scaffold a policy missing exactly the service the user asked for. The result is
+ * deduplicated and ordered by {@link NEON_SERVICES} so the rendered file doesn't depend on the
+ * order they were typed in.
+ */
+export const parseServices = (raw) => {
+    const names = raw
+        .split(",")
+        .map((name) => name.trim())
+        .filter((name) => name !== "");
+    if (names.includes(NO_SERVICES)) {
+        if (names.length > 1) {
+            throw new Error(`--services ${NO_SERVICES} cannot be combined with other services.`);
+        }
+        return [];
+    }
+    const unknown = names.filter((name) => !NEON_SERVICES.includes(name));
+    if (unknown.length > 0) {
+        throw new Error(`Unknown service${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")}. ` +
+            `Supported values: ${NEON_SERVICES.join(", ")}, ${NO_SERVICES}.`);
+    }
+    return NEON_SERVICES.filter((service) => names.includes(service));
+};
+/** The `preview` block for the selected services, or "" when none of them is a preview feature. */
+const renderPreview = (services) => {
+    const lines = [];
+    if (services.includes("ai-gateway")) {
+        lines.push("    aiGateway: true,");
+    }
+    if (services.includes("functions")) {
+        lines.push("    functions: {", `      ${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`, "    },");
+    }
+    if (services.includes("storage")) {
+        lines.push("    buckets: {", `      // "private" is the default; use "public_read" for anonymous reads`, `      ${BUCKET_NAME}: { access: "private" },`, "    },");
+    }
+    if (lines.length === 0) {
+        return "";
+    }
+    return `${["  preview: {", ...lines, "  },"].join("\n")}\n`;
+};
+/**
+ * Render the `neon.ts` policy `config init` writes. With no services this is the starter
+ * policy — an explicit `auth: false`, no `preview` block, and a `branch` closure that gives
+ * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
+ * non-interactive run produce the identical file.
+ */
+export const renderNeonConfig = (services) => `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
+
+export default defineConfig({
+  // Declare your Neon services here
+  auth: ${services.includes("auth")},
+${renderPreview(services)}  // Branch policy: per-branch tuning
+  branch: (branch) => {
+    if (branch.isDefault) {
+      // Default branch: no overrides, uses project defaults
+      return {};
+    }
+    if (!branch.exists) {
+      // New non-default branches: auto-expire
+      // Run \`neon checkout <name>\` to create a new branch with these settings
+      return { ttl: "7d" };
+    }
+    // Existing branch: no changes
+    return {};
+  },
+});
+`;
+/**
+ * The handler written alongside `neon.ts` when `functions` is selected. It has to exist:
+ * `FunctionDef.source` is only resolved when `config apply` / `deploy` bundles it, so a
+ * declared function with no file on disk fails at deploy time rather than at authoring time.
+ *
+ * A default-exported function rather than `export default { fetch }`: both are resolved (see
+ * `resolveFetchHandler`), and the bare function is less to read and less to get wrong. It is
+ * named rather than anonymous so a project's linter has nothing to say about it, and takes no
+ * parameter because a scaffold shipping an unused `req` fails a `noUnusedParameters` project.
+ */
+export const FUNCTION_TEMPLATE = `export default async function hello(): Promise<Response> {
+  return new Response("Hello from Neon Functions");
+}
+`;

package/dist/context.js

@@ -31,6 +31,15 @@ export const isCurrentBranchProbe = (args) => args.currentBranch === true &&
  * client), mirroring {@link isCurrentBranchProbe}.
  */
 export const isConfigInit = (args) => args._[0] === "config" && args._[1] === "init";
+/**
+ * `neon profile …` manages credentials on disk and never calls the Neon API, so the global
+ * auth middleware must skip it — mirroring {@link isConfigInit}.
+ *
+ * More than a nicety: without this, listing your profiles would launch a browser login, and
+ * removing a broken profile would demand you sign into it first. Removing a profile whose
+ * access has already lapsed is the main reason to remove one.
+ */
+export const isProfileCommand = (args) => args._[0] === "profile" || args._[0] === "profiles";
 const CONTEXT_FILE = ".neon";
 const GITIGNORE_FILE = ".gitignore";
 const canAccessFile = (file) => {

package/dist/index.js

@@ -67,6 +67,11 @@ builder = builder
     group: "Global options:",
     type: "string",
     default: defaultDir,
+})
+    .option("profile", {
+    describe: "Named credentials to use, from profiles.json (default: NEON_PROFILE, else DEFAULT)",
+    group: "Global options:",
+    type: "string",
 })
     .option("force-auth", {
     describe: "Force authentication",

package/dist/profiles.js

@@ -0,0 +1,190 @@
+/**
+ * # Profiles — several Neon accounts in one config directory
+ *
+ * A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
+ * keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
+ * "active profile" state to fall out of sync, and no migration.
+ *
+ * ```
+ * ~/.config/neon/
+ * ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
+ * ├── credentials.work.json     # created by `neon auth --profile work`
+ * └── profiles.json             # created only once a second profile exists
+ * ```
+ *
+ * `profiles.json` maps a name to a path, and the path may point anywhere — which is what
+ * makes adopting an existing directory a one-line edit rather than an import command:
+ *
+ * ```json
+ * {
+ *   "version": 1,
+ *   "profiles": {
+ *     "DEFAULT": { "credentials": "credentials.json" },
+ *     "work": {
+ *       "credentials": "../neonctl-databricks/credentials.json",
+ *       "label": "someone@example.com"
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * ## Selection
+ *
+ * `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
+ * `profile use` command, so nothing persists that could disagree with what you typed.
+ *
+ * ## Compatibility
+ *
+ * An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
+ * resolves to `credentials.json` in the config directory (including an existing one in the
+ * legacy `neonctl` directory — see `@neon/config/paths`). Nothing is created until a second
+ * profile is, and nothing is ever moved.
+ */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { resolveConfigFile } from "@neon/config/paths";
+import { credentialsPath, defaultDir } from "./config.js";
+import { log } from "./log.js";
+export const PROFILES_FILE = "profiles.json";
+/** The implicit profile. Backed by plain `credentials.json`, with or without a profiles file. */
+export const DEFAULT_PROFILE = "DEFAULT";
+/** Profile names become part of a filename, so keep them boring. */
+const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/** Which profile this invocation should use: `--profile` → `NEON_PROFILE` → `DEFAULT`. */
+export const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? DEFAULT_PROFILE;
+export const assertValidProfileName = (name) => {
+    if (!NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid profile name "${name}". Use letters, digits, dot, dash or underscore, starting with a letter or digit.`);
+    }
+};
+/** Where `profiles.json` lives for this config directory (whether or not it exists yet). */
+export const profilesFilePath = (dir) => resolveConfigFile(PROFILES_FILE, dir === defaultDir ? {} : { dir }).path;
+/**
+ * Read `profiles.json`, or `null` when there isn't one — the normal single-account state.
+ * A malformed file is reported and treated as absent rather than breaking every command;
+ * the worst case is that a named profile is "not found", which is recoverable, whereas
+ * throwing here would lock the user out of `neon auth` itself.
+ */
+export const readProfiles = (dir) => {
+    const path = profilesFilePath(dir);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed === null ||
+            typeof parsed !== "object" ||
+            Array.isArray(parsed))
+            throw new Error("not an object");
+        const profiles = parsed.profiles;
+        if (profiles === null ||
+            typeof profiles !== "object" ||
+            Array.isArray(profiles))
+            throw new Error("missing `profiles`");
+        return { version: 1, profiles };
+    }
+    catch (err) {
+        log.warning("Ignoring malformed %s: %s", path, err instanceof Error ? err.message : String(err));
+        return null;
+    }
+};
+/** Resolve a profile to an absolute credentials path. Throws when a named profile is unknown. */
+export const resolveProfile = (dir, name) => {
+    const file = readProfiles(dir);
+    const entry = file?.profiles[name];
+    if (entry) {
+        return {
+            name,
+            credentialsPath: resolveEntryPath(dir, entry.credentials),
+            ...(entry.label ? { label: entry.label } : {}),
+            ...(entry.userId ? { userId: entry.userId } : {}),
+            declared: true,
+        };
+    }
+    // DEFAULT works with no profiles.json at all, and keeps working when one exists but
+    // doesn't mention it — that is the pre-profiles behaviour, unchanged.
+    if (name === DEFAULT_PROFILE) {
+        return {
+            name,
+            credentialsPath: credentialsPath(dir),
+            declared: false,
+        };
+    }
+    const known = file
+        ? Object.keys(file.profiles).join(", ")
+        : DEFAULT_PROFILE;
+    throw new Error(`Unknown profile "${name}". Known profiles: ${known}. Create it with \`neon auth --profile ${name}\`.`);
+};
+/** Default location for a new named profile's credentials file. */
+export const newProfileCredentialsPath = (dir, name) => resolve(dir, `credentials.${name}.json`);
+/**
+ * Record a profile, creating `profiles.json` if this is the first named one.
+ *
+ * When the file is created, `DEFAULT` is written explicitly and pointed at wherever
+ * `credentials.json` actually is. That matters for an install predating the directory
+ * rename: `profiles.json` is created in `neon/` while the credentials are still in
+ * `neonctl/`, so `DEFAULT` is recorded as `../neonctl/credentials.json` rather than a
+ * relative name that would resolve to a file that isn't there.
+ */
+export const upsertProfile = (dir, name, entry) => {
+    assertValidProfileName(name);
+    const path = profilesFilePath(dir);
+    const file = readProfiles(dir) ?? {
+        version: 1,
+        profiles: {
+            [DEFAULT_PROFILE]: {
+                credentials: relativeToProfiles(path, credentialsPath(dir)),
+            },
+        },
+    };
+    file.profiles[name] = {
+        credentials: relativeToProfiles(path, entry.credentials),
+        ...(entry.label ? { label: entry.label } : {}),
+        ...(entry.userId ? { userId: entry.userId } : {}),
+    };
+    writeProfiles(path, file);
+};
+/** Remove an entry. Returns false when it wasn't there. */
+export const removeProfileEntry = (dir, name) => {
+    const path = profilesFilePath(dir);
+    const file = readProfiles(dir);
+    if (!file?.profiles[name])
+        return false;
+    delete file.profiles[name];
+    writeProfiles(path, file);
+    return true;
+};
+/**
+ * True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
+ * lazy creation: a single-account install has no profiles file, before or after.
+ */
+export const onlyDefaultRemains = (file) => {
+    const names = Object.keys(file.profiles);
+    return (names.length === 0 ||
+        (names.length === 1 && names[0] === DEFAULT_PROFILE));
+};
+export const listProfiles = (dir) => {
+    const file = readProfiles(dir);
+    if (!file)
+        return [resolveProfile(dir, DEFAULT_PROFILE)];
+    const names = Object.keys(file.profiles);
+    if (!names.includes(DEFAULT_PROFILE))
+        names.unshift(DEFAULT_PROFILE);
+    return names.map((name) => resolveProfile(dir, name));
+};
+const writeProfiles = (path, file) => {
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+};
+const resolveEntryPath = (dir, entry) => isAbsolute(entry) ? entry : resolve(profilesDir(dir), entry);
+/** `profiles.json` may sit in the legacy directory, so entries resolve against its own dir. */
+const profilesDir = (dir) => resolve(profilesFilePath(dir), "..");
+/** Keep entries relative when they sit near `profiles.json`; absolute paths stay absolute. */
+const relativeToProfiles = (profilesPath, target) => {
+    const rel = relative(resolve(profilesPath, ".."), target);
+    return rel && !isAbsolute(rel) ? rel : target;
+};
+function nonEmpty(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed === "" ? undefined : trimmed;
+}

package/dist/utils/service_picker.js

@@ -0,0 +1,64 @@
+import prompts from "prompts";
+import { NEON_SERVICES } from "../config_template.js";
+/**
+ * The picker's rows, in {@link NEON_SERVICES} order. Titles use the product names from the
+ * CLI's README ("Managed Better Auth", "Object Storage") rather than the `neon.ts` field
+ * names, since this is the list a user reads before they've seen a policy.
+ */
+const CHOICES = [
+    {
+        value: "auth",
+        title: "Managed Better Auth",
+        description: "Authentication with users and sessions stored in Postgres.",
+    },
+    {
+        value: "functions",
+        title: "Functions",
+        description: "Long-running, without timeouts, and closer to your database.",
+    },
+    {
+        value: "storage",
+        title: "Object Storage",
+        description: "S3-compatible blob storage that branches with your projects.",
+    },
+    {
+        value: "ai-gateway",
+        title: "AI Gateway",
+        description: "All models, one API, one bill. Powered by Databricks. Not available on the Neon free plan.",
+    },
+];
+/**
+ * Ask which services the scaffolded `neon.ts` should declare. Selecting nothing is a real
+ * answer — it yields the bare starter policy — so an empty list returns empty rather than
+ * re-prompting. Aborting (Ctrl-C) exits 1, matching the prompts in `link`.
+ *
+ * Callers guard the TTY themselves (see `initCmd`); this function assumes it may prompt.
+ */
+export const pickServicesInteractively = async () => {
+    const { services } = await prompts({
+        onState: (state) => {
+            if (state.aborted) {
+                // Restore the cursor prompts hid, then exit — otherwise the terminal is
+                // left without one for the rest of the session.
+                process.stdout.write("\x1B[?25h");
+                process.stdout.write("\n");
+                process.exit(1);
+            }
+        },
+        type: "multiselect",
+        name: "services",
+        message: "Which Neon services should neon.ts declare? (space to toggle, enter to confirm)",
+        instructions: false,
+        choices: CHOICES.map((choice) => ({
+            value: choice.value,
+            title: choice.title,
+            description: choice.description,
+        })),
+    });
+    if (!Array.isArray(services)) {
+        throw new Error("Aborted: no services selected.");
+    }
+    // Order by NEON_SERVICES rather than selection order so the rendered neon.ts is
+    // independent of the order the rows were toggled in.
+    return NEON_SERVICES.filter((service) => services.includes(service));
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.39.1",
+  "version": "2.41.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -55,11 +55,11 @@
     "which": "3.0.1",
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
+    "@neon/config": "0.13.0",
     "@neon/sdk": "1.4.0",
-    "@neon/config": "0.12.0",
-    "@neon/config-runtime": "0.12.0",
-    "@neon/env": "0.13.0",
-    "neon-init": "0.20.5"
+    "@neon/config-runtime": "0.12.1",
+    "neon-init": "0.20.6",
+    "@neon/env": "0.13.1"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"