neon 2.39.1 → 2.42.0

package/README.md

@@ -456,9 +456,55 @@ export default defineConfig({
 });
 ```
 
-Three sub-commands plus two top-level aliases drive it:
+### Getting a `neon.ts` (`config init`)
+
+`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is purely local — no auth, no API calls. In an interactive terminal it asks which services the policy should declare:
+
+```
+? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›
+◯   Managed Better Auth
+     Authentication with users and sessions stored in Postgres.
+◯   Functions
+     Long-running, without timeouts, and closer to your database.
+◯   Object Storage
+     S3-compatible blob storage that branches with your projects.
+◯   AI Gateway
+     All models, one API, one bill. Powered by Databricks. Not available on the Neon free plan.
+```
+
+Selecting nothing is a valid answer: you get the starter policy, which is also what a non-interactive run (CI, no TTY) writes. Pass `--services` to skip the prompt anywhere:
+
+```bash
+# Pick interactively (TTY) or take the starter policy (CI)
+neon config init
+
+# Declare services with no prompt
+neon config init --services auth,functions,storage,ai-gateway
+
+# Explicitly ask for the bare starter policy
+neon config init --services none
+
+# Scaffold but print the install command instead of running it
+neon config init --no-install
+```
+
+Choosing **Functions** also writes the handler the policy points at, since `source` is only resolved when `apply` bundles it — a declared function with no file on disk fails at deploy:
+
+```ts
+// hello.ts
+export default async function hello(): Promise<Response> {
+  return new Response('Hello from Neon Functions');
+}
+```
+
+An existing `neon.ts` (or `hello.ts`) is never overwritten.
+
+Four sub-commands plus two top-level aliases drive it:
 
 ```bash
+# Scaffold a neon.ts and install the config packages (local only)
+neon config init
+
 # Inspect the branch's live Neon state (read-only — never mutates)
 neon config status
 
@@ -591,11 +637,57 @@ neon snapshots schedule set --branch main --schedule '[{"frequency":"weekly","da
 
 All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
 
+## Profiles
+
+The CLI holds one Neon account by default. A profile adds another, and is nothing more than a pointer to a credentials file:
+
+```
+~/.config/neon/
+├── credentials.json          # this IS the DEFAULT profile
+├── credentials.work.json     # created by `neon auth --profile work`
+└── profiles.json             # created only once a second profile exists
+```
+
+```bash
+neon auth --profile work     # create it, or sign in again
+neon profile list
+neon profile remove work
+```
+
+```console
+$ neon profile list
+Profiles
+┌────────┬─────────┬──────────────────────┬──────────┬──────────────────────────────────────┐
+│ Active │ Name    │ Account              │ SignedIn │ Credentials                          │
+├────────┼─────────┼──────────────────────┼──────────┼──────────────────────────────────────┤
+│ *      │ DEFAULT │ me@example.com       │ yes      │ ~/.config/neon/credentials.json      │
+├────────┼─────────┼──────────────────────┼──────────┼──────────────────────────────────────┤
+│        │ work    │ me@work.example.com  │ yes      │ ~/.config/neon/credentials.work.json │
+└────────┴─────────┴──────────────────────┴──────────┴──────────────────────────────────────┘
+```
+
+Select one per invocation with `--profile`, or per shell with `NEON_PROFILE`. There is no `profile use` command and nothing is stored about which profile is "current", so what you type is always what runs.
+
+Entries in `profiles.json` are paths, and a path may point anywhere — which is how you adopt a directory you already have, without moving or re-authenticating anything:
+
+```json
+{
+  "version": 1,
+  "profiles": {
+    "DEFAULT": { "credentials": "credentials.json" },
+    "work": { "credentials": "../neonctl-work/credentials.json" }
+  }
+}
+```
+
+`neon profile remove` revokes the refresh token at the authorization server, not just locally. It deletes the credentials file only when the CLI created it: an adopted path like the one above is unlinked and left on disk, and the command says so. Removing the last named profile deletes `profiles.json`, returning you to the single-account layout. `neon profile remove DEFAULT` signs you out.
+
 ## Commands
 
 | Command                                                                    | Subcommands                                                                                                  | Description                        |
 | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------- |
 | [auth](https://neon.com/docs/reference/cli-auth)                           |                                                                                                              | Authenticate                       |
+| profile                                                                    | `list`, `remove`                                                                                             | Manage named sets of credentials   |
 | [projects](https://neon.com/docs/reference/cli-projects)                   | `list`, `create`, `update`, `delete`, `get`                                                                  | Manage projects                    |
 | [ip-allow](https://neon.com/docs/reference/cli-ip-allow)                   | `list`, `add`, `remove`, `reset`                                                                             | Manage IP Allow                    |
 | [me](https://neon.com/docs/reference/cli-me)                               |                                                                                                              | Show current user                  |
@@ -612,7 +704,7 @@ All sub-commands honor the [global options](#global-options), including `--outpu
 | checkout                                                                   |                                                                                                              | Pin a branch in `.neon`            |
 | diff                                                                       |                                                                                                              | Git-style schema diff vs a branch  |
 | [link](https://neon.com/docs/reference/cli-link)                           |                                                                                                              | Link a directory to a project      |
-| config                                                                     | `status`, `plan`, `apply`                                                                                    | Drive a branch from `neon.ts`      |
+| config                                                                     | `init`, `status`, `plan`, `apply`                                                                            | Drive a branch from `neon.ts`      |
 | deploy                                                                     |                                                                                                              | Alias for `config apply`           |
 | bootstrap                                                                  |                                                                                                              | Scaffold a project from a template |
 | bucket                                                                     | `create`, `list`, `delete`, `object list`, `object get`, `object put`, `object delete` (incl. `--recursive`) | Manage buckets and their objects   |
@@ -625,7 +717,8 @@ Global options are supported with any Neon CLI command.
 | Option                      | Description                                                 | Type    | Default                        |
 | :-------------------------- | :---------------------------------------------------------- | :------ | :----------------------------- |
 | [-o, --output](#output)     | Set the Neon CLI output format (`json`, `yaml`, or `table`) | string  | table                          |
-| [--config-dir](#config-dir) | Path to the Neon CLI configuration directory                | string  | `/home/<user>/.config/neonctl` |
+| [--config-dir](#config-dir) | Path to the Neon CLI configuration directory                | string  | `/home/<user>/.config/neon`    |
+| [--profile](#profile)       | Named credentials to use, from `profiles.json`              | string  | `DEFAULT`                      |
 | [--api-key](#api-key)       | Neon API key                                                | string  | ""                             |
 | [--analytics](#analytics)   | Manage analytics                                            | boolean | true                           |
 | [-v, --version](#version)   | Show the Neon CLI version number                            | boolean | -                              |
@@ -641,12 +734,27 @@ Global options are supported with any Neon CLI command.
 
 - <a id="config-dir"></a>`--config-dir`
 
-  Specifies the path to the `neon` configuration directory. To view the default configuration directory containing you `credentials.json` file, run `neon --help`. The credentials file is created when you authenticate using the `neon auth` command. This option is only necessary if you move your `neon` configuration file to a location other than the default.
+  Specifies the path to the `neon` configuration directory, which holds the `credentials.json` written by `neon auth`. The default is `$XDG_CONFIG_HOME/neon`, or `~/.config/neon`; run `neon --help` to see the resolved path. This option is only necessary if you keep your configuration somewhere else.
+
+  The directory was called `neonctl` before the CLI was renamed. An existing one is still read, and is used **in place** — nothing is moved or copied, so there is never a second credentials file to go stale. A directory you pass explicitly is used exactly as given and never falls back to the legacy name, so pointing a CI run at a scratch directory cannot pick up local credentials.
 
   ```bash
-  neon projects list --config-dir /home/dtprice/.config/neonctl
+  neon projects list --config-dir /home/dtprice/.config/neon
   ```
 
+- <a id="profile"></a>`--profile`
+
+  Selects a named set of credentials, for holding more than one Neon account at a time. A profile is a pointer to a credentials file, recorded in `profiles.json` next to it.
+
+  ```bash
+  neon auth --profile work        # create it, or sign in again
+  neon profile list               # names, accounts, and where each one's credentials live
+  neon projects list --profile work
+  NEON_PROFILE=work neon projects list
+  ```
+
+  Precedence is `--profile`, then `NEON_PROFILE`, then `DEFAULT`. `DEFAULT` is plain `credentials.json`, so an install with a single account needs no `profiles.json` and behaves exactly as before. See [Profiles](#profiles) to list or remove them.
+
 - <a id="api-key"></a>`--api-key`
 
   Specifies your Neon API key. You can authenticate using a Neon API key when running a Neon CLI command instead of using `neon auth`. For information about obtaining an Neon API key, see [Authentication](https://api-docs.neon.tech/reference/authentication), in the _Neon API Reference_.

package/dist/analytics.js

@@ -1,8 +1,7 @@
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
 import { Analytics } from "@segment/analytics-node";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { CREDENTIALS_FILE } from "./config.js";
+import { credentialsPath } from "./config.js";
 import { isCurrentBranchProbe } from "./context.js";
 import { getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
@@ -57,8 +56,7 @@ export const analyticsMiddleware = async (args) => {
         return;
     }
     try {
-        const credentialsPath = join(args.configDir, CREDENTIALS_FILE);
-        const credentials = readFileSync(credentialsPath, {
+        const credentials = readFileSync(credentialsPath(args.configDir), {
             encoding: "utf-8",
         });
         userId = JSON.parse(credentials).user_id;

package/dist/auth.js

@@ -38,6 +38,35 @@ export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, toke
     });
     return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
+/**
+ * Invalidate a refresh token at the authorization server (RFC 7009).
+ *
+ * Best-effort by design, and it returns a boolean rather than throwing: the usual reason to
+ * revoke is that a profile is being removed, and a revoke that fails — offline, token
+ * already dead, server unreachable — must not leave the local entry stranded. Deleting the
+ * file alone would only stop *us* using the token; this stops anyone.
+ */
+export const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+    const token = tokenSet.refresh_token;
+    if (typeof token !== "string" || token === "")
+        return false;
+    try {
+        const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
+            timeout: SERVER_TIMEOUT,
+            execute: allowUnsafeTls
+                ? [client.allowInsecureRequests]
+                : undefined,
+        });
+        await client.tokenRevocation(configuration, token, {
+            token_type_hint: "refresh_token",
+        });
+        return true;
+    }
+    catch (err) {
+        log.debug("Token revocation failed: %s", err instanceof Error ? err.message : String(err));
+        return false;
+    }
+};
 export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
     log.debug("Discovering oauth server");
     const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {

package/dist/commands/auth.js

@@ -1,14 +1,26 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
 import { setAuthContext } from "../auth_context.js";
-import { CREDENTIALS_FILE } from "../config.js";
-import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { credentialsPath as defaultCredentialsPath } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe, isProfileCommand, } from "../context.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { assertValidProfileName, DEFAULT_PROFILE, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile, } from "../profiles.js";
 import { extendTokenSet } from "../utils/auth.js";
+/**
+ * The credentials file this invocation reads and writes: the selected profile's, falling
+ * back to plain `credentials.json` when no profile was named and none is declared. An
+ * unknown profile name is a hard error rather than a silent write to the default file —
+ * a typo must not authenticate the wrong account.
+ */
+const credentialsPathFor = ({ configDir, profile, }) => {
+    const name = selectProfileName(profile);
+    if (name === DEFAULT_PROFILE && !readProfiles(configDir))
+        return defaultCredentialsPath(configDir);
+    return resolveProfile(configDir, name).credentialsPath;
+};
 export const command = "auth";
 export const aliases = ["login"];
 export const describe = "Authenticate";
@@ -18,7 +30,7 @@ export const builder = (yargs) => yargs.option("context-file", {
 export const handler = async (args) => {
     await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, profile, }) => {
     const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
     if (!allowInteractiveAuth && isCi()) {
         throw new Error("Cannot run interactive auth in CI");
@@ -28,9 +40,19 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
         clientId: clientId,
         allowUnsafeTls,
     });
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+    // A named profile that doesn't exist yet is created here rather than erroring: `neon
+    // auth --profile work` is how you make one, so it must work before there is anything
+    // to look up.
+    const profileName = selectProfileName(profile);
+    const isNamed = profileName !== DEFAULT_PROFILE;
+    if (isNamed)
+        assertValidProfileName(profileName);
+    const credentialsPath = isNamed && !readProfiles(configDir)?.profiles[profileName]
+        ? newProfileCredentialsPath(configDir, profileName)
+        : credentialsPathFor({ configDir, profile });
+    let identity = {};
     try {
-        await preserveCredentials(credentialsPath, tokenSet, getApiClient({
+        identity = await preserveCredentials(credentialsPath, tokenSet, getApiClient({
             apiKey: tokenSet.access_token || "",
             apiHost,
         }));
@@ -39,22 +61,36 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
         log.error("Failed to save credentials");
         return "";
     }
+    if (isNamed) {
+        upsertProfile(configDir, profileName, {
+            credentials: credentialsPath,
+            ...(identity.email ? { label: identity.email } : {}),
+            ...(identity.id ? { userId: identity.id } : {}),
+        });
+        log.info('Saved profile "%s" (%s)', profileName, credentialsPath);
+    }
     log.info("Auth complete");
     return tokenSet.access_token || "";
 };
+/**
+ * Persist the token set and return the account it belongs to, so a named profile can be
+ * labelled with an email. The credentials file records only `user_id` — a UUID with no
+ * email — which is why identifying a stored profile offline is otherwise impossible.
+ */
 const preserveCredentials = async (path, credentials, apiClient) => {
-    const { data: { id }, } = await apiClient.getCurrentUserInfo();
+    const { data: { id, email }, } = await apiClient.getCurrentUserInfo();
     const contents = JSON.stringify({
         // Cast to a plain record: we intentionally spread the credentials object.
         ...credentials,
         user_id: id,
     });
-    // correctly sets needed permissions for the credentials file
+    // Owner-only. A credentials file needs read/write, never execute.
     writeFileSync(path, contents, {
-        mode: 0o700,
+        mode: 0o600,
     });
     log.debug("Saved credentials to %s", path);
     log.debug("Credentials MD5 hash: %s", md5hash(contents));
+    return { ...(id ? { id } : {}), ...(email ? { email } : {}) };
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     // Use existing access_token, if present and valid
@@ -113,6 +149,11 @@ export const ensureAuth = async (props) => {
     if (isConfigInit(props)) {
         return;
     }
+    // `profile` reads and edits credential files on disk. Authenticating first would mean
+    // a browser login just to list profiles, and would make a lapsed profile unremovable.
+    if (isProfileCommand(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if
@@ -141,7 +182,7 @@ export const ensureAuth = async (props) => {
         });
         return;
     }
-    const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
+    const credentialsPath = credentialsPathFor(props);
     // Handle case when credentials file exists
     if (existsSync(credentialsPath)) {
         log.debug("Trying to read credentials from %s", credentialsPath);
@@ -204,11 +245,17 @@ export const ensureAuth = async (props) => {
     });
 };
 /**
- * Deletes the credentials file at the specified path
- * @param configDir Directory where credentials file is stored
+ * Delete the credentials backing a profile — used by the 401 handler to clear a token the
+ * API has rejected, so the next command re-authenticates instead of failing again.
+ *
+ * @param configDir Directory the credentials live in
+ * @param profile Profile whose credentials to clear. Defaults to the selected one.
  */
-export const deleteCredentials = (configDir) => {
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
+export const deleteCredentials = (configDir, profile) => {
+    const credentialsPath = credentialsPathFor({
+        configDir,
+        ...(profile ? { profile } : {}),
+    });
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);

package/dist/commands/config.js

@@ -5,6 +5,7 @@ import { apply, createBranch as createBranchFromPolicy, inspect, isPartialBranch
 import chalk from "chalk";
 import { getApiClient } from "../api.js";
 import { toNeonConfigView } from "../config_format.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, NEON_SERVICES, NO_SERVICES, parseServices, REQUIRED_PACKAGES, renderNeonConfig, renderNeonConfigFromView, } from "../config_template.js";
 import { contextBranch, readContextFile } from "../context.js";
 import { isCi } from "../env.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
@@ -15,6 +16,7 @@ import { renderAppliedChanges, renderBranchSettingConflicts, } from "../utils/co
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
 import { addDependenciesArgs, resolvePackageManager, runCommand, } from "../utils/package_manager.js";
+import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
 import { writer } from "../writer.js";
 import { autoPullEnvAfterPin } from "./env.js";
@@ -69,18 +71,6 @@ export const envPullFlag = {
     },
 };
 // ── `config init` ─────────────────────────────────────────────────────────────
-/**
- * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
- *
- * ⚠️ These ship to users the next time `neonctl` is released, so do NOT release
- * neonctl until `@neon/config` and `@neon/env` are published to npm — otherwise
- * `config init` would install packages that don't exist yet. (The libraries are
- * mid-migration from `@neondatabase/*`; track their publish before cutting a CLI
- * release.)
- */
-const CONFIG_PACKAGE = "@neon/config";
-const ENV_PACKAGE = "@neon/env";
-const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 /** package.json fields a dependency can be declared in. */
 const DEPENDENCY_FIELDS = [
     "dependencies",
@@ -92,28 +82,6 @@ const DEPENDENCY_FIELDS = [
 const NEON_CONFIG_FILENAMES = ["neon.ts", "neon.mts", "neon.js", "neon.mjs"];
 /** Whether `dir` already has a Neon config file the runtime would load. */
 export const hasNeonConfigFile = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
-/** Starter `neon.ts` written by `config init` when a project has none. */
-const NEON_CONFIG_TEMPLATE = `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
-
-export default defineConfig({
-  // Declare your Neon services here
-  auth: false,
-  // Branch policy: per-branch tuning
-  branch: (branch) => {
-    if (branch.isDefault) {
-      // Default branch: no overrides, uses project defaults
-      return {};
-    }
-    if (!branch.exists) {
-      // New non-default branches: auto-expire
-      // Run \`neon checkout <name>\` to create a new branch with these settings
-      return { ttl: "7d" };
-    }
-    // Existing branch: no changes
-    return {};
-  },
-});
-`;
 const isRecord = (value) => typeof value === "object" && value !== null;
 /**
  * The {@link REQUIRED_PACKAGES} not already declared in the project's package.json
@@ -143,22 +111,104 @@ const missingDependencies = (cwd) => {
     }
     return REQUIRED_PACKAGES.filter((pkg) => !declared.has(pkg));
 };
+/**
+ * Which services the scaffolded policy declares. `--services` always wins so a script or an
+ * agent gets the same result without a TTY; an injected picker is next (tests); the real
+ * picker only runs on an interactive terminal outside CI. Everything else scaffolds the
+ * starter policy, which is what `config init` has always written.
+ */
+const resolveServices = async (props) => {
+    if (props.services !== undefined) {
+        return parseServices(props.services);
+    }
+    if (props.pickServices) {
+        return props.pickServices();
+    }
+    if (isCi() || !process.stdout.isTTY) {
+        return [];
+    }
+    return pickServicesInteractively();
+};
+/**
+ * Write the hello-world handler the scaffolded `preview.functions` entry points at. An
+ * existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
+ * better outcome than overwriting a file the user wrote.
+ */
+const scaffoldFunction = (cwd) => {
+    const path = join(cwd, FUNCTION_FILENAME);
+    if (existsSync(path)) {
+        log.info("Found an existing %s — leaving it untouched; the %s function points at it.", FUNCTION_FILENAME, FUNCTION_SLUG);
+        return;
+    }
+    writeFileSync(path, FUNCTION_TEMPLATE);
+    log.info("Created %s — the source of the %s function.", FUNCTION_FILENAME, FUNCTION_SLUG);
+};
+/**
+ * Read a branch's live state and render it as a `neon.ts`. The read goes through the same
+ * {@link liveConfigView} as `config status`, so a seeded policy declares exactly what
+ * `config status --config-json` reports — including what it cannot report (see
+ * {@link renderNeonConfigFromView}).
+ */
+const seedFromBranch = async (props) => {
+    const { apiClient, projectId } = props;
+    if (!apiClient || !projectId) {
+        throw new Error("--from-branch needs a project. Pass --project-id, or run `neon link` to pin one in .neon.");
+    }
+    const ref = await resolveBranchRef({
+        apiClient,
+        projectId,
+        ...(props.branch !== undefined ? { branch: props.branch } : {}),
+    });
+    if (ref.usedDefault) {
+        log.info("No branch pinned or passed — seeding from the project's default branch %s.", ref.branchName);
+    }
+    const { live, view } = await liveConfigView({
+        projectId,
+        branchId: ref.branchId,
+        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
+        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
+    });
+    const rendered = renderNeonConfigFromView(view, live.branch.name);
+    return { ...rendered, branchName: live.branch.name };
+};
 /**
  * Scaffold a `neon.ts` policy and make sure the Neon config packages are
  * installed, so a project can go straight to `neon config plan` / `apply`.
- * Purely local — it never touches the Neon API (see {@link isConfigInit}).
+ * Local-only unless `--from-branch` is set (see {@link isConfigInit}).
  */
 export const initCmd = async (props) => {
     const cwd = props.cwd ?? process.cwd();
     const run = props.run ?? runCommand;
-    // 1. Scaffold neon.ts unless the project already has a Neon config file.
+    // 1. Scaffold neon.ts unless the project already has a Neon config file. Resolving the
+    // services (which may prompt) happens only when there is something to write — asking
+    // which services to declare and then declaring nothing would be a lie.
     const existing = NEON_CONFIG_FILENAMES.find((name) => existsSync(join(cwd, name)));
     if (existing) {
         log.info("Found an existing %s — leaving it untouched.", existing);
     }
+    else if (props.fromBranch) {
+        const { source, seeded, branchName } = await seedFromBranch(props);
+        writeFileSync(join(cwd, "neon.ts"), source);
+        if (seeded) {
+            log.info("Created neon.ts from the live state of %s.", branchName);
+        }
+        else {
+            log.info("%s declares no services and no branch settings — created neon.ts with the starter policy instead.", branchName);
+        }
+    }
     else {
-        writeFileSync(join(cwd, "neon.ts"), NEON_CONFIG_TEMPLATE);
-        log.info("Created neon.ts with a starter policy.");
+        const services = await resolveServices(props);
+        writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+        if (services.length === 0) {
+            log.info("Created neon.ts with a starter policy.");
+        }
+        else {
+            log.info("Created neon.ts declaring %s.", services.join(", "));
+        }
+        if (services.includes("functions")) {
+            scaffoldFunction(cwd);
+        }
     }
     // 2. Make sure the config packages are installed.
     const missing = missingDependencies(cwd);
@@ -234,10 +284,53 @@ export const builder = (argv) => argv
         type: "boolean",
         default: true,
     },
+    services: {
+        describe: `Services the scaffolded neon.ts declares, comma-separated: ${NEON_SERVICES.join(", ")}. ` +
+            `Pass "${NO_SERVICES}" for the bare starter policy. Omitted: pick interactively on a ` +
+            "terminal, starter policy in CI or without a TTY.",
+        type: "string",
+    },
+    "from-branch": {
+        describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the " +
+            "branch pinned in .neon, or --branch <name|id>, or the project's default " +
+            "branch. The only mode of `config init` that calls the Neon API.",
+        type: "boolean",
+        // No `default`: yargs counts a defaulted key as provided, so
+        // `default: false` makes `conflicts` reject every `--services` run.
+        conflicts: "services",
+    },
 }), (args) => initCmd(args));
 export const handler = (args) => {
     return args;
 };
+/**
+ * A branch's live state, plus that state projected into the `neon.ts`-shaped
+ * {@link NeonConfigView}. Shared by `config status` and `config init --from-branch` so both
+ * read the branch through one path: what `status --config-json` prints is exactly what
+ * `init --from-branch` writes.
+ *
+ * The pulled `config` carries the branch's tuning inside a closure that JSON can't render, so
+ * it is resolved against the live branch target first.
+ */
+const liveConfigView = async (opts) => {
+    const live = await inspect({
+        projectId: opts.projectId,
+        branchId: opts.branchId,
+        ...(opts.apiKey ? { apiKey: opts.apiKey } : {}),
+        ...(opts.apiHost ? { apiHost: opts.apiHost } : {}),
+        ...(opts.runtimeApi ? { api: opts.runtimeApi } : {}),
+    });
+    const resolved = resolveConfig(live.config, {
+        name: live.branch.name,
+        id: live.branch.id,
+        exists: true,
+        isDefault: live.branch.isDefault,
+        isProtected: live.branch.protected,
+        ...(live.branch.parent ? { parentId: live.branch.parent } : {}),
+        ...(live.branch.expiresAt ? { expiresAt: live.branch.expiresAt } : {}),
+    });
+    return { live, view: toNeonConfigView(resolved, live.preview) };
+};
 const loadConfig = async (props) => {
     // Load the optional --env file FIRST so a `neon.ts` whose function `env` values read
     // `process.env.X` sees them. Must happen before the policy module is imported/evaluated.
@@ -272,27 +365,13 @@ export const status = async (props) => {
     if (!props.configJson) {
         announceTargetBranch(props, branch, "Inspecting branch");
     }
-    const branchId = branch.branchId;
-    const live = await inspect({
+    const { live, view: configView } = await liveConfigView({
         projectId: props.projectId,
-        branchId,
+        branchId: branch.branchId,
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
         ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
-    });
-    // The pulled `config` carries the branch's tuning inside a closure that JSON can't
-    // render. Resolve it against the live branch target to get the concrete settings, then
-    // project both that and the separately-pulled preview state into a neon.ts-shaped view.
-    const resolved = resolveConfig(live.config, {
-        name: live.branch.name,
-        id: live.branch.id,
-        exists: true,
-        isDefault: live.branch.isDefault,
-        isProtected: live.branch.protected,
-        ...(live.branch.parent ? { parentId: live.branch.parent } : {}),
-        ...(live.branch.expiresAt ? { expiresAt: live.branch.expiresAt } : {}),
+        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
     });
-    const configView = toNeonConfigView(resolved, live.preview);
     // `--config-json`: emit just the neon.ts-shaped config to stdout (script-friendly,
     // copy-paste-able), regardless of the global --output.
     if (props.configJson) {

package/dist/commands/index.js

@@ -20,6 +20,7 @@ import * as link from "./link.js";
 import * as neonAuth from "./neon_auth.js";
 import * as operations from "./operations.js";
 import * as orgs from "./orgs.js";
+import * as profile from "./profile.js";
 import * as projects from "./projects.js";
 import * as psql from "./psql.js";
 import * as roles from "./roles.js";
@@ -30,6 +31,7 @@ import * as users from "./user.js";
 import * as vpcEndpoints from "./vpc_endpoints.js";
 export default [
     auth,
+    profile,
     api,
     users,
     orgs,