neon 2.46.0 → 3.0.0

package/dist/commands/dev.js

@@ -1,13 +1,16 @@
 import { spawn, spawnSync } from "node:child_process";
 import { once } from "node:events";
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { describeNativeFinding, findUndeclaredNativePackages, } from "@neon/config-runtime";
 import chalk from "chalk";
 import { resolveDevEnv } from "../dev/env.js";
 import { resolveFunctionsFromConfig, } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { log } from "../log.js";
+import { getCliName } from "../utils/cli_name.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
 export const command = "dev";
@@ -30,7 +33,68 @@ export const builder = (argv) => argv
         type: "number",
     },
 })
+    .epilogue([
+    "",
+    "Functions run with the linked branch's Neon env injected, the same set the",
+    "deployed runtime gives them: DATABASE_URL, plus Neon Auth, the Data API,",
+    "object storage and the AI Gateway where the branch has them. A neon.ts in",
+    "this directory decides instead, exactly as it does for `env pull`.",
+    "",
+    "`dev` reads your .env / .env.local to reuse the branch credential behind the",
+    "AI Gateway and object storage, and never writes to them. With no such file it",
+    "issues a credential on every start, so run `env pull` once if you restart often.",
+].join("\n"))
     .strict();
+/**
+ * The resolver context for a `neon dev` run.
+ *
+ * Two things here are what make local dev match the deployed runtime, which injects a
+ * branch's whole env into a function:
+ *
+ * - **The AI Gateway is asked for**, like `env pull` does, because nothing can detect it.
+ *   Without this, a function that works deployed fails locally with no `NEON_AI_GATEWAY_*`,
+ *   which is exactly the difference `dev` exists to eliminate.
+ * - **The local dotenv file is layered in**, so the branch credential behind the gateway and
+ *   object storage is *reused* rather than re-minted. `dev` writes no file of its own, so
+ *   without a source of persisted secrets every start would mint a credential and leave the
+ *   last one live — one orphan per restart. `neon-env run` already reads the file for this
+ *   reason; `dev` was the one that didn't.
+ */
+export const devEnvContext = (props, branchId, cwd) => {
+    const envFile = resolveEnvFilePath(cwd);
+    return {
+        cwd,
+        implyAiGateway: true,
+        env: {
+            ...process.env,
+            ...(existsSync(envFile) ? readEnvFile(envFile) : {}),
+        },
+        ...(props.projectId ? { projectId: props.projectId } : {}),
+        ...(branchId ? { branchId } : {}),
+        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
+    };
+};
+/**
+ * Say when a run issued a branch credential.
+ *
+ * `dev` has nowhere to persist one — it writes no file — so on a branch with nothing to reuse
+ * it mints per start and cannot name the previous one to revoke it. Every other command that
+ * mints says so; this is the one that runs dozens of times a day, and the server banner listing
+ * `NEON_AI_GATEWAY_TOKEN` reads as "fetched", not "just created, and the last one is still
+ * live". The note names the one action that stops it, so it disappears once followed.
+ */
+export const reportDevCredential = (credential) => {
+    if (!credential?.issued)
+        return;
+    if (credential.revoked.length > 0) {
+        log.info("Issued a new branch credential — %s changed. Revoked the one it replaced (%s).", credential.keys.join(", "), credential.revoked.join(", "));
+        return;
+    }
+    log.warning("Issued a branch credential for this run (%s) and left any previous one live — a dev " +
+        `server has nowhere to keep it. Run \`${getCliName()} env pull\` once to write it to ` +
+        "your .env, and restarts will reuse it instead of issuing another.", credential.keys.join(", "));
+};
 export const handler = async (props) => {
     if (props.source !== undefined) {
         await runSingleSource(props);
@@ -51,17 +115,12 @@ const runSingleSource = async (props) => {
         throw new Error(`Source file not found: ${source}`);
     }
     const branchId = await resolveBranchId(props);
-    const { vars: neonEnv, skipped } = await resolveDevEnv({
-        cwd: process.cwd(),
-        ...(props.projectId ? { projectId: props.projectId } : {}),
-        ...(branchId ? { branchId } : {}),
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-    });
+    const { vars: neonEnv, skipped, credential, } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
+    reportDevCredential(credential);
     const unit = {
         slug: null,
         source,
-        bundleDir: join(process.cwd(), "node_modules", ".neon-dev"),
+        bundleDir: devBundleDir(process.cwd()),
         childEnv: buildChildEnv(neonEnv, portFromProps(props.port)),
         label: null,
         envSummary: { neon: Object.keys(neonEnv), fn: [] },
@@ -89,13 +148,8 @@ const runFromConfig = async (props) => {
         throw new Error("neon.ts has no functions to serve. Add at least one under " +
             "`preview.functions`, or pass --source <path>.");
     }
-    const { vars: neonEnv, skipped } = await resolveDevEnv({
-        cwd: process.cwd(),
-        ...(props.projectId ? { projectId: props.projectId } : {}),
-        ...(branchId ? { branchId } : {}),
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-    });
+    const { vars: neonEnv, skipped, credential, } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
+    reportDevCredential(credential);
     const units = planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);
     // Re-derive the units from neon.ts on demand so the config watcher can hot-add/remove
     // functions without restarting the dev server. `searchBase` lets a freshly-added unit
@@ -160,6 +214,19 @@ const portFromProps = (port) => {
     }
     return { mode: "search", from: DEFAULT_PORT_BASE };
 };
+/**
+ * Where a locally-served function's bundle is written.
+ *
+ * The location inside the project's own `node_modules` is load-bearing, not a tidiness
+ * choice. A function's `externalPackages` are left unbundled, and Node resolves an unbundled
+ * import by walking up from the importing file — so from here it reaches the project's real
+ * `node_modules` and finds them, at the host architecture that can actually run locally.
+ * Moving this directory anywhere outside `node_modules` breaks `neon dev` for those
+ * functions with a `Cannot find module`, so the path is pinned by a test.
+ */
+export const devBundleDir = (cwd, slug) => slug === undefined
+    ? join(cwd, "node_modules", ".neon-dev")
+    : join(cwd, "node_modules", ".neon-dev", slug);
 /**
  * Translate a {@link PlannedFunction} into a {@link ServedUnit}. Port rules:
  *   - explicit `dev.port`: bind exactly, fail if taken.
@@ -174,7 +241,7 @@ const plannedToUnit = (fn, branchEnv, searchBase) => {
     return {
         slug: fn.slug,
         source: fn.source,
-        bundleDir: join(process.cwd(), "node_modules", ".neon-dev", fn.slug),
+        bundleDir: devBundleDir(process.cwd(), fn.slug),
         childEnv,
         label: fn.slug,
         envSummary: { neon: Object.keys(branchEnv), fn: Object.keys(fn.env) },
@@ -233,7 +300,9 @@ const runSupervisor = async (units, options = {}) => {
     const bundleAndStart = async (r) => {
         let bundlePath;
         try {
-            bundlePath = await writeBundle(r.unit.source, r.unit.bundleDir, r.unit.externalPackages);
+            bundlePath = await writeBundle(r.unit.source, r.unit.bundleDir, r.unit.externalPackages, 
+            // The `neon.ts` key, so a function is named the same way here as at deploy.
+            r.unit.slug ?? undefined);
         }
         catch (err) {
             r.status = "error";
@@ -481,10 +550,35 @@ const spawnChild = (unit, runtimePath, bundlePath) => {
         detached: true,
     });
 };
-const writeBundle = async (source, bundleDir, externalPackages) => {
-    const files = await bundleEntry(source, {
+/**
+ * Findings already reported for a served unit, so an advisory that cannot change between
+ * saves is not reprinted on every one. A dev session on a project with a standing false
+ * positive would otherwise repeat the whole block for its lifetime.
+ */
+const reportedFindings = new Map();
+const writeBundle = async (source, bundleDir, externalPackages, label) => {
+    // Left unbundled only. `bundleDir` sits inside the project's node_modules, so an
+    // externalized package resolves from the real tree at the host architecture — no install
+    // or copy is needed or wanted locally, whatever `includeFiles` says for a deploy.
+    const { files, metafile, warnings } = await bundleEntry(source, {
         ...(externalPackages ? { externalPackages } : {}),
     });
+    for (const warning of warnings)
+        log.warning(warning);
+    // Local runs resolve native packages from the real tree, so a missing declaration is
+    // invisible until deploy. Reporting it here is the only signal before then.
+    const findings = findUndeclaredNativePackages({
+        metafile,
+        declared: externalPackages ?? [],
+        projectDir: dirname(source),
+    });
+    const signature = findings.map((f) => f.name).join(",");
+    if (reportedFindings.get(source) !== signature) {
+        reportedFindings.set(source, signature);
+        for (const finding of findings) {
+            log.warning(describeNativeFinding(label ?? basename(source), finding));
+        }
+    }
     mkdirSync(bundleDir, { recursive: true });
     // bundleEntry emits a single `index.mjs` (no source map). The `.mjs` extension makes Node
     // load it as ESM directly, so no `package.json` `"type": "module"` marker is needed.

package/dist/commands/env.js

@@ -1,10 +1,12 @@
 import { existsSync } from "node:fs";
-import { NEON_ENV_VAR_KEYS } from "@neon/env";
 import chalk from "chalk";
+import { NEON_ENV_VAR_KEYS } from "../_shared/env-core/env.js";
 import { ensureGitignored } from "../context.js";
 import { resolveNeonEnvVars } from "../dev/env.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
+import { ENV_PULL_SERVICES, ENV_PULL_UNAVAILABLE, envServiceKeys, ownedEnvServiceKeys, } from "../env_services.js";
 import { log } from "../log.js";
+import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption, } from "../neon_services.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -34,14 +36,51 @@ export const builder = (argv) => argv
             "lines are preserved.",
         type: "string",
     },
+    service: servicesOption({
+        key: "service",
+        allowed: ENV_PULL_SERVICES,
+        describe: "Pull only these services' variables",
+        also: "Overrides neon.ts, and prunes only within the services you name.",
+    }),
 })
+    .epilogue([
+    "",
+    "What gets pulled, in precedence order:",
+    "  1. --service, when given — exactly those, ignoring neon.ts.",
+    "  2. neon.ts, when this directory has one.",
+    "  3. Otherwise everything the branch has, plus the AI Gateway —",
+    "     which mints a branch credential for it.",
+    "",
+    "The pull bundled into link / checkout / config apply follows 2 and 3",
+    "without the AI Gateway, so it never mints a credential you did not ask",
+    "for. Run `env pull` to add it.",
+].join("\n"))
     .example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)")
-    .example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file"), async (args) => {
+    .example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file")
+    .example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables"), async (args) => {
+    const raw = servicesFlagValue(args.service);
     // Explicit `env pull` announces the branch it's reading from up front so the user
     // can catch "pulled env from the wrong branch" before it overwrites their .env. The
     // bundled auto-pull (link / checkout / apply) stays quiet — those already report the
     // branch they pinned/applied to.
-    await pull(args, { announce: true });
+    //
+    // It also implies the AI Gateway when there is no neon.ts, so a bare `env pull`
+    // really does write everything the branch can give you. The bundled auto-pull does
+    // not: minting a credential for a service the user never named is not something a
+    // side effect of `link` / `checkout` / `apply` should do.
+    await pull({
+        ...args,
+        ...(raw
+            ? {
+                services: parseServices(raw, {
+                    allowed: ENV_PULL_SERVICES,
+                    whyUnavailable: ENV_PULL_UNAVAILABLE,
+                    flag: "--service",
+                    onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical)),
+                }),
+            }
+            : {}),
+    }, { announce: true, implyAiGateway: raw === undefined });
 })
     .demandCommand(1);
 export const handler = (args) => args;
@@ -83,16 +122,18 @@ export const pull = async (props, opts = {}) => {
     // Reuse `neon dev`'s tiered resolver (neon.ts policy -> plan gate -> fetchEnv, else
     // pullConfig -> fetchEnv). Unlike dev, an unresolved context or failure is surfaced —
     // `env pull` is an explicit action, so it should error rather than write nothing.
-    const { vars, credential } = await resolveNeonEnvVars({
+    const { vars, credential, skipped } = await resolveNeonEnvVars({
         cwd,
         projectId: props.projectId,
         branchId,
         env: { ...process.env, ...existingEnv },
+        ...(props.services ? { services: props.services } : {}),
+        ...(opts.implyAiGateway ? { implyAiGateway: true } : {}),
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
         ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
     });
-    const neonVars = pickNeonVars(vars);
+    const neonVars = pickServiceVars(pickNeonVars(vars), props.services);
     if (Object.keys(neonVars).length === 0) {
         log.info("No Neon env variables to pull for this branch (no DATABASE_URL or " +
             "enabled Auth / Data API).");
@@ -102,7 +143,7 @@ export const pull = async (props, opts = {}) => {
     // Neon-owned vars the branch no longer has (e.g. NEON_AUTH_* / NEON_DATA_API_* carried over
     // from a previous project/branch). Non-Neon lines are always preserved.
     const { written, removed } = mergeEnvFile(targetPath, neonVars, {
-        managedKeys: NEON_OWNED_ENV_KEYS,
+        managedKeys: managedKeysFor(props.services, unreachedButCurrent(skipped, existingEnv, branchId)),
     });
     log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
     if (removed.length > 0) {
@@ -116,6 +157,17 @@ export const pull = async (props, opts = {}) => {
         if (credential.revoked.length > 0) {
             log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
         }
+        else if (credential.superseded.length > 0) {
+            // An unscoped pull revokes what it supersedes and says so above. A scoped one
+            // cannot — it may not be the only service on that credential — so it leaves the
+            // old one live. Say that too, rather than letting the identical-looking output
+            // imply the branch is not accumulating credentials. Driven by what the resolver
+            // actually declined to revoke, so a first pull (which supersedes nothing) does
+            // not send the user hunting for a credential that was never there.
+            log.info("Left the credential it replaced live (%s): a pull scoped with --service " +
+                "can't tell which other services still use it. Revoke it in the Neon " +
+                "Console if nothing does.", credential.superseded.join(", "));
+        }
     }
     // A dotenv file *we* create holds live branch credentials (DATABASE_URL, Auth keys, service
     // tokens), so ignore it the same way the `.neon` context file is — otherwise a fresh repo is
@@ -143,8 +195,75 @@ export const pull = async (props, opts = {}) => {
         written,
         file: targetPath,
         ...(credential && credential.keys.length > 0 ? { credential } : {}),
+        ...(skipped && skipped.length > 0 ? { skipped } : {}),
     };
 };
+/**
+ * The keys this pull is allowed to prune, i.e. the ones it is authoritative for.
+ *
+ * A `--service` selection narrows that to the services it named: `env pull -s ai-gateway`
+ * says nothing about `DATABASE_URL`, so it must not read that variable's absence from this
+ * pull as "the branch no longer has it". `unreached` is subtracted for the same reason — see
+ * {@link unreachedButCurrent}.
+ */
+const managedKeysFor = (services, unreached) => {
+    const owned = services
+        ? ownedEnvServiceKeys(services)
+        : [...NEON_OWNED_ENV_KEYS];
+    if (unreached.length === 0)
+        return owned;
+    const keep = new Set(ownedEnvServiceKeys(unreached));
+    return owned.filter((key) => !keep.has(key));
+};
+/**
+ * Of the services this pull could not reach, the ones whose variables already on disk belong
+ * to the branch being pulled — the only ones worth keeping.
+ *
+ * Failing to reach a service is not evidence that the branch stopped having it:
+ * `PLATFORM_FEATURE_UNAVAILABLE` covers a transient incident as well as a project that
+ * genuinely lacks the feature, and pruning would delete a token whose secret exists nowhere
+ * else and strand the live credential behind it. But that only argues for keeping *this
+ * branch's* values. Variables left over from another branch are stale by definition, and
+ * keeping those would leave an app pointed at the wrong branch's gateway — a worse failure
+ * than losing a token, because it is silent.
+ *
+ * The gateway is the only service that can be unreached (only it is implied rather than
+ * observed), and its base URL is branch-scoped, so the persisted URL is what tells the two
+ * cases apart. Anything that does not resolve to this branch's gateway host is pruned, which
+ * is the safe direction: a stale entry costs a re-pull, a wrongly-kept one silently misroutes
+ * traffic.
+ */
+const unreachedButCurrent = (skipped, existingEnv, branchId) => {
+    if (!skipped?.includes("ai-gateway"))
+        return [];
+    const baseUrl = existingEnv[NEON_ENV_VAR_KEYS.aiGateway.baseUrl];
+    return baseUrl !== undefined && isBranchGatewayUrl(baseUrl, branchId)
+        ? ["ai-gateway"]
+        : [];
+};
+/**
+ * Whether a persisted `NEON_AI_GATEWAY_BASE_URL` addresses `branchId`'s gateway.
+ *
+ * Checks the parsed **hostname** against the shape `@neon/env` builds
+ * (`<branchId>-api.ai.<host suffix>`), not the raw string: a prefix comparison is satisfied
+ * by a URL whose userinfo carries the branch id (`https://<branchId>-api.ai.@other-host/`)
+ * while the request actually goes elsewhere. An unparseable value is not this branch's
+ * gateway either, which is an answer rather than a swallowed failure.
+ */
+const isBranchGatewayUrl = (baseUrl, branchId) => URL.canParse(baseUrl) &&
+    new URL(baseUrl).hostname.startsWith(`${branchId}-api.ai.`);
+/**
+ * Narrow the resolved vars to the selected services (plus `NEON_BRANCH`, which every pull
+ * refreshes). Needed because the two `DATABASE_URL*` vars are always resolved — `fetchEnv`
+ * reads both connection URIs regardless, since the AI Gateway host is derived from the direct
+ * one — so `--service ai-gateway` has to drop them here rather than avoid fetching them.
+ */
+const pickServiceVars = (vars, services) => {
+    if (!services)
+        return vars;
+    const wanted = envServiceKeys(services);
+    return Object.fromEntries(Object.entries(vars).filter(([key]) => wanted.has(key)));
+};
 /**
  * Pull a freshly-pinned branch's Neon env vars into a local `.env`, bundled into `link` and
  * `checkout` so the branch-first loop is just *link + checkout* — `env pull` runs for you.
@@ -183,6 +302,8 @@ export const renderAgentPullNote = (result) => {
             const credential = result.credential?.issued
                 ? ` Issued a new branch credential, so ${result.credential.keys.join(", ")} changed.`
                 : "";
+            // No `skipped` note: only the implied AI Gateway can be skipped, and the auto-pull
+            // this renders never implies it.
             return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.${credential}`;
         }
         case "empty":

package/dist/commands/functions.js

@@ -1,5 +1,6 @@
 import { existsSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { describeNativeFinding, findUndeclaredNativePackages, } from "@neon/config-runtime";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { createDeployment, deleteFunction, getFunction, listFunctions, } from "../functions_api.js";
 import { log } from "../log.js";
@@ -194,7 +195,20 @@ const deploy = async (props) => {
         throw new Error(`No entry file found in ${src}. Expected one of: ${ENTRY_CANDIDATES.join(", ")}.`);
     }
     // Bundle before any network round-trip so a bundling failure fails fast.
-    const zip = zipBundle(await bundleEntry(source));
+    const bundled = await bundleEntry(source);
+    for (const warning of bundled.warnings)
+        log.warning(warning);
+    // `--src` bypasses `neon.ts`, so there is no policy to declare anything in and no way to
+    // stage files here. The advisory still runs: this is the shortest path to a function that
+    // deploys clean and then fails at invoke, so it is the last place to stay silent.
+    for (const finding of findUndeclaredNativePackages({
+        metafile: bundled.metafile,
+        declared: [],
+        projectDir: dirname(source),
+    })) {
+        log.warning(describeNativeFinding(props.slug, finding));
+    }
+    const zip = zipBundle(bundled.files);
     const branchId = await branchIdFromProps(props);
     // Snapshot the current version before deploy so we can detect the new one
     // afterward. A missing function (404) or no deployment yet → undefined.

package/dist/config_template.js

@@ -1,3 +1,4 @@
+import { NEON_SERVICES } from "./neon_services.js";
 /**
  * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
  *
@@ -11,55 +12,32 @@ export const CONFIG_PACKAGE = "@neon/config";
 export const ENV_PACKAGE = "@neon/env";
 export const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 /**
- * A Neon service `config init` can declare in the `neon.ts` it scaffolds, spelled the way a
- * user types it in `--services`. Kebab-case rather than the `neon.ts` field names (`aiGateway`,
- * `buckets`) so the flag reads like a flag; {@link renderNeonConfig} owns the mapping.
+ * The services `config init` can declare in the `neon.ts` it scaffolds — the subset of
+ * {@link NEON_SERVICES} a policy has a field for. {@link renderNeonConfig} owns the mapping
+ * from these names to the `neon.ts` fields (`aiGateway`, `buckets`).
  *
- * Postgres is absent because every branch has it, and `dataApi` is absent because enabling it
- * with the default `authProvider: "neon"` requires `auth` — a pairing the picker would have to
- * enforce rather than offer.
+ * Postgres is absent because every branch has it, so there is nothing to declare. `data-api`
+ * is absent because enabling it with the default `authProvider: "neon"` requires `auth` — a
+ * pairing the picker would have to enforce rather than offer.
  */
-export const NEON_SERVICES = [
-    "auth",
-    "functions",
-    "storage",
-    "ai-gateway",
-];
-/** `--services none`: declare nothing, i.e. scaffold the bare starter policy. */
-export const NO_SERVICES = "none";
+export const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres" && service !== "data-api");
+/**
+ * What `config init --services none` produces. One constant because it is both the help text
+ * and what tells the parser `none` is a value here — passing the literal at each call site
+ * lets the two drift into documenting something the parser does not accept.
+ */
+export const CONFIG_INIT_NONE_MEANS = "the bare starter policy";
+/** Why the two a policy cannot declare are not selectable, for the refusal message. */
+export const CONFIG_INIT_UNAVAILABLE = {
+    postgres: "every branch has Postgres, so a policy has nothing to declare for it",
+    "data-api": "enabling it with the default provider requires auth, so declare auth here and turn the Data API on with `neon data-api create`",
+};
 /** Slug, display name, and source path of the function scaffolded for `functions`. */
 export const FUNCTION_SLUG = "hello";
 export const FUNCTION_NAME = "Hello World";
 export const FUNCTION_FILENAME = "hello.ts";
 /** Name of the bucket scaffolded for `storage`. */
 export const BUCKET_NAME = "assets";
-/**
- * Parse a `--services` value into a canonical service list: comma-separated
- * {@link NEON_SERVICES} names, or {@link NO_SERVICES} on its own for none.
- *
- * Unknown names are rejected here rather than silently dropped — a typo'd service would
- * otherwise scaffold a policy missing exactly the service the user asked for. The result is
- * deduplicated and ordered by {@link NEON_SERVICES} so the rendered file doesn't depend on the
- * order they were typed in.
- */
-export const parseServices = (raw) => {
-    const names = raw
-        .split(",")
-        .map((name) => name.trim())
-        .filter((name) => name !== "");
-    if (names.includes(NO_SERVICES)) {
-        if (names.length > 1) {
-            throw new Error(`--services ${NO_SERVICES} cannot be combined with other services.`);
-        }
-        return [];
-    }
-    const unknown = names.filter((name) => !NEON_SERVICES.includes(name));
-    if (unknown.length > 0) {
-        throw new Error(`Unknown service${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")}. ` +
-            `Supported values: ${NEON_SERVICES.join(", ")}, ${NO_SERVICES}.`);
-    }
-    return NEON_SERVICES.filter((service) => names.includes(service));
-};
 /**
  * One indentation level in the emitted `neon.ts`. Two spaces, which is what every renderer
  * here produces and what `config_template.format.test.ts` holds them to.
@@ -88,7 +66,7 @@ const renderPreview = (services) => {
             ...at(3, `${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`),
         ]));
     }
-    if (services.includes("storage")) {
+    if (services.includes("object-storage")) {
         lines.push(...block(2, "buckets", [
             ...at(3, `// "private" is the default; use "public_read" for anonymous reads`, `${BUCKET_NAME}: { access: "private" },`),
         ]));