neon 2.47.0 → 3.1.0

package/dist/commands/config.js

@@ -1,724 +1,641 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { resolveConfig } from "@neon/config";
-import { apply, createBranch as createBranchFromPolicy, inspect, isPartialBranchCreateError, loadConfigFromFile, PushConflictError, plan, } from "@neon/config-runtime";
-import chalk from "chalk";
-import { getApiClient } from "../api.js";
-import { toNeonConfigView } from "../config_format.js";
-import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderNeonConfig, renderNeonConfigFromView, } from "../config_template.js";
-import { contextBranch, readContextFile } from "../context.js";
+import { __exportAll } from "../_virtual/_rolldown/runtime.js";
 import { isCi } from "../env.js";
-import { loadEnvFileIntoProcess } from "../env_file.js";
 import { log } from "../log.js";
-import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption, } from "../neon_services.js";
-import { assertAiGatewayProvisionable, warnAiGateway, } from "../utils/ai_gateway_notice.js";
-import { announceTargetBranch } from "../utils/branch_notice.js";
+import { getApiClient } from "../api.js";
+import { contextBranch, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
-import { renderAppliedChanges, renderBranchSettingConflicts, } from "../utils/config_diff.js";
+import { toNeonConfigView } from "../config_format.js";
+import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
+import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
+import { loadEnvFileIntoProcess } from "../env_file.js";
+import { writer } from "../writer.js";
+import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
+import { assertAiGatewayProvisionable, warnAiGateway } from "../utils/ai_gateway_notice.js";
+import { announceTargetBranch } from "../utils/branch_notice.js";
+import { renderAppliedChanges, renderBranchSettingConflicts } from "../utils/config_diff.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { addDependenciesArgs, resolvePackageManager, runCommand, } from "../utils/package_manager.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
-import { writer } from "../writer.js";
 import { autoPullEnvAfterPin } from "./env.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import chalk from "chalk";
+import { packagesToStage, resolveConfig } from "@neon/config";
+import { PushConflictError, apply, assertZipWithinLimits, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, loadConfigFromFile as loadConfigFromFile$1, plan, traceNativePackages } from "@neon/config-runtime";
+//#region src/commands/config.ts
+var config_exports = /* @__PURE__ */ __exportAll({
+	applyCmd: () => applyCmd,
+	applyFlags: () => applyFlags,
+	applyPolicyOnCreate: () => applyPolicyOnCreate,
+	builder: () => builder,
+	command: () => command,
+	createBranchFromPolicyOnCheckout: () => createBranchFromPolicyOnCheckout,
+	describe: () => describe,
+	envFlag: () => envFlag,
+	envPullFlag: () => envPullFlag,
+	handler: () => handler,
+	hasNeonConfigFile: () => hasNeonConfigFile,
+	initCmd: () => initCmd,
+	planCmd: () => planCmd,
+	status: () => status
+});
 /**
- * Bundle a function with neonctl's OWN bundler (the shared esbuild helper) so the
- * config-runtime never has to import esbuild itself. Injecting this keeps esbuild
- * out of config-runtime's static module graph — and therefore out of the packaged
- * neonctl snapshot, which resolves esbuild dynamically at deploy time.
- */
-const neonctlBundler = async (fn) => zipBundle(await bundleEntry(fn.source, {
-    ...(fn.externalPackages
-        ? { externalPackages: fn.externalPackages }
-        : {}),
-}));
-const INSPECT_FIELDS = ["project", "branch", "config"];
-/**
- * Shared `--env` flag for `config plan|apply` and `deploy`. Loads a `.env` into
- * `process.env` before the policy is evaluated.
- */
-export const envFlag = {
-    env: {
-        describe: "Path to a .env file to load into the environment before evaluating neon.ts " +
-            "(so function env values resolve from it). Existing env vars are not overridden.",
-        type: "string",
-    },
+* Bundle a function with neonctl's OWN bundler (the shared esbuild helper) so the
+* config-runtime never has to import esbuild itself. Injecting this keeps esbuild
+* out of config-runtime's static module graph — and therefore out of the packaged
+* neonctl snapshot, which resolves esbuild dynamically at deploy time.
+*/
+const neonctlBundler = async (fn) => {
+	const externalPackages = fn.externalPackages ?? [];
+	const { files, metafile, warnings } = await bundleEntry(fn.source, { externalPackages: externalPackages.map((pkg) => pkg.name) });
+	for (const warning of warnings) log.warning(warning);
+	for (const finding of findUndeclaredNativePackages({
+		metafile,
+		declared: externalPackages.map((pkg) => pkg.name),
+		projectDir: dirname(fn.source)
+	})) log.warning(describeNativeFinding(fn.slug, finding));
+	const staged = packagesToStage(externalPackages);
+	if (staged.length === 0) return zipBundle(files);
+	const traced = await traceNativePackages({
+		slug: fn.slug,
+		packages: staged,
+		projectDir: dirname(fn.source)
+	});
+	for (const warning of traced.warnings) log.warning(warning);
+	const entries = {
+		...files,
+		...traced.entries
+	};
+	enforceLimits(fn.slug, entries);
+	const zip = zipBundle(entries);
+	assertZipWithinLimits(fn.slug, zip, entries);
+	return zip;
 };
+const INSPECT_FIELDS = [
+	"project",
+	"branch",
+	"config"
+];
+/**
+* Shared `--env` flag for `config plan|apply` and `deploy`. Loads a `.env` into
+* `process.env` before the policy is evaluated.
+*/
+const envFlag = { env: {
+	describe: "Path to a .env file to load into the environment before evaluating neon.ts (so function env values resolve from it). Existing env vars are not overridden.",
+	type: "string"
+} };
 /** Apply-only flags, exported so `deploy` can reuse the exact same surface. */
-export const applyFlags = {
-    "update-existing": {
-        describe: "Auto-confirm overriding existing remote settings on the branch",
-        type: "boolean",
-        default: false,
-    },
-    "allow-protected": {
-        describe: "Auto-confirm applying to a branch marked protected on Neon",
-        type: "boolean",
-        default: false,
-    },
+const applyFlags = {
+	"update-existing": {
+		describe: "Auto-confirm overriding existing remote settings on the branch",
+		type: "boolean",
+		default: false
+	},
+	"allow-protected": {
+		describe: "Auto-confirm applying to a branch marked protected on Neon",
+		type: "boolean",
+		default: false
+	}
 };
 /**
- * `--env-pull` for `config apply` / `deploy` (shared so both expose the identical surface).
- * After a successful apply, the branch's Neon env vars are written to a local `.env` — the
- * same bundled convenience as `link` / `checkout`. On by default; `--no-env-pull` opts out.
- */
-export const envPullFlag = {
-    "env-pull": {
-        describe: "Pull the branch's Neon env vars (DATABASE_URL, …) into a local .env after a " +
-            "successful apply. On by default; use --no-env-pull to skip (e.g. when injecting " +
-            "env at runtime with `neon-env run` / `neon dev`).",
-        type: "boolean",
-        default: true,
-    },
-};
-// ── `config init` ─────────────────────────────────────────────────────────────
+* `--env-pull` for `config apply` / `deploy` (shared so both expose the identical surface).
+* After a successful apply, the branch's Neon env vars are written to a local `.env` — the
+* same bundled convenience as `link` / `checkout`. On by default; `--no-env-pull` opts out.
+*/
+const envPullFlag = { "env-pull": {
+	describe: "Pull the branch's Neon env vars (DATABASE_URL, …) into a local .env after a successful apply. On by default; use --no-env-pull to skip (e.g. when injecting env at runtime with `neon-env run` / `neon dev`).",
+	type: "boolean",
+	default: true
+} };
 /** package.json fields a dependency can be declared in. */
 const DEPENDENCY_FIELDS = [
-    "dependencies",
-    "devDependencies",
-    "peerDependencies",
-    "optionalDependencies",
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
 ];
 /** Config filenames the runtime loads (mirrors @neon/config's loader). */
-const NEON_CONFIG_FILENAMES = ["neon.ts", "neon.mts", "neon.js", "neon.mjs"];
+const NEON_CONFIG_FILENAMES = [
+	"neon.ts",
+	"neon.mts",
+	"neon.js",
+	"neon.mjs"
+];
 /** Whether `dir` already has a Neon config file the runtime would load. */
-export const hasNeonConfigFile = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
+const hasNeonConfigFile = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
 const isRecord = (value) => typeof value === "object" && value !== null;
 /**
- * The {@link REQUIRED_PACKAGES} not already declared in the project's package.json
- * (any dependency field). A missing or malformed package.json means none are
- * declared, so all are reported missing.
- */
+* The {@link REQUIRED_PACKAGES} not already declared in the project's package.json
+* (any dependency field). A missing or malformed package.json means none are
+* declared, so all are reported missing.
+*/
 const missingDependencies = (cwd) => {
-    const declared = new Set();
-    const pkgPath = join(cwd, "package.json");
-    if (existsSync(pkgPath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
-        }
-        catch {
-            parsed = undefined;
-        }
-        if (isRecord(parsed)) {
-            for (const field of DEPENDENCY_FIELDS) {
-                const deps = parsed[field];
-                if (isRecord(deps)) {
-                    for (const name of Object.keys(deps))
-                        declared.add(name);
-                }
-            }
-        }
-    }
-    return REQUIRED_PACKAGES.filter((pkg) => !declared.has(pkg));
+	const declared = /* @__PURE__ */ new Set();
+	const pkgPath = join(cwd, "package.json");
+	if (existsSync(pkgPath)) {
+		let parsed;
+		try {
+			parsed = JSON.parse(readFileSync(pkgPath, "utf8"));
+		} catch {
+			parsed = void 0;
+		}
+		if (isRecord(parsed)) for (const field of DEPENDENCY_FIELDS) {
+			const deps = parsed[field];
+			if (isRecord(deps)) for (const name of Object.keys(deps)) declared.add(name);
+		}
+	}
+	return REQUIRED_PACKAGES.filter((pkg) => !declared.has(pkg));
 };
 /**
- * Which services the scaffolded policy declares. `--services` always wins so a script or an
- * agent gets the same result without a TTY; an injected picker is next (tests); the real
- * picker only runs on an interactive terminal outside CI. Everything else scaffolds the
- * starter policy, which is what `config init` has always written.
- */
+* Which services the scaffolded policy declares. `--services` always wins so a script or an
+* agent gets the same result without a TTY; an injected picker is next (tests); the real
+* picker only runs on an interactive terminal outside CI. Everything else scaffolds the
+* starter policy, which is what `config init` has always written.
+*/
 const resolveServices = async (props) => {
-    if (props.services !== undefined) {
-        return parseServices(props.services, {
-            allowed: CONFIG_INIT_SERVICES,
-            whyUnavailable: CONFIG_INIT_UNAVAILABLE,
-            flag: "--services",
-            noneMeans: CONFIG_INIT_NONE_MEANS,
-            onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical)),
-        });
-    }
-    if (props.pickServices) {
-        return props.pickServices();
-    }
-    if (isCi() || !process.stdout.isTTY) {
-        return [];
-    }
-    return pickServicesInteractively();
+	if (props.services !== void 0) return parseServices(props.services, {
+		allowed: CONFIG_INIT_SERVICES,
+		whyUnavailable: CONFIG_INIT_UNAVAILABLE,
+		flag: "--services",
+		noneMeans: CONFIG_INIT_NONE_MEANS,
+		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
+	});
+	if (props.pickServices) return props.pickServices();
+	if (isCi() || !process.stdout.isTTY) return [];
+	return pickServicesInteractively();
 };
 /**
- * Write the hello-world handler the scaffolded `preview.functions` entry points at. An
- * existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
- * better outcome than overwriting a file the user wrote.
- */
+* Write the hello-world handler the scaffolded `preview.functions` entry points at. An
+* existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
+* better outcome than overwriting a file the user wrote.
+*/
 const scaffoldFunction = (cwd) => {
-    const path = join(cwd, FUNCTION_FILENAME);
-    if (existsSync(path)) {
-        log.info("Found an existing %s — leaving it untouched; the %s function points at it.", FUNCTION_FILENAME, FUNCTION_SLUG);
-        return;
-    }
-    writeFileSync(path, FUNCTION_TEMPLATE);
-    log.info("Created %s — the source of the %s function.", FUNCTION_FILENAME, FUNCTION_SLUG);
+	const path = join(cwd, FUNCTION_FILENAME);
+	if (existsSync(path)) {
+		log.info("Found an existing %s — leaving it untouched; the %s function points at it.", FUNCTION_FILENAME, FUNCTION_SLUG);
+		return;
+	}
+	writeFileSync(path, FUNCTION_TEMPLATE);
+	log.info("Created %s — the source of the %s function.", FUNCTION_FILENAME, FUNCTION_SLUG);
 };
 /**
- * Read a branch's live state and render it as a `neon.ts`. The read goes through the same
- * {@link liveConfigView} as `config status`, so a seeded policy declares exactly what
- * `config status --config-json` reports — including what it cannot report (see
- * {@link renderNeonConfigFromView}).
- */
+* Read a branch's live state and render it as a `neon.ts`. The read goes through the same
+* {@link liveConfigView} as `config status`, so a seeded policy declares exactly what
+* `config status --config-json` reports — including what it cannot report (see
+* {@link renderNeonConfigFromView}).
+*/
 const seedFromBranch = async (props) => {
-    const { apiClient, projectId } = props;
-    if (!apiClient || !projectId) {
-        throw new Error("--from-branch needs a project. Pass --project-id, or run `neon link` to pin one in .neon.");
-    }
-    const ref = await resolveBranchRef({
-        apiClient,
-        projectId,
-        ...(props.branch !== undefined ? { branch: props.branch } : {}),
-    });
-    if (ref.usedDefault) {
-        log.info("No branch pinned or passed — seeding from the project's default branch %s.", ref.branchName);
-    }
-    const { live, view } = await liveConfigView({
-        projectId,
-        branchId: ref.branchId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
-    });
-    const rendered = renderNeonConfigFromView(view, live.branch.name);
-    return { ...rendered, branchName: live.branch.name };
+	const { apiClient, projectId } = props;
+	if (!apiClient || !projectId) throw new Error("--from-branch needs a project. Pass --project-id, or run `neon link` to pin one in .neon.");
+	const ref = await resolveBranchRef({
+		apiClient,
+		projectId,
+		...props.branch !== void 0 ? { branch: props.branch } : {}
+	});
+	if (ref.usedDefault) log.info("No branch pinned or passed — seeding from the project's default branch %s.", ref.branchName);
+	const { live, view } = await liveConfigView({
+		projectId,
+		branchId: ref.branchId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+	});
+	return {
+		...renderNeonConfigFromView(view, live.branch.name),
+		branchName: live.branch.name
+	};
 };
 /**
- * Scaffold a `neon.ts` policy and make sure the Neon config packages are
- * installed, so a project can go straight to `neon config plan` / `apply`.
- * Local-only unless `--from-branch` is set (see {@link isConfigInit}).
- */
-export const initCmd = async (props) => {
-    const cwd = props.cwd ?? process.cwd();
-    const run = props.run ?? runCommand;
-    // 1. Scaffold neon.ts unless the project already has a Neon config file. Resolving the
-    // services (which may prompt) happens only when there is something to write — asking
-    // which services to declare and then declaring nothing would be a lie.
-    const existing = NEON_CONFIG_FILENAMES.find((name) => existsSync(join(cwd, name)));
-    if (existing) {
-        log.info("Found an existing %s — leaving it untouched.", existing);
-    }
-    else if (props.fromBranch) {
-        const { source, seeded, branchName } = await seedFromBranch(props);
-        writeFileSync(join(cwd, "neon.ts"), source);
-        if (seeded) {
-            log.info("Created neon.ts from the live state of %s.", branchName);
-        }
-        else {
-            log.info("%s declares no services and no branch settings — created neon.ts with the starter policy instead.", branchName);
-        }
-    }
-    else {
-        const services = await resolveServices(props);
-        writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
-        if (services.length === 0) {
-            log.info("Created neon.ts with a starter policy.");
-        }
-        else {
-            log.info("Created neon.ts declaring %s.", services.join(", "));
-        }
-        if (services.includes("functions")) {
-            scaffoldFunction(cwd);
-        }
-    }
-    // 2. Make sure the config packages are installed.
-    const missing = missingDependencies(cwd);
-    if (missing.length === 0) {
-        log.info("%s are already installed.", REQUIRED_PACKAGES.join(" and "));
-    }
-    else {
-        const pm = resolvePackageManager(cwd);
-        const args = addDependenciesArgs(pm, missing);
-        if (props.install === false) {
-            log.info("Install the Neon config packages to use neon.ts: %s %s", pm, args.join(" "));
-        }
-        else {
-            log.info("Installing %s with %s…", missing.join(", "), pm);
-            const ok = await run(pm, args, cwd);
-            if (!ok) {
-                log.warning("Could not install the config packages automatically. Run by hand: %s %s", pm, args.join(" "));
-            }
-        }
-    }
-    log.info("Next: edit neon.ts, then run `neon config plan` to preview and `neon config apply`.");
+* Scaffold a `neon.ts` policy and make sure the Neon config packages are
+* installed, so a project can go straight to `neon config plan` / `apply`.
+* Local-only unless `--from-branch` is set (see {@link isConfigInit}).
+*/
+const initCmd = async (props) => {
+	const cwd = props.cwd ?? process.cwd();
+	const run = props.run ?? runCommand;
+	const existing = NEON_CONFIG_FILENAMES.find((name) => existsSync(join(cwd, name)));
+	if (existing) log.info("Found an existing %s — leaving it untouched.", existing);
+	else if (props.fromBranch) {
+		const { source, seeded, branchName } = await seedFromBranch(props);
+		writeFileSync(join(cwd, "neon.ts"), source);
+		if (seeded) log.info("Created neon.ts from the live state of %s.", branchName);
+		else log.info("%s declares no services and no branch settings — created neon.ts with the starter policy instead.", branchName);
+	} else {
+		const services = await resolveServices(props);
+		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+		if (services.length === 0) log.info("Created neon.ts with a starter policy.");
+		else log.info("Created neon.ts declaring %s.", services.join(", "));
+		if (services.includes("functions")) scaffoldFunction(cwd);
+	}
+	const missing = missingDependencies(cwd);
+	if (missing.length === 0) log.info("%s are already installed.", REQUIRED_PACKAGES.join(" and "));
+	else {
+		const pm = resolvePackageManager(cwd);
+		const args = installArgs(pm, missing);
+		if (props.install === false) log.info("Install the Neon config packages to use neon.ts: %s", formatInstallCommand(pm, missing));
+		else {
+			log.info("Installing %s with %s…", missing.join(", "), pm);
+			if (!await run(pm, args, cwd)) log.warning("Could not install the config packages automatically. Run by hand: %s", formatInstallCommand(pm, missing));
+		}
+	}
+	log.info("Next: edit neon.ts, then run `neon config plan` to preview and `neon config apply`.");
 };
-export const command = "config";
-export const describe = "Manage a branch with a neon.ts policy";
-export const builder = (argv) => argv
-    .usage("$0 config <sub-command> [options]")
-    .options({
-    "project-id": {
-        describe: "Project ID",
-        type: "string",
-    },
-    branch: {
-        describe: "Branch ID or name",
-        type: "string",
-    },
-})
-    .middleware(fillSingleProject)
-    .command("status", "Show the branch's live Neon state", (yargs) => yargs.options({
-    "config-json": {
-        describe: "Print only the branch's live config as neon.ts-shaped JSON " +
-            "(services + branch tuning + preview), to stdout. Useful for " +
-            "scripting or copying into a neon.ts.",
-        type: "boolean",
-        default: false,
-    },
-    "current-branch": {
-        describe: "Print only the linked branch name from the local .neon file " +
-            "(no network). Exits non-zero when no branch is pinned.",
-        type: "boolean",
-        default: false,
-    },
-}), (args) => status(args))
-    .command("plan", "Show what `config apply` would change (dry run)", (yargs) => yargs.options({
-    config: {
-        describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
-        type: "string",
-    },
-    ...envFlag,
-}), (args) => planCmd(args))
-    .command("apply", "Apply a neon.ts policy to the branch", (yargs) => yargs.options({
-    config: {
-        describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
-        type: "string",
-    },
-    ...envFlag,
-    ...applyFlags,
-    ...envPullFlag,
-}), (args) => applyCmd(args))
-    .command("init", "Scaffold a neon.ts policy and install the Neon config packages", (yargs) => yargs.options({
-    install: {
-        describe: "Install @neon/config and @neon/env if they're missing. " +
-            "On by default; use --no-install to just print the command.",
-        type: "boolean",
-        default: true,
-    },
-    services: servicesOption({
-        key: "services",
-        allowed: CONFIG_INIT_SERVICES,
-        noneMeans: CONFIG_INIT_NONE_MEANS,
-        describe: "Services the scaffolded neon.ts declares",
-        also: "Omitted: pick interactively on a terminal, starter policy in " +
-            "CI or without a TTY.",
-    }),
-    "from-branch": {
-        describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the " +
-            "branch pinned in .neon, or --branch <name|id>, or the project's default " +
-            "branch. The only mode of `config init` that calls the Neon API.",
-        type: "boolean",
-        // No `default`: yargs counts a defaulted key as provided, so
-        // `default: false` makes `conflicts` reject every `--services` run.
-        conflicts: "services",
-    },
+const command = "config";
+const describe = "Manage a branch with a neon.ts policy";
+const builder = (argv) => argv.usage("$0 config <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("status", "Show the branch's live Neon state", (yargs) => yargs.options({
+	"config-json": {
+		describe: "Print only the branch's live config as neon.ts-shaped JSON (services + branch tuning + preview), to stdout. Useful for scripting or copying into a neon.ts.",
+		type: "boolean",
+		default: false
+	},
+	"current-branch": {
+		describe: "Print only the linked branch name from the local .neon file (no network). Exits non-zero when no branch is pinned.",
+		type: "boolean",
+		default: false
+	}
+}), (args) => status(args)).command("plan", "Show what `config apply` would change (dry run)", (yargs) => yargs.options({
+	config: {
+		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		type: "string"
+	},
+	...envFlag
+}), (args) => planCmd(args)).command("apply", "Apply a neon.ts policy to the branch", (yargs) => yargs.options({
+	config: {
+		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		type: "string"
+	},
+	...envFlag,
+	...applyFlags,
+	...envPullFlag
+}), (args) => applyCmd(args)).command("init", "Scaffold a neon.ts policy and install the Neon config packages", (yargs) => yargs.options({
+	install: {
+		describe: "Install @neon/config and @neon/env if they're missing. On by default; use --no-install to just print the command.",
+		type: "boolean",
+		default: true
+	},
+	services: servicesOption({
+		key: "services",
+		allowed: CONFIG_INIT_SERVICES,
+		noneMeans: CONFIG_INIT_NONE_MEANS,
+		describe: "Services the scaffolded neon.ts declares",
+		also: "Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
+	}),
+	"from-branch": {
+		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. The only mode of `config init` that calls the Neon API.",
+		type: "boolean",
+		conflicts: "services"
+	}
 }), (args) => initCmd({
-    ...args,
-    // `args` is untyped here, and "flag omitted" has to stay distinct from
-    // "flag given" — it decides whether the picker runs at all.
-    services: servicesFlagValue(args.services),
+	...args,
+	services: servicesFlagValue(args.services)
 }));
-export const handler = (args) => {
-    return args;
+const handler = (args) => {
+	return args;
 };
 /**
- * A branch's live state, plus that state projected into the `neon.ts`-shaped
- * {@link NeonConfigView}. Shared by `config status` and `config init --from-branch` so both
- * read the branch through one path: what `status --config-json` prints is exactly what
- * `init --from-branch` writes.
- *
- * The pulled `config` carries the branch's tuning inside a closure that JSON can't render, so
- * it is resolved against the live branch target first.
- */
+* A branch's live state, plus that state projected into the `neon.ts`-shaped
+* {@link NeonConfigView}. Shared by `config status` and `config init --from-branch` so both
+* read the branch through one path: what `status --config-json` prints is exactly what
+* `init --from-branch` writes.
+*
+* The pulled `config` carries the branch's tuning inside a closure that JSON can't render, so
+* it is resolved against the live branch target first.
+*/
 const liveConfigView = async (opts) => {
-    const live = await inspect({
-        projectId: opts.projectId,
-        branchId: opts.branchId,
-        ...(opts.apiKey ? { apiKey: opts.apiKey } : {}),
-        ...(opts.apiHost ? { apiHost: opts.apiHost } : {}),
-        ...(opts.runtimeApi ? { api: opts.runtimeApi } : {}),
-    });
-    const resolved = resolveConfig(live.config, {
-        name: live.branch.name,
-        id: live.branch.id,
-        exists: true,
-        isDefault: live.branch.isDefault,
-        isProtected: live.branch.protected,
-        ...(live.branch.parent ? { parentId: live.branch.parent } : {}),
-        ...(live.branch.expiresAt ? { expiresAt: live.branch.expiresAt } : {}),
-    });
-    return { live, view: toNeonConfigView(resolved, live.preview) };
+	const live = await inspect({
+		projectId: opts.projectId,
+		branchId: opts.branchId,
+		...opts.apiKey ? { apiKey: opts.apiKey } : {},
+		...opts.apiHost ? { apiHost: opts.apiHost } : {},
+		...opts.runtimeApi ? { api: opts.runtimeApi } : {}
+	});
+	const resolved = resolveConfig(live.config, {
+		name: live.branch.name,
+		id: live.branch.id,
+		exists: true,
+		isDefault: live.branch.isDefault,
+		isProtected: live.branch.protected,
+		...live.branch.parent ? { parentId: live.branch.parent } : {},
+		...live.branch.expiresAt ? { expiresAt: live.branch.expiresAt } : {}
+	});
+	return {
+		live,
+		view: toNeonConfigView(resolved, live.preview)
+	};
 };
 const loadConfig = async (props) => {
-    // Load the optional --env file FIRST so a `neon.ts` whose function `env` values read
-    // `process.env.X` sees them. Must happen before the policy module is imported/evaluated.
-    if (props.env) {
-        const applied = loadEnvFileIntoProcess(props.env);
-        log.debug("Loaded %d var(s) from %s into the environment: %s", applied.length, props.env, applied.join(", "));
-    }
-    const { config } = await loadConfigFromFile({
-        ...(props.config ? { path: props.config } : {}),
-    });
-    return config;
+	if (props.env) {
+		const applied = loadEnvFileIntoProcess(props.env);
+		log.debug("Loaded %d var(s) from %s into the environment: %s", applied.length, props.env, applied.join(", "));
+	}
+	const { config } = await loadConfigFromFile$1({ ...props.config ? { path: props.config } : {} });
+	return config;
 };
-export const status = async (props) => {
-    // `--current-branch` short-circuits here (before resolveBranchRef), so it wins
-    // over --config-json and ignores --output. See ConfigProps.currentBranch / isCurrentBranchProbe.
-    if (props.currentBranch) {
-        const branch = contextBranch(readContextFile(props.contextFile));
-        if (branch) {
-            process.stdout.write(`${branch}\n`);
-        }
-        else {
-            // No branch pinned: hint on stderr and exit non-zero (grep-style) so a prompt's
-            // `when` hides the segment cleanly instead of rendering a bare icon.
-            log.info(`No branch pinned. Run \`${getCliName()} checkout <branch>\` to pin a branch and pull its env vars.`);
-            process.exitCode = 1;
-        }
-        return;
-    }
-    const branch = await resolveBranchRef(props);
-    // `--config-json` is a script-friendly mode that emits only JSON to stdout, so keep it
-    // pristine; the regular human view gets the "which branch am I inspecting" guardrail.
-    if (!props.configJson) {
-        announceTargetBranch(props, branch, "Inspecting branch");
-    }
-    const { live, view: configView } = await liveConfigView({
-        projectId: props.projectId,
-        branchId: branch.branchId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
-    });
-    // `--config-json`: emit just the neon.ts-shaped config to stdout (script-friendly,
-    // copy-paste-able), regardless of the global --output.
-    if (props.configJson) {
-        process.stdout.write(`${JSON.stringify(configView, null, 2)}\n`);
-        return;
-    }
-    // Default: the live project/branch tables, but with the unhelpful raw `config` replaced
-    // by the resolved neon.ts-shaped view so the user sees enabled infra + branch tuning.
-    writer(props).end({ project: live.project, branch: live.branch, config: configView }, { fields: INSPECT_FIELDS });
+const status = async (props) => {
+	if (props.currentBranch) {
+		const branch = contextBranch(readContextFile(props.contextFile));
+		if (branch) process.stdout.write(`${branch}\n`);
+		else {
+			log.info(`No branch pinned. Run \`${getCliName()} checkout <branch>\` to pin a branch and pull its env vars.`);
+			process.exitCode = 1;
+		}
+		return;
+	}
+	const branch = await resolveBranchRef(props);
+	if (!props.configJson) announceTargetBranch(props, branch, "Inspecting branch");
+	const { live, view: configView } = await liveConfigView({
+		projectId: props.projectId,
+		branchId: branch.branchId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+	});
+	if (props.configJson) {
+		process.stdout.write(`${JSON.stringify(configView, null, 2)}\n`);
+		return;
+	}
+	writer(props).end({
+		project: live.project,
+		branch: live.branch,
+		config: configView
+	}, { fields: INSPECT_FIELDS });
 };
-export const planCmd = async (props) => {
-    const config = await loadConfig(props);
-    const branch = await resolveBranchRef(props);
-    announceTargetBranch(props, branch, "Planning against branch");
-    const branchId = branch.branchId;
-    // `plan` is a dry run that never bundles, so its options don't accept (or need)
-    // an injected bundler — only `apply` does (it uses neonctlBundler).
-    const result = await plan(config, {
-        projectId: props.projectId,
-        branchId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
-    });
-    const services = utilizedServices(config);
-    reportPushResult(props, result, "plan", services);
-    // `plan` is a dry run and never pulls credentials, so it can only offer the plan-based
-    // (Free) AI Gateway notice — the reduced-model-set check needs a live gateway token,
-    // which `apply`/`checkout`/`env pull` get via the bundled env pull. Best-effort.
-    if (services.includes("AI Gateway")) {
-        await warnAiGateway({
-            apiClient: props.apiClient,
-            projectId: props.projectId,
-            branchId,
-        });
-    }
+const planCmd = async (props) => {
+	const config = await loadConfig(props);
+	const branch = await resolveBranchRef(props);
+	announceTargetBranch(props, branch, "Planning against branch");
+	const branchId = branch.branchId;
+	const result = await plan(config, {
+		projectId: props.projectId,
+		branchId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { api: props.runtimeApi } : {}
+	});
+	const services = utilizedServices(config);
+	reportPushResult(props, result, "plan", services);
+	if (services.includes("AI Gateway")) await warnAiGateway({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId
+	});
 };
-export const applyCmd = async (props) => {
-    const config = await loadConfig(props);
-    const branch = await resolveBranchRef(props);
-    announceTargetBranch(props, branch, "Applying to branch");
-    const branchId = branch.branchId;
-    // The AI Gateway can't serve on the Free plan, so refuse to provision it up front rather
-    // than write a credential that won't work. Only when the policy actually enables the
-    // gateway; best-effort on the plan lookup (a transient failure never blocks a paid user).
-    if (utilizedServices(config).includes("AI Gateway")) {
-        await assertAiGatewayProvisionable({
-            apiClient: props.apiClient,
-            projectId: props.projectId,
-        });
-    }
-    let result;
-    try {
-        result = await apply(config, {
-            projectId: props.projectId,
-            branchId,
-            ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-            ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-            ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
-            ...(props.updateExisting ? { updateExisting: true } : {}),
-            ...(props.allowProtected ? { allowProtectedBranch: true } : {}),
-            bundleFunction: neonctlBundler,
-        });
-    }
-    catch (err) {
-        // Drift without `--update-existing` throws with the conflicting fields attached.
-        // Render them as the same git-style before→after diff, then fail with a concise
-        // message (the detailed diff above replaces the library's long multi-line text).
-        if (err instanceof PushConflictError) {
-            reportConflicts(props, err.conflicts);
-            throw new Error("Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above.");
-        }
-        throw err;
-    }
-    reportPushResult(props, result, "apply", utilizedServices(config));
-    // After a successful apply/deploy, write the branch's Neon env vars to a local .env —
-    // the same bundled convenience as `link` / `checkout`, so the branch is immediately
-    // usable for local dev. `--no-env-pull` opts out; a pull failure degrades to a warning
-    // (the apply already succeeded). See autoPullEnvAfterPin.
-    await autoPullEnvAfterPin({ ...props, envPull: props.envPull !== false });
+const applyCmd = async (props) => {
+	const config = await loadConfig(props);
+	const branch = await resolveBranchRef(props);
+	announceTargetBranch(props, branch, "Applying to branch");
+	const branchId = branch.branchId;
+	if (utilizedServices(config).includes("AI Gateway")) await assertAiGatewayProvisionable({
+		apiClient: props.apiClient,
+		projectId: props.projectId
+	});
+	let result;
+	try {
+		result = await apply(config, {
+			projectId: props.projectId,
+			branchId,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { api: props.runtimeApi } : {},
+			...props.updateExisting ? { updateExisting: true } : {},
+			...props.allowProtected ? { allowProtectedBranch: true } : {},
+			bundleFunction: neonctlBundler
+		});
+	} catch (err) {
+		if (err instanceof PushConflictError) {
+			reportConflicts(props, err.conflicts);
+			throw new Error("Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above.");
+		}
+		throw err;
+	}
+	reportPushResult(props, result, "apply", utilizedServices(config));
+	await autoPullEnvAfterPin({
+		...props,
+		envPull: props.envPull !== false
+	});
 };
 /**
- * A static service toggle (`auth` / `dataApi` / `preview.aiGateway`) is "on" unless
- * explicitly disabled: `true` / `{}` / `{ enabled: true }` enable it; `false` /
- * `{ enabled: false }` / absent leave it off. Mirrors the runtime's `isServiceEnabled`
- * (which isn't exported), kept tiny and pure so it can be read straight off the policy.
- */
+* A static service toggle (`auth` / `dataApi` / `preview.aiGateway`) is "on" unless
+* explicitly disabled: `true` / `{}` / `{ enabled: true }` enable it; `false` /
+* `{ enabled: false }` / absent leave it off. Mirrors the runtime's `isServiceEnabled`
+* (which isn't exported), kept tiny and pure so it can be read straight off the policy.
+*/
 const isToggleEnabled = (toggle) => {
-    if (toggle === undefined)
-        return false;
-    if (typeof toggle === "boolean")
-        return toggle;
-    return toggle.enabled !== false;
+	if (toggle === void 0) return false;
+	if (typeof toggle === "boolean") return toggle;
+	return toggle.enabled !== false;
 };
 /**
- * Human-readable list of the services a `neon.ts` policy utilizes on the branch, shown under
- * the plan/apply table. Postgres is always present (every branch has it); the rest are listed
- * only when the policy declares them. This deliberately surfaces services that produce **no**
- * plan step — notably the AI Gateway, which is always available and only needs a scoped branch
- * credential (not a provisioning step) — so adding `preview.aiGateway` to a neon.ts isn't
- * mistaken for being silently dropped. Service enablement is static top-level config (it never
- * lives in the per-branch closure), so reading it straight off `config` is accurate.
- */
+* Human-readable list of the services a `neon.ts` policy utilizes on the branch, shown under
+* the plan/apply table. Postgres is always present (every branch has it); the rest are listed
+* only when the policy declares them. This deliberately surfaces services that produce **no**
+* plan step — notably the AI Gateway, which is always available and only needs a scoped branch
+* credential (not a provisioning step) — so adding `preview.aiGateway` to a neon.ts isn't
+* mistaken for being silently dropped. Service enablement is static top-level config (it never
+* lives in the per-branch closure), so reading it straight off `config` is accurate.
+*/
 const utilizedServices = (config) => {
-    const services = ["Postgres"];
-    if (isToggleEnabled(config.auth))
-        services.push("Neon Auth");
-    if (isToggleEnabled(config.dataApi))
-        services.push("Data API");
-    if (Object.keys(config.preview?.buckets ?? {}).length > 0) {
-        services.push("Object Storage");
-    }
-    if (Object.keys(config.preview?.functions ?? {}).length > 0) {
-        services.push("Functions");
-    }
-    if (isToggleEnabled(config.preview?.aiGateway))
-        services.push("AI Gateway");
-    return services;
+	const services = ["Postgres"];
+	if (isToggleEnabled(config.auth)) services.push("Neon Auth");
+	if (isToggleEnabled(config.dataApi)) services.push("Data API");
+	if (Object.keys(config.preview?.buckets ?? {}).length > 0) services.push("Object Storage");
+	if (Object.keys(config.preview?.functions ?? {}).length > 0) services.push("Functions");
+	if (isToggleEnabled(config.preview?.aiGateway)) services.push("AI Gateway");
+	return services;
 };
 /**
- * Render a {@link PushResult}. JSON/YAML output emits the raw result (plus a `services`
- * summary) verbatim so it can be piped; the human-readable path renders the actual changes
- * (dropping noops) and any blocking conflicts as a `git diff`-style report, or a "nothing to
- * do" line when both are empty — and always closes with the list of services the policy
- * utilizes so a service that produces no plan step (Postgres, or the credential-gated AI
- * Gateway) isn't mistaken for being missing from the plan above.
- *
- * The diff is asymmetric on purpose (see the CLI's `neon diff`): **service** changes are
- * additions with no "before", so they list as `+`/`~` lines; **branch setting** changes have
- * a natural before→after, so conflicts render as a sorted `current → desired` diff. Planned
- * branch updates (under `--update-existing`) carry only the new value, so they render
- * desired-only for now (the previous value isn't threaded through the runtime yet).
- */
+* Render a {@link PushResult}. JSON/YAML output emits the raw result (plus a `services`
+* summary) verbatim so it can be piped; the human-readable path renders the actual changes
+* (dropping noops) and any blocking conflicts as a `git diff`-style report, or a "nothing to
+* do" line when both are empty — and always closes with the list of services the policy
+* utilizes so a service that produces no plan step (Postgres, or the credential-gated AI
+* Gateway) isn't mistaken for being missing from the plan above.
+*
+* The diff is asymmetric on purpose (see the CLI's `neon diff`): **service** changes are
+* additions with no "before", so they list as `+`/`~` lines; **branch setting** changes have
+* a natural before→after, so conflicts render as a sorted `current → desired` diff. Planned
+* branch updates (under `--update-existing`) carry only the new value, so they render
+* desired-only for now (the previous value isn't threaded through the runtime yet).
+*/
 const reportPushResult = (props, result, mode, services) => {
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end({ ...result, services }, { fields: [] });
-        return;
-    }
-    const appliedChanges = result.applied.filter((change) => change.action !== "noop");
-    // Deployed functions carry their invocation URL in the change details — collect them so
-    // we can list where to call each function without digging through the raw details blob.
-    // Keyed by slug so a function never shows twice.
-    const functionUrlBySlug = new Map();
-    for (const change of appliedChanges) {
-        const slug = change.details?.slug;
-        const invocationUrl = change.details?.invocationUrl;
-        if (typeof slug === "string" && typeof invocationUrl === "string") {
-            functionUrlBySlug.set(slug, invocationUrl);
-        }
-    }
-    // chalk self-detects TTY/NO_COLOR; `--no-color` (props.color === false) forces plain.
-    const color = props.color !== false;
-    const out = writer(props);
-    // Conflicts never reach here in the CLI: `plan` runs with updateExisting on, and a bare
-    // `apply` throws PushConflictError (rendered by reportConflicts). So an empty applied set
-    // is the whole story here.
-    const noChanges = appliedChanges.length === 0;
-    const appliedText = renderAppliedChanges(appliedChanges, mode === "plan" ? "Planned changes" : "Applied changes", { color });
-    if (appliedText)
-        out.text(`${appliedText}\n`);
-    // Function URLs are a plain list rather than a table: an invocation URL can be 70+ chars,
-    // which makes any bordered table overflow and wrap awkwardly in a normal terminal. A list
-    // lets each URL reflow on its own line, and stays copy-pasteable.
-    if (functionUrlBySlug.size > 0) {
-        const heading = mode === "plan" ? "Function URLs (after apply)" : "Function URLs";
-        out.text(`\n${isCi() ? heading : chalk.bold(heading)}\n`);
-        for (const [slug, invocationUrl] of functionUrlBySlug) {
-            out.text(`  • ${slug}: ${invocationUrl}\n`);
-        }
-    }
-    if (noChanges) {
-        log.info(`No changes — branch ${result.branchName} already matches the policy.`);
-    }
-    out.text(`\nUtilized services: ${services.join(", ")}\n`);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end({
+			...result,
+			services
+		}, { fields: [] });
+		return;
+	}
+	const appliedChanges = result.applied.filter((change) => change.action !== "noop");
+	const functionUrlBySlug = /* @__PURE__ */ new Map();
+	for (const change of appliedChanges) {
+		const slug = change.details?.slug;
+		const invocationUrl = change.details?.invocationUrl;
+		if (typeof slug === "string" && typeof invocationUrl === "string") functionUrlBySlug.set(slug, invocationUrl);
+	}
+	const color = props.color !== false;
+	const out = writer(props);
+	const noChanges = appliedChanges.length === 0;
+	const appliedText = renderAppliedChanges(appliedChanges, mode === "plan" ? "Planned changes" : "Applied changes", { color });
+	if (appliedText) out.text(`${appliedText}\n`);
+	if (functionUrlBySlug.size > 0) {
+		const heading = mode === "plan" ? "Function URLs (after apply)" : "Function URLs";
+		out.text(`\n${isCi() ? heading : chalk.bold(heading)}\n`);
+		for (const [slug, invocationUrl] of functionUrlBySlug) out.text(`  • ${slug}: ${invocationUrl}\n`);
+	}
+	if (noChanges) log.info(`No changes — branch ${result.branchName} already matches the policy.`);
+	out.text(`\nUtilized services: ${services.join(", ")}\n`);
 };
 /**
- * Render the branch-setting {@link ConflictReport}s a bare `apply` refused to override (drift
- * without `--update-existing`) as the git-style before→after diff. JSON/YAML output emits the
- * structured conflicts so it can be piped; the human path prints the sorted diff followed by
- * any conflict whose fix is *not* `--update-existing` (e.g. an immutable "no endpoint" case),
- * so nothing the library's error message carried is lost.
- */
+* Render the branch-setting {@link ConflictReport}s a bare `apply` refused to override (drift
+* without `--update-existing`) as the git-style before→after diff. JSON/YAML output emits the
+* structured conflicts so it can be piped; the human path prints the sorted diff followed by
+* any conflict whose fix is *not* `--update-existing` (e.g. an immutable "no endpoint" case),
+* so nothing the library's error message carried is lost.
+*/
 const reportConflicts = (props, conflicts) => {
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end({ conflicts }, { fields: [] });
-        return;
-    }
-    const out = writer(props);
-    const text = renderBranchSettingConflicts([...conflicts], {
-        color: props.color !== false,
-    });
-    if (text)
-        out.text(`${text}\n`);
-    for (const conflict of conflicts) {
-        if (!/updateExisting/i.test(conflict.reason)) {
-            out.text(`  ! ${conflict.field}: ${conflict.reason}\n`);
-        }
-    }
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end({ conflicts }, { fields: [] });
+		return;
+	}
+	const out = writer(props);
+	const text = renderBranchSettingConflicts([...conflicts], { color: props.color !== false });
+	if (text) out.text(`${text}\n`);
+	for (const conflict of conflicts) if (!/updateExisting/i.test(conflict.reason)) out.text(`  ! ${conflict.field}: ${conflict.reason}\n`);
 };
 /**
- * Block provisioning the AI Gateway on a Free plan from the `checkout` policy paths, which
- * carry raw credentials (`apiKey`/`apiHost`) rather than the CLI's api client. Builds a client
- * from them and defers to {@link assertAiGatewayProvisionable}. Skipped when a `runtimeApi` is
- * injected (tests) or no `apiKey` is available; the interactive commands always have a key.
- */
+* Block provisioning the AI Gateway on a Free plan from the `checkout` policy paths, which
+* carry raw credentials (`apiKey`/`apiHost`) rather than the CLI's api client. Builds a client
+* from them and defers to {@link assertAiGatewayProvisionable}. Skipped when a `runtimeApi` is
+* injected (tests) or no `apiKey` is available; the interactive commands always have a key.
+*/
 const assertAiGatewayProvisionableFromCreds = async (props) => {
-    if (props.runtimeApi || !props.apiKey)
-        return;
-    if (!utilizedServices(props.config).includes("AI Gateway"))
-        return;
-    const apiClient = getApiClient({
-        apiKey: props.apiKey,
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-    });
-    await assertAiGatewayProvisionable({
-        apiClient,
-        projectId: props.projectId,
-    });
+	if (props.runtimeApi || !props.apiKey) return;
+	if (!utilizedServices(props.config).includes("AI Gateway")) return;
+	const apiClient = getApiClient({
+		apiKey: props.apiKey,
+		...props.apiHost ? { apiHost: props.apiHost } : {}
+	});
+	await assertAiGatewayProvisionable({
+		apiClient,
+		projectId: props.projectId
+	});
 };
 /**
- * Apply a `neon.ts` policy to a **freshly created** branch (used by `neonctl checkout`
- * when it creates a branch). No-op when there is no `neon.ts` on the path from cwd up to
- * the repo root — checkout still succeeds, it just has no policy to apply.
- *
- * The branch was just created by us, so we apply non-interactively (`updateExisting` /
- * `allowProtectedBranch`) — there is no pre-existing state a user would be surprised to
- * see overridden. Functions are bundled with neonctl's own esbuild helper.
- */
-export const applyPolicyOnCreate = async (props) => {
-    let config;
-    try {
-        ({ config } = await loadConfigFromFile({
-            ...(props.cwd ? { cwd: props.cwd } : {}),
-        }));
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (/Could not find a Neon config file/i.test(message))
-            return;
-        throw err;
-    }
-    await assertAiGatewayProvisionableFromCreds({
-        projectId: props.projectId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
-        config,
-    });
-    log.info("Applying neon.ts policy to the new branch…");
-    const result = await apply(config, {
-        projectId: props.projectId,
-        branchId: props.branchId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
-        updateExisting: true,
-        allowProtectedBranch: true,
-        bundleFunction: neonctlBundler,
-    });
-    logPolicyResult(result, { color: props.color !== false });
+* Apply a `neon.ts` policy to a **freshly created** branch (used by `neonctl checkout`
+* when it creates a branch). No-op when there is no `neon.ts` on the path from cwd up to
+* the repo root — checkout still succeeds, it just has no policy to apply.
+*
+* The branch was just created by us, so we apply non-interactively (`updateExisting` /
+* `allowProtectedBranch`) — there is no pre-existing state a user would be surprised to
+* see overridden. Functions are bundled with neonctl's own esbuild helper.
+*/
+const applyPolicyOnCreate = async (props) => {
+	let config;
+	try {
+		({config} = await loadConfigFromFile$1({ ...props.cwd ? { cwd: props.cwd } : {} }));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (/Could not find a Neon config file/i.test(message)) return;
+		throw err;
+	}
+	await assertAiGatewayProvisionableFromCreds({
+		projectId: props.projectId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {},
+		config
+	});
+	log.info("Applying neon.ts policy to the new branch…");
+	const result = await apply(config, {
+		projectId: props.projectId,
+		branchId: props.branchId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { api: props.runtimeApi } : {},
+		updateExisting: true,
+		allowProtectedBranch: true,
+		bundleFunction: neonctlBundler
+	});
+	logPolicyResult(result, { color: props.color !== false });
 };
 /**
- * Report what applying a `neon.ts` policy changed, using the same `field → value` diff
- * `deploy` prints (see {@link renderAppliedChanges}) rather than a bare list of change
- * identifiers — the identifier alone repeats the branch name once per change and never says
- * *what* was applied, which is the only interesting part on a freshly created branch.
- */
+* Report what applying a `neon.ts` policy changed, using the same `field → value` diff
+* `deploy` prints (see {@link renderAppliedChanges}) rather than a bare list of change
+* identifiers — the identifier alone repeats the branch name once per change and never says
+* *what* was applied, which is the only interesting part on a freshly created branch.
+*/
 const logPolicyResult = (result, opts) => {
-    const changes = result.applied.filter((c) => c.action !== "noop");
-    if (changes.length === 0) {
-        log.info("neon.ts applied — no changes were needed.");
-        return;
-    }
-    log.info("%s", renderAppliedChanges(changes, `neon.ts applied — ${changes.length} change${changes.length === 1 ? "" : "s"}:`, opts));
+	const changes = result.applied.filter((c) => c.action !== "noop");
+	if (changes.length === 0) {
+		log.info("neon.ts applied — no changes were needed.");
+		return;
+	}
+	log.info("%s", renderAppliedChanges(changes, `neon.ts applied — ${changes.length} change${changes.length === 1 ? "" : "s"}:`, opts));
 };
 /**
- * Create a branch **from** the local `neon.ts` policy. Returns `null` when there is no
- * `neon.ts` on the path from cwd up to the repo root, so `neonctl checkout` can fall back to a
- * bare branch create.
- *
- * Unlike a bare create followed by {@link applyPolicyOnCreate}, this evaluates the policy for
- * the **new** branch (`exists: false`): the runtime branches from the policy's `parent` and
- * brings the branch up with its declared TTL / compute settings / services. That's what makes
- * a policy keyed on `!branch.exists` (the common "only configure new branches" shape) take
- * effect on the very first `checkout` — a bare create + `apply` always saw `exists: true` and
- * skipped that block.
- *
- * A branch that was created but whose policy failed to apply is reported through
- * `policyFailure` rather than thrown: the branch is real, so `checkout` still needs to pin it
- * (see the handler) instead of leaving it stranded behind an unchanged `.neon`.
- */
-export const createBranchFromPolicyOnCheckout = async (props) => {
-    let config;
-    try {
-        ({ config } = await loadConfigFromFile({
-            ...(props.cwd ? { cwd: props.cwd } : {}),
-        }));
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (/Could not find a Neon config file/i.test(message))
-            return null;
-        throw err;
-    }
-    await assertAiGatewayProvisionableFromCreds({
-        projectId: props.projectId,
-        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-        ...(props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}),
-        config,
-    });
-    try {
-        const { branchId, branchName, result } = await createBranchFromPolicy(config, {
-            projectId: props.projectId,
-            branchName: props.branchName,
-            ...(props.apiKey ? { apiKey: props.apiKey } : {}),
-            ...(props.apiHost ? { apiHost: props.apiHost } : {}),
-            ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
-            bundleFunction: neonctlBundler,
-        });
-        log.info("Created branch %s (%s) from neon.ts policy.", branchName, branchId);
-        logPolicyResult(result, { color: props.color !== false });
-        return { branchId };
-    }
-    catch (err) {
-        // The branch exists but its policy didn't fully apply. Hand the id back so checkout
-        // pins it and reports the failure with the remediation, rather than aborting with an
-        // unpinned context and a branch the next `checkout` would silently accept as-is.
-        if (isPartialBranchCreateError(err)) {
-            log.info("Created branch %s (%s) from neon.ts policy.", err.branchName, err.branchId);
-            return { branchId: err.branchId, policyFailure: err.reason };
-        }
-        throw err;
-    }
+* Create a branch **from** the local `neon.ts` policy. Returns `null` when there is no
+* `neon.ts` on the path from cwd up to the repo root, so `neonctl checkout` can fall back to a
+* bare branch create.
+*
+* Unlike a bare create followed by {@link applyPolicyOnCreate}, this evaluates the policy for
+* the **new** branch (`exists: false`): the runtime branches from the policy's `parent` and
+* brings the branch up with its declared TTL / compute settings / services. That's what makes
+* a policy keyed on `!branch.exists` (the common "only configure new branches" shape) take
+* effect on the very first `checkout` — a bare create + `apply` always saw `exists: true` and
+* skipped that block.
+*
+* A branch that was created but whose policy failed to apply is reported through
+* `policyFailure` rather than thrown: the branch is real, so `checkout` still needs to pin it
+* (see the handler) instead of leaving it stranded behind an unchanged `.neon`.
+*/
+const createBranchFromPolicyOnCheckout = async (props) => {
+	let config;
+	try {
+		({config} = await loadConfigFromFile$1({ ...props.cwd ? { cwd: props.cwd } : {} }));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (/Could not find a Neon config file/i.test(message)) return null;
+		throw err;
+	}
+	await assertAiGatewayProvisionableFromCreds({
+		projectId: props.projectId,
+		...props.apiKey ? { apiKey: props.apiKey } : {},
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {},
+		config
+	});
+	try {
+		const { branchId, branchName, result } = await createBranch(config, {
+			projectId: props.projectId,
+			branchName: props.branchName,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { api: props.runtimeApi } : {},
+			bundleFunction: neonctlBundler
+		});
+		log.info("Created branch %s (%s) from neon.ts policy.", branchName, branchId);
+		logPolicyResult(result, { color: props.color !== false });
+		return { branchId };
+	} catch (err) {
+		if (isPartialBranchCreateError(err)) {
+			log.info("Created branch %s (%s) from neon.ts policy.", err.branchName, err.branchId);
+			return {
+				branchId: err.branchId,
+				policyFailure: err.reason
+			};
+		}
+		throw err;
+	}
 };
+//#endregion
+export { applyCmd, applyFlags, applyPolicyOnCreate, builder, command, config_exports, createBranchFromPolicyOnCheckout, describe, envFlag, envPullFlag, handler, hasNeonConfigFile, initCmd, planCmd, status };