neon 3.1.0 → 3.2.0

package/dist/{_virtual/_rolldown/runtime.js → _chunks/rolldown-runtime-D7D4PA-g.js}

@@ -10,4 +10,4 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
-export { __exportAll };
+export { __exportAll as t };

package/dist/{_shared/secure_file.js → _chunks/secure_file-BucZj4yQ.js}

@@ -1,8 +1,6 @@
 import { renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-//#region src/_shared/secure_file.ts
-/** Owner read/write. A credential needs those two and nothing else. */
-const SECRET_FILE_MODE = 384;
+//#region ../../internals/cli-core/dist/secure_file.js
 /**
 * Write a secret to disk owner-only, by creating a temporary file in the same directory and
 * renaming it over the target.
@@ -38,4 +36,4 @@ const writeSecretFile = (path, contents) => {
 	}
 };
 //#endregion
-export { SECRET_FILE_MODE, writeSecretFile };
+export { writeSecretFile as t };

package/dist/analytics.js

@@ -1,9 +1,9 @@
-import { OAUTH, inspectCredentials } from "./_shared/credentials.js";
+import { n as OAUTH, o as inspectCredentials } from "./_chunks/credentials-MYdHdKah.js";
 import { getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { credentialsPath } from "./_shared/paths.js";
+import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 import { getAuthContext } from "./auth_context.js";
 import { isCurrentBranchProbe } from "./context.js";

package/dist/auth_context.js

@@ -1,4 +1,4 @@
-import { isOwnedCredentialPath } from "./_shared/paths.js";
+import { a as isOwnedCredentialPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 //#region src/auth_context.ts
 let current = null;

package/dist/commands/api.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { getEndpoints, loadSpec } from "../utils/openapi.js";
 import { writer } from "../writer.js";
 import { readFileSync } from "node:fs";
@@ -245,4 +245,4 @@ const handler = async (args) => {
 	await runRequest(apiArgs);
 };
 //#endregion
-export { api_exports, buildBody, buildQuery, builder, command, describe, handler, parseHeaders, parseKeyValue, parseTypedValue, setDeep };
+export { buildBody, buildQuery, builder, command, describe, handler, parseHeaders, parseKeyValue, parseTypedValue, setDeep, api_exports as t };

package/dist/commands/api_keys.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
@@ -283,4 +283,4 @@ const orgIdForProject = async (client, projectId) => {
 	return orgId;
 };
 //#endregion
-export { aliases, api_keys_exports, builder, command, describe, handler, orgIdForProject };
+export { aliases, builder, command, describe, handler, orgIdForProject, api_keys_exports as t };

package/dist/commands/auth.js

@@ -1,16 +1,16 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
-import { API_KEY, OAUTH, interpretCredentials, readCredentials, writeCredentials } from "../_shared/credentials.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { d as writeCredentials, l as readCredentials, n as OAUTH, s as interpretCredentials, t as API_KEY } from "../_chunks/credentials-MYdHdKah.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
-import { credentialsPath } from "../_shared/paths.js";
+import { n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
 import "../config.js";
 import { setAuthContext } from "../auth_context.js";
 import { isConfigInit, isCurrentBranchProbe, isProfileCommand } from "../context.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
-import { DEFAULT_PROFILE, assertProfilesUsable, assertValidProfileName, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile } from "../_shared/profiles.js";
-import { credentialInputs, displacedProfileWarning, selectCredential } from "../_shared/auth_selection.js";
+import { a as newProfileCredentialsPath, c as readProfiles, d as upsertProfile, l as resolveProfile, n as assertProfilesUsable, r as assertValidProfileName, t as DEFAULT_PROFILE, u as selectProfileName } from "../_chunks/profiles-Ir29rqns.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
 import { existsSync, rmSync } from "node:fs";
 import { createHash } from "node:crypto";
 //#region src/commands/auth.ts
@@ -174,6 +174,7 @@ const ensureAuth = async (props) => {
 	if (isCurrentBranchProbe(props)) return;
 	if (isConfigInit(props)) return;
 	if (isProfileCommand(props)) return;
+	if (props._[0] === "open") return;
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
 	const isInit = props._[0] === "init";
@@ -298,4 +299,4 @@ const deleteCredentialsAt = (credentialsPath) => {
 };
 const md5hash = (s) => createHash("md5").update(s).digest("hex");
 //#endregion
-export { aliases, authFlow, auth_exports, builder, command, credentialsPathForName, deleteCredentialsAt, describe, ensureAuth, handler, usableCredential };
+export { aliases, authFlow, builder, command, credentialsPathForName, deleteCredentialsAt, describe, ensureAuth, handler, auth_exports as t, usableCredential };

package/dist/commands/bootstrap.js

@@ -1,8 +1,8 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { credentialInputs } from "../_shared/auth_selection.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
 import { BootstrapInputError, FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
 import { DO_NOT_SUBSTITUTE_HINT, formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";
@@ -427,4 +427,4 @@ const onPromptState = (state) => {
 	}
 };
 //#endregion
-export { bootstrap_exports, builder, command, describe, handler };
+export { builder, command, describe, handler, bootstrap_exports as t };

package/dist/commands/branches.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
 import { contextBranch, readContextFile } from "../context.js";
@@ -334,4 +334,4 @@ const setExpiration = async (props) => {
 	writer(props).end(data.branch, { fields: BRANCH_FIELDS });
 };
 //#endregion
-export { BRANCH_FIELDS, aliases, branches_exports, builder, command, describe, handler };
+export { BRANCH_FIELDS, aliases, builder, command, describe, handler, branches_exports as t };

package/dist/commands/bucket.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
@@ -406,4 +406,4 @@ const deleteObject = async (props) => {
 	log.info(`Object "${rest}" deleted from bucket "${bucket}" on branch ${branchId}`);
 };
 //#endregion
-export { aliases, bucket_exports, builder, command, describe, handler, resolveListDelimiter, splitBucketTarget };
+export { aliases, builder, command, describe, handler, resolveListDelimiter, splitBucketTarget, bucket_exports as t };

package/dist/commands/checkout.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
@@ -234,4 +234,4 @@ const tryAutoDetectProject = async (props) => {
 	}
 };
 //#endregion
-export { builder, checkout_exports, command, describe, handler };
+export { builder, command, describe, handler, checkout_exports as t };

package/dist/commands/config.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
@@ -638,4 +638,4 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 	}
 };
 //#endregion
-export { applyCmd, applyFlags, applyPolicyOnCreate, builder, command, config_exports, createBranchFromPolicyOnCheckout, describe, envFlag, envPullFlag, handler, hasNeonConfigFile, initCmd, planCmd, status };
+export { applyCmd, applyFlags, applyPolicyOnCreate, builder, command, createBranchFromPolicyOnCheckout, describe, envFlag, envPullFlag, handler, hasNeonConfigFile, initCmd, planCmd, status, config_exports as t };

package/dist/commands/connection_string.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
@@ -141,4 +141,4 @@ const handler = async (props) => {
 	else process.stdout.write(connectionString.toString() + "\n");
 };
 //#endregion
-export { SSL_MODES, aliases, builder, command, connection_string_exports, describe, handler };
+export { SSL_MODES, aliases, builder, command, describe, handler, connection_string_exports as t };

package/dist/commands/data_api.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -260,4 +260,4 @@ const deleteDataApi = async (props) => {
 	log.info(`Data API deleted for ${database} on branch ${branchId}`);
 };
 //#endregion
-export { builder, command, data_api_exports, describe, handler };
+export { builder, command, describe, handler, data_api_exports as t };

package/dist/commands/databases.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
@@ -70,4 +70,4 @@ const deleteDb = async (props) => {
 	if (data) writer(props).end(data.database, { fields: DATABASE_FIELDS });
 };
 //#endregion
-export { DATABASE_FIELDS, aliases, builder, command, create, databases_exports, deleteDb, describe, handler, list };
+export { DATABASE_FIELDS, aliases, builder, command, create, deleteDb, describe, handler, list, databases_exports as t };

package/dist/commands/deploy.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { applyCmd, applyFlags, envFlag, envPullFlag } from "./config.js";
 //#region src/commands/deploy.ts
@@ -29,4 +29,4 @@ const builder = (argv) => argv.usage("$0 deploy [options]").options({
 }).middleware(fillSingleProject).strict();
 const handler = (props) => applyCmd(props);
 //#endregion
-export { builder, command, deploy_exports, describe, handler };
+export { builder, command, describe, handler, deploy_exports as t };

package/dist/commands/dev.js

@@ -1,10 +1,10 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { resolveDevEnv } from "../dev/env.js";
+import { i as resolveDevEnv } from "../_chunks/env-NbA61JR3.js";
 import { resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
@@ -715,4 +715,4 @@ const resolveRuntimePath = () => {
 	return candidate;
 };
 //#endregion
-export { builder, command, describe, devBundleDir, devEnvContext, dev_exports, diffUnits, formatEnvSummary, handler, reportDevCredential };
+export { builder, command, describe, devBundleDir, devEnvContext, diffUnits, formatEnvSummary, handler, reportDevCredential, dev_exports as t };

package/dist/commands/diff.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
@@ -175,4 +175,4 @@ const writeStructured = (props, diffs) => {
 	] });
 };
 //#endregion
-export { builder, command, describe, diff_exports, handler };
+export { builder, command, describe, handler, diff_exports as t };

package/dist/commands/env.js

@@ -1,15 +1,14 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { ensureGitignored } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { NEON_ENV_VAR_KEYS } from "../_shared/env-core/env.js";
-import { ENV_PULL_SERVICES, ENV_PULL_UNAVAILABLE, envServiceKeys, ownedEnvServiceKeys } from "../env_services.js";
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_UNAVAILABLE, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_SERVICES } from "../_chunks/env_services-Tz9G4JeT.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { resolveNeonEnvVars } from "../dev/env.js";
+import { a as resolveNeonEnvVars } from "../_chunks/env-NbA61JR3.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -49,12 +48,18 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 		key: "service",
 		allowed: ENV_PULL_SERVICES,
 		describe: "Pull only these services' variables",
-		also: "Overrides neon.ts, and prunes only within the services you name."
-	})
+		also: "Overrides neon.ts, and prunes only within the services you name. Combines with --env as a union."
+	}),
+	env: {
+		alias: "e",
+		describe: `Pull only these individual variables: ${ENV_PULL_KEYS.join(", ")}. Repeat the flag or comma-separate. Overrides neon.ts. Combines with --service as a union; it never narrows a service bundle.`,
+		type: "array",
+		string: true
+	}
 }).epilogue([
 	"",
 	"What gets pulled, in precedence order:",
-	"  1. --service, when given — exactly those, ignoring neon.ts.",
+	"  1. --service / --env, when given — their union, ignoring neon.ts.",
 	"  2. neon.ts, when this directory has one.",
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
 	"     which mints a branch credential for it.",
@@ -62,19 +67,23 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"The pull bundled into link / checkout / config apply follows 2 and 3",
 	"without the AI Gateway, so it never mints a credential you did not ask",
 	"for. Run `env pull` to add it."
-].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables"), async (args) => {
-	const raw = servicesFlagValue(args.service);
+].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables").example("$0 env pull -e DATABASE_URL", "Pull only the pooled Postgres connection string").example("$0 env pull -s auth -e DATABASE_URL", "Pull all Auth variables plus DATABASE_URL").strict(), async (args) => {
+	const rawServices = servicesFlagValue(args.service);
+	const rawEnvKeys = envPullFlagValue(args.env);
+	const services = rawServices ? parseServices(rawServices, {
+		allowed: ENV_PULL_SERVICES,
+		whyUnavailable: ENV_PULL_UNAVAILABLE,
+		flag: "--service",
+		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
+	}) : void 0;
+	const envKeys = rawEnvKeys ? parseEnvPullKeys(rawEnvKeys, "--env") : void 0;
 	await pull({
 		...args,
-		...raw ? { services: parseServices(raw, {
-			allowed: ENV_PULL_SERVICES,
-			whyUnavailable: ENV_PULL_UNAVAILABLE,
-			flag: "--service",
-			onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
-		}) } : {}
+		...services ? { services } : {},
+		...envKeys ? { envKeys } : {}
 	}, {
 		announce: true,
-		implyAiGateway: raw === void 0
+		implyAiGateway: rawServices === void 0 && rawEnvKeys === void 0
 	});
 }).demandCommand(1);
 const handler = (args) => args;
@@ -101,6 +110,7 @@ const NEON_OWNED_ENV_KEYS = [
 ];
 const pull = async (props, opts = {}) => {
 	const cwd = props.cwd ?? process.cwd();
+	const selectedKeys = props.services !== void 0 || props.envKeys !== void 0 ? envKeysForSelection(props.services ?? [], props.envKeys ?? []) : void 0;
 	const branch = await resolveBranchRef(props);
 	if (opts.announce) announceTargetBranch(props, branch, "Pulling env from branch");
 	const branchId = branch.branchId;
@@ -116,23 +126,24 @@ const pull = async (props, opts = {}) => {
 			...existingEnv
 		},
 		...props.services ? { services: props.services } : {},
+		...props.envKeys ? { envKeys: props.envKeys } : {},
 		...opts.implyAiGateway ? { implyAiGateway: true } : {},
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.runtimeApi ? { api: props.runtimeApi } : {}
 	});
-	const neonVars = pickServiceVars(pickNeonVars(vars), props.services);
+	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys);
 	if (Object.keys(neonVars).length === 0) {
 		log.info("No Neon env variables to pull for this branch (no DATABASE_URL or enabled Auth / Data API).");
 		return { status: "empty" };
 	}
-	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(props.services, unreachedButCurrent(skipped, existingEnv, branchId)) });
+	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId)) });
 	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
 	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
 	if (credential?.issued) {
 		log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
 		if (credential.revoked.length > 0) log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
-		else if (credential.superseded.length > 0) log.info("Left the credential it replaced live (%s): a pull scoped with --service can't tell which other services still use it. Revoke it in the Neon Console if nothing does.", credential.superseded.join(", "));
+		else if (credential.superseded.length > 0) log.info("Left the credential it replaced live (%s): an explicitly scoped pull can't tell which other variables still use it. Revoke it in the Neon Console if nothing does.", credential.superseded.join(", "));
 	}
 	if (!fileExisted) ensureGitignored(targetPath);
 	const gatewayBaseUrl = neonVars.NEON_AI_GATEWAY_BASE_URL;
@@ -157,13 +168,13 @@ const pull = async (props, opts = {}) => {
 /**
 * The keys this pull is allowed to prune, i.e. the ones it is authoritative for.
 *
-* A `--service` selection narrows that to the services it named: `env pull -s ai-gateway`
-* says nothing about `DATABASE_URL`, so it must not read that variable's absence from this
-* pull as "the branch no longer has it". `unreached` is subtracted for the same reason — see
+* An explicit selection narrows that to the service bundles and individual keys it named:
+* `env pull -s ai-gateway` and `env pull -e NEON_AI_GATEWAY_TOKEN` both say nothing about
+* `DATABASE_URL`. `unreached` is subtracted for the same reason — see
 * {@link unreachedButCurrent}.
 */
-const managedKeysFor = (services, unreached) => {
-	const owned = services ? ownedEnvServiceKeys(services) : [...NEON_OWNED_ENV_KEYS];
+const managedKeysFor = (selectedKeys, unreached) => {
+	const owned = selectedKeys ? NEON_OWNED_ENV_KEYS.filter((key) => selectedKeys.includes(key)) : [...NEON_OWNED_ENV_KEYS];
 	if (unreached.length === 0) return owned;
 	const keep = new Set(ownedEnvServiceKeys(unreached));
 	return owned.filter((key) => !keep.has(key));
@@ -202,14 +213,13 @@ const unreachedButCurrent = (skipped, existingEnv, branchId) => {
 */
 const isBranchGatewayUrl = (baseUrl, branchId) => URL.canParse(baseUrl) && new URL(baseUrl).hostname.startsWith(`${branchId}-api.ai.`);
 /**
-* Narrow the resolved vars to the selected services (plus `NEON_BRANCH`, which every pull
-* refreshes). Needed because the two `DATABASE_URL*` vars are always resolved — `fetchEnv`
-* reads both connection URIs regardless, since the AI Gateway host is derived from the direct
-* one — so `--service ai-gateway` has to drop them here rather than avoid fetching them.
+* Narrow the resolved vars to the explicit service/key union. `fetchEnv` may resolve
+* supporting values that were not selected (the direct connection URI derives the AI Gateway
+* host, for example); those must not land in the target file.
 */
-const pickServiceVars = (vars, services) => {
-	if (!services) return vars;
-	const wanted = envServiceKeys(services);
+const pickSelectedVars = (vars, selectedKeys) => {
+	if (!selectedKeys) return vars;
+	const wanted = new Set(selectedKeys);
 	return Object.fromEntries(Object.entries(vars).filter(([key]) => wanted.has(key)));
 };
 /**
@@ -268,4 +278,4 @@ const pickNeonVars = (vars) => {
 	return out;
 };
 //#endregion
-export { ENV_PULL_SKIPPED_HINT, autoPullEnvAfterPin, builder, command, describe, env_exports, handler, pull, renderAgentPullNote };
+export { ENV_PULL_SKIPPED_HINT, autoPullEnvAfterPin, builder, command, describe, handler, pull, renderAgentPullNote, env_exports as t };

package/dist/commands/functions.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -305,4 +305,4 @@ const list = async (props) => {
 	});
 };
 //#endregion
-export { aliases, builder, command, describe, functions_exports, handler };
+export { aliases, builder, command, describe, handler, functions_exports as t };

package/dist/commands/index.js

@@ -1,36 +1,37 @@
-import { auth_exports } from "./auth.js";
-import { api_exports } from "./api.js";
-import { api_keys_exports } from "./api_keys.js";
-import { bootstrap_exports } from "./bootstrap.js";
-import { branches_exports } from "./branches.js";
-import { bucket_exports } from "./bucket.js";
-import { env_exports } from "./env.js";
-import { config_exports } from "./config.js";
-import { projects_exports } from "./projects.js";
-import { link_exports } from "./link.js";
-import { checkout_exports } from "./checkout.js";
-import { connection_string_exports } from "./connection_string.js";
-import { data_api_exports } from "./data_api.js";
-import { databases_exports } from "./databases.js";
-import { deploy_exports } from "./deploy.js";
-import { dev_exports } from "./dev.js";
-import { diff_exports } from "./diff.js";
-import { functions_exports } from "./functions.js";
-import { init_exports } from "./init.js";
-import { inspect_exports } from "./inspect.js";
-import { ip_allow_exports } from "./ip_allow.js";
-import { logs_exports } from "./logs.js";
-import { neon_auth_exports } from "./neon_auth.js";
-import { operations_exports } from "./operations.js";
-import { orgs_exports } from "./orgs.js";
-import { profile_exports } from "./profile.js";
-import { psql_exports } from "./psql.js";
-import { roles_exports } from "./roles.js";
-import { set_context_exports } from "./set_context.js";
-import { snapshots_exports } from "./snapshots.js";
-import { status_exports } from "./status.js";
-import { user_exports } from "./user.js";
-import { vpc_endpoints_exports } from "./vpc_endpoints.js";
+import { t as auth_exports } from "./auth.js";
+import { t as api_exports } from "./api.js";
+import { t as api_keys_exports } from "./api_keys.js";
+import { t as bootstrap_exports } from "./bootstrap.js";
+import { t as branches_exports } from "./branches.js";
+import { t as bucket_exports } from "./bucket.js";
+import { t as env_exports } from "./env.js";
+import { t as config_exports } from "./config.js";
+import { t as projects_exports } from "./projects.js";
+import { t as link_exports } from "./link.js";
+import { t as checkout_exports } from "./checkout.js";
+import { t as connection_string_exports } from "./connection_string.js";
+import { t as data_api_exports } from "./data_api.js";
+import { t as databases_exports } from "./databases.js";
+import { t as deploy_exports } from "./deploy.js";
+import { t as dev_exports } from "./dev.js";
+import { t as diff_exports } from "./diff.js";
+import { t as functions_exports } from "./functions.js";
+import { t as init_exports } from "./init.js";
+import { t as inspect_exports } from "./inspect.js";
+import { t as ip_allow_exports } from "./ip_allow.js";
+import { t as logs_exports } from "./logs.js";
+import { t as neon_auth_exports } from "./neon_auth.js";
+import { t as open_exports } from "./open.js";
+import { t as operations_exports } from "./operations.js";
+import { t as orgs_exports } from "./orgs.js";
+import { t as profile_exports } from "./profile.js";
+import { t as psql_exports } from "./psql.js";
+import { t as roles_exports } from "./roles.js";
+import { t as set_context_exports } from "./set_context.js";
+import { t as snapshots_exports } from "./snapshots.js";
+import { t as status_exports } from "./status.js";
+import { t as user_exports } from "./user.js";
+import { t as vpc_endpoints_exports } from "./vpc_endpoints.js";
 //#region src/commands/index.ts
 var commands_default = [
 	auth_exports,
@@ -55,6 +56,7 @@ var commands_default = [
 	set_context_exports,
 	checkout_exports,
 	link_exports,
+	open_exports,
 	init_exports,
 	data_api_exports,
 	functions_exports,

package/dist/commands/init.js

@@ -1,6 +1,6 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { closeAnalytics, sendError } from "../analytics.js";
-import { credentialInputs } from "../_shared/auth_selection.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
 import { detectAgent } from "../init/detect_agent.js";
 import { enrichResponse } from "../init/enrich_output.js";
 import { interactiveInit } from "../init/interactive.js";
@@ -97,4 +97,4 @@ const handler = async (argv) => {
 	}
 };
 //#endregion
-export { builder, command, describe, handler, init_exports };
+export { builder, command, describe, handler, init_exports as t };

package/dist/commands/inspect.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { resolveConnectionUri, runInspectQuery } from "../utils/inspect_db.js";
@@ -62,4 +62,4 @@ const handler = (args) => {
 	return args;
 };
 //#endregion
-export { aliases, builder, command, describe, handler, inspect_exports };
+export { aliases, builder, command, describe, handler, inspect_exports as t };

package/dist/commands/ip_allow.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { writer } from "../writer.js";
@@ -103,4 +103,4 @@ const parse = (project) => {
 	};
 };
 //#endregion
-export { builder, command, describe, handler, ip_allow_exports };
+export { builder, command, describe, handler, ip_allow_exports as t };

package/dist/commands/link.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";
@@ -974,4 +974,4 @@ const mustString = (value, name) => {
 	return value;
 };
 //#endregion
-export { builder, command, describe, handler, link_exports };
+export { builder, command, describe, handler, link_exports as t };

package/dist/commands/logs.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
@@ -288,4 +288,4 @@ const fieldValues = async (props) => {
 	if (data.is_truncated) log.info(`More values exist than were returned for "${escapeLogSingleLine(props.field)}". Narrow the window with --since or --start-time, restrict --source, or raise --limit, then run it again.`);
 };
 //#endregion
-export { assertReachableLogsPage, buildLogsQueryBody, builder, command, describe, escapeLogSingleLine, escapeLogTableCell, handler, logs_exports };
+export { assertReachableLogsPage, buildLogsQueryBody, builder, command, describe, escapeLogSingleLine, escapeLogTableCell, handler, logs_exports as t };

package/dist/commands/neon_auth.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
@@ -817,4 +817,4 @@ const userSetRole = async (props) => {
 	printKvBlock("Roles updated", [["User ID: ", data.id], ["Roles:   ", props.roles.join(", ")]]);
 };
 //#endregion
-export { builder, command, describe, handler, neon_auth_exports };
+export { builder, command, describe, handler, neon_auth_exports as t };