neon 4.13.1 → 4.14.0

package/README.md

@@ -78,9 +78,36 @@ neon claim create --service auth --service data-api
 ```
 
 When the current directory has a `neon.ts`, `claim create` also requests every service
-declared there. Explicit `--service` values are added to that set. Object Storage, Functions,
-and the AI Gateway are sent to the service so demand is recorded, but are reported as
-unavailable until the project is claimed; the CLI does not silently remove them.
+declared there. Explicit `--service` values are added to that set. If that policy enables
+the Data API, identity includes a snake_case `data_api` object. A neon.ts with
+`dataApi: { authProvider: "external", jwksUrl: "https://idp.example.com/jwks.json" }`
+sends:
+
+```json
+{
+  "type": "anonymous",
+  "capabilities": ["postgres", "data_api"],
+  "source": "neon_cli",
+  "data_api": {
+    "auth_provider": "external",
+    "jwks_url": "https://idp.example.com/jwks.json"
+  }
+}
+```
+
+`neon claim create --service data-api` with no neon.ts Data API block omits `data_api`:
+
+```json
+{
+  "type": "anonymous",
+  "capabilities": ["postgres", "data_api"],
+  "source": "neon_cli"
+}
+```
+
+Object Storage, Functions, and the AI Gateway are sent to the service so demand is
+recorded, but are reported as unavailable until the project is claimed; the CLI does
+not silently remove them.
 
 The command writes:
 
@@ -467,8 +494,8 @@ The human-readable summary line goes to stderr and the diff body to stdout, so `
 **What gets pulled**, in precedence order:
 
 1. **`--service` and/or `--env`**, when you pass either — their union is the complete selection, ignoring `neon.ts` and unselected branch variables. `--service` adds a service's complete variable bundle; `--env` adds only the individual variables you name.
-2. **`neon.ts`**, when the working directory has one — the policy is the source of truth, same as `neon dev` and `neon deploy`.
-3. **Everything the branch has** otherwise — Postgres, Neon Auth, the Data API, and object storage read back from the branch, plus the AI Gateway. The gateway has no branch-level state to read back, so a bare `env pull` asks for it rather than detecting it and may mint a branch credential. To leave it out, name only what you do want with `--service` and/or `--env`.
+2. **`neon.ts`**, when the working directory has one — the policy is the source of truth, same as `neon dev` and `neon deploy`. Declared function URLs are derived from the branch connection host; the function does not have to be deployed.
+3. **Everything the branch has** otherwise — Postgres, Neon Auth, the Data API, object storage, and function invocation URLs read back from the branch, plus the AI Gateway. The gateway has no branch-level state to read back, so a bare `env pull` asks for it rather than detecting it and may mint a branch credential. To leave it out, name only what you do want with `--service` and/or `--env`.
 
 If the gateway can't be resolved, it is dropped with a warning and the rest of the pull still lands. Gateway variables already in your file for *this* branch are left alone — a pull that couldn't reach the gateway is no evidence the branch has stopped having one — while ones left over from a different branch are pruned like any other stale value.
 
@@ -492,6 +519,10 @@ neon env pull -e DATABASE_URL,NEON_AUTH_BASE_URL
 
 # The selectors compose as a union: all Auth vars plus DATABASE_URL
 neon env pull -s auth -e DATABASE_URL
+
+# Function invocation URLs
+neon env pull -s functions
+neon env pull -e NEON_FUNCTION_HELLO_BASE_URL
 ```
 
 Every services flag in the CLI takes those three spellings, the same value syntax, and the same service names — see [`config init --services`](#getting-a-neonts-config-init).
@@ -501,14 +532,15 @@ Every services flag in the CLI takes those three spellings, the same value synta
 | `postgres` | `DATABASE_URL`, `DATABASE_URL_UNPOOLED` |
 | `auth` | `NEON_AUTH_BASE_URL`, `NEON_AUTH_JWKS_URL` |
 | `data-api` | `NEON_DATA_API_URL` |
+| `functions` | `NEON_FUNCTION_<SLUG>_BASE_URL` for each deployed function |
 | `object-storage` | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`, `AWS_REGION` |
 | `ai-gateway` | `NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL` |
 
-`-e, --env` accepts any variable in the table plus `NEON_BRANCH`. It is case-sensitive and rejects unknown names rather than silently widening the pull. `NEON_BRANCH` is written by unscoped and service-scoped pulls because it is branch identity, not a service; an env-only pull writes it only when you select it.
+`-e, --env` accepts any variable in the table plus `NEON_BRANCH`, or `NEON_FUNCTION_<SLUG>_BASE_URL` where `<SLUG>` is the function slug uppercased. It is case-sensitive and rejects unknown names rather than silently widening the pull. `NEON_BRANCH` is written by unscoped and service-scoped pulls because it is branch identity, not a service; an env-only pull writes it only when you select it.
 
 `--env` never narrows `--service`: `neon env pull -s postgres -e DATABASE_URL` still pulls the complete Postgres bundle (`DATABASE_URL`, `DATABASE_URL_UNPOOLED`, and `NEON_BRANCH`). The two selectors always form a union.
 
-**A scoped pull is scoped in both directions.** An unscoped `env pull` owns the Neon-named variables: pointing a directory at a branch without Neon Auth prunes the stale `NEON_AUTH_*` lines. `--service` narrows that to the services you named, while `--env` narrows it to the exact keys you named, so `env pull -e DATABASE_URL` never touches `DATABASE_URL_UNPOOLED`. (`AWS_*` is never pruned by any pull: those names collide with credentials you may set yourself, so `env pull` only ever writes them.)
+**A scoped pull is scoped in both directions.** An unscoped `env pull` owns the Neon-named variables: pointing a directory at a branch without Neon Auth prunes the stale `NEON_AUTH_*` lines, and a branch without those functions prunes stale `NEON_FUNCTION_*_BASE_URL` lines. `--service` narrows that to the services you named, while `--env` narrows it to the exact keys you named, so `env pull -e DATABASE_URL` never touches `DATABASE_URL_UNPOOLED`. (`AWS_*` is never pruned by any pull: those names collide with credentials you may set yourself, so `env pull` only ever writes them.)
 
 **A scoped pull also never revokes a credential.** Where an unscoped pull revokes the credential it replaces, a scoped one leaves the old one live — it can't tell which other variables still use it. It says so when it happens; revoke it in the Neon Console if nothing does.
 
@@ -526,7 +558,7 @@ Console), or drop auth from --service.
 
 If you'd rather not keep env vars on disk, inject them at runtime instead with `neon-env run -- <your dev command>` (from `@neon/env`) or `neon dev`, and pass `--no-env-pull` to `link` / `checkout`.
 
-**`neon dev` resolves the same set, by the same rules** — including the AI Gateway on a branch with no `neon.ts`. A function running locally gets what the deployed runtime would inject into it, which is the whole point of `dev`; a handler that reads `NEON_AI_GATEWAY_BASE_URL` should not work in production and fail on your machine. `dev` writes nothing, but it does *read* your `.env` / `.env.local` to reuse the branch credential behind the AI Gateway and object storage. Without a file to read from it issues one on every start and leaves the last one live — it has nowhere to keep it, and so cannot name it to revoke it. It says so when it happens; run `env pull` (or just `link` / `checkout`) once and restarts reuse the credential instead.
+**`neon dev` resolves the same set, by the same rules** — including the AI Gateway on a branch with no `neon.ts`. A function running locally gets the same Postgres / Auth / Data API / storage / AI Gateway vars a deploy would inject. Each `NEON_FUNCTION_<SLUG>_BASE_URL` this process is serving is rewritten to `http://localhost:<port>`: every neon.ts function, or the matching slug when `--source` names one. `neon env pull` and `neon-env run` write the production URL (`https://<branchId>-<slug>.compute.…`). `dev` writes nothing, but it does *read* your `.env` / `.env.local` to reuse the branch credential behind the AI Gateway and object storage. Without a file to read from it issues one on every start and leaves the last one live — it has nowhere to keep it, and so cannot name it to revoke it. It says so when it happens; run `env pull` (or just `link` / `checkout`) once and restarts reuse the credential instead.
 
 **Where `.neon` lives**: `link` writes `.neon` into the **current working directory** by default. If an existing `.neon` is found in any parent directory, that file is reused — so commands run from a sub-directory of a linked project still pick up the project's context. To pin the location explicitly, pass `--context-file <path>`.
 
@@ -677,6 +709,16 @@ neon deploy --branch my-feature --update-existing
 
 Function deploys declared under `preview.functions` are bundled with esbuild by default. A directory `source` is discovered as `index.ts`, then `index.js`, then `index.mjs`. Set `bundler: "none"` to ship a prebuilt directory as-is. `neon function deploy --no-bundle` is the same switch without a `neon.ts`.
 
+Point a domain you already own at a function with `neon function domains` (alias `domain`):
+
+```bash
+neon function domains register docs.example.com --slug api
+neon function domains list
+neon function domains delete docs.example.com
+```
+
+Register prints the record, then an INFO line `CNAME <domain> to <cname_target>`. The domain goes live after that CNAME resolves and a certificate is issued on the first request.
+
 When a package cannot be bundled — a native addon with no esbuild loader, or an optional peer dependency a library references on an untaken code path — list it in that function's `externalPackages` and the bundler leaves the import alone. `neon dev` honours the same list. It does not make the package resolvable in the deployed archive (there is no `node_modules` next to the bundle), so it only unblocks an import that is never evaluated — a dependency the handler actually calls has to be bundled, and a natively-backed one cannot be. See [`@neon/config`](../config/README.md#unbundleable-dependencies-externalpackages).
 
 ## Scaffold a project (`bootstrap`)
@@ -1224,7 +1266,7 @@ Id   Name      Project         Created At            Last Used At          Last
 | [me](https://neon.com/docs/reference/cli-me)                               |                                                                                                              | Show current user                  |
 | [branches](https://neon.com/docs/reference/cli-branches)                   | `list`, `create`, `rename`, `add-compute`, `set-default`, `set-expiration`, `delete`, `get`                  | Manage branches                    |
 | [databases](https://neon.com/docs/reference/cli-databases)                 | `list`, `create`, `delete`                                                                                   | Manage databases                   |
-| function                                                                   | `deploy`, `list`, `get`, `delete`                                                                            | Manage Neon Functions              |
+| function                                                                   | `deploy`, `list`, `get`, `delete`, `domains list`, `domains register`, `domains delete`                      | Manage Neon Functions              |
 | [roles](https://neon.com/docs/reference/cli-roles)                         | `list`, `create`, `delete`                                                                                   | Manage roles                       |
 | [operations](https://neon.com/docs/reference/cli-operations)               | `list`                                                                                                       | Manage operations                  |
 | logs                                                                       | `query`, `fields`, `field-values`                                                                            | Query branch logs (Beta)           |

package/dist/_chunks/{credential_io-YeAxg9Xn.js → credential_io-D8AR-jvB.js}

@@ -236,7 +236,7 @@ const createCredentialStore = (dir, options = {}) => {
 	const assertKeyringWritable = (profile) => {
 		if (keyring === null) throw new KeyringUnavailableError(profile, "write");
 	};
-	const setKeyringOrRollback = (profile, credentials) => {
+	const setKeyringOrRollback = (profile, credentials, restorePrevious) => {
 		assertKeyringWritable(profile);
 		const kr = keyring;
 		if (kr === null) throw new KeyringUnavailableError(profile, "write");
@@ -256,7 +256,7 @@ const createCredentialStore = (dir, options = {}) => {
 		try {
 			if (kr.get("com.neon.neon-cli", account) === null) throw new Error(`Wrote credentials to the OS keyring for ${label} but could not read them back.`);
 		} catch (err) {
-			if (previous !== null) {
+			if (restorePrevious && previous !== null) {
 				try {
 					kr.set(KEYRING_SERVICE, account, previous);
 				} catch {
@@ -372,9 +372,9 @@ const createCredentialStore = (dir, options = {}) => {
 			profile: at.profile
 		};
 	};
-	const write = (at, credentials) => {
+	const write = (at, credentials, options) => {
 		if (at.storage === "keyring") {
-			setKeyringOrRollback(at.profile, credentials);
+			setKeyringOrRollback(at.profile, credentials, options?.restorePrevious !== false);
 			return {
 				credentials,
 				backend: CRED_STORAGE_KEYRING,

package/dist/_chunks/{env-NbA61JR3.js → env-CZmstYrY.js}

@@ -1,9 +1,9 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { _ as policyEnvKeys, a as envKeysForSelection, b as toEntries, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as fetchEnvKeys, h as credentialName, m as credentialEnvKeys, p as createApiFromOptions, r as ENV_PULL_SERVICES, u as serviceForEnvKey, v as previewCredentialScopes, y as resolveBranchPolicy } from "./env_services-Tz9G4JeT.js";
+import { S as toEntries, _ as functionBaseUrlKey, a as envKeysForSelection, b as previewCredentialScopes, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as fetchEnvKeysState, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as isFunctionBaseUrlKey, x as resolveBranchPolicy, y as policyEnvKeys } from "./env_services-CAWrZTWa.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { credentialScopesSatisfied } from "@neon/config/v1";
-import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError, loadConfigFromFile } from "@neon/config";
+import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError as isPlatformError$1, loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
 /**
@@ -45,7 +45,7 @@ async function fetchEnvReusingSecrets(config, options) {
 	const { branch, desired } = await resolveBranchPolicy(config, options, api);
 	const allPolicyKeys = policyEnvKeys(desired);
 	const requested = requestedKeys ? new Set(requestedKeys) : null;
-	const selectedPolicyKeys = requested === null ? allPolicyKeys : allPolicyKeys.filter((key) => requested.has(key));
+	const selectedPolicyKeys = requested === null ? allPolicyKeys : [...allPolicyKeys.filter((key) => requested.has(key)), ...[...requested].filter(isFunctionBaseUrlKey).sort()];
 	const selected = new Set(selectedPolicyKeys);
 	const K = NEON_ENV_VAR_KEYS;
 	const storageCredentialSelected = (desired.preview?.buckets.length ?? 0) > 0 && (selected.has(K.storage.accessKeyId) || selected.has(K.storage.secretAccessKey));
@@ -55,15 +55,16 @@ async function fetchEnvReusingSecrets(config, options) {
 		aiGateway: gatewayCredentialSelected
 	}).filter((key) => selected.has(key));
 	if (secretKeys.length === 0) {
-		const fetched = await fetchEnvKeys(config, fetchOptions, requested === null ? null : selectedPolicyKeys);
+		const fetched = await fetchEnvKeysState(config, fetchOptions, requested === null ? null : selectedPolicyKeys);
 		return {
-			vars: preferPersisted(toEntries(fetched), source),
+			vars: preferPersisted(toEntries(fetched.env), source),
 			credential: {
 				issued: false,
 				keys: [],
 				revoked: [],
 				superseded: []
-			}
+			},
+			...fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {}
 		};
 	}
 	const persisted = readPersistedSecrets(source);
@@ -83,13 +84,15 @@ async function fetchEnvReusingSecrets(config, options) {
 		aiGateway: gatewayCredentialSelected
 	});
 	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-	const fetchKeys = keep ? selectedPolicyKeys.filter((key) => !secretKeys.includes(key)) : selectedPolicyKeys;
-	const fetched = await fetchEnvKeys(config, {
+	const fetchKeys = requested === null ? null : keep ? selectedPolicyKeys.filter((key) => !secretKeys.includes(key)) : selectedPolicyKeys;
+	const fetched = await fetchEnvKeysState(config, {
 		...fetchOptions,
 		branchId: branch.id,
-		api
+		api,
+		...keep && requested === null ? { omitKeys: secretKeys } : {}
 	}, fetchKeys);
-	const vars = preferPersisted(toEntries(fetched), source);
+	const vars = preferPersisted(toEntries(fetched.env), source);
+	const unavailable = fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {};
 	if (keep) {
 		for (const key of secretKeys) {
 			const value = source[key];
@@ -102,7 +105,8 @@ async function fetchEnvReusingSecrets(config, options) {
 				keys: secretKeys,
 				revoked: [],
 				superseded: []
-			}
+			},
+			...unavailable
 		};
 	}
 	const ours = /* @__PURE__ */ new Set();
@@ -115,7 +119,8 @@ async function fetchEnvReusingSecrets(config, options) {
 			keys: secretKeys,
 			revoked: revokeSuperseded ? [...ours] : [],
 			superseded: revokeSuperseded ? [] : [...ours]
-		}
+		},
+		...unavailable
 	};
 }
 /** Read the branch credential's secrets out of an env source. */
@@ -197,14 +202,7 @@ const apiOptions = (ctx) => ({
 	...ctx.apiHost ? { apiHost: ctx.apiHost } : {},
 	...ctx.api ? { api: ctx.api } : {}
 });
-/**
-* Thrown when a `neon.ts` policy declares a branch-level resource (Neon Auth,
-* Data API, a bucket, the AI Gateway) that the linked remote branch does not
-* have yet. Unlike every other failure in {@link resolveDevEnv} — which degrades
-* to "run without injection" — this is a hard stop: the user's intent (a policy)
-* cannot be honored, and silently dropping the secret would be more confusing
-* than refusing to start. The fix is to provision the resource first.
-*/
+/** Policy mismatches hard-stop because running without declared env vars violates user intent. */
 var DevEnvMismatchError = class extends Error {
 	constructor(..._args) {
 		super(..._args);
@@ -247,12 +245,17 @@ var ServiceNotOnBranchError = class extends Error {
 *   1. a `neon.ts` policy is found -> the policy is the source of truth. We first
 *      check it against the branch's live state (`plan`); if it declares a resource
 *      the branch is missing, we stop with a {@link DevEnvMismatchError} pointing at
-*      `neonctl deploy`. Otherwise `fetchEnv` evaluates the policy.
+*      `neonctl deploy`. Function declarations are excluded from that check: their
+*      invocation URLs are derived from the branch connection host, so an undeployed
+*      function still gets `NEON_FUNCTION_*_BASE_URL`. Otherwise `fetchEnv` evaluates
+*      the policy.
 *   2. no `neon.ts`, but a project + branch are known -> `pullConfig` reads the
 *      branch's live state (Auth / Data API enablement plus any object-storage
 *      buckets) into a config, then `fetchEnv` resolves what is actually enabled —
 *      so a branch with a bucket gets its `AWS_*` storage vars pulled with no policy.
-*      With {@link DevEnvContext.implyAiGateway}, the AI Gateway is added on top, since
+*      Function invocation URLs are listed live (`functionUrls: "all-live"`) because
+*      `pullConfig` cannot round-trip them into `preview.functions`. With
+*      {@link DevEnvContext.implyAiGateway}, the AI Gateway is added on top, since
 *      `pullConfig` cannot read it back.
 *   3. otherwise -> throw {@link MissingBranchContextError}.
 *
@@ -261,12 +264,11 @@ var ServiceNotOnBranchError = class extends Error {
 */
 const resolveNeonEnvVars = async (ctx) => {
 	if (ctx.services !== void 0 || ctx.envKeys !== void 0) return await resolveSelectedServices(ctx, ctx.services ?? [], ctx.envKeys ?? []);
-	const config = await loadNeonConfig(ctx.cwd);
+	const config = await loadNeonConfig(ctx);
 	if (config) {
 		if (!ctx.projectId || !ctx.branchId) throw new MissingBranchContextError(`Found a neon.ts but could not resolve the project/branch. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
-		const envConfig = withoutPreviewFunctions(config);
-		await assertPolicyMatchesBranch(envConfig, ctx);
-		return await fetchAndProject(envConfig, ctx);
+		await assertPolicyMatchesBranch(withoutPreviewFunctions(config), ctx);
+		return await fetchAndProject(config, ctx);
 	}
 	if (ctx.projectId && ctx.branchId) {
 		const pulled = await pullConfig({
@@ -274,7 +276,7 @@ const resolveNeonEnvVars = async (ctx) => {
 			branchId: ctx.branchId,
 			...apiOptions(ctx)
 		});
-		if (!ctx.implyAiGateway) return await fetchAndProject(pulled.config, ctx);
+		if (!ctx.implyAiGateway) return await fetchAndProject(pulled.config, ctx, { functionUrls: "all-live" });
 		return await resolveWithImpliedGateway(pulled.config, ctx, {
 			projectId: ctx.projectId,
 			branchId: ctx.branchId
@@ -313,11 +315,12 @@ const withAiGateway = (config) => ({
 */
 const resolveWithImpliedGateway = async (config, ctx, branch) => {
 	const unreachable = await credentialsUnreachable(ctx, branch);
-	if (unreachable === null) return await fetchAndProject(withAiGateway(config), ctx);
+	if (unreachable === null) return await fetchAndProject(withAiGateway(config), ctx, { functionUrls: "all-live" });
 	log.warning(`Could not reach the AI Gateway's credentials, so %s were not resolved. Everything else was. Either this project does not have the AI Gateway, or the call failed — \`${getCliName()} env pull -s ai-gateway\` will say which.\nDetails: %s`, [NEON_ENV_VAR_KEYS.aiGateway.apiKey, NEON_ENV_VAR_KEYS.aiGateway.baseUrl].join(" and "), unreachable);
+	const pulled = await fetchAndProject(config, ctx, { functionUrls: "all-live" });
 	return {
-		...await fetchAndProject(config, ctx),
-		skipped: ["ai-gateway"]
+		...pulled,
+		skipped: [...pulled.skipped ?? [], "ai-gateway"]
 	};
 };
 /**
@@ -354,12 +357,17 @@ const resolveSelectedServices = async (ctx, directServices, envKeys) => {
 	const api = apiFor(ctx);
 	const has = (service) => services.includes(service);
 	const checkAiGateway = has("ai-gateway") && !selectedKeys.includes(NEON_ENV_VAR_KEYS.aiGateway.apiKey);
-	const [auth, dataApiEnabled, buckets, aiGatewayAvailable] = await Promise.all([
+	const [auth, dataApiEnabled, buckets, aiGatewayAvailable, functions] = await Promise.all([
 		has("auth") ? api.getNeonAuth(projectId, branchId) : null,
 		has("data-api") ? readDataApiEnabled(api, projectId, branchId) : null,
 		has("object-storage") ? api.listBranchBuckets(projectId, branchId) : null,
-		checkAiGateway ? readAiGatewayAvailable(api, projectId, branchId) : null
+		checkAiGateway ? readAiGatewayAvailable(api, projectId, branchId) : null,
+		directServices.includes("functions") ? api.listBranchFunctions(projectId, branchId) : null
 	]);
+	const callableFunctions = (functions ?? []).filter((fn) => fn.invocationUrl !== "");
+	if (directServices.includes("functions") && callableFunctions.length === 0) throw new ServiceNotOnBranchError(`--service functions: branch ${branchId} has no deployed functions, so there are no NEON_FUNCTION_*_BASE_URL vars to pull. Deploy a function first (\`${getCliName()} deploy\`, or in the Neon Console), or drop functions from --service.`);
+	const functionKeys = directServices.includes("functions") ? callableFunctions.map((fn) => functionBaseUrlKey(fn.slug)).sort((left, right) => left.localeCompare(right)) : [];
+	const fetchKeys = [.../* @__PURE__ */ new Set([...selectedKeys, ...functionKeys])];
 	const config = configForServices(services, branchId, {
 		authEnabled: auth !== null,
 		dataApiEnabled,
@@ -370,8 +378,12 @@ const resolveSelectedServices = async (ctx, directServices, envKeys) => {
 		envKeys
 	});
 	return await fetchAndProject(config, ctx, {
-		keys: selectedKeys,
-		revokeSuperseded: false
+		keys: fetchKeys,
+		revokeSuperseded: false,
+		...directServices.includes("functions") ? {
+			functionUrls: "all-live",
+			listedFunctions: callableFunctions
+		} : {}
 	});
 };
 /**
@@ -395,7 +407,7 @@ const readAiGatewayAvailable = async (api, projectId, branchId) => {
 		await api.listCredentials(projectId, branchId);
 		return true;
 	} catch (error) {
-		if (isPlatformError(error) && error.code === ErrorCode$1.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
+		if (isPlatformError$1(error) && error.code === ErrorCode$1.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
 		throw error;
 	}
 };
@@ -483,15 +495,7 @@ const resolveDevEnv = async (ctx) => {
 		};
 	}
 };
-/**
-* Return the policy with its `preview.functions` removed, so the env path never enumerates
-* functions against the Neon API. Functions are local-source-bundled and produce no
-* branch-level secrets, so they are irrelevant to env resolution; probing them only risks
-* failing the whole resolve (undeployed function, or Functions Preview disabled on the
-* project). Buckets / AI Gateway and the top-level Auth / Data API toggles are preserved —
-* they DO carry env, so they must still be checked and resolved. Returns the config
-* unchanged when it declares no functions.
-*/
+/** Functions are omitted because `plan` treats undeployed functions as resources to create. */
 const withoutPreviewFunctions = (config) => {
 	const preview = config.preview;
 	if (!preview?.functions) return config;
@@ -507,10 +511,6 @@ const withoutPreviewFunctions = (config) => {
 * it declares a branch-level resource the branch is missing. Built on `plan` so
 * it covers every present and future provisionable resource for free: any
 * `create` action is a resource `neonctl deploy` would provision.
-*
-* Called with functions already stripped (see {@link withoutPreviewFunctions}), so the
-* `plan` probe never enumerates the functions API — an undeployed function, or a project
-* without the Functions Preview, must never block local dev or sink env injection.
 */
 const assertPolicyMatchesBranch = async (config, ctx) => {
 	const missing = (await plan(config, {
@@ -528,14 +528,23 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
 * — and functions are excluded (see {@link assertPolicyMatchesBranch}).
 */
 const isMissingResource = (change) => change.kind === "service" && change.action === "create" && !change.identifier.startsWith("function:");
-const fetchAndProject = async (config, ctx, opts = {}) => fetchEnvReusingSecrets(config, {
-	projectId: ctx.projectId,
-	branch: ctx.branchId,
-	...apiOptions(ctx),
-	...ctx.env ? { env: ctx.env } : {},
-	...opts.keys ? { keys: opts.keys } : {},
-	...opts.revokeSuperseded === false ? { revokeSuperseded: false } : {}
-});
+const fetchAndProject = async (config, ctx, opts = {}) => {
+	const result = await fetchEnvReusingSecrets(config, {
+		projectId: ctx.projectId,
+		branch: ctx.branchId,
+		...apiOptions(ctx),
+		...ctx.env ? { env: ctx.env } : {},
+		...opts.keys ? { keys: opts.keys } : {},
+		...opts.revokeSuperseded === false ? { revokeSuperseded: false } : {},
+		...opts.functionUrls ? { functionUrls: opts.functionUrls } : {},
+		...opts.listedFunctions ? { listedFunctions: opts.listedFunctions } : {}
+	});
+	return {
+		vars: result.vars,
+		credential: result.credential,
+		...result.functionUrlsUnavailable ? { skipped: ["functions"] } : {}
+	};
+};
 /**
 * Load a `neon.ts` policy if one exists on the path from `cwd` up to the repo
 * root. Returns `null` when there is none (the common "no config" case), and
@@ -570,14 +579,17 @@ const looksLikeMissingDependency = (err) => {
 	const text = errorChainText(err);
 	return MISSING_DEPENDENCY_HINTS.some((hint) => text.includes(hint));
 };
-const loadNeonConfig = async (cwd) => {
+const loadNeonConfig = async (ctx) => {
 	try {
-		const { config } = await loadConfigFromFile({ cwd });
+		const { config } = await loadConfigFromFile({
+			cwd: ctx.cwd,
+			...ctx.omitUnsetFunctionEnv ? { unsetFunctionEnv: "omit" } : {}
+		});
 		return config;
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (/Could not find a Neon config file/i.test(message)) return null;
-		if (looksLikeMissingDependency(err)) throw new Error(`Could not load neon.ts: a package it imports is not installed. Run \`${formatInstallCommand(resolvePackageManager(cwd))}\`, then try again.\nOriginal error: ${message}`);
+		if (looksLikeMissingDependency(err)) throw new Error(`Could not load neon.ts: a package it imports is not installed. Run \`${formatInstallCommand(resolvePackageManager(ctx.cwd))}\`, then try again.\nOriginal error: ${message}`);
 		throw err;
 	}
 };