neon 4.14.3 → 4.14.5

package/README.md

@@ -105,16 +105,23 @@ sends:
 }
 ```
 
-Object Storage, Functions, and the AI Gateway are sent to the service so demand is
-recorded, but are reported as unavailable until the project is claimed; the CLI does
-not silently remove them.
+Object Storage, Functions, and the AI Gateway passed with `--service` are sent so
+demand is recorded, then reported as unavailable until the project is claimed. The CLI
+does not drop them from the request.
+
+The bundled env pull still follows `neon.ts`. A `neon.ts` that names AI Gateway,
+Functions, or Object Storage fails the pull, and the create is rolled back. Use
+`--config` for a different policy file (registration and that pull), or `--no-env-pull`
+to skip the dotenv write.
 
 The command writes:
 
 - a `.neon` context that identifies the project and Claimable Neon service;
 - an owner-only identity assertion under the CLI config directory;
-- `DATABASE_URL` and any granted Auth or Data API variables to `.env` or `.env.local`
-  (disable this with `--no-env-pull`).
+- `DATABASE_URL`, `DATABASE_URL_UNPOOLED`, `NEON_BRANCH`, and Auth / Data API variables
+  when `neon.ts` declares them (or, with no `neon.ts`, when they are provisioned) to `.env`
+  or `.env.local` (disable this with `--no-env-pull`). The write is the same `env pull` used
+  after create.
 
 Subsequent project commands automatically exchange the assertion for a short-lived agent
 token and send API calls to Claimable Neon. The service decides which operations are
@@ -125,7 +132,7 @@ neon claim status                 # lifecycle and transfer status
 neon projects get <project-id>    # regular CLI command, same agent token
 neon psql --role-name neondb_owner -- -c "select now()"
 neon config plan
-neon env pull --service postgres --service auth --service data-api
+neon env pull
 
 neon claim accept                 # create a claim code and open the transfer URL
 neon claim delete --yes           # permanently delete an unclaimed project
@@ -497,6 +504,8 @@ The human-readable summary line goes to stderr and the diff body to stdout, so `
 2. **`neon.ts`**, when the working directory has one — the policy is the source of truth, same as `neon dev` and `neon deploy`. Declared function URLs are derived from the branch connection host; the function does not have to be deployed.
 3. **Everything the branch has** otherwise — Postgres, Neon Auth, the Data API, object storage, and function invocation URLs read back from the branch, plus the AI Gateway. The gateway has no branch-level state to read back, so a bare `env pull` asks for it rather than detecting it and may mint a branch credential. To leave it out, name only what you do want with `--service` and/or `--env`.
 
+On an unclaimed Claimable Neon project, `neon.ts` is still the source of truth when it only declares Postgres, Auth, and the Data API. A `neon.ts` that declares AI Gateway, Functions, or Object Storage fails: those cannot be used until the project is claimed. Without a `neon.ts`, a bare pull writes provisioned Postgres, Auth, and Data API. Naming AI Gateway, Functions, or Object Storage with `--service` / `--env` warns and writes nothing for them. `--config` selects the policy file, the same flag as `claim create` and `config plan`.
+
 If the gateway can't be resolved, it is dropped with a warning and the rest of the pull still lands. Gateway variables already in your file for *this* branch are left alone — a pull that couldn't reach the gateway is no evidence the branch has stopped having one — while ones left over from a different branch are pruned like any other stale value.
 
 ```bash
@@ -506,6 +515,9 @@ neon env pull
 # Pull a specific branch into a specific file
 neon env pull --branch preview --file .env.preview
 
+# Use a specific neon.ts
+neon env pull --config ./claimable.ts
+
 # Only the AI Gateway
 neon env pull --service ai-gateway
 

package/dist/_chunks/{env-CZmstYrY.js → env-DsakkOVZ.js}

@@ -1,5 +1,6 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
+import { declaredNeonServices } from "../config_services.js";
 import { S as toEntries, _ as functionBaseUrlKey, a as envKeysForSelection, b as previewCredentialScopes, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as fetchEnvKeysState, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as isFunctionBaseUrlKey, x as resolveBranchPolicy, y as policyEnvKeys } from "./env_services-CAWrZTWa.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { credentialScopesSatisfied } from "@neon/config/v1";
@@ -232,6 +233,134 @@ var ServiceNotOnBranchError = class extends Error {
 		this.name = "ServiceNotOnBranchError";
 	}
 };
+const CLAIMABLE_UNSUPPORTED_SERVICES = /* @__PURE__ */ new Set([
+	"ai-gateway",
+	"functions",
+	"object-storage"
+]);
+const CLAIMABLE_RESOLVE_ORDER = [
+	"postgres",
+	"auth",
+	"data-api"
+];
+const emptyClaimableCredential = () => ({
+	issued: false,
+	keys: [],
+	revoked: [],
+	superseded: []
+});
+const isClaimableUnsupportedService = (service) => CLAIMABLE_UNSUPPORTED_SERVICES.has(service);
+const dropClaimableUnsupported = (services, envKeys) => {
+	const skipped = [];
+	const keptServices = [];
+	for (const service of services) {
+		if (isClaimableUnsupportedService(service)) {
+			if (!skipped.includes(service)) skipped.push(service);
+			continue;
+		}
+		keptServices.push(service);
+	}
+	const keptKeys = [];
+	for (const key of envKeys) {
+		const service = serviceForEnvKey(key);
+		if (service !== null && isClaimableUnsupportedService(service)) {
+			if (!skipped.includes(service)) skipped.push(service);
+			continue;
+		}
+		keptKeys.push(key);
+	}
+	return {
+		services: keptServices,
+		envKeys: keptKeys,
+		skipped
+	};
+};
+const warnClaimableSkipped = (skipped) => {
+	if (skipped.length === 0) return;
+	log.warning("Skipped %s: not available on an unclaimed Claimable Neon project. Postgres, Auth, and the Data API can be pulled when they are provisioned.", skipped.join(", "));
+};
+/**
+* Claimable Neon does not complete concurrent Management API reads.
+* Resolve one allowed service at a time.
+*/
+const resolveClaimableServicesSequentially = async (ctx, services, envKeys) => {
+	const leftover = envKeys.filter((key) => serviceForEnvKey(key) === null);
+	const parts = [];
+	for (const service of CLAIMABLE_RESOLVE_ORDER) {
+		const named = services.includes(service);
+		const keysForService = [...envKeys.filter((key) => serviceForEnvKey(key) === service), ...service === "postgres" ? leftover : []];
+		if (!named && keysForService.length === 0) continue;
+		parts.push(await resolveSelectedServices(ctx, named ? [service] : [], keysForService));
+	}
+	const resolvedPostgresPartition = services.includes("postgres") || envKeys.some((key) => serviceForEnvKey(key) === "postgres");
+	if (leftover.length > 0 && !resolvedPostgresPartition) parts.push(await resolveSelectedServices(ctx, [], leftover));
+	if (parts.length === 0) return {
+		vars: {},
+		credential: emptyClaimableCredential()
+	};
+	const vars = Object.assign({}, ...parts.map((part) => part.vars));
+	const skipped = parts.flatMap((part) => part.skipped ?? []);
+	return {
+		vars,
+		credential: emptyClaimableCredential(),
+		...skipped.length > 0 ? { skipped } : {}
+	};
+};
+const resolveClaimableLiveEnv = async (ctx) => {
+	const { projectId, branchId } = ctx;
+	if (!projectId || !branchId) throw new MissingBranchContextError(`No project/branch context found. Link a branch (\`${getCliName()} link\` / \`${getCliName()} checkout\`) or pass --project-id and --branch.`);
+	const api = apiFor(ctx);
+	const auth = await api.getNeonAuth(projectId, branchId);
+	const dataApiEnabled = await readDataApiEnabled(api, projectId, branchId);
+	const services = ["postgres"];
+	if (auth !== null) services.push("auth");
+	if (dataApiEnabled !== false) services.push("data-api");
+	return await resolveClaimableServicesSequentially(ctx, services, []);
+};
+const throwPolicyMissingOnBranch = (names, branchId) => {
+	throw new DevEnvMismatchError(`Your neon.ts declares ${names} for branch ${branchId}, but the branch does not have it yet, so the matching env vars cannot be injected. Provision it first with \`${getCliName()} deploy\` (or \`${getCliName()} config apply\`), then re-run \`${getCliName()} dev\`.`);
+};
+/**
+* Honor neon.ts on Claimable Neon without going through `plan` / `fetchEnv`.
+* Those fire concurrent Management API reads, which Claimable does not complete.
+*/
+const resolveClaimablePolicyEnv = async (ctx, config) => {
+	const declared = declaredNeonServices(config);
+	const unsupported = declared.filter(isClaimableUnsupportedService);
+	if (unsupported.length > 0) throw new DevEnvMismatchError(`Your neon.ts declares ${unsupported.join(", ")}, which cannot be used on an unclaimed Claimable Neon project. Remove those services from neon.ts.`);
+	const { projectId, branchId } = ctx;
+	if (!projectId || !branchId) throw new MissingBranchContextError(`Found a neon.ts but could not resolve the project/branch. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
+	const api = apiFor(ctx);
+	const missing = [];
+	if (declared.includes("auth")) {
+		if (await api.getNeonAuth(projectId, branchId) === null) missing.push("auth");
+	}
+	if (declared.includes("data-api")) {
+		if (await readDataApiEnabled(api, projectId, branchId) === false) missing.push("data-api");
+	}
+	if (missing.length > 0) throwPolicyMissingOnBranch(missing.join(", "), branchId);
+	return await resolveClaimableServicesSequentially(ctx, ["postgres", ...declared], []);
+};
+const resolveClaimableNeonEnvVars = async (ctx) => {
+	if (ctx.services !== void 0 || ctx.envKeys !== void 0) {
+		const dropped = dropClaimableUnsupported(ctx.services ?? [], ctx.envKeys ?? []);
+		warnClaimableSkipped(dropped.skipped);
+		if (dropped.services.length === 0 && dropped.envKeys.length === 0) return {
+			vars: {},
+			credential: emptyClaimableCredential(),
+			...dropped.skipped.length > 0 ? { skipped: dropped.skipped } : {}
+		};
+		const resolved = await resolveClaimableServicesSequentially(ctx, dropped.services, dropped.envKeys);
+		const skipped = [...resolved.skipped ?? [], ...dropped.skipped];
+		return {
+			...resolved,
+			...skipped.length > 0 ? { skipped } : {}
+		};
+	}
+	const config = await loadNeonConfig(ctx);
+	if (config) return await resolveClaimablePolicyEnv(ctx, config);
+	return await resolveClaimableLiveEnv(ctx);
+};
 /**
 * Resolve the branch's Neon env vars (pooled / direct `DATABASE_URL`, plus Auth /
 * Data API when enabled) into a `{ KEY: value }` map. Shared by `neon dev` (which
@@ -259,10 +388,16 @@ var ServiceNotOnBranchError = class extends Error {
 *      `pullConfig` cannot read it back.
 *   3. otherwise -> throw {@link MissingBranchContextError}.
 *
+* {@link DevEnvContext.claimable} keeps the same precedence. Credentials are not
+* minted. A neon.ts that names AI Gateway, Functions, or Object Storage fails
+* instead of pulling a subset. The live and policy reads run one service at a
+* time because Claimable Neon does not complete concurrent Management API reads.
+*
 * Unlike {@link resolveDevEnv}, this never swallows errors — callers decide how to
 * handle them.
 */
 const resolveNeonEnvVars = async (ctx) => {
+	if (ctx.claimable) return await resolveClaimableNeonEnvVars(ctx);
 	if (ctx.services !== void 0 || ctx.envKeys !== void 0) return await resolveSelectedServices(ctx, ctx.services ?? [], ctx.envKeys ?? []);
 	const config = await loadNeonConfig(ctx);
 	if (config) {
@@ -519,7 +654,7 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
 		...apiOptions(ctx)
 	})).applied.filter(isMissingResource);
 	if (missing.length === 0) return;
-	throw new DevEnvMismatchError(`Your neon.ts declares ${missing.map((change) => change.identifier).join(", ")} for branch ${ctx.branchId}, but the branch does not have it yet, so the matching env vars cannot be injected. Provision it first with \`${getCliName()} deploy\` (or \`${getCliName()} config apply\`), then re-run \`${getCliName()} dev\`.`);
+	throwPolicyMissingOnBranch(missing.map((change) => change.identifier).join(", "), ctx.branchId);
 };
 /**
 * A planned change that provisions a branch-level resource the branch lacks: a
@@ -583,6 +718,7 @@ const loadNeonConfig = async (ctx) => {
 	try {
 		const { config } = await loadConfigFromFile({
 			cwd: ctx.cwd,
+			...ctx.config ? { path: ctx.config } : {},
 			...ctx.omitUnsetFunctionEnv ? { unsetFunctionEnv: "omit" } : {}
 		});
 		return config;
@@ -594,4 +730,4 @@ const loadNeonConfig = async (ctx) => {
 	}
 };
 //#endregion
-export { resolveNeonEnvVars as a, resolveDevEnv as i, MissingBranchContextError as n, ServiceNotOnBranchError as r, DevEnvMismatchError as t };
+export { resolveDevEnv as a, dropClaimableUnsupported as i, MissingBranchContextError as n, resolveNeonEnvVars as o, ServiceNotOnBranchError as r, DevEnvMismatchError as t };

package/dist/claimable/state.js

@@ -1,4 +1,7 @@
 import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
+import { getAuthContext } from "../auth_context.js";
+import { readContextFile } from "../context.js";
+import { ClaimableClient } from "./api.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 //#region src/claimable/state.ts
@@ -88,5 +91,21 @@ const resolveClaimableContext = (context) => {
 	};
 };
 const shouldUseClaimableCredentials = (inputs, profileFlag, context) => inputs.apiKeyFlag.trim() === "" && inputs.apiKeyEnv.trim() === "" && inputs.profileEnv.trim() === "" && (profileFlag === void 0 || profileFlag.trim() === "") && resolveClaimableContext(context) !== null;
+/** Management API base URL the CLI uses for a Claimable Neon origin. */
+const claimableApiHost = (origin) => `${new ClaimableClient(origin).origin}/v1`;
+/**
+* Whether this invocation is talking to Claimable Neon, so env resolve must not
+* mint credentials or pull services that require claim.
+*
+* Auth source wins so a same-process checkout that rewrote `.neon` without the
+* marker still skips minting. A `.neon` marker plus a production API host is an
+* account override and is not claimable.
+*/
+const isClaimableEnvTarget = (props) => {
+	if (getAuthContext()?.source === "claimable") return true;
+	const linked = resolveClaimableContext(readContextFile(props.contextFile));
+	if (linked === null) return false;
+	return props.apiHost.trim().replace(/\/+$/, "") === claimableApiHost(linked.origin);
+};
 //#endregion
-export { assertionHasExpired, claimableCredentialsPath, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials, writeClaimableCredentials };
+export { assertionHasExpired, claimableApiHost, claimableCredentialsPath, isClaimableEnvTarget, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials, writeClaimableCredentials };

package/dist/commands/claim.js

@@ -1,15 +1,17 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
-import { applyContext, contextBranch, ensureGitignored, readContextFile } from "../context.js";
+import { getApiClient } from "../api.js";
+import { applyContext, contextBranch, readContextFile } from "../context.js";
 import { claimableDataApiCreateBody, declaredNeonServices } from "../config_services.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { mergeEnvFile, resolveEnvFilePath } from "../env_file.js";
+import { resolveEnvFilePath } from "../env_file.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
+import { pull } from "./env.js";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -25,6 +27,7 @@ var claim_exports = /* @__PURE__ */ __exportAll({
 	claimCreateFields: () => claimCreateFields,
 	claimableCapabilities: () => claimableCapabilities,
 	command: () => command,
+	create: () => create,
 	describe: () => describe,
 	findNeonConfig: () => findNeonConfig,
 	handler: () => handler
@@ -84,7 +87,10 @@ const loadCreatePolicy = async (explicitPath) => {
 	const path = explicitPath ?? findNeonConfig();
 	if (!path) return void 0;
 	const { config } = await loadConfigFromFile({ path });
-	return config;
+	return {
+		path,
+		config
+	};
 };
 const removeFileIfPresent = (path) => {
 	try {
@@ -129,10 +135,10 @@ const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option(
 	describe: "Target dotenv file. Defaults to an existing .env, otherwise .env.local",
 	type: "string"
 }).option("config", {
-	describe: "Path to neon.ts. Defaults to walking up from the current directory",
+	describe: "Path to neon.ts for registration and the bundled env pull. Defaults to walking up from the current directory",
 	type: "string"
 }).option("env-pull", {
-	describe: "Write the provisioned DATABASE_URL and service URLs to a dotenv file",
+	describe: "Write the same Neon env vars `env pull` would",
 	type: "boolean",
 	default: true
 }).strict().check(noPassthrough("claim create")), async (args) => {
@@ -143,11 +149,12 @@ const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option(
 		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
 	}) : [];
 	const policy = await loadCreatePolicy(typeof args.config === "string" ? args.config : void 0);
-	const configuredServices = policy ? declaredNeonServices(policy) : [];
-	const dataApi = policy ? claimableDataApiCreateBody(policy) : void 0;
+	const configuredServices = policy ? declaredNeonServices(policy.config) : [];
+	const dataApi = policy ? claimableDataApiCreateBody(policy.config) : void 0;
 	await create({
 		...args,
 		services: [.../* @__PURE__ */ new Set([...services, ...configuredServices])],
+		...policy ? { config: policy.path } : {},
 		...dataApi ? { dataApi } : {}
 	});
 }).command("status [project-id]", "Show a claimable project's lifecycle and claim status", (y) => y.positional("project-id", {
@@ -205,7 +212,8 @@ const create = async (props) => {
 	const existing = readContextFile(props.contextFile);
 	if (existing.projectId || existing.orgId || existing.claimable) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
 	const contextFileExisted = existsSync(props.contextFile);
-	const envFile = props.envPull ? resolveEnvFilePath(process.cwd(), props.file) : void 0;
+	const cwd = props.cwd ?? process.cwd();
+	const envFile = props.envPull ? resolveEnvFilePath(cwd, props.file) : void 0;
 	const envFileExisted = envFile ? existsSync(envFile) : false;
 	const previousEnv = envFileExisted && envFile ? readFileSync(envFile) : void 0;
 	const client = new ClaimableClient(props.claimableHost);
@@ -242,20 +250,26 @@ const create = async (props) => {
 		contextWritten = true;
 		const token = await client.exchange(registration.identityAssertion);
 		accessToken = token.accessToken;
-		const credentials = await client.credentials(registration.project.id, token.accessToken);
-		if (credentials.projectId !== registration.project.id || credentials.branchId !== registration.project.branchId) throw new Error("Claimable Neon returned credentials for a different project. The project was not kept.");
 		if (envFile) {
-			const env = {
-				DATABASE_URL: credentials.databaseUrl,
-				...credentials.services.dataApi ? { NEON_DATA_API_URL: credentials.services.dataApi.url } : {},
-				...credentials.services.auth ? {
-					NEON_AUTH_BASE_URL: credentials.services.auth.baseUrl,
-					NEON_AUTH_JWKS_URL: credentials.services.auth.jwksUrl
-				} : {}
-			};
+			const apiHost = `${client.origin}/v1`;
+			const apiClient = props.apiClient ?? getApiClient({
+				apiKey: token.accessToken,
+				apiHost
+			});
 			envWriteAttempted = true;
-			mergeEnvFile(envFile, env);
-			ensureGitignored(envFile);
+			if ((await pull({
+				apiClient,
+				apiKey: token.accessToken,
+				apiHost,
+				contextFile: props.contextFile,
+				output: props.output,
+				projectId: registration.project.id,
+				branch: registration.project.branchId,
+				cwd,
+				file: props.file,
+				...props.config ? { config: props.config } : {},
+				...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+			})).status === "empty") throw new Error("No Neon env variables were pulled for this claimable project.");
 		}
 		const granted = registration.capabilities.filter((decision) => decision.granted).map((decision) => cliServiceName(decision.capability));
 		const denied = registration.capabilities.filter((decision) => !decision.granted).map((decision) => ({
@@ -467,4 +481,4 @@ const finishClaimedContext = (props, projectId, contextMatches) => {
 	log.info("Dropped the local identity assertion. The next command needs `neon auth` or `neon link`.");
 };
 //#endregion
-export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, describe, findNeonConfig, handler, claim_exports as t };
+export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, create, describe, findNeonConfig, handler, claim_exports as t };

package/dist/commands/dev.js

@@ -3,9 +3,10 @@ import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { _ as functionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
+import { isClaimableEnvTarget } from "../claimable/state.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { i as resolveDevEnv } from "../_chunks/env-CZmstYrY.js";
+import { a as resolveDevEnv } from "../_chunks/env-DsakkOVZ.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -85,7 +86,11 @@ const devEnvContext = (props, branchId, cwd) => {
 		...props.projectId ? { projectId: props.projectId } : {},
 		...branchId ? { branchId } : {},
 		...props.apiKey ? { apiKey: props.apiKey } : {},
-		...props.apiHost ? { apiHost: props.apiHost } : {}
+		...props.apiHost ? { apiHost: props.apiHost } : {},
+		...isClaimableEnvTarget({
+			apiHost: props.apiHost,
+			contextFile: props.contextFile ?? ""
+		}) ? { claimable: true } : {}
 	};
 };
 /**

package/dist/commands/env.js

@@ -5,10 +5,11 @@ import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, v as isFunctionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
+import { isClaimableEnvTarget } from "../claimable/state.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { a as resolveNeonEnvVars } from "../_chunks/env-CZmstYrY.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DsakkOVZ.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -54,6 +55,10 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 		describe: `Pull only these individual variables: ${ENV_PULL_KEY_HELP}. Repeat the flag or comma-separate. Overrides neon.ts. Combines with --service as a union; it never narrows a service bundle.`,
 		type: "array",
 		string: true
+	},
+	config: {
+		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		type: "string"
 	}
 }).epilogue([
 	"",
@@ -64,6 +69,14 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
 	"     which mints a branch credential for it.",
 	"",
+	"On an unclaimed Claimable Neon project, neon.ts is still the source",
+	"of truth when it only declares Postgres, Auth, and the Data API.",
+	"A neon.ts that declares AI Gateway, Functions, or Object Storage",
+	"fails: those cannot be used until the project is claimed. Without",
+	"a neon.ts, a bare pull writes provisioned Postgres, Auth, and Data",
+	"API. Naming unsupported services with --service / --env warns",
+	"and writes nothing for them.",
+	"",
 	"The pull bundled into link / checkout / config apply follows 2 and 3",
 	"without the AI Gateway, so it never mints a credential you did not ask",
 	"for. Run `env pull` to add it."
@@ -109,7 +122,11 @@ const NEON_OWNED_ENV_KEYS = [
 ];
 const pull = async (props, opts = {}) => {
 	const cwd = props.cwd ?? process.cwd();
-	const selectedKeys = props.services !== void 0 || props.envKeys !== void 0 ? envKeysForSelection(props.services ?? [], props.envKeys ?? []) : void 0;
+	const claimable = isClaimableEnvTarget(props);
+	const dropped = claimable && (props.services !== void 0 || props.envKeys !== void 0) ? dropClaimableUnsupported(props.services ?? [], props.envKeys ?? []) : null;
+	const selectionServices = dropped ? dropped.services : props.services ?? [];
+	const selectionEnvKeys = dropped ? dropped.envKeys : props.envKeys ?? [];
+	const selectedKeys = props.services !== void 0 || props.envKeys !== void 0 ? envKeysForSelection(selectionServices, selectionEnvKeys) : void 0;
 	const branch = await resolveBranchRef(props);
 	if (opts.announce) announceTargetBranch(props, branch, "Pulling env from branch");
 	const branchId = branch.branchId;
@@ -124,20 +141,22 @@ const pull = async (props, opts = {}) => {
 			...process.env,
 			...existingEnv
 		},
-		...props.services ? { services: props.services } : {},
-		...props.envKeys ? { envKeys: props.envKeys } : {},
+		...props.services !== void 0 ? { services: props.services } : {},
+		...props.envKeys !== void 0 ? { envKeys: props.envKeys } : {},
 		...opts.implyAiGateway ? { implyAiGateway: true } : {},
 		omitUnsetFunctionEnv: true,
+		...claimable ? { claimable: true } : {},
+		...props.config ? { config: props.config } : {},
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.runtimeApi ? { api: props.runtimeApi } : {}
 	});
-	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys, props.services);
+	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys, props.services !== void 0 ? selectionServices : void 0);
 	if (Object.keys(neonVars).length === 0) {
-		log.info("No Neon env variables to pull for this branch (no DATABASE_URL or enabled Auth / Data API).");
+		if (!(dropped !== null && dropped.services.length === 0 && dropped.envKeys.length === 0 && dropped.skipped.length > 0)) log.info("No Neon env variables to pull for this branch (no DATABASE_URL or enabled Auth / Data API).");
 		return { status: "empty" };
 	}
-	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId), existingEnv, props.services, props.envKeys) });
+	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId), existingEnv, props.services !== void 0 ? selectionServices : void 0, props.envKeys !== void 0 ? selectionEnvKeys : void 0) });
 	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
 	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
 	if (credential?.issued) {

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveNeonEnvVars, i as resolveDevEnv, n as MissingBranchContextError, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-CZmstYrY.js";
-export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, resolveDevEnv, resolveNeonEnvVars };
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-DsakkOVZ.js";
+export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_file.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 //#region src/env_file.ts
 /**
 * Default dotenv file `env pull` writes to: `.env` when one already exists in the working
@@ -7,7 +7,7 @@ import { join } from "node:path";
 * `vercel env pull` convention. An explicit `--file` always wins over this.
 */
 const resolveEnvFilePath = (cwd, file) => {
-	if (file) return join(cwd, file);
+	if (file) return resolve(cwd, file);
 	if (existsSync(join(cwd, ".env"))) return join(cwd, ".env");
 	return join(cwd, ".env.local");
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.14.3",
+  "version": "4.14.5",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/sdk": "3.2.0",
-    "@neon/config-runtime": "1.2.2",
-    "@neon/config": "1.3.1"
+    "@neon/config-runtime": "1.2.3",
+    "@neon/sdk": "4.0.0",
+    "@neon/config": "1.3.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -97,8 +97,8 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
+    "@neon-internals/env-core": "0.0.10",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.9",
     "@neon/e2e-harness": "0.0.0",
     "@neon/functions": "0.9.0"
   },