neon 4.14.5 → 4.15.0

package/README.md

@@ -116,22 +116,23 @@ to skip the dotenv write.
 
 The command writes:
 
-- a `.neon` context that identifies the project and Claimable Neon service;
+- a `.neon` context with the project id and pinned branch;
 - an owner-only identity assertion under the CLI config directory;
 - `DATABASE_URL`, `DATABASE_URL_UNPOOLED`, `NEON_BRANCH`, and Auth / Data API variables
   when `neon.ts` declares them (or, with no `neon.ts`, when they are provisioned) to `.env`
   or `.env.local` (disable this with `--no-env-pull`). The write is the same `env pull` used
   after create.
 
-Subsequent project commands automatically exchange the assertion for a short-lived agent
-token and send API calls to Claimable Neon. The service decides which operations are
-allowed before claim.
+Subsequent project commands find that assertion by the linked project id, exchange it for a
+short-lived agent token, and send API calls to Claimable Neon. The service decides which
+operations are allowed before claim.
 
 ```bash
 neon claim status                 # lifecycle and transfer status
 neon projects get <project-id>    # regular CLI command, same agent token
 neon psql --role-name neondb_owner -- -c "select now()"
 neon config plan
+neon checkout main
 neon env pull
 
 neon claim accept                 # create a claim code and open the transfer URL
@@ -439,8 +440,8 @@ The branch argument is **optional**: run `neon checkout` with no branch in an in
 
 Branch **id vs name** is detected automatically (a `br-…` value is treated as an id):
 
-- **id** — matched strictly by id. A non-existent id is a hard "not found" error (ids are server-assigned, so checkout never creates one).
-- **name** — matched by name. If the name doesn't exist, in an interactive terminal `checkout` offers to **create** it (equivalent to `neon branch create --name <name>`: branched from the project's default branch with a read-write compute), then checks it out. In a non-interactive context a missing name is the usual "not found" error.
+- **id** — matched strictly by id. A non-existent id is a hard "not found" error (ids are server-assigned, so checkout never creates one, including with `--create`).
+- **name** — matched by name. If the name doesn't exist, pass `--create` to create it (equivalent to `neon branch create --name <name>`: branched from the project's default branch with a read-write compute, or from `neon.ts` when that file is present), then check it out. `--create` is a no-op when the name already exists. Without `--create`, an interactive terminal offers to create the branch; in CI or with no TTY the error names `--create`.
 
 The project is resolved through the standard neon chain, each entry winning over the next:
 
@@ -456,11 +457,15 @@ The resolved branch is then written (by name) to the same `.neon` file `link` us
 $ neon checkout main --project-id polished-snowflake-12345678
 INFO: Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
+$ neon checkout dev --create --project-id polished-snowflake-12345678
+INFO: Created branch dev (br-dev-branch-12345678).
+INFO: Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+
 $ cat .neon
 {
   "orgId": "org-abc123",
   "projectId": "polished-snowflake-12345678",
-  "branch": "main"
+  "branch": "dev"
 }
 ```
 

package/dist/claimable/state.js

@@ -77,35 +77,34 @@ const removeClaimableCredentials = (configDir, projectId) => {
 		throw error;
 	}
 };
-const resolveClaimableContext = (context) => {
-	const marker = context.claimable;
-	if (marker === void 0) return null;
-	if (!isRecord(marker)) throw new Error("The linked .neon file has an invalid \"claimable\" marker. Delete the claimable field from .neon, or delete .neon.");
-	if (marker.version !== 1) throw new Error(`Unsupported Claimable Neon context version in .neon. Update the Neon CLI before using this project.`);
-	if (!nonEmptyString(marker.origin) || !nonEmptyString(context.projectId)) throw new Error("The linked .neon file has an incomplete \"claimable\" marker. Delete the claimable field from .neon, or delete .neon.");
-	assertProjectId(context.projectId);
-	return {
-		origin: marker.origin,
-		projectId: context.projectId,
-		...nonEmptyString(context.branch) ? { branch: context.branch } : {}
-	};
+const readLinkedClaimableCredentials = (configDir, context) => {
+	if (!nonEmptyString(context.projectId)) return null;
+	if (!PROJECT_ID.test(context.projectId)) return null;
+	return readClaimableCredentials(configDir, context.projectId);
+};
+const claimableCredentialsExist = (configDir, projectId) => {
+	if (!PROJECT_ID.test(projectId)) return false;
+	return existsSync(claimableCredentialsPath(configDir, projectId));
 };
-const shouldUseClaimableCredentials = (inputs, profileFlag, context) => inputs.apiKeyFlag.trim() === "" && inputs.apiKeyEnv.trim() === "" && inputs.profileEnv.trim() === "" && (profileFlag === void 0 || profileFlag.trim() === "") && resolveClaimableContext(context) !== null;
+const shouldUseClaimableCredentials = (inputs, profileFlag, context, configDir) => inputs.apiKeyFlag.trim() === "" && inputs.apiKeyEnv.trim() === "" && inputs.profileEnv.trim() === "" && (profileFlag === void 0 || profileFlag.trim() === "") && readLinkedClaimableCredentials(configDir, context) !== null;
 /** Management API base URL the CLI uses for a Claimable Neon origin. */
 const claimableApiHost = (origin) => `${new ClaimableClient(origin).origin}/v1`;
 /**
 * Whether this invocation is talking to Claimable Neon, so env resolve must not
 * mint credentials or pull services that require claim.
 *
-* Auth source wins so a same-process checkout that rewrote `.neon` without the
-* marker still skips minting. A `.neon` marker plus a production API host is an
-* account override and is not claimable.
+* Auth source wins so a same-process checkout that rewrote `.neon` still skips
+* minting. A credential file plus a production API host is an account override
+* and is not claimable.
 */
 const isClaimableEnvTarget = (props) => {
-	if (getAuthContext()?.source === "claimable") return true;
-	const linked = resolveClaimableContext(readContextFile(props.contextFile));
-	if (linked === null) return false;
-	return props.apiHost.trim().replace(/\/+$/, "") === claimableApiHost(linked.origin);
+	const source = getAuthContext()?.source;
+	if (source === "claimable") return true;
+	if (source !== void 0) return false;
+	if (props.configDir.trim() === "") return false;
+	const stored = readLinkedClaimableCredentials(props.configDir, readContextFile(props.contextFile));
+	if (stored === null) return false;
+	return props.apiHost.trim().replace(/\/+$/, "") === claimableApiHost(stored.origin);
 };
 //#endregion
-export { assertionHasExpired, claimableApiHost, claimableCredentialsPath, isClaimableEnvTarget, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials, writeClaimableCredentials };
+export { assertionHasExpired, claimableApiHost, claimableCredentialsExist, claimableCredentialsPath, isClaimableEnvTarget, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, shouldUseClaimableCredentials, writeClaimableCredentials };

package/dist/commands/auth.js

@@ -5,13 +5,13 @@ import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
+import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
 import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, claimableCredentialsPath, readClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials } from "../claimable/state.js";
+import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { withExclusiveLock } from "../refresh_lock.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { existsSync } from "node:fs";
@@ -291,6 +291,7 @@ const ensureAuth = async (props) => {
 	if (isConfigInit(props)) return;
 	if (isProfileCommand(props)) return;
 	if (isMcpOauth(props)) return;
+	if (isInspectDbUrl(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
 	if (isAskCommand(props)) return;
@@ -316,15 +317,12 @@ const ensureAuth = async (props) => {
 	const inputs = credentialInputs();
 	const contextFile = typeof props.contextFile === "function" ? props.contextFile() : props.contextFile ?? currentContextFile();
 	const localContext = readContextFile(contextFile);
-	if (shouldUseClaimableCredentials(inputs, props.profile, localContext)) {
-		const linked = resolveClaimableContext(localContext);
-		if (linked === null) throw new Error("The linked Claimable Neon context could not be resolved.");
-		const stored = readClaimableCredentials(props.configDir, linked.projectId);
-		const path = claimableCredentialsPath(props.configDir, linked.projectId);
-		if (stored === null) throw new Error(`The linked project is claimable, but its identity assertion is missing from ${path}. Run \`neon claim create\` in a new directory, or \`neon link\` after claiming the project.`);
-		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${linked.projectId} has expired. Run \`neon claim delete ${linked.projectId} --yes\` to drop the local record.`);
+	if (shouldUseClaimableCredentials(inputs, props.profile, localContext, props.configDir)) {
+		const stored = readLinkedClaimableCredentials(props.configDir, localContext);
+		if (stored === null || localContext.projectId === void 0) throw new Error("The linked Claimable Neon identity assertion could not be read.");
+		const path = claimableCredentialsPath(props.configDir, localContext.projectId);
+		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${localContext.projectId} has expired. Run \`neon claim delete ${localContext.projectId} --yes\` to drop the local record.`);
 		const client = new ClaimableClient(stored.origin);
-		if (client.origin !== new ClaimableClient(linked.origin).origin) throw new Error(`The linked .neon file and ${path} name different Claimable Neon services. Delete .neon or the assertion file and run \`neon claim create\` in a new directory.`);
 		let token;
 		try {
 			token = await client.exchange(stored.identityAssertion);
@@ -346,7 +344,7 @@ const ensureAuth = async (props) => {
 		log.debug("Using the linked Claimable Neon project's short-lived access token");
 		return;
 	}
-	if (localContext.claimable !== void 0) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
+	if (localContext.projectId !== void 0 && claimableCredentialsExist(props.configDir, localContext.projectId)) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
 	const selection = selectCredential({
 		...inputs,
 		profileFlag: props.profile

package/dist/commands/checkout.js

@@ -28,7 +28,7 @@ const formatCheckoutPolicyFailure = (opts) => {
 	return [
 		`Branch ${opts.branchName} (${opts.branchId}) was created and checked out, but applying neon.ts to it failed: ${opts.failure}`,
 		`The branch is usable but does not match the policy, and \`${cli} checkout\` never reconciles a branch that already exists.`,
-		`Fix the cause above, then run \`${cli} deploy --update-existing${envArg}\` to apply the policy to it — or, if your policy only configures new branches (keyed on \`!branch.exists\`), delete the branch and check it out again: \`${cli} branches delete ${opts.branchName}\` then \`${cli} checkout ${opts.branchName}${envArg}\`.`
+		`Fix the cause above, then run \`${cli} deploy --update-existing${envArg}\` to apply the policy to it — or, if your policy only configures new branches (keyed on \`!branch.exists\`), delete the branch and check it out again: \`${cli} branches delete ${opts.branchName}\` then \`${cli} checkout ${opts.branchName} --create${envArg}\`.`
 	].join("\n");
 };
 const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").positional("id", {
@@ -44,6 +44,11 @@ const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").position
 		type: "boolean",
 		default: true
 	},
+	create: {
+		describe: "Create the named branch if it does not exist, then check it out",
+		type: "boolean",
+		default: false
+	},
 	...envFlag,
 	env: {
 		...envFlag.env,
@@ -52,12 +57,14 @@ const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").position
 }).example([
 	["$0 checkout", "Pick a branch interactively from the project in the closest .neon file"],
 	["$0 checkout main", "Pin the branch named \"main\" in the closest .neon file"],
-	["$0 checkout feat --env .env.local", "Create feat from neon.ts, loading Function env from .env.local first"],
+	["$0 checkout dev --create", "Create and pin a missing branch named dev"],
+	["$0 checkout feat --create --env .env.local", "Create feat from neon.ts, loading Function env from .env.local first"],
 	["$0 checkout br-cool-snow-12345678 --project-id project-id-123", "Pin a branch by id for an explicit project"]
 ]);
 const handler = async (props) => {
 	const previousBranch = contextBranch(readContextFile(props.contextFile));
 	if (previousBranch) log.info("%s Currently on branch %s", chalk.dim("→"), chalk.cyan.bold(previousBranch));
+	if (props.create && !props.id?.trim()) throw new Error(`No branch specified. Pass a branch name with --create (e.g. \`${getCliName()} checkout dev --create\`).`);
 	const projectId = await resolveProjectId(props);
 	const { branchId, branchName, created, policyApplied, policyFailure } = await resolveBranchId(props, projectId);
 	const orgId = await resolveOrgId(props, projectId);
@@ -137,8 +144,10 @@ const resolveBranchId = async (props, projectId) => {
 		created: false,
 		policyApplied: false
 	};
-	if (isCi() || !process.stdout.isTTY) throw new Error(notFoundMessage(ref, branches));
-	log.error(notFoundMessage(ref, branches));
+	if (props.create) return createCheckoutBranch(props, projectId, ref, branches);
+	const missingName = notFoundMessage(ref, branches, { suggestCreate: true });
+	if (isCi() || !process.stdout.isTTY) throw new Error(missingName);
+	log.error(missingName);
 	const { create } = await prompts({
 		type: "confirm",
 		name: "create",
@@ -178,7 +187,7 @@ const createCheckoutBranch = async (props, projectId, name, branches) => {
 		policyApplied: false
 	};
 };
-const notFoundMessage = (ref, branches) => `Branch ${ref} not found.\nAvailable branches: ${branches.map((b) => b.name).join(", ")}`;
+const notFoundMessage = (ref, branches, opts) => `Branch ${ref} not found.${opts?.suggestCreate ? " Pass --create to create it." : ""}\nAvailable branches: ${branches.map((b) => b.name).join(", ")}`;
 /**
 * Resolve the org id to heal into the context file.
 *

package/dist/commands/claim.js

@@ -8,7 +8,7 @@ import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagVal
 import { resolveEnvFilePath } from "../env_file.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
+import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { pull } from "./env.js";
@@ -184,19 +184,23 @@ const resolveTarget = (props) => {
 	rejectExplicitAccountCredential(props);
 	const requested = props.projectId?.trim();
 	const context = readContextFile(props.contextFile);
-	const linked = resolveClaimableContext(context);
-	const projectId = requested || linked?.projectId;
-	if (projectId === void 0) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
-	const credentials = readClaimableCredentials(props.configDir, projectId);
-	if (credentials === null) throw new Error(`The identity assertion for ${projectId} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
-	const client = new ClaimableClient(credentials.origin);
-	const contextMatches = linked?.projectId === projectId;
-	if (contextMatches && linked !== null && client.origin !== new ClaimableClient(linked.origin).origin) throw new Error("The .neon context and saved identity assertion name different Claimable Neon services. Delete .neon or the assertion file and run `neon claim create` in a new directory.");
+	if (requested) {
+		const credentials = readClaimableCredentials(props.configDir, requested);
+		if (credentials === null) throw new Error(`The identity assertion for ${requested} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
+		return {
+			projectId: requested,
+			credentials,
+			client: new ClaimableClient(credentials.origin),
+			contextMatches: context.projectId === requested
+		};
+	}
+	const linked = readLinkedClaimableCredentials(props.configDir, context);
+	if (linked === null) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
 	return {
-		projectId,
-		credentials,
-		client,
-		contextMatches
+		projectId: linked.projectId,
+		credentials: linked,
+		client: new ClaimableClient(linked.origin),
+		contextMatches: true
 	};
 };
 const requireLiveIdentity = (credentials) => {
@@ -210,7 +214,7 @@ const clearLocalRecord = (props, projectId, contextMatches) => {
 const create = async (props) => {
 	rejectExplicitAccountCredential(props);
 	const existing = readContextFile(props.contextFile);
-	if (existing.projectId || existing.orgId || existing.claimable) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
+	if (existing.projectId || existing.orgId) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
 	const contextFileExisted = existsSync(props.contextFile);
 	const cwd = props.cwd ?? process.cwd();
 	const envFile = props.envPull ? resolveEnvFilePath(cwd, props.file) : void 0;
@@ -241,11 +245,7 @@ const create = async (props) => {
 		localStateWritten = true;
 		applyContext(props.contextFile, {
 			projectId: registration.project.id,
-			branch: registration.project.branchId,
-			claimable: {
-				version: 1,
-				origin: client.origin
-			}
+			branch: registration.project.branchId
 		});
 		contextWritten = true;
 		const token = await client.exchange(registration.identityAssertion);
@@ -261,6 +261,7 @@ const create = async (props) => {
 				apiClient,
 				apiKey: token.accessToken,
 				apiHost,
+				configDir: props.configDir,
 				contextFile: props.contextFile,
 				output: props.output,
 				projectId: registration.project.id,

package/dist/commands/config.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
-import { contextBranch, readContextFile } from "../context.js";
+import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -229,6 +229,7 @@ const initCmd = async (props) => {
 		const args = installArgs(pm, missing);
 		if (props.install === false) log.info("Install the Neon config packages to use neon.ts: %s", formatInstallCommand(pm, missing));
 		else {
+			ensureDirectoryGitignored(join(cwd, "node_modules"));
 			log.info("Installing %s with %s…", missing.join(", "), pm);
 			if (!await run(pm, args, cwd)) log.warning("Could not install the config packages automatically. Run by hand: %s", formatInstallCommand(pm, missing));
 		}

package/dist/commands/dev.js

@@ -89,7 +89,8 @@ const devEnvContext = (props, branchId, cwd) => {
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...isClaimableEnvTarget({
 			apiHost: props.apiHost,
-			contextFile: props.contextFile ?? ""
+			contextFile: props.contextFile ?? "",
+			configDir: props.configDir ?? ""
 		}) ? { claimable: true } : {}
 	};
 };

package/dist/commands/env.js

@@ -122,7 +122,11 @@ const NEON_OWNED_ENV_KEYS = [
 ];
 const pull = async (props, opts = {}) => {
 	const cwd = props.cwd ?? process.cwd();
-	const claimable = isClaimableEnvTarget(props);
+	const claimable = isClaimableEnvTarget({
+		apiHost: props.apiHost,
+		contextFile: props.contextFile,
+		configDir: props.configDir ?? ""
+	});
 	const dropped = claimable && (props.services !== void 0 || props.envKeys !== void 0) ? dropClaimableUnsupported(props.services ?? [], props.envKeys ?? []) : null;
 	const selectionServices = dropped ? dropped.services : props.services ?? [];
 	const selectionEnvKeys = dropped ? dropped.envKeys : props.envKeys ?? [];

package/dist/context.js

@@ -55,6 +55,12 @@ const isMcpCommand = (args) => args._[0] === "mcp";
 const isSkillsCommand = (args) => args._[0] === "skills" || args._[0] === "skill";
 const isPluginsCommand = (args) => args._[0] === "plugins" || args._[0] === "plugin";
 const isAskCommand = (args) => args._[0] === "ask";
+/**
+* `inspect db --db-url` talks to Postgres with that URI. Skip only when the
+* parsed value is nonempty: empty `--db-url` still goes through project
+* resolution and needs an API client.
+*/
+const isInspectDbUrl = (args) => (args._[0] === "inspect" || args._[0] === "inspection") && typeof args.dbUrl === "string" && args.dbUrl.length > 0;
 /** Raw argv is required because auth middleware runs before MCP flags are parsed. */
 const isMcpOauth = (args) => isMcpCommand(args) && argvEnablesMcpOauth(process.argv);
 const OAUTH_FALSE = /* @__PURE__ */ new Set([
@@ -193,21 +199,33 @@ const setContext = (file, context) => {
 * must not be blocked by a `.gitignore` write error.
 */
 const ensureGitignored = (file) => {
+	ensureGitignoreEntry(file, basenameOf(file));
+};
+/**
+* Make sure a directory is ignored by the `.gitignore` in its parent. The written entry keeps
+* the conventional trailing slash, while coverage checks also recognize an existing entry
+* without one.
+*/
+const ensureDirectoryGitignored = (directory) => {
+	const normalized = directory.replace(/[\\/]+$/, "");
+	ensureGitignoreEntry(directory, `${basenameOf(normalized)}/`);
+};
+const ensureGitignoreEntry = (path, entry) => {
 	try {
-		const dir = dirname(file);
-		const entry = basenameOf(file);
+		const dir = dirname(path);
 		const gitignorePath = resolve(dir, GITIGNORE_FILE);
+		const coveredEntry = entry.replace(/\/$/, "");
 		if (!existsSync(gitignorePath)) {
 			writeFileSync(gitignorePath, `${entry}\n`);
 			return;
 		}
 		const current = readFileSync(gitignorePath, "utf-8");
-		if (hasGitignoreEntry(current, entry)) return;
+		if (hasGitignoreEntry(current, coveredEntry)) return;
 		const addition = `${current.length > 0 && !current.endsWith("\n") ? "\n" : ""}${entry}\n`;
 		writeFileSync(gitignorePath, current + addition);
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
-		log.debug("Failed to update .gitignore next to %s: %s", file, message);
+		log.debug("Failed to update .gitignore next to %s: %s", path, message);
 	}
 };
 const basenameOf = (file) => {
@@ -242,4 +260,4 @@ const globToRegExp = (pattern) => {
 	return new RegExp(`^${source}$`);
 };
 //#endregion
-export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureGitignored, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };
+export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.14.5",
+  "version": "4.15.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config-runtime": "1.2.3",
-    "@neon/sdk": "4.0.0",
-    "@neon/config": "1.3.2"
+    "@neon/config": "1.3.3",
+    "@neon/config-runtime": "1.2.4",
+    "@neon/sdk": "4.1.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -97,8 +97,8 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.10",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.11",
     "@neon/e2e-harness": "0.0.0",
     "@neon/functions": "0.9.0"
   },