neon 4.14.6 → 4.16.0

package/README.md

@@ -440,8 +440,8 @@ The branch argument is **optional**: run `neon checkout` with no branch in an in
 
 Branch **id vs name** is detected automatically (a `br-…` value is treated as an id):
 
-- **id** — matched strictly by id. A non-existent id is a hard "not found" error (ids are server-assigned, so checkout never creates one).
-- **name** — matched by name. If the name doesn't exist, in an interactive terminal `checkout` offers to **create** it (equivalent to `neon branch create --name <name>`: branched from the project's default branch with a read-write compute), then checks it out. In a non-interactive context a missing name is the usual "not found" error.
+- **id** — matched strictly by id. A non-existent id is a hard "not found" error (ids are server-assigned, so checkout never creates one, including with `--create`).
+- **name** — matched by name. If the name doesn't exist, pass `--create` to create it (equivalent to `neon branch create --name <name>`: branched from the project's default branch with a read-write compute, or from `neon.ts` when that file is present), then check it out. `--create` is a no-op when the name already exists. Without `--create`, an interactive terminal offers to create the branch; in CI or with no TTY the error names `--create`.
 
 The project is resolved through the standard neon chain, each entry winning over the next:
 
@@ -457,11 +457,15 @@ The resolved branch is then written (by name) to the same `.neon` file `link` us
 $ neon checkout main --project-id polished-snowflake-12345678
 INFO: Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
+$ neon checkout dev --create --project-id polished-snowflake-12345678
+INFO: Created branch dev (br-dev-branch-12345678).
+INFO: Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+
 $ cat .neon
 {
   "orgId": "org-abc123",
   "projectId": "polished-snowflake-12345678",
-  "branch": "main"
+  "branch": "dev"
 }
 ```
 
@@ -763,27 +767,34 @@ The target directory must be empty unless you pass `--force` (a lone `.git` is i
 
 ## Set up a project (`init`)
 
-`neon init` sets up this directory for Neon.
+`neon init` sets up this directory for Neon as one flow: agents, a linked project, and optionally `neon.ts`.
+
+An empty directory (nothing except `.git`) asks how to set up the directory. Pick a starter template, or skip scaffolding and only install agent tooling, link a project, and optionally write `neon.ts`. That skip is only on `init` — `neon bootstrap` always scaffolds.
 
-An empty directory (nothing except `.git`) runs `neon bootstrap .` and stops. With `-y` that is `neon bootstrap . --default`. Bootstrap handles scaffolding, agent tooling, and linking. Interactive bootstrap prints a NEON banner, asks every setup question, then runs the work — dependency install last, except when a `neon.ts` needs deps before `link`.
+`-y` in an empty directory scaffolds the default template (`bootstrap --default`) and does not add a later `config init` step. `--skip-template` skips scaffolding even with `-y`. `--template <id>` scaffolds that template; combine it with `-y` to skip the remaining bootstrap pickers.
 
-An existing app installs agent tooling, then `neon link` unless `.neon` already has a projectId, then `neon config init`. Interactive `config init` opens the services picker; `-y` uses `--services none` (starter policy).
+An existing app (or skip-template) installs agent tooling, then `neon link --no-config` unless `.neon` already has a projectId, then asks whether to create `neon.ts`. Saying no skips the services picker and does not write the file. `--no-config` does the same without asking. `-y` writes `config init --services none` unless `--no-config`. `--services` implies creating `neon.ts`.
 
 In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. It never runs plugin and skills+MCP together.
 
 ```bash
 $ neon init
+$ neon init --skip-template
 $ neon init -y
 $ neon init --agent cursor --agent claude-code
 ```
 
 Without a TTY, pass `-y`. `--agent` skips agent selection but does not replace `-y` for link or templates.
 
-`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. Existing app: plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent; otherwise skills and MCP. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
+`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. `--skip-template` or an existing app: plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent; otherwise skills and MCP. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
 
 `--agent` / `-a` (repeatable) names coding agents and skips agent selection, interactive or with `-y`. Init forwards those names to `plugins`, or to `skills` and `mcp`, not both.
 
-`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to `bootstrap`, `--yes` to `link`, and `--services none` to `config init`. `--agent` is forwarded with them. `mcp -y` is the global install. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
+`--project-id`, `--org-id`, `--project-name`, `--region-id`, and `--branch` are forwarded to `link`, including the link step inside nested bootstrap when a template is scaffolded. They are not filled from `.neon`; a linked directory is not relinked unless you pass one of those flags.
+
+`--config`, `--no-config`, and `--services` apply on the existing-app and `--skip-template` path. A template's own `neon.ts` is left as the template shipped it. Passing those flags while scaffolding prints a warning and still copies the template as shipped. After a new `neon.ts` on a pinned branch, init runs `env pull`.
+
+`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to nested bootstrap, `--yes --no-config` to `link`, and `--services none` to `config init`. `--agent` is forwarded with them. `mcp -y` is the global install. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
 
 A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
@@ -946,6 +957,40 @@ neon snapshots schedule set --branch main --schedule '[{"frequency":"weekly","da
 
 All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
 
+## Function triggers (`triggers`)
+
+`neon triggers` (alias `neon trigger`) manages **scheduled function triggers** on a branch — cron jobs that invoke a Neon Function. Beta. The only trigger type is `schedule`; cron is a five-field UTC expression.
+
+Every sub-command resolves the project through the standard chain (`--project-id`, then the `.neon` context file, then a single-project auto-detect) and the branch through `--branch <id|name>`, the `.neon` pin, or the project's default branch.
+
+```bash
+neon triggers create --function-slug uptime --name uptime-check --cron '*/15 * * * *'
+neon triggers list
+neon triggers get trigger-test-123
+neon triggers update trigger-test-123 --cron '0 3 * * *'
+neon triggers enable trigger-test-123
+neon triggers disable trigger-test-123
+neon triggers delete trigger-test-123
+```
+
+`enable` / `disable` are wrappers over `update --enabled`. List shows `inherited` when the effective config was authored on an ancestor branch.
+
+## Branch credentials (`credentials`)
+
+`neon credentials` (alias `neon credential`) lists, issues, reveals, rotates, and revokes **branch-scoped credentials** — the tokens behind Object Storage (`AWS_*`) and the AI Gateway (`NEON_AI_GATEWAY_TOKEN`). Beta. In regions where those services exist, a new project already has default credentials named `Default AI gateway credential` and `Default object storage credential`; `list` then `reveal` recovers their secrets without minting another token.
+
+```bash
+neon credentials list
+neon credentials create --name app --scope storage:read --scope storage:write
+neon credentials reveal nak_live_…
+neon credentials rotate nak_live_…
+neon credentials revoke nak_live_…
+```
+
+`create` always issues a customer-managed (`user`) credential. `--scope` is repeatable; `--help` lists the values. `reveal` and `rotate` print `api_token` and `s3_secret_access_key`. Rotation keeps the same `token_id` (it is the `AWS_ACCESS_KEY_ID`) and is not idempotent: a retry after a lost response mints another secret.
+
+All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
+
 ## Database diagnostics (`inspect`)
 
 `neon inspect db stalled-queries` takes a read-only snapshot of active queries that have run for more than 30 seconds and groups parallel workers with their leader. Oldest group first. Table output shows duration, wait event, blocking pids, role, query group, and query. `--output json` adds timestamps, query IDs, pids, database, and the rest of the row. A blocking pid can belong to an idle-in-transaction backend this command does not list; `neon inspect db locks` shows lock holders.
@@ -1285,6 +1330,8 @@ Id   Name      Project         Created At            Last Used At          Last
 | logs                                                                       | `query`, `fields`, `field-values`                                                                            | Query branch logs (Beta)           |
 | inspect                                                                    | `db stalled-queries`                                                                                         | Inspect Postgres diagnostics       |
 | snapshots                                                                  | `list`, `get`, `create`, `update`, `delete`, `restore`, `finalize`, `schedule get`, `schedule set`           | Manage snapshots                   |
+| triggers                                                                   | `list`, `get`, `create`, `update`, `enable`, `disable`, `delete`                                             | Manage function triggers           |
+| credentials                                                                | `list`, `create`, `reveal`, `rotate`, `revoke`                                                               | Manage branch credentials          |
 | [connection-string](https://neon.com/docs/reference/cli-connection-string) |                                                                                                              | Get connection string              |
 | [psql](https://neon.com/docs/reference/cli-psql)                           |                                                                                                              | Connect to a database via psql     |
 | set-context                                                                |                                                                                                              | Deprecated; use `link`             |

package/dist/analytics.js

@@ -156,13 +156,20 @@ const closeAnalytics = async (opts) => {
 		log.debug("Flushed CLI analytics");
 	}
 };
+const getErrorAnalyticsEventContext = (_args) => ({
+	version: pkg_default.version,
+	ci: isCi(),
+	agent: getCliAgent(process.env)
+});
+const CREDENTIAL_TOKEN_ID = /\bnak_live_[0-9a-f]+\b/gi;
+const redactCredentialTokenIds = (text) => text.replace(CREDENTIAL_TOKEN_ID, "nak_live_<redacted>");
 const getErrorAnalyticsEventProperties = (err, errCode, context) => {
 	const apiError = isNeonApiError(err) ? err : void 0;
 	const requestId = apiError?.headers?.["x-neon-ret-request-id"];
 	return {
 		...context,
-		message: err.message,
-		stack: err.stack,
+		message: redactCredentialTokenIds(err.message),
+		stack: err.stack ? redactCredentialTokenIds(err.stack) : err.stack,
 		errCode,
 		statusCode: apiError?.status,
 		requestId
@@ -188,15 +195,10 @@ const trackEvent = (event, properties) => {
 	});
 	log.debug("Sent CLI event: %s", event);
 };
-const getErrorAnalyticsEventContext = (_args) => ({
-	version: pkg_default.version,
-	ci: isCi(),
-	agent: getCliAgent(process.env)
-});
 const analyticsCommand = (args) => {
 	const command = args._.join(" ");
-	if (args._[0] !== "ask" || typeof args.prompt !== "string") return command;
-	return `${command} ${args.prompt}`;
+	const raw = args._[0] !== "ask" || typeof args.prompt !== "string" ? command : `${command} ${args.prompt}`;
+	return redactCredentialTokenIds(raw);
 };
 const getAnalyticsEventProperties = (args) => ({
 	version: pkg_default.version,

package/dist/api.js

@@ -872,6 +872,85 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				auth_user_id: authUserId
 			},
 			body: data
+		})),
+		listProjectBranchTriggers: (projectId, branchId) => call(() => raw.listProjectBranchTriggers({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		getProjectBranchTrigger: (projectId, branchId, triggerId) => call(() => raw.getProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			}
+		})),
+		createProjectBranchTrigger: (projectId, branchId, data) => call(() => raw.createProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		updateProjectBranchTrigger: (projectId, branchId, triggerId, data) => call(() => raw.updateProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			},
+			body: data
+		})),
+		deleteProjectBranchTrigger: (projectId, branchId, triggerId) => call(() => raw.deleteProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			}
+		})),
+		listCredentials: (projectId, branchId) => call(() => raw.listCredentials({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		createCredential: (projectId, branchId, data) => call(() => raw.createCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		revokeCredential: (projectId, branchId, tokenId) => call(() => raw.revokeCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
+		})),
+		revealCredential: (projectId, branchId, tokenId) => call(() => raw.revealCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
+		})),
+		rotateCredential: (projectId, branchId, tokenId) => call(() => raw.rotateCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
 		}))
 	};
 };

package/dist/commands/bootstrap.js

@@ -8,14 +8,14 @@ import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, s
 import { spawnCliChild } from "../init/child.js";
 import { agentSetupDoneLabel, formatInitDone, printInitBanner, printInitDone, shouldPrintInitBanner } from "../init/chrome.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
-import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
+import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, planLinkStep, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
+import { formatTemplateTitle } from "../init/template_title.js";
 import { pickAgentSetupInteractively } from "../init/wizard.js";
 import { runAgentTooling, runInitSteps } from "../init/tooling.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import chalk from "chalk";
 import prompts from "prompts";
 //#region src/commands/bootstrap.ts
 var bootstrap_exports = /* @__PURE__ */ __exportAll({
@@ -102,20 +102,19 @@ const handler = async (props) => {
 		}
 		return;
 	}
-	if (shouldPrintInitBanner(props.default)) printInitBanner();
+	if (props.printBanner !== false && shouldPrintInitBanner(props.default)) printInitBanner();
 	const named = resolveNamedAgents(props.agent ?? []);
 	if (props.agentSetup !== false) assertNamedAgentTooling(named, "bootstrap", {
 		...props.directory !== void 0 && props.directory.length > 0 ? { directory: props.directory } : {},
 		...props.default ? { yes: true } : {}
 	});
-	const templates = await resolveTemplateList(props);
 	const interactive = !props.default && Boolean(process.stdout.isTTY) && !isCi();
-	const template = await resolveSelectedTemplate(props, interactive, templates);
+	const template = props.selectedTemplate ?? await resolveSelectedTemplate(props, interactive, await resolveTemplateList(props));
 	const targetDir = await resolveTargetDir(props, interactive, template);
 	ensureTargetUsable(targetDir, props.force);
 	await scaffold(template, targetDir);
 	printScaffolded(template, targetDir);
-	await runPostScaffoldSteps(props, targetDir, interactive, template, named);
+	return runPostScaffoldSteps(props, targetDir, interactive, template, named);
 };
 /**
 * The template list to choose from. When --template is given we try the
@@ -123,18 +122,6 @@ const handler = async (props) => {
 * remote manifest if the id isn't one of the defaults.
 */
 const resolveTemplateList = async (props) => props.template && findTemplate(FALLBACK_TEMPLATES, props.template) ? FALLBACK_TEMPLATES : fetchTemplates();
-/**
-* The picker label for a template: the title first, then the Neon services it
-* uses as a dim, italic suffix, e.g. "Hono API …  Postgres · Functions". The
-* suffix is styled with chalk.dim (and italic) only — never a foreground color —
-* so it survives the cyan/underline `prompts` paints over the focused row: dim
-* and italic reset with their own SGRs, leaving the row's color and underline
-* intact. Descriptions are intentionally omitted to keep the picker uncluttered.
-*/
-const formatTemplateTitle = (template) => {
-	if (!template.services || template.services.length === 0) return template.title;
-	return `${template.title}  ${chalk.dim.italic(template.services.join(" · "))}`;
-};
 const resolveSelectedTemplate = async (props, interactive, templates) => {
 	if (props.template) {
 		const template = findTemplate(templates, props.template);
@@ -188,20 +175,19 @@ const scaffold = async (template, targetDir) => {
 	log.info("Scaffolded %d files into %s.", filesWritten, targetDir);
 	return filesWritten;
 };
+const nestedResult = (template, targetDir, hasNeonConfig, outcome) => ({
+	templateTitle: template.title,
+	targetDir,
+	hasNeonConfig,
+	...outcome
+});
 const runPostScaffoldSteps = async (props, targetDir, interactive, template, named) => {
 	const inferred = inferPackageManager(targetDir);
 	const defaultPm = resolvePackageManager(targetDir);
 	const neonConfig = hasNeonConfig(targetDir);
-	if (props.default) {
-		await runDefaultSteps(props, targetDir, defaultPm, neonConfig, template, named);
-		return;
-	}
+	if (props.default) return runDefaultSteps(props, targetDir, defaultPm, neonConfig, template, named);
 	if (!interactive) {
-		printDoneSummary({
-			heading: "Project scaffolded.",
-			template,
-			targetDir,
-			pm: defaultPm,
+		const outcome = {
 			installed: false,
 			installFailed: false,
 			gitFailed: false,
@@ -209,10 +195,18 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 			agentSetup: "skip",
 			linked: false,
 			skippedLinkForDeps: false,
-			suggestLink: true,
 			agentsRan: false
+		};
+		finishPostScaffold({
+			heading: "Project scaffolded.",
+			template,
+			targetDir,
+			pm: defaultPm,
+			...outcome,
+			suggestLink: true,
+			skipPrint: props.skipDoneSummary === true
 		});
-		return;
+		return nestedResult(template, targetDir, neonConfig, outcome);
 	}
 	let pm = defaultPm;
 	const wantInstall = props.install && await confirm(installPrompt(inferred));
@@ -239,8 +233,10 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 		targetDir,
 		pm,
 		...outcome,
-		suggestLink: !outcome.linked
+		suggestLink: !outcome.linked,
+		skipPrint: props.skipDoneSummary === true
 	});
+	return nestedResult(template, targetDir, neonConfig, outcome);
 };
 const installPrompt = (inferred) => inferred ? `Install dependencies with ${inferred}?` : "Install dependencies?";
 /** `link --yes` still asks for a project unless one is already linked. */
@@ -265,11 +261,16 @@ const runDefaultSteps = async (props, targetDir, pm, neonConfig, template, named
 		targetDir,
 		pm,
 		...outcome,
-		suggestLink: !outcome.linked
+		suggestLink: !outcome.linked,
+		skipPrint: props.skipDoneSummary === true
 	});
+	return nestedResult(template, targetDir, neonConfig, outcome);
 };
 const executePostScaffold = async (props, targetDir, choices) => {
-	const kids = bootstrapChildren(props, targetDir);
+	const kids = {
+		...bootstrapChildren(props, targetDir),
+		...props.narrate ? { narrate: props.narrate } : {}
+	};
 	let installed = false;
 	let installFailed = false;
 	let gitFailed = false;
@@ -321,7 +322,10 @@ const executePostScaffold = async (props, targetDir, choices) => {
 			logSkippedLink(choices.pm);
 			continue;
 		}
-		await runInitSteps([choices.yes ? ["link", "--yes"] : ["link"]], {
+		await runInitSteps([props.linkNoConfig === true ? planLinkStep({
+			yes: choices.yes,
+			extra: props.linkExtra
+		}) : choices.yes ? ["link", "--yes"] : ["link"]], {
 			cwd: targetDir,
 			...kids
 		});
@@ -450,7 +454,7 @@ const printDoneSummary = (input) => {
 	}));
 };
 const finishPostScaffold = (input) => {
-	printDoneSummary(input);
+	if (!input.skipPrint) printDoneSummary(input);
 	if (input.installFailed || input.gitFailed) throw new Error("Setup did not finish.");
 };
 const isCurrentDir = (targetDir) => relative(process.cwd(), targetDir) === "";

package/dist/commands/checkout.js

@@ -28,7 +28,7 @@ const formatCheckoutPolicyFailure = (opts) => {
 	return [
 		`Branch ${opts.branchName} (${opts.branchId}) was created and checked out, but applying neon.ts to it failed: ${opts.failure}`,
 		`The branch is usable but does not match the policy, and \`${cli} checkout\` never reconciles a branch that already exists.`,
-		`Fix the cause above, then run \`${cli} deploy --update-existing${envArg}\` to apply the policy to it — or, if your policy only configures new branches (keyed on \`!branch.exists\`), delete the branch and check it out again: \`${cli} branches delete ${opts.branchName}\` then \`${cli} checkout ${opts.branchName}${envArg}\`.`
+		`Fix the cause above, then run \`${cli} deploy --update-existing${envArg}\` to apply the policy to it — or, if your policy only configures new branches (keyed on \`!branch.exists\`), delete the branch and check it out again: \`${cli} branches delete ${opts.branchName}\` then \`${cli} checkout ${opts.branchName} --create${envArg}\`.`
 	].join("\n");
 };
 const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").positional("id", {
@@ -44,6 +44,11 @@ const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").position
 		type: "boolean",
 		default: true
 	},
+	create: {
+		describe: "Create the named branch if it does not exist, then check it out",
+		type: "boolean",
+		default: false
+	},
 	...envFlag,
 	env: {
 		...envFlag.env,
@@ -52,12 +57,14 @@ const builder = (argv) => argv.usage("$0 checkout [id|name] [options]").position
 }).example([
 	["$0 checkout", "Pick a branch interactively from the project in the closest .neon file"],
 	["$0 checkout main", "Pin the branch named \"main\" in the closest .neon file"],
-	["$0 checkout feat --env .env.local", "Create feat from neon.ts, loading Function env from .env.local first"],
+	["$0 checkout dev --create", "Create and pin a missing branch named dev"],
+	["$0 checkout feat --create --env .env.local", "Create feat from neon.ts, loading Function env from .env.local first"],
 	["$0 checkout br-cool-snow-12345678 --project-id project-id-123", "Pin a branch by id for an explicit project"]
 ]);
 const handler = async (props) => {
 	const previousBranch = contextBranch(readContextFile(props.contextFile));
 	if (previousBranch) log.info("%s Currently on branch %s", chalk.dim("→"), chalk.cyan.bold(previousBranch));
+	if (props.create && !props.id?.trim()) throw new Error(`No branch specified. Pass a branch name with --create (e.g. \`${getCliName()} checkout dev --create\`).`);
 	const projectId = await resolveProjectId(props);
 	const { branchId, branchName, created, policyApplied, policyFailure } = await resolveBranchId(props, projectId);
 	const orgId = await resolveOrgId(props, projectId);
@@ -137,8 +144,10 @@ const resolveBranchId = async (props, projectId) => {
 		created: false,
 		policyApplied: false
 	};
-	if (isCi() || !process.stdout.isTTY) throw new Error(notFoundMessage(ref, branches));
-	log.error(notFoundMessage(ref, branches));
+	if (props.create) return createCheckoutBranch(props, projectId, ref, branches);
+	const missingName = notFoundMessage(ref, branches, { suggestCreate: true });
+	if (isCi() || !process.stdout.isTTY) throw new Error(missingName);
+	log.error(missingName);
 	const { create } = await prompts({
 		type: "confirm",
 		name: "create",
@@ -178,7 +187,7 @@ const createCheckoutBranch = async (props, projectId, name, branches) => {
 		policyApplied: false
 	};
 };
-const notFoundMessage = (ref, branches) => `Branch ${ref} not found.\nAvailable branches: ${branches.map((b) => b.name).join(", ")}`;
+const notFoundMessage = (ref, branches, opts) => `Branch ${ref} not found.${opts?.suggestCreate ? " Pass --create to create it." : ""}\nAvailable branches: ${branches.map((b) => b.name).join(", ")}`;
 /**
 * Resolve the org id to heal into the context file.
 *

package/dist/commands/config.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
-import { contextBranch, readContextFile } from "../context.js";
+import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -229,6 +229,7 @@ const initCmd = async (props) => {
 		const args = installArgs(pm, missing);
 		if (props.install === false) log.info("Install the Neon config packages to use neon.ts: %s", formatInstallCommand(pm, missing));
 		else {
+			ensureDirectoryGitignored(join(cwd, "node_modules"));
 			log.info("Installing %s with %s…", missing.join(", "), pm);
 			if (!await run(pm, args, cwd)) log.warning("Could not install the config packages automatically. Run by hand: %s", formatInstallCommand(pm, missing));
 		}

package/dist/commands/credentials.js

@@ -0,0 +1,146 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { isNeonApiError, messageFromBody, retryOnLock } from "../api.js";
+import { writer } from "../writer.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+//#region src/commands/credentials.ts
+var credentials_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	create: () => create,
+	describe: () => describe,
+	handler: () => handler,
+	list: () => list,
+	reveal: () => reveal,
+	revoke: () => revoke,
+	rotate: () => rotate
+});
+const CREDENTIAL_SCOPES = [
+	"storage:read",
+	"storage:write",
+	"ai_gateway:invoke",
+	"functions:invoke"
+];
+const LIST_FIELDS = [
+	"token_id",
+	"name",
+	"principal_type",
+	"scopes",
+	"created_at"
+];
+const SECRET_META_FIELDS = [
+	"token_id",
+	"name",
+	"scopes"
+];
+const renderColumns = { scopes: (c) => (c.scopes ?? []).join(", ") };
+/** Translate a token-id 404 into a resource-specific message; re-throw everything else. */
+async function withCredentialNotFound(tokenId, branchId, run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) {
+			if ((messageFromBody(err.data) ?? "").includes("platform credentials not available")) throw err;
+			throw new Error(`Credential ${tokenId} not found on branch ${branchId}.`);
+		}
+		throw err;
+	}
+}
+/**
+* Secrets are shown only once (create/rotate) or on demand (reveal). Table
+* output keeps them off the grid so they stay one selectable line; json/yaml
+* keep them on the object for scripts.
+*/
+const reportSecrets = (props, data, warning) => {
+	const out = writer(props);
+	if (props.output === "table") {
+		out.write(data, { fields: SECRET_META_FIELDS });
+		out.end();
+		const apiToken = "api_token" in data && typeof data.api_token === "string" ? data.api_token : "";
+		const secretKey = "s3_secret_access_key" in data && typeof data.s3_secret_access_key === "string" ? data.s3_secret_access_key : "";
+		out.text(`api_token: ${apiToken}\n`);
+		out.text(`s3_secret_access_key: ${secretKey}\n`);
+	} else out.end(data, { fields: [
+		"token_id",
+		"name",
+		"scopes",
+		"api_token",
+		"s3_secret_access_key"
+	] });
+	log.warning(warning);
+};
+const command = "credentials";
+const describe = "Manage branch credentials";
+const aliases = ["credential"];
+const builder = (argv) => argv.usage("$0 credentials <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("list", "List credentials on the branch", (yargs) => yargs, (args) => list(args)).command("create", "Issue a scoped credential on the branch", (yargs) => yargs.options({
+	name: {
+		describe: "Label for the credential",
+		type: "string"
+	},
+	scope: {
+		describe: "Capability to grant. Repeatable. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke",
+		type: "string",
+		array: true,
+		choices: CREDENTIAL_SCOPES,
+		demandOption: true
+	}
+}), (args) => create(args)).command("reveal <tokenId>", "Show a credential's api_token and s3_secret_access_key", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => reveal(args)).command("rotate <tokenId>", "Replace a credential's secrets in place. The token id is unchanged.", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => rotate(args)).command("revoke <tokenId>", "Revoke a credential", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => revoke(args));
+const handler = (args) => {
+	return args;
+};
+const list = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await props.apiClient.listCredentials(props.projectId, branchId);
+	writer(props).end(data.credentials, {
+		fields: LIST_FIELDS,
+		renderColumns,
+		emptyMessage: "No credentials found on this branch."
+	});
+};
+const create = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const scopes = (Array.isArray(props.scope) ? props.scope : [props.scope]).filter((scope) => CREDENTIAL_SCOPES.some((allowed) => allowed === scope));
+	if (scopes.length === 0) throw new Error("Pass at least one --scope. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke");
+	const { data } = await retryOnLock(() => props.apiClient.createCredential(props.projectId, branchId, {
+		scopes,
+		principal_type: "user",
+		...props.name !== void 0 ? { name: props.name } : {}
+	}));
+	reportSecrets(props, data, "Store these secrets now: they are not shown again unless you run neon credentials reveal.");
+};
+const reveal = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => props.apiClient.revealCredential(props.projectId, branchId, props.tokenId));
+	reportSecrets(props, data, "These are live secrets. Treat them like a password.");
+};
+const rotate = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.rotateCredential(props.projectId, branchId, props.tokenId)));
+	reportSecrets(props, data, "Store the new secrets now: a retry mints another pair and does not recover a lost response. A replica may briefly accept the previous secret.");
+};
+const revoke = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.revokeCredential(props.projectId, branchId, props.tokenId)));
+	log.info(`Credential ${props.tokenId} revoked`);
+};
+//#endregion
+export { aliases, builder, command, create, describe, handler, list, reveal, revoke, rotate, credentials_exports as t };

package/dist/commands/index.js

@@ -12,6 +12,7 @@ import { t as link_exports } from "./link.js";
 import { t as checkout_exports } from "./checkout.js";
 import { t as claim_exports } from "./claim.js";
 import { t as connection_string_exports } from "./connection_string.js";
+import { t as credentials_exports } from "./credentials.js";
 import { t as data_api_exports } from "./data_api.js";
 import { t as databases_exports } from "./databases.js";
 import { t as deploy_exports } from "./deploy.js";
@@ -35,6 +36,7 @@ import { t as set_context_exports } from "./set_context.js";
 import { t as skills_exports } from "./skills.js";
 import { t as snapshots_exports } from "./snapshots.js";
 import { t as status_exports } from "./status.js";
+import { t as triggers_exports } from "./triggers.js";
 import { t as user_exports } from "./user.js";
 import { t as vpc_endpoints_exports } from "./vpc_endpoints.js";
 //#region src/commands/index.ts
@@ -70,6 +72,8 @@ var commands_default = [
 	ask_exports,
 	data_api_exports,
 	functions_exports,
+	triggers_exports,
+	credentials_exports,
 	dev_exports,
 	diff_exports,
 	config_exports,