neon 4.15.0 → 4.17.0

package/README.md

@@ -767,27 +767,34 @@ The target directory must be empty unless you pass `--force` (a lone `.git` is i
 
 ## Set up a project (`init`)
 
-`neon init` sets up this directory for Neon.
+`neon init` sets up this directory for Neon as one flow: agents, a linked project, and optionally `neon.ts`.
 
-An empty directory (nothing except `.git`) runs `neon bootstrap .` and stops. With `-y` that is `neon bootstrap . --default`. Bootstrap handles scaffolding, agent tooling, and linking. Interactive bootstrap prints a NEON banner, asks every setup question, then runs the work — dependency install last, except when a `neon.ts` needs deps before `link`.
+An empty directory (nothing except `.git`) asks how to set up the directory. Pick a starter template, or skip scaffolding and only install agent tooling, link a project, and optionally write `neon.ts`. That skip is only on `init` — `neon bootstrap` always scaffolds.
 
-An existing app installs agent tooling, then `neon link` unless `.neon` already has a projectId, then `neon config init`. Interactive `config init` opens the services picker; `-y` uses `--services none` (starter policy).
+`-y` in an empty directory scaffolds the default template (`bootstrap --default`) and does not add a later `config init` step. `--skip-template` skips scaffolding even with `-y`. `--template <id>` scaffolds that template; combine it with `-y` to skip the remaining bootstrap pickers.
+
+An existing app (or skip-template) installs agent tooling, then `neon link --no-config` unless `.neon` already has a projectId, then asks whether to create `neon.ts`. Saying no skips the services picker and does not write the file. `--no-config` does the same without asking. `-y` writes `config init --services none` unless `--no-config`. `--services` implies creating `neon.ts`.
 
 In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. It never runs plugin and skills+MCP together.
 
 ```bash
 $ neon init
+$ neon init --skip-template
 $ neon init -y
 $ neon init --agent cursor --agent claude-code
 ```
 
 Without a TTY, pass `-y`. `--agent` skips agent selection but does not replace `-y` for link or templates.
 
-`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. Existing app: plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent; otherwise skills and MCP. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
+`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. `--skip-template` or an existing app: plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent; otherwise skills and MCP. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
 
 `--agent` / `-a` (repeatable) names coding agents and skips agent selection, interactive or with `-y`. Init forwards those names to `plugins`, or to `skills` and `mcp`, not both.
 
-`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to `bootstrap`, `--yes` to `link`, and `--services none` to `config init`. `--agent` is forwarded with them. `mcp -y` is the global install. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
+`--project-id`, `--org-id`, `--project-name`, `--region-id`, and `--branch` are forwarded to `link`, including the link step inside nested bootstrap when a template is scaffolded. They are not filled from `.neon`; a linked directory is not relinked unless you pass one of those flags.
+
+`--config`, `--no-config`, and `--services` apply on the existing-app and `--skip-template` path. A template's own `neon.ts` is left as the template shipped it. Passing those flags while scaffolding prints a warning and still copies the template as shipped. After a new `neon.ts` on a pinned branch, init runs `env pull`.
+
+`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to nested bootstrap, `--yes --no-config` to `link`, and `--services none` to `config init`. `--agent` is forwarded with them. `mcp -y` is the global install. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
 
 A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
@@ -950,6 +957,40 @@ neon snapshots schedule set --branch main --schedule '[{"frequency":"weekly","da
 
 All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
 
+## Function triggers (`triggers`)
+
+`neon triggers` (alias `neon trigger`) manages **scheduled function triggers** on a branch — cron jobs that invoke a Neon Function. Beta. The only trigger type is `schedule`; cron is a five-field UTC expression.
+
+Every sub-command resolves the project through the standard chain (`--project-id`, then the `.neon` context file, then a single-project auto-detect) and the branch through `--branch <id|name>`, the `.neon` pin, or the project's default branch.
+
+```bash
+neon triggers create --function-slug uptime --name uptime-check --cron '*/15 * * * *'
+neon triggers list
+neon triggers get trigger-test-123
+neon triggers update trigger-test-123 --cron '0 3 * * *'
+neon triggers enable trigger-test-123
+neon triggers disable trigger-test-123
+neon triggers delete trigger-test-123
+```
+
+`enable` / `disable` are wrappers over `update --enabled`. List shows `inherited` when the effective config was authored on an ancestor branch.
+
+## Branch credentials (`credentials`)
+
+`neon credentials` (alias `neon credential`) lists, issues, reveals, rotates, and revokes **branch-scoped credentials** — the tokens behind Object Storage (`AWS_*`) and the AI Gateway (`NEON_AI_GATEWAY_TOKEN`). Beta. In regions where those services exist, a new project already has default credentials named `Default AI gateway credential` and `Default object storage credential`; `list` then `reveal` recovers their secrets without minting another token.
+
+```bash
+neon credentials list
+neon credentials create --name app --scope storage:read --scope storage:write
+neon credentials reveal nak_live_…
+neon credentials rotate nak_live_…
+neon credentials revoke nak_live_…
+```
+
+`create` always issues a customer-managed (`user`) credential. `--scope` is repeatable; `--help` lists the values. `reveal` and `rotate` print `api_token` and `s3_secret_access_key`. Rotation keeps the same `token_id` (it is the `AWS_ACCESS_KEY_ID`) and is not idempotent: a retry after a lost response mints another secret.
+
+All sub-commands honor the [global options](#global-options), including `--output json|yaml|table`.
+
 ## Database diagnostics (`inspect`)
 
 `neon inspect db stalled-queries` takes a read-only snapshot of active queries that have run for more than 30 seconds and groups parallel workers with their leader. Oldest group first. Table output shows duration, wait event, blocking pids, role, query group, and query. `--output json` adds timestamps, query IDs, pids, database, and the rest of the row. A blocking pid can belong to an idle-in-transaction backend this command does not list; `neon inspect db locks` shows lock holders.
@@ -1289,6 +1330,8 @@ Id   Name      Project         Created At            Last Used At          Last
 | logs                                                                       | `query`, `fields`, `field-values`                                                                            | Query branch logs (Beta)           |
 | inspect                                                                    | `db stalled-queries`                                                                                         | Inspect Postgres diagnostics       |
 | snapshots                                                                  | `list`, `get`, `create`, `update`, `delete`, `restore`, `finalize`, `schedule get`, `schedule set`           | Manage snapshots                   |
+| triggers                                                                   | `list`, `get`, `create`, `update`, `enable`, `disable`, `delete`                                             | Manage function triggers           |
+| credentials                                                                | `list`, `create`, `reveal`, `rotate`, `revoke`                                                               | Manage branch credentials          |
 | [connection-string](https://neon.com/docs/reference/cli-connection-string) |                                                                                                              | Get connection string              |
 | [psql](https://neon.com/docs/reference/cli-psql)                           |                                                                                                              | Connect to a database via psql     |
 | set-context                                                                |                                                                                                              | Deprecated; use `link`             |

package/dist/_chunks/{env-DsakkOVZ.js → env-B75xufe_.js}

@@ -1,27 +1,26 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
-import { S as toEntries, _ as functionBaseUrlKey, a as envKeysForSelection, b as previewCredentialScopes, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as fetchEnvKeysState, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as isFunctionBaseUrlKey, x as resolveBranchPolicy, y as policyEnvKeys } from "./env_services-CAWrZTWa.js";
+import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-CbARRnq9.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { credentialScopesSatisfied } from "@neon/config/v1";
 import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError as isPlatformError$1, loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
 /**
-* Resolve a branch's env while keeping one-time secrets the caller already holds.
+* Resolve a branch's env while keeping secrets the caller already holds.
 *
-* {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
-* credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
-* them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
-* pull` would leave a live credential behind each time. This is the wrapper that avoids that:
-* it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
-* for only the rest.
+* {@link fetchEnvKeys} reveals the platform default credentials (or mints a fallback when a
+* region has none). Calling it on every `neon dev` start would rewrite `.env` with freshly
+* revealed secrets each time. This wrapper looks at what the caller already has, keeps a
+* half when it already *is* that default (storage and gateway are independent credentials),
+* and asks `fetchEnv` for only the rest.
 *
 * The check is a real verification, not a presence test. A persisted secret is kept only when
-* it names a credential that still exists on this branch, is not revoked or expired, and
-* carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
-* the console, one copied in from another branch, or one predating a newly-enabled feature all
-* fail that check and get replaced.
+* it names a credential that still exists on this branch, is not revoked or expired, and —
+* when defaults exist — *is* that default. A leftover `neon-env ${branch}` credential this
+* tool minted is replaced by the defaults and revoked. A `.env.example` placeholder, a
+* credential revoked in the console, or one copied in from another branch fails that check.
 *
 * None of this needs local bookkeeping, because the secrets carry their own credential id:
 * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
@@ -71,47 +70,47 @@ async function fetchEnvReusingSecrets(config, options) {
 	const persisted = readPersistedSecrets(source);
 	const storageCredentialManaged = requested === null || storageCredentialSelected;
 	const gatewayCredentialManaged = requested === null || gatewayCredentialSelected;
-	const complete = (!storageCredentialSelected || Boolean(persisted.accessKeyId && persisted.secretAccessKey)) && (!gatewayCredentialSelected || Boolean(persisted.apiToken));
-	const named = storageCredentialManaged && persisted.accessKeyId !== "" || gatewayCredentialManaged && persisted.apiToken !== "" ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted) : {
+	const storageComplete = Boolean(persisted.accessKeyId && persisted.secretAccessKey);
+	const gatewayComplete = Boolean(persisted.apiToken);
+	const listed = storageCredentialManaged && persisted.accessKeyId !== "" || gatewayCredentialManaged && persisted.apiToken !== "" ? await api.listCredentials(options.projectId, branch.id) : [];
+	const named = listed.length > 0 ? namedCredentials(listed, persisted) : {
 		storage: null,
 		gateway: null
 	};
-	const reusable = complete ? reusableCredential(named, {
-		storageEnabled: storageCredentialSelected,
-		gatewayEnabled: gatewayCredentialSelected
-	}) : null;
-	const scopes = previewCredentialScopes(desired.preview, {
-		storage: storageCredentialSelected,
-		aiGateway: gatewayCredentialSelected
-	});
-	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-	const fetchKeys = requested === null ? null : keep ? selectedPolicyKeys.filter((key) => !secretKeys.includes(key)) : selectedPolicyKeys;
+	const now = Date.now();
+	const storageDefault = defaultStorageCredential(listed, now);
+	const gatewayDefault = defaultAiGatewayCredential(listed, now);
+	const keepStorage = !storageCredentialSelected || storageComplete && halfReusable(named.storage, storageDefault, ["storage:read", "storage:write"]);
+	const keepGateway = !gatewayCredentialSelected || gatewayComplete && halfReusable(named.gateway, gatewayDefault, ["ai_gateway:invoke"]);
+	const keptSecretKeys = credentialEnvKeys({
+		storage: storageCredentialSelected && keepStorage,
+		aiGateway: gatewayCredentialSelected && keepGateway
+	}).filter((key) => selected.has(key));
+	const fetchKeys = requested === null ? null : selectedPolicyKeys.filter((key) => !keptSecretKeys.includes(key));
 	const fetched = await fetchEnvKeysState(config, {
 		...fetchOptions,
 		branchId: branch.id,
 		api,
-		...keep && requested === null ? { omitKeys: secretKeys } : {}
+		...keptSecretKeys.length > 0 && requested === null ? { omitKeys: keptSecretKeys } : {}
 	}, fetchKeys);
 	const vars = preferPersisted(toEntries(fetched.env), source);
 	const unavailable = fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {};
-	if (keep) {
-		for (const key of secretKeys) {
-			const value = source[key];
-			if (value !== void 0) vars[key] = value;
-		}
-		return {
-			vars,
-			credential: {
-				issued: false,
-				keys: secretKeys,
-				revoked: [],
-				superseded: []
-			},
-			...unavailable
-		};
+	for (const key of keptSecretKeys) {
+		const value = source[key];
+		if (value !== void 0) vars[key] = value;
 	}
+	if (!(storageCredentialSelected && !keepStorage || gatewayCredentialSelected && !keepGateway)) return {
+		vars,
+		credential: {
+			issued: false,
+			keys: secretKeys,
+			revoked: [],
+			superseded: []
+		},
+		...unavailable
+	};
 	const ours = /* @__PURE__ */ new Set();
-	for (const meta of [storageCredentialManaged ? named.storage : null, gatewayCredentialManaged ? named.gateway : null]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
+	for (const meta of [storageCredentialManaged && !keepStorage ? named.storage : null, gatewayCredentialManaged && !keepGateway ? named.gateway : null]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
 	if (revokeSuperseded) for (const tokenId of ours) await api.revokeCredential(options.projectId, branch.id, tokenId);
 	return {
 		vars,
@@ -162,13 +161,6 @@ function preferPersisted(vars, source) {
 function gatewayTokenIdShort(apiToken) {
 	return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
 }
-/** Whether an issued credential can still be used: not revoked, not past its expiry. */
-function isLiveCredential(meta, now) {
-	if (meta.revokedAt !== void 0) return false;
-	if (meta.expiresAt === void 0) return true;
-	const expiresAt = Date.parse(meta.expiresAt);
-	return Number.isNaN(expiresAt) || expiresAt > now;
-}
 /**
 * The live credentials the persisted secrets name — at most one per half. A half that names
 * nothing contributes nothing, which is what a placeholder, a credential revoked in the
@@ -183,17 +175,17 @@ function namedCredentials(live, persisted) {
 	};
 }
 /**
-* The credential the persisted secrets can be *reused* as, or `null`.
+* Whether a persisted half can be reused.
 *
-* Strict on purpose: every half the policy enables has to name a live credential, and when both
-* features are enabled they must name the *same* one — they share a single credential, so
-* halves that disagree came from two different calls and neither can be trusted.
+* When a platform default exists, only that default is reusable — a leftover
+* `neon-env ${branch}` mint is replaced. When no default exists (mint fallback),
+* any live credential the secrets name is reusable if it still carries the
+* scopes that half needs.
 */
-function reusableCredential(named, enabled) {
-	if (enabled.storageEnabled && enabled.gatewayEnabled) return named.storage && named.gateway && named.storage.tokenId === named.gateway.tokenId ? named.storage : null;
-	if (enabled.storageEnabled) return named.storage;
-	if (enabled.gatewayEnabled) return named.gateway;
-	return null;
+function halfReusable(named, defaultMeta, requiredScopes) {
+	if (named === null) return false;
+	if (defaultMeta !== null) return named.tokenId === defaultMeta.tokenId;
+	return credentialScopesSatisfied(named.scopes, requiredScopes);
 }
 //#endregion
 //#region src/dev/env.ts
@@ -437,16 +429,17 @@ const withAiGateway = (config) => ({
 *
 * So the gateway is only added once its credential endpoint has been shown to answer, by
 * reading the branch's credentials first. A project that does not have them says so on a
-* read, before anything is minted — which is the whole question, since the gateway's env is a
-* credential and nothing else.
+* read, before anything is revealed or minted — which is the whole question, since the
+* gateway's env is a credential and nothing else.
 *
 * Deciding this **before** resolving, rather than by catching and retrying, is what keeps it
 * honest. A retry re-runs every call the first attempt made, so it would blame the gateway for
-* a one-off failure in shared work, and — worse — a first attempt that minted a credential and
-* then failed would be papered over by a second that succeeds without one, swallowing the
-* error and stranding a secret nobody holds. Once the read succeeds, a later failure is a real
-* failure and propagates: the same thing already happens on a branch with object storage,
-* whose credential is minted whether or not the gateway is involved.
+* a one-off failure in shared work, and — worse — a first attempt that revealed or minted a
+* credential and then failed would be papered over by a second that succeeds without one,
+* swallowing the error and stranding a secret nobody holds. Once the read succeeds, a later
+* failure is a real failure and propagates: the same thing already happens on a branch with
+* object storage, whose credential is revealed (or minted as a fallback) whether or not the
+* gateway is involved.
 */
 const resolveWithImpliedGateway = async (config, ctx, branch) => {
 	const unreachable = await credentialsUnreachable(ctx, branch);

package/dist/_chunks/{env_services-CAWrZTWa.js → env_services-CbARRnq9.js}

@@ -190,7 +190,7 @@ async function fetchEnvKeysState(config, options, keys) {
 				branchId: branch.id
 			} });
 		}
-		const secrets = wantsCredential ? await mintBranchCredential({
+		const secrets = wantsCredential ? await resolveBranchCredentialSecrets({
 			api,
 			projectId,
 			branchId: branch.id,
@@ -303,9 +303,9 @@ async function resolveBranchPolicy(config, options, api) {
 	};
 }
 /**
-* Scopes the branch credential should carry for a resolved branch policy and optional key
-* selection. Only object storage and the AI Gateway *require* a credential; functions never
-* force one, but `functions:invoke` rides along when another selected feature mints one.
+* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway
+* *require* secrets; functions never force a credential. `functions:invoke` rides along only
+* when this path still has to mint (defaults already cover storage and the gateway).
 */
 function previewCredentialScopes(preview, selected) {
 	if (!preview) return [];
@@ -348,15 +348,70 @@ function policyEnvKeys(desired) {
 		...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []
 	];
 }
+/** Exact `name` values the credentials list endpoint returns for the platform defaults. */
+const DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = "Default AI gateway credential";
+const DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = "Default object storage credential";
+/** Whether an issued credential can still be used: not revoked, not past its expiry. */
+function isLiveCredential(meta, now) {
+	if (meta.revokedAt !== void 0) return false;
+	if (meta.expiresAt === void 0) return true;
+	const expiresAt = Date.parse(meta.expiresAt);
+	return Number.isNaN(expiresAt) || expiresAt > now;
+}
+function defaultStorageCredential(live, now) {
+	return live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;
+}
+function defaultAiGatewayCredential(live, now) {
+	return live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;
+}
 /**
-* Mint the branch credential backing object storage / the AI Gateway.
+* Resolve secrets for object storage / the AI Gateway.
 *
-* `api_token` and `s3_secret_access_key` come back **exactly once** — they are not stored
-* server-side and the list endpoint returns metadata only — so the caller's copy is the only
-* copy. That is why {@link fetchEnv} mints rather than fetches: there is nothing to fetch. A
-* caller that already holds a valid copy should leave the secret keys out of `keys` (see
-* {@link fetchEnvReusingSecrets}) instead of minting one it will discard.
+* Regions that expose those products already have platform defaults on every branch.
+* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.
+* Mint only the half (or both) that has no default — regions without the credentials
+* endpoint still fail at list, same as before.
+*
+* A caller that already holds secrets for those defaults should leave the secret keys out
+* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.
 */
+async function resolveBranchCredentialSecrets(args) {
+	const needsStorage = args.scopes.includes("storage:read") || args.scopes.includes("storage:write");
+	const needsGateway = args.scopes.includes("ai_gateway:invoke");
+	const live = await args.api.listCredentials(args.projectId, args.branchId);
+	const now = Date.now();
+	const storageDefault = defaultStorageCredential(live, now);
+	const gatewayDefault = defaultAiGatewayCredential(live, now);
+	const secrets = {
+		accessKeyId: "",
+		secretAccessKey: "",
+		apiToken: ""
+	};
+	if (needsStorage && storageDefault) {
+		const revealed = await args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId);
+		secrets.accessKeyId = revealed.tokenId;
+		secrets.secretAccessKey = revealed.s3SecretAccessKey;
+	}
+	if (needsGateway && gatewayDefault) secrets.apiToken = (await args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)).apiToken;
+	const missingStorage = needsStorage && storageDefault === null;
+	const missingGateway = needsGateway && gatewayDefault === null;
+	if (missingStorage || missingGateway) {
+		const minted = await mintBranchCredential({
+			...args,
+			scopes: deriveCredentialScopes({
+				storage: missingStorage,
+				aiGateway: missingGateway,
+				functions: args.scopes.includes("functions:invoke")
+			})
+		});
+		if (missingStorage) {
+			secrets.accessKeyId = minted.accessKeyId;
+			secrets.secretAccessKey = minted.secretAccessKey;
+		}
+		if (missingGateway) secrets.apiToken = minted.apiToken;
+	}
+	return secrets;
+}
 async function mintBranchCredential(args) {
 	const minted = await args.api.createCredential(args.projectId, args.branchId, {
 		scopes: args.scopes,
@@ -625,4 +680,4 @@ const editDistance = (left, right) => {
 /** Narrow yargs' array option value without accepting any other runtime shape. */
 const envPullFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
 //#endregion
-export { toEntries as S, functionBaseUrlKey as _, envKeysForSelection as a, previewCredentialScopes as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, fetchEnvKeysState as g, credentialName as h, ENV_PULL_SERVICES as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_KEY_HELP as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, isFunctionBaseUrlKey as v, resolveBranchPolicy as x, policyEnvKeys as y };
+export { resolveBranchPolicy as C, policyEnvKeys as S, defaultStorageCredential as _, envKeysForSelection as a, isFunctionBaseUrlKey as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, defaultAiGatewayCredential as g, credentialName as h, ENV_PULL_SERVICES as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_KEY_HELP as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, fetchEnvKeysState as v, toEntries as w, isLiveCredential as x, functionBaseUrlKey as y };

package/dist/analytics.js

@@ -156,13 +156,20 @@ const closeAnalytics = async (opts) => {
 		log.debug("Flushed CLI analytics");
 	}
 };
+const getErrorAnalyticsEventContext = (_args) => ({
+	version: pkg_default.version,
+	ci: isCi(),
+	agent: getCliAgent(process.env)
+});
+const CREDENTIAL_TOKEN_ID = /\bnak_live_[0-9a-f]+\b/gi;
+const redactCredentialTokenIds = (text) => text.replace(CREDENTIAL_TOKEN_ID, "nak_live_<redacted>");
 const getErrorAnalyticsEventProperties = (err, errCode, context) => {
 	const apiError = isNeonApiError(err) ? err : void 0;
 	const requestId = apiError?.headers?.["x-neon-ret-request-id"];
 	return {
 		...context,
-		message: err.message,
-		stack: err.stack,
+		message: redactCredentialTokenIds(err.message),
+		stack: err.stack ? redactCredentialTokenIds(err.stack) : err.stack,
 		errCode,
 		statusCode: apiError?.status,
 		requestId
@@ -188,15 +195,10 @@ const trackEvent = (event, properties) => {
 	});
 	log.debug("Sent CLI event: %s", event);
 };
-const getErrorAnalyticsEventContext = (_args) => ({
-	version: pkg_default.version,
-	ci: isCi(),
-	agent: getCliAgent(process.env)
-});
 const analyticsCommand = (args) => {
 	const command = args._.join(" ");
-	if (args._[0] !== "ask" || typeof args.prompt !== "string") return command;
-	return `${command} ${args.prompt}`;
+	const raw = args._[0] !== "ask" || typeof args.prompt !== "string" ? command : `${command} ${args.prompt}`;
+	return redactCredentialTokenIds(raw);
 };
 const getAnalyticsEventProperties = (args) => ({
 	version: pkg_default.version,

package/dist/api.js

@@ -872,6 +872,85 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				auth_user_id: authUserId
 			},
 			body: data
+		})),
+		listProjectBranchTriggers: (projectId, branchId) => call(() => raw.listProjectBranchTriggers({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		getProjectBranchTrigger: (projectId, branchId, triggerId) => call(() => raw.getProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			}
+		})),
+		createProjectBranchTrigger: (projectId, branchId, data) => call(() => raw.createProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		updateProjectBranchTrigger: (projectId, branchId, triggerId, data) => call(() => raw.updateProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			},
+			body: data
+		})),
+		deleteProjectBranchTrigger: (projectId, branchId, triggerId) => call(() => raw.deleteProjectBranchTrigger({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				trigger_id: triggerId
+			}
+		})),
+		listCredentials: (projectId, branchId) => call(() => raw.listCredentials({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		createCredential: (projectId, branchId, data) => call(() => raw.createCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		revokeCredential: (projectId, branchId, tokenId) => call(() => raw.revokeCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
+		})),
+		revealCredential: (projectId, branchId, tokenId) => call(() => raw.revealCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
+		})),
+		rotateCredential: (projectId, branchId, tokenId) => call(() => raw.rotateCredential({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				token_id: tokenId
+			}
 		}))
 	};
 };