neon 4.15.0 → 4.17.0

package/dist/commands/bootstrap.js

@@ -8,14 +8,14 @@ import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, s
 import { spawnCliChild } from "../init/child.js";
 import { agentSetupDoneLabel, formatInitDone, printInitBanner, printInitDone, shouldPrintInitBanner } from "../init/chrome.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
-import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
+import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, planLinkStep, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
+import { formatTemplateTitle } from "../init/template_title.js";
 import { pickAgentSetupInteractively } from "../init/wizard.js";
 import { runAgentTooling, runInitSteps } from "../init/tooling.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
-import chalk from "chalk";
 import prompts from "prompts";
 //#region src/commands/bootstrap.ts
 var bootstrap_exports = /* @__PURE__ */ __exportAll({
@@ -102,20 +102,19 @@ const handler = async (props) => {
 		}
 		return;
 	}
-	if (shouldPrintInitBanner(props.default)) printInitBanner();
+	if (props.printBanner !== false && shouldPrintInitBanner(props.default)) printInitBanner();
 	const named = resolveNamedAgents(props.agent ?? []);
 	if (props.agentSetup !== false) assertNamedAgentTooling(named, "bootstrap", {
 		...props.directory !== void 0 && props.directory.length > 0 ? { directory: props.directory } : {},
 		...props.default ? { yes: true } : {}
 	});
-	const templates = await resolveTemplateList(props);
 	const interactive = !props.default && Boolean(process.stdout.isTTY) && !isCi();
-	const template = await resolveSelectedTemplate(props, interactive, templates);
+	const template = props.selectedTemplate ?? await resolveSelectedTemplate(props, interactive, await resolveTemplateList(props));
 	const targetDir = await resolveTargetDir(props, interactive, template);
 	ensureTargetUsable(targetDir, props.force);
 	await scaffold(template, targetDir);
 	printScaffolded(template, targetDir);
-	await runPostScaffoldSteps(props, targetDir, interactive, template, named);
+	return runPostScaffoldSteps(props, targetDir, interactive, template, named);
 };
 /**
 * The template list to choose from. When --template is given we try the
@@ -123,18 +122,6 @@ const handler = async (props) => {
 * remote manifest if the id isn't one of the defaults.
 */
 const resolveTemplateList = async (props) => props.template && findTemplate(FALLBACK_TEMPLATES, props.template) ? FALLBACK_TEMPLATES : fetchTemplates();
-/**
-* The picker label for a template: the title first, then the Neon services it
-* uses as a dim, italic suffix, e.g. "Hono API …  Postgres · Functions". The
-* suffix is styled with chalk.dim (and italic) only — never a foreground color —
-* so it survives the cyan/underline `prompts` paints over the focused row: dim
-* and italic reset with their own SGRs, leaving the row's color and underline
-* intact. Descriptions are intentionally omitted to keep the picker uncluttered.
-*/
-const formatTemplateTitle = (template) => {
-	if (!template.services || template.services.length === 0) return template.title;
-	return `${template.title}  ${chalk.dim.italic(template.services.join(" · "))}`;
-};
 const resolveSelectedTemplate = async (props, interactive, templates) => {
 	if (props.template) {
 		const template = findTemplate(templates, props.template);
@@ -188,20 +175,19 @@ const scaffold = async (template, targetDir) => {
 	log.info("Scaffolded %d files into %s.", filesWritten, targetDir);
 	return filesWritten;
 };
+const nestedResult = (template, targetDir, hasNeonConfig, outcome) => ({
+	templateTitle: template.title,
+	targetDir,
+	hasNeonConfig,
+	...outcome
+});
 const runPostScaffoldSteps = async (props, targetDir, interactive, template, named) => {
 	const inferred = inferPackageManager(targetDir);
 	const defaultPm = resolvePackageManager(targetDir);
 	const neonConfig = hasNeonConfig(targetDir);
-	if (props.default) {
-		await runDefaultSteps(props, targetDir, defaultPm, neonConfig, template, named);
-		return;
-	}
+	if (props.default) return runDefaultSteps(props, targetDir, defaultPm, neonConfig, template, named);
 	if (!interactive) {
-		printDoneSummary({
-			heading: "Project scaffolded.",
-			template,
-			targetDir,
-			pm: defaultPm,
+		const outcome = {
 			installed: false,
 			installFailed: false,
 			gitFailed: false,
@@ -209,10 +195,18 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 			agentSetup: "skip",
 			linked: false,
 			skippedLinkForDeps: false,
-			suggestLink: true,
 			agentsRan: false
+		};
+		finishPostScaffold({
+			heading: "Project scaffolded.",
+			template,
+			targetDir,
+			pm: defaultPm,
+			...outcome,
+			suggestLink: true,
+			skipPrint: props.skipDoneSummary === true
 		});
-		return;
+		return nestedResult(template, targetDir, neonConfig, outcome);
 	}
 	let pm = defaultPm;
 	const wantInstall = props.install && await confirm(installPrompt(inferred));
@@ -239,8 +233,10 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 		targetDir,
 		pm,
 		...outcome,
-		suggestLink: !outcome.linked
+		suggestLink: !outcome.linked,
+		skipPrint: props.skipDoneSummary === true
 	});
+	return nestedResult(template, targetDir, neonConfig, outcome);
 };
 const installPrompt = (inferred) => inferred ? `Install dependencies with ${inferred}?` : "Install dependencies?";
 /** `link --yes` still asks for a project unless one is already linked. */
@@ -265,11 +261,16 @@ const runDefaultSteps = async (props, targetDir, pm, neonConfig, template, named
 		targetDir,
 		pm,
 		...outcome,
-		suggestLink: !outcome.linked
+		suggestLink: !outcome.linked,
+		skipPrint: props.skipDoneSummary === true
 	});
+	return nestedResult(template, targetDir, neonConfig, outcome);
 };
 const executePostScaffold = async (props, targetDir, choices) => {
-	const kids = bootstrapChildren(props, targetDir);
+	const kids = {
+		...bootstrapChildren(props, targetDir),
+		...props.narrate ? { narrate: props.narrate } : {}
+	};
 	let installed = false;
 	let installFailed = false;
 	let gitFailed = false;
@@ -321,7 +322,10 @@ const executePostScaffold = async (props, targetDir, choices) => {
 			logSkippedLink(choices.pm);
 			continue;
 		}
-		await runInitSteps([choices.yes ? ["link", "--yes"] : ["link"]], {
+		await runInitSteps([props.linkNoConfig === true ? planLinkStep({
+			yes: choices.yes,
+			extra: props.linkExtra
+		}) : choices.yes ? ["link", "--yes"] : ["link"]], {
 			cwd: targetDir,
 			...kids
 		});
@@ -450,7 +454,7 @@ const printDoneSummary = (input) => {
 	}));
 };
 const finishPostScaffold = (input) => {
-	printDoneSummary(input);
+	if (!input.skipPrint) printDoneSummary(input);
 	if (input.installFailed || input.gitFailed) throw new Error("Setup did not finish.");
 };
 const isCurrentDir = (targetDir) => relative(process.cwd(), targetDir) === "";

package/dist/commands/credentials.js

@@ -0,0 +1,146 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { isNeonApiError, messageFromBody, retryOnLock } from "../api.js";
+import { writer } from "../writer.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+//#region src/commands/credentials.ts
+var credentials_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	create: () => create,
+	describe: () => describe,
+	handler: () => handler,
+	list: () => list,
+	reveal: () => reveal,
+	revoke: () => revoke,
+	rotate: () => rotate
+});
+const CREDENTIAL_SCOPES = [
+	"storage:read",
+	"storage:write",
+	"ai_gateway:invoke",
+	"functions:invoke"
+];
+const LIST_FIELDS = [
+	"token_id",
+	"name",
+	"principal_type",
+	"scopes",
+	"created_at"
+];
+const SECRET_META_FIELDS = [
+	"token_id",
+	"name",
+	"scopes"
+];
+const renderColumns = { scopes: (c) => (c.scopes ?? []).join(", ") };
+/** Translate a token-id 404 into a resource-specific message; re-throw everything else. */
+async function withCredentialNotFound(tokenId, branchId, run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) {
+			if ((messageFromBody(err.data) ?? "").includes("platform credentials not available")) throw err;
+			throw new Error(`Credential ${tokenId} not found on branch ${branchId}.`);
+		}
+		throw err;
+	}
+}
+/**
+* Secrets are shown only once (create/rotate) or on demand (reveal). Table
+* output keeps them off the grid so they stay one selectable line; json/yaml
+* keep them on the object for scripts.
+*/
+const reportSecrets = (props, data, warning) => {
+	const out = writer(props);
+	if (props.output === "table") {
+		out.write(data, { fields: SECRET_META_FIELDS });
+		out.end();
+		const apiToken = "api_token" in data && typeof data.api_token === "string" ? data.api_token : "";
+		const secretKey = "s3_secret_access_key" in data && typeof data.s3_secret_access_key === "string" ? data.s3_secret_access_key : "";
+		out.text(`api_token: ${apiToken}\n`);
+		out.text(`s3_secret_access_key: ${secretKey}\n`);
+	} else out.end(data, { fields: [
+		"token_id",
+		"name",
+		"scopes",
+		"api_token",
+		"s3_secret_access_key"
+	] });
+	log.warning(warning);
+};
+const command = "credentials";
+const describe = "Manage branch credentials";
+const aliases = ["credential"];
+const builder = (argv) => argv.usage("$0 credentials <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("list", "List credentials on the branch", (yargs) => yargs, (args) => list(args)).command("create", "Issue a scoped credential on the branch", (yargs) => yargs.options({
+	name: {
+		describe: "Label for the credential",
+		type: "string"
+	},
+	scope: {
+		describe: "Capability to grant. Repeatable. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke",
+		type: "string",
+		array: true,
+		choices: CREDENTIAL_SCOPES,
+		demandOption: true
+	}
+}), (args) => create(args)).command("reveal <tokenId>", "Show a credential's api_token and s3_secret_access_key", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => reveal(args)).command("rotate <tokenId>", "Replace a credential's secrets in place. The token id is unchanged.", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => rotate(args)).command("revoke <tokenId>", "Revoke a credential", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => revoke(args));
+const handler = (args) => {
+	return args;
+};
+const list = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await props.apiClient.listCredentials(props.projectId, branchId);
+	writer(props).end(data.credentials, {
+		fields: LIST_FIELDS,
+		renderColumns,
+		emptyMessage: "No credentials found on this branch."
+	});
+};
+const create = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const scopes = (Array.isArray(props.scope) ? props.scope : [props.scope]).filter((scope) => CREDENTIAL_SCOPES.some((allowed) => allowed === scope));
+	if (scopes.length === 0) throw new Error("Pass at least one --scope. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke");
+	const { data } = await retryOnLock(() => props.apiClient.createCredential(props.projectId, branchId, {
+		scopes,
+		principal_type: "user",
+		...props.name !== void 0 ? { name: props.name } : {}
+	}));
+	reportSecrets(props, data, "Store these secrets now: they are not shown again unless you run neon credentials reveal.");
+};
+const reveal = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => props.apiClient.revealCredential(props.projectId, branchId, props.tokenId));
+	reportSecrets(props, data, "These are live secrets. Treat them like a password.");
+};
+const rotate = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.rotateCredential(props.projectId, branchId, props.tokenId)));
+	reportSecrets(props, data, "Store the new secrets now: a retry mints another pair and does not recover a lost response. A replica may briefly accept the previous secret.");
+};
+const revoke = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.revokeCredential(props.projectId, branchId, props.tokenId)));
+	log.info(`Credential ${props.tokenId} revoked`);
+};
+//#endregion
+export { aliases, builder, command, create, describe, handler, list, reveal, revoke, rotate, credentials_exports as t };

package/dist/commands/dev.js

@@ -2,11 +2,11 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { _ as functionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
+import { y as functionBaseUrlKey } from "../_chunks/env_services-CbARRnq9.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-DsakkOVZ.js";
+import { a as resolveDevEnv } from "../_chunks/env-B75xufe_.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -95,21 +95,19 @@ const devEnvContext = (props, branchId, cwd) => {
 	};
 };
 /**
-* Say when a run issued a branch credential.
+* Say when this run obtained credential secrets it did not already hold.
 *
-* `dev` has nowhere to persist one — it writes no file — so on a branch with nothing to reuse
-* it mints per start and cannot name the previous one to revoke it. Every other command that
-* mints says so; this is the one that runs dozens of times a day, and the server banner listing
-* `NEON_AI_GATEWAY_TOKEN` reads as "fetched", not "just created, and the last one is still
-* live". The note names the one action that stops it, so it disappears once followed.
+* `dev` writes no file. With platform defaults, each start re-reveals the same secrets until
+* `env pull` persists them. In a region with no defaults, each start mints another credential
+* and cannot revoke the last one. The note names the one action that stops either loop.
 */
 const reportDevCredential = (credential) => {
 	if (!credential?.issued) return;
 	if (credential.revoked.length > 0) {
-		log.info("Issued a new branch credential — %s changed. Revoked the one it replaced (%s).", credential.keys.join(", "), credential.revoked.join(", "));
+		log.info("Wrote credential secrets — %s changed. Revoked the leftover it replaced (%s).", credential.keys.join(", "), credential.revoked.join(", "));
 		return;
 	}
-	log.warning(`Issued a branch credential for this run (%s) and left any previous one live — a dev server has nowhere to keep it. Run \`${getCliName()} env pull\` once to write it to your .env, and restarts will reuse it instead of issuing another.`, credential.keys.join(", "));
+	log.warning(`Resolved credential secrets for this run (%s) without writing them to a file. Run \`${getCliName()} env pull\` once so restarts reuse them instead of revealing or minting again.`, credential.keys.join(", "));
 };
 const handler = async (props) => {
 	if (props.source !== void 0) {

package/dist/commands/env.js

@@ -4,12 +4,12 @@ import { ensureGitignored } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, v as isFunctionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
+import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-CbARRnq9.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DsakkOVZ.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-B75xufe_.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -67,7 +67,7 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"  2. neon.ts, when this directory has one — including derived function",
 	"     URLs (the function does not have to be deployed).",
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
-	"     which mints a branch credential for it.",
+	"     which pulls the default AI Gateway credential.",
 	"",
 	"On an unclaimed Claimable Neon project, neon.ts is still the source",
 	"of truth when it only declares Postgres, Auth, and the Data API.",
@@ -78,8 +78,8 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"and writes nothing for them.",
 	"",
 	"The pull bundled into link / checkout / config apply follows 2 and 3",
-	"without the AI Gateway, so it never mints a credential you did not ask",
-	"for. Run `env pull` to add it."
+	"without the AI Gateway, so it never writes a gateway token you did",
+	"not ask for. Run `env pull` to add it."
 ].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables").example("$0 env pull -e DATABASE_URL", "Pull only the pooled Postgres connection string").example("$0 env pull -s auth -e DATABASE_URL", "Pull all Auth variables plus DATABASE_URL").example("$0 env pull -s functions", "Pull NEON_FUNCTION_<SLUG>_BASE_URL for every deployed function").example("$0 env pull -e NEON_FUNCTION_HELLO_BASE_URL", "Write that function's production invocation URL (no deploy required)").strict(), async (args) => {
 	const rawServices = servicesFlagValue(args.service);
 	const rawEnvKeys = envPullFlagValue(args.env);
@@ -164,7 +164,7 @@ const pull = async (props, opts = {}) => {
 	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
 	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
 	if (credential?.issued) {
-		log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
+		log.info("Wrote credential secrets — these now hold fresh values: %s", credential.keys.join(", "));
 		if (credential.revoked.length > 0) log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
 		else if (credential.superseded.length > 0) log.info("Left the credential it replaced live (%s): an explicitly scoped pull can't tell which other variables still use it. Revoke it in the Neon Console if nothing does.", credential.superseded.join(", "));
 	}

package/dist/commands/index.js

@@ -12,6 +12,7 @@ import { t as link_exports } from "./link.js";
 import { t as checkout_exports } from "./checkout.js";
 import { t as claim_exports } from "./claim.js";
 import { t as connection_string_exports } from "./connection_string.js";
+import { t as credentials_exports } from "./credentials.js";
 import { t as data_api_exports } from "./data_api.js";
 import { t as databases_exports } from "./databases.js";
 import { t as deploy_exports } from "./deploy.js";
@@ -35,6 +36,7 @@ import { t as set_context_exports } from "./set_context.js";
 import { t as skills_exports } from "./skills.js";
 import { t as snapshots_exports } from "./snapshots.js";
 import { t as status_exports } from "./status.js";
+import { t as triggers_exports } from "./triggers.js";
 import { t as user_exports } from "./user.js";
 import { t as vpc_endpoints_exports } from "./vpc_endpoints.js";
 //#region src/commands/index.ts
@@ -70,6 +72,8 @@ var commands_default = [
 	ask_exports,
 	data_api_exports,
 	functions_exports,
+	triggers_exports,
+	credentials_exports,
 	dev_exports,
 	diff_exports,
 	config_exports,