neon 4.16.0 → 4.17.1

package/README.md

@@ -742,7 +742,7 @@ When a package cannot be bundled — a native addon with no esbuild loader, or a
 
 `neon bootstrap` copies a Neon starter template into a new (or current) directory — conceptually like `degit`, but it only pulls from a small set of templates we maintain in the public [`neondatabase/examples`](https://github.com/neondatabase/examples) repo. The template copy needs no Neon login: it downloads files from GitHub.
 
-After scaffolding, an interactive terminal asks about dependency install, git, agent tooling (the Neon plugin, or skills and MCP separately — never both), and `neon link` before running those steps. Dependency install is last, except when the template has a `neon.ts` and you chose to link — then install runs first so link can pull env. `--default` / `-y` skips the template, install, git, and agent pickers, then installs agent tooling for project folders, else the host CLI agent. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `--default` / `-y` in a terminal to pick. `--agent` / `-a` names coding agents, skips agent selection, and is forwarded to `plugins`, or to `skills` and `mcp`, not both. `link --yes` still asks for a project unless one is already linked. `--no-agent-setup` and `--no-link` skip those. Non-interactive without `--default` prints next steps and does not install, set up agents, or link.
+After scaffolding, an interactive terminal asks about dependency install and git, then finishes agent setup before asking whether to link a Neon project. Dependency install is last, except when the template has a `neon.ts` and you chose to link — then install runs first so the link flow can pull env. `--default` / `-y` skips the template, install, git, and agent pickers, then installs agent tooling for project folders, else the host CLI agent. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `--default` / `-y` in a terminal to pick. `--agent` / `-a` names coding agents, skips agent selection, and is forwarded to `plugins`, or to `skills` and `mcp`, not both. Project selection may still be required. `--no-agent-setup` and `--no-link` skip those steps. Non-interactive without `--default` prints next steps and does not install, set up agents, or link.
 
 Pass a target directory (or `.` for the current one). In an interactive terminal you pick the template from a list; in CI / non-interactive contexts pass `--template <id>`.
 
@@ -773,18 +773,19 @@ An empty directory (nothing except `.git`) asks how to set up the directory. Pic
 
 `-y` in an empty directory scaffolds the default template (`bootstrap --default`) and does not add a later `config init` step. `--skip-template` skips scaffolding even with `-y`. `--template <id>` scaffolds that template; combine it with `-y` to skip the remaining bootstrap pickers.
 
-An existing app (or skip-template) installs agent tooling, then `neon link --no-config` unless `.neon` already has a projectId, then asks whether to create `neon.ts`. Saying no skips the services picker and does not write the file. `--no-config` does the same without asking. `-y` writes `config init --services none` unless `--no-config`. `--services` implies creating `neon.ts`.
+An existing app (or skip-template) installs agent tooling, then asks whether to link unless `.neon` already has a projectId, then asks whether to create `neon.ts`. Linking uses the same organization, project, and branch flow as `neon link`. Saying no to `neon.ts` skips the services picker and does not write the file. `--no-config` does the same without asking. `-y` writes `config init --services none` unless `--no-config`. `--services` implies creating `neon.ts`.
 
-In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. It never runs plugin and skills+MCP together.
+In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. Agent selection and setup finish before the link question. It never runs plugin and skills+MCP together.
 
 ```bash
 $ neon init
 $ neon init --skip-template
+$ neon init --skip-template --no-link
 $ neon init -y
 $ neon init --agent cursor --agent claude-code
 ```
 
-Without a TTY, pass `-y`. `--agent` skips agent selection but does not replace `-y` for link or templates.
+Without a TTY, pass `-y`. `--agent` skips agent selection but does not replace `-y` for link or templates. `--no-link` skips project linking without asking, including when a template is scaffolded.
 
 `-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. `--skip-template` or an existing app: plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent; otherwise skills and MCP. If none are found, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
 
@@ -794,7 +795,7 @@ Without a TTY, pass `-y`. `--agent` skips agent selection but does not replace `
 
 `--config`, `--no-config`, and `--services` apply on the existing-app and `--skip-template` path. A template's own `neon.ts` is left as the template shipped it. Passing those flags while scaffolding prints a warning and still copies the template as shipped. After a new `neon.ts` on a pinned branch, init runs `env pull`.
 
-`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to nested bootstrap, `--yes --no-config` to `link`, and `--services none` to `config init`. `--agent` is forwarded with them. `mcp -y` is the global install. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
+`-y` forwards `-y` to `plugins` or `skills`/`mcp`, uses default choices in the built-in link flow, passes `--default` to nested bootstrap, and forwards `--services none` to `config init`. `--agent` is forwarded to agent setup. `mcp -y` is the global install. Default linking skips the "already linked" confirmation; it can still require project selection.
 
 A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
@@ -1228,7 +1229,7 @@ When both are only environment variables the key wins, which keeps a CI pipeline
 
 `neon auth` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon auth --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
 
-`neon init` forwards `--profile` and `--config-dir` to the commands it runs. An explicit `--api-key` is passed to those children through `NEON_API_KEY`, not argv.
+`neon init` forwards `--profile` and `--config-dir` to agent and config children and uses them directly for its link flow. An explicit `--api-key` is passed to authenticated children through `NEON_API_KEY`, not argv.
 
 ## API passthrough (`api`)
 

package/dist/_chunks/{env-DsakkOVZ.js → env-B75xufe_.js}

@@ -1,27 +1,26 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
-import { S as toEntries, _ as functionBaseUrlKey, a as envKeysForSelection, b as previewCredentialScopes, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as fetchEnvKeysState, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as isFunctionBaseUrlKey, x as resolveBranchPolicy, y as policyEnvKeys } from "./env_services-CAWrZTWa.js";
+import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-CbARRnq9.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { credentialScopesSatisfied } from "@neon/config/v1";
 import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError as isPlatformError$1, loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
 /**
-* Resolve a branch's env while keeping one-time secrets the caller already holds.
+* Resolve a branch's env while keeping secrets the caller already holds.
 *
-* {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
-* credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
-* them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
-* pull` would leave a live credential behind each time. This is the wrapper that avoids that:
-* it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
-* for only the rest.
+* {@link fetchEnvKeys} reveals the platform default credentials (or mints a fallback when a
+* region has none). Calling it on every `neon dev` start would rewrite `.env` with freshly
+* revealed secrets each time. This wrapper looks at what the caller already has, keeps a
+* half when it already *is* that default (storage and gateway are independent credentials),
+* and asks `fetchEnv` for only the rest.
 *
 * The check is a real verification, not a presence test. A persisted secret is kept only when
-* it names a credential that still exists on this branch, is not revoked or expired, and
-* carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
-* the console, one copied in from another branch, or one predating a newly-enabled feature all
-* fail that check and get replaced.
+* it names a credential that still exists on this branch, is not revoked or expired, and —
+* when defaults exist — *is* that default. A leftover `neon-env ${branch}` credential this
+* tool minted is replaced by the defaults and revoked. A `.env.example` placeholder, a
+* credential revoked in the console, or one copied in from another branch fails that check.
 *
 * None of this needs local bookkeeping, because the secrets carry their own credential id:
 * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
@@ -71,47 +70,47 @@ async function fetchEnvReusingSecrets(config, options) {
 	const persisted = readPersistedSecrets(source);
 	const storageCredentialManaged = requested === null || storageCredentialSelected;
 	const gatewayCredentialManaged = requested === null || gatewayCredentialSelected;
-	const complete = (!storageCredentialSelected || Boolean(persisted.accessKeyId && persisted.secretAccessKey)) && (!gatewayCredentialSelected || Boolean(persisted.apiToken));
-	const named = storageCredentialManaged && persisted.accessKeyId !== "" || gatewayCredentialManaged && persisted.apiToken !== "" ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted) : {
+	const storageComplete = Boolean(persisted.accessKeyId && persisted.secretAccessKey);
+	const gatewayComplete = Boolean(persisted.apiToken);
+	const listed = storageCredentialManaged && persisted.accessKeyId !== "" || gatewayCredentialManaged && persisted.apiToken !== "" ? await api.listCredentials(options.projectId, branch.id) : [];
+	const named = listed.length > 0 ? namedCredentials(listed, persisted) : {
 		storage: null,
 		gateway: null
 	};
-	const reusable = complete ? reusableCredential(named, {
-		storageEnabled: storageCredentialSelected,
-		gatewayEnabled: gatewayCredentialSelected
-	}) : null;
-	const scopes = previewCredentialScopes(desired.preview, {
-		storage: storageCredentialSelected,
-		aiGateway: gatewayCredentialSelected
-	});
-	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-	const fetchKeys = requested === null ? null : keep ? selectedPolicyKeys.filter((key) => !secretKeys.includes(key)) : selectedPolicyKeys;
+	const now = Date.now();
+	const storageDefault = defaultStorageCredential(listed, now);
+	const gatewayDefault = defaultAiGatewayCredential(listed, now);
+	const keepStorage = !storageCredentialSelected || storageComplete && halfReusable(named.storage, storageDefault, ["storage:read", "storage:write"]);
+	const keepGateway = !gatewayCredentialSelected || gatewayComplete && halfReusable(named.gateway, gatewayDefault, ["ai_gateway:invoke"]);
+	const keptSecretKeys = credentialEnvKeys({
+		storage: storageCredentialSelected && keepStorage,
+		aiGateway: gatewayCredentialSelected && keepGateway
+	}).filter((key) => selected.has(key));
+	const fetchKeys = requested === null ? null : selectedPolicyKeys.filter((key) => !keptSecretKeys.includes(key));
 	const fetched = await fetchEnvKeysState(config, {
 		...fetchOptions,
 		branchId: branch.id,
 		api,
-		...keep && requested === null ? { omitKeys: secretKeys } : {}
+		...keptSecretKeys.length > 0 && requested === null ? { omitKeys: keptSecretKeys } : {}
 	}, fetchKeys);
 	const vars = preferPersisted(toEntries(fetched.env), source);
 	const unavailable = fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {};
-	if (keep) {
-		for (const key of secretKeys) {
-			const value = source[key];
-			if (value !== void 0) vars[key] = value;
-		}
-		return {
-			vars,
-			credential: {
-				issued: false,
-				keys: secretKeys,
-				revoked: [],
-				superseded: []
-			},
-			...unavailable
-		};
+	for (const key of keptSecretKeys) {
+		const value = source[key];
+		if (value !== void 0) vars[key] = value;
 	}
+	if (!(storageCredentialSelected && !keepStorage || gatewayCredentialSelected && !keepGateway)) return {
+		vars,
+		credential: {
+			issued: false,
+			keys: secretKeys,
+			revoked: [],
+			superseded: []
+		},
+		...unavailable
+	};
 	const ours = /* @__PURE__ */ new Set();
-	for (const meta of [storageCredentialManaged ? named.storage : null, gatewayCredentialManaged ? named.gateway : null]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
+	for (const meta of [storageCredentialManaged && !keepStorage ? named.storage : null, gatewayCredentialManaged && !keepGateway ? named.gateway : null]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
 	if (revokeSuperseded) for (const tokenId of ours) await api.revokeCredential(options.projectId, branch.id, tokenId);
 	return {
 		vars,
@@ -162,13 +161,6 @@ function preferPersisted(vars, source) {
 function gatewayTokenIdShort(apiToken) {
 	return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
 }
-/** Whether an issued credential can still be used: not revoked, not past its expiry. */
-function isLiveCredential(meta, now) {
-	if (meta.revokedAt !== void 0) return false;
-	if (meta.expiresAt === void 0) return true;
-	const expiresAt = Date.parse(meta.expiresAt);
-	return Number.isNaN(expiresAt) || expiresAt > now;
-}
 /**
 * The live credentials the persisted secrets name — at most one per half. A half that names
 * nothing contributes nothing, which is what a placeholder, a credential revoked in the
@@ -183,17 +175,17 @@ function namedCredentials(live, persisted) {
 	};
 }
 /**
-* The credential the persisted secrets can be *reused* as, or `null`.
+* Whether a persisted half can be reused.
 *
-* Strict on purpose: every half the policy enables has to name a live credential, and when both
-* features are enabled they must name the *same* one — they share a single credential, so
-* halves that disagree came from two different calls and neither can be trusted.
+* When a platform default exists, only that default is reusable — a leftover
+* `neon-env ${branch}` mint is replaced. When no default exists (mint fallback),
+* any live credential the secrets name is reusable if it still carries the
+* scopes that half needs.
 */
-function reusableCredential(named, enabled) {
-	if (enabled.storageEnabled && enabled.gatewayEnabled) return named.storage && named.gateway && named.storage.tokenId === named.gateway.tokenId ? named.storage : null;
-	if (enabled.storageEnabled) return named.storage;
-	if (enabled.gatewayEnabled) return named.gateway;
-	return null;
+function halfReusable(named, defaultMeta, requiredScopes) {
+	if (named === null) return false;
+	if (defaultMeta !== null) return named.tokenId === defaultMeta.tokenId;
+	return credentialScopesSatisfied(named.scopes, requiredScopes);
 }
 //#endregion
 //#region src/dev/env.ts
@@ -437,16 +429,17 @@ const withAiGateway = (config) => ({
 *
 * So the gateway is only added once its credential endpoint has been shown to answer, by
 * reading the branch's credentials first. A project that does not have them says so on a
-* read, before anything is minted — which is the whole question, since the gateway's env is a
-* credential and nothing else.
+* read, before anything is revealed or minted — which is the whole question, since the
+* gateway's env is a credential and nothing else.
 *
 * Deciding this **before** resolving, rather than by catching and retrying, is what keeps it
 * honest. A retry re-runs every call the first attempt made, so it would blame the gateway for
-* a one-off failure in shared work, and — worse — a first attempt that minted a credential and
-* then failed would be papered over by a second that succeeds without one, swallowing the
-* error and stranding a secret nobody holds. Once the read succeeds, a later failure is a real
-* failure and propagates: the same thing already happens on a branch with object storage,
-* whose credential is minted whether or not the gateway is involved.
+* a one-off failure in shared work, and — worse — a first attempt that revealed or minted a
+* credential and then failed would be papered over by a second that succeeds without one,
+* swallowing the error and stranding a secret nobody holds. Once the read succeeds, a later
+* failure is a real failure and propagates: the same thing already happens on a branch with
+* object storage, whose credential is revealed (or minted as a fallback) whether or not the
+* gateway is involved.
 */
 const resolveWithImpliedGateway = async (config, ctx, branch) => {
 	const unreachable = await credentialsUnreachable(ctx, branch);

package/dist/_chunks/{env_services-CAWrZTWa.js → env_services-CbARRnq9.js}

@@ -190,7 +190,7 @@ async function fetchEnvKeysState(config, options, keys) {
 				branchId: branch.id
 			} });
 		}
-		const secrets = wantsCredential ? await mintBranchCredential({
+		const secrets = wantsCredential ? await resolveBranchCredentialSecrets({
 			api,
 			projectId,
 			branchId: branch.id,
@@ -303,9 +303,9 @@ async function resolveBranchPolicy(config, options, api) {
 	};
 }
 /**
-* Scopes the branch credential should carry for a resolved branch policy and optional key
-* selection. Only object storage and the AI Gateway *require* a credential; functions never
-* force one, but `functions:invoke` rides along when another selected feature mints one.
+* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway
+* *require* secrets; functions never force a credential. `functions:invoke` rides along only
+* when this path still has to mint (defaults already cover storage and the gateway).
 */
 function previewCredentialScopes(preview, selected) {
 	if (!preview) return [];
@@ -348,15 +348,70 @@ function policyEnvKeys(desired) {
 		...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []
 	];
 }
+/** Exact `name` values the credentials list endpoint returns for the platform defaults. */
+const DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = "Default AI gateway credential";
+const DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = "Default object storage credential";
+/** Whether an issued credential can still be used: not revoked, not past its expiry. */
+function isLiveCredential(meta, now) {
+	if (meta.revokedAt !== void 0) return false;
+	if (meta.expiresAt === void 0) return true;
+	const expiresAt = Date.parse(meta.expiresAt);
+	return Number.isNaN(expiresAt) || expiresAt > now;
+}
+function defaultStorageCredential(live, now) {
+	return live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;
+}
+function defaultAiGatewayCredential(live, now) {
+	return live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;
+}
 /**
-* Mint the branch credential backing object storage / the AI Gateway.
+* Resolve secrets for object storage / the AI Gateway.
 *
-* `api_token` and `s3_secret_access_key` come back **exactly once** — they are not stored
-* server-side and the list endpoint returns metadata only — so the caller's copy is the only
-* copy. That is why {@link fetchEnv} mints rather than fetches: there is nothing to fetch. A
-* caller that already holds a valid copy should leave the secret keys out of `keys` (see
-* {@link fetchEnvReusingSecrets}) instead of minting one it will discard.
+* Regions that expose those products already have platform defaults on every branch.
+* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.
+* Mint only the half (or both) that has no default — regions without the credentials
+* endpoint still fail at list, same as before.
+*
+* A caller that already holds secrets for those defaults should leave the secret keys out
+* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.
 */
+async function resolveBranchCredentialSecrets(args) {
+	const needsStorage = args.scopes.includes("storage:read") || args.scopes.includes("storage:write");
+	const needsGateway = args.scopes.includes("ai_gateway:invoke");
+	const live = await args.api.listCredentials(args.projectId, args.branchId);
+	const now = Date.now();
+	const storageDefault = defaultStorageCredential(live, now);
+	const gatewayDefault = defaultAiGatewayCredential(live, now);
+	const secrets = {
+		accessKeyId: "",
+		secretAccessKey: "",
+		apiToken: ""
+	};
+	if (needsStorage && storageDefault) {
+		const revealed = await args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId);
+		secrets.accessKeyId = revealed.tokenId;
+		secrets.secretAccessKey = revealed.s3SecretAccessKey;
+	}
+	if (needsGateway && gatewayDefault) secrets.apiToken = (await args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)).apiToken;
+	const missingStorage = needsStorage && storageDefault === null;
+	const missingGateway = needsGateway && gatewayDefault === null;
+	if (missingStorage || missingGateway) {
+		const minted = await mintBranchCredential({
+			...args,
+			scopes: deriveCredentialScopes({
+				storage: missingStorage,
+				aiGateway: missingGateway,
+				functions: args.scopes.includes("functions:invoke")
+			})
+		});
+		if (missingStorage) {
+			secrets.accessKeyId = minted.accessKeyId;
+			secrets.secretAccessKey = minted.secretAccessKey;
+		}
+		if (missingGateway) secrets.apiToken = minted.apiToken;
+	}
+	return secrets;
+}
 async function mintBranchCredential(args) {
 	const minted = await args.api.createCredential(args.projectId, args.branchId, {
 		scopes: args.scopes,
@@ -625,4 +680,4 @@ const editDistance = (left, right) => {
 /** Narrow yargs' array option value without accepting any other runtime shape. */
 const envPullFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
 //#endregion
-export { toEntries as S, functionBaseUrlKey as _, envKeysForSelection as a, previewCredentialScopes as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, fetchEnvKeysState as g, credentialName as h, ENV_PULL_SERVICES as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_KEY_HELP as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, isFunctionBaseUrlKey as v, resolveBranchPolicy as x, policyEnvKeys as y };
+export { resolveBranchPolicy as C, policyEnvKeys as S, defaultStorageCredential as _, envKeysForSelection as a, isFunctionBaseUrlKey as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, defaultAiGatewayCredential as g, credentialName as h, ENV_PULL_SERVICES as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_KEY_HELP as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, fetchEnvKeysState as v, toEntries as w, isLiveCredential as x, functionBaseUrlKey as y };

package/dist/auth_recovery.js

@@ -0,0 +1,61 @@
+import { t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
+import { log } from "./log.js";
+import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
+import { AuthRefreshError } from "./auth.js";
+import { isAccessTokenUsable, refreshStoredCredentials } from "./commands/auth.js";
+//#region src/auth_recovery.ts
+const supersededOnDisk = (rejectedToken) => {
+	if (rejectedToken === void 0) return false;
+	const context = getAuthContext();
+	if (context === null) return false;
+	const at = locationFromContext(context);
+	if (at === null) return false;
+	try {
+		const loaded = storeFor(context.configDir).read(at);
+		return loaded !== null && loaded.credentials.access_token !== rejectedToken && isAccessTokenUsable(loaded.credentials, Date.now());
+	} catch {
+		return false;
+	}
+};
+const recoverFrom401 = async (canRetry) => {
+	const context = getAuthContext();
+	if (context === null || context.source !== "stored-credentials") {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	if (context.refreshed === true || !canRetry) {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	if (supersededOnDisk(context.accessToken)) {
+		log.debug("The rejected token has already been replaced on disk; retrying with the current one");
+		return true;
+	}
+	const at = locationFromContext(context);
+	if (at === null || context.oauthHost === void 0 || context.clientId === void 0) {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	try {
+		if (await refreshStoredCredentials(at, {
+			apiHost: "",
+			oauthHost: context.oauthHost,
+			clientId: context.clientId,
+			configDir: context.configDir
+		})) {
+			log.debug("Refreshed the stored session after a 401; retrying");
+			return true;
+		}
+	} catch (err) {
+		if (err instanceof AuthRefreshError) {
+			log.error(err.message);
+			if (err.terminal) log.error(`Run \`neon auth --profile ${context.profile ?? "DEFAULT"}\` to sign in again.`);
+			return false;
+		}
+		log.debug("Refresh after 401 failed: %s", err instanceof Error ? err.message : "unknown error");
+	}
+	log.error(authFailureMessage(context));
+	return false;
+};
+//#endregion
+export { recoverFrom401 };

package/dist/commands/bootstrap.js

@@ -1,19 +1,20 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
-import { getCliName } from "../utils/cli_name.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { getCliName } from "../utils/cli_name.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { writer } from "../writer.js";
 import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
 import { spawnCliChild } from "../init/child.js";
 import { agentSetupDoneLabel, formatInitDone, printInitBanner, printInitDone, shouldPrintInitBanner } from "../init/chrome.js";
+import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
+import { runAuthenticatedLink } from "../init/link.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
-import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, planLinkStep, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
+import { assertNamedAgentTooling, chooseYesAgentTooling, initPluginAgents, initSkillsMcpAgents, postScaffoldActions, projectContextFile, resolveNamedAgents } from "../init/plan.js";
 import { formatTemplateTitle } from "../init/template_title.js";
-import { pickAgentSetupInteractively } from "../init/wizard.js";
-import { runAgentTooling, runInitSteps } from "../init/tooling.js";
-import { helpCsv, helpEpilogue } from "../utils/help_text.js";
-import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
+import { pickAgentSetupInteractively, pickInitLinkInteractively } from "../init/wizard.js";
+import { runAgentTooling } from "../init/tooling.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import prompts from "prompts";
@@ -47,7 +48,7 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 	},
 	default: {
 		alias: "y",
-		describe: "Quick start: scaffold the default template (or --template), then install, git, agent tooling (project folders, else the host CLI agent; if none, pass --agent or omit --default in a terminal), and link --yes. Skips those pickers; link --yes still asks for a project unless one is already linked",
+		describe: "Quick start: scaffold the default template (or --template), then install, git, agent tooling (project folders, else the host CLI agent; if none, pass --agent or omit --default in a terminal), and link with defaults. Project selection may still be required",
 		type: "boolean",
 		default: false
 	},
@@ -62,7 +63,7 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 		default: true
 	},
 	link: {
-		describe: `Run \`${getCliName()} link\` after scaffolding. Templates with neon.ts link after install so env pull works; otherwise link runs before install. In interactive mode this is offered as a prompt; use --no-link to skip without being asked.`,
+		describe: "Link a Neon project after scaffolding. Templates with neon.ts link after install so env pull works; otherwise linking happens before install. In interactive mode this is offered as a prompt; use --no-link to skip without being asked.",
 		type: "boolean",
 		default: true
 	},
@@ -78,7 +79,7 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 		describe: "Coding agent to install into (repeatable). Forwarded to plugins, or to skills and mcp. Skips agent selection. Values listed below",
 		coerce: coerceAgentFlag
 	}
-}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Skip the pickers; link --yes still asks for a project unless one is already linked").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").example("$0 bootstrap my-app --agent cursor --agent claude-code", "Skip agent selection; install the plugin for those agents").epilogue(helpEpilogue("--agent / -a is forwarded to plugins, or to skills and mcp, not both. It skips agent selection, including with --default.", helpCsv("Plugin agents", initPluginAgents()), helpCsv("Skills and MCP agents", initSkillsMcpAgents()))).strict();
+}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Skip the pickers; project selection may still be required").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").example("$0 bootstrap my-app --agent cursor --agent claude-code", "Skip agent selection; install the plugin for those agents").epilogue(helpEpilogue("--agent / -a is forwarded to plugins, or to skills and mcp, not both. It skips agent selection, including with --default.", helpCsv("Plugin agents", initPluginAgents()), helpCsv("Skills and MCP agents", initSkillsMcpAgents()))).strict();
 const handler = async (props) => {
 	if (props.listTemplates) {
 		const templates = await fetchTemplates();
@@ -215,7 +216,6 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 	const agentSetup = props.agentSetup === false ? "skip" : named.length > 0 ? chooseYesAgentTooling(named).setup : await (props.pickAgentSetup ?? pickAgentSetupInteractively)();
 	const canLink = props.link && !(neonConfig && !wantInstall);
 	if (props.link && !canLink) logSkippedLink(pm);
-	const wantLink = canLink && await confirm(`Link this project to a Neon project now? (runs ${getCliName()} link)`);
 	const outcome = await executePostScaffold(props, targetDir, {
 		yes: false,
 		lockAgentSetup: named.length === 0,
@@ -223,7 +223,7 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 		git: wantGit,
 		agentSetup,
 		install: wantInstall,
-		link: wantLink,
+		link: canLink,
 		hasNeonConfig: neonConfig,
 		named
 	});
@@ -239,9 +239,8 @@ const runPostScaffoldSteps = async (props, targetDir, interactive, template, nam
 	return nestedResult(template, targetDir, neonConfig, outcome);
 };
 const installPrompt = (inferred) => inferred ? `Install dependencies with ${inferred}?` : "Install dependencies?";
-/** `link --yes` still asks for a project unless one is already linked. */
 const runDefaultSteps = async (props, targetDir, pm, neonConfig, template, named) => {
-	log.info("Quick start (--default): skipping the template, install, git, and agent pickers. link --yes still asks for a project unless one is already linked.");
+	log.info("Quick start (--default): skipping the template, install, git, and agent pickers. Project selection may still be required.");
 	const wantGit = props.git && !isGitRepo(targetDir);
 	const agentSetup = props.agentSetup === false ? "skip" : named.length > 0 ? chooseYesAgentTooling(named).setup : "skills-mcp";
 	const outcome = await executePostScaffold(props, targetDir, {
@@ -322,12 +321,26 @@ const executePostScaffold = async (props, targetDir, choices) => {
 			logSkippedLink(choices.pm);
 			continue;
 		}
-		await runInitSteps([props.linkNoConfig === true ? planLinkStep({
+		if (!(choices.yes || await (props.pickLink ?? pickInitLinkInteractively)())) continue;
+		await (props.linkProject ?? runAuthenticatedLink)({
+			apiClient: props.apiClient,
+			apiKey: props.apiKey,
+			apiHost: props.apiHost,
+			output: props.output,
+			contextFile: projectContextFile(targetDir, props.contextFile),
 			yes: choices.yes,
-			extra: props.linkExtra
-		}) : choices.yes ? ["link", "--yes"] : ["link"]], {
+			clear: false,
+			checks: true,
+			envPull: true,
+			config: props.linkNoConfig !== true,
 			cwd: targetDir,
-			...kids
+			...props.linkInputs,
+			...props.configDir ? { configDir: props.configDir } : {},
+			...props.profile ? { profile: props.profile } : {},
+			...props.oauthHost ? { oauthHost: props.oauthHost } : {},
+			...props.clientId ? { clientId: props.clientId } : {},
+			...props.forceAuth !== void 0 ? { forceAuth: props.forceAuth } : {},
+			...props.allowUnsafeTls !== void 0 ? { allowUnsafeTls: props.allowUnsafeTls } : {}
 		});
 		linked = true;
 	}

package/dist/commands/branches.js

@@ -3,13 +3,13 @@ import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
 import { contextBranch, readContextFile } from "../context.js";
 import { writer } from "../writer.js";
-import { branchCreateRequest } from "../parameters.gen.js";
 import { EndpointType } from "../utils/api_enums.js";
-import { getComputeUnits } from "../utils/compute_units.js";
 import { looksLikeBranchId, looksLikeLSN, looksLikeTimestamp } from "../utils/formats.js";
 import { branchIdFromProps, branchIdResolve, fillSingleProject } from "../utils/enrichers.js";
-import { parsePointInTime } from "../utils/point_in_time.js";
+import { branchCreateRequest } from "../parameters.gen.js";
+import { getComputeUnits } from "../utils/compute_units.js";
 import { psql } from "../utils/psql.js";
+import { parsePointInTime } from "../utils/point_in_time.js";
 import { parseSchemaDiffParams, schemaDiff } from "./schema_diff.js";
 //#region src/commands/branches.ts
 var branches_exports = /* @__PURE__ */ __exportAll({

package/dist/commands/checkout.js

@@ -4,9 +4,9 @@ import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { applyContext, contextBranch, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { applyPolicyOnCreate, createBranchFromPolicyOnCheckout, envFlag } from "./config.js";
 import { handler as handler$1 } from "./link.js";

package/dist/commands/claim.js

@@ -3,12 +3,12 @@ import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { applyContext, contextBranch, readContextFile } from "../context.js";
-import { claimableDataApiCreateBody, declaredNeonServices } from "../config_services.js";
-import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { resolveEnvFilePath } from "../env_file.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
+import { claimableDataApiCreateBody, declaredNeonServices } from "../config_services.js";
+import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
+import { resolveEnvFilePath } from "../env_file.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { pull } from "./env.js";

package/dist/commands/config.js

@@ -10,11 +10,11 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
 import { writer } from "../writer.js";
-import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
-import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { assertAiGatewayProvisionable, warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
 import { renderAppliedChanges, renderBranchSettingConflicts } from "../utils/config_diff.js";
+import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
+import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { bundleEntry } from "../utils/esbuild.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";

package/dist/commands/connection_string.js

@@ -2,8 +2,8 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
-import { parsePITBranch } from "../utils/point_in_time.js";
 import { psql } from "../utils/psql.js";
+import { parsePITBranch } from "../utils/point_in_time.js";
 //#region src/commands/connection_string.ts
 var connection_string_exports = /* @__PURE__ */ __exportAll({
 	SSL_MODES: () => SSL_MODES,