neon 4.16.0 → 4.17.1

package/dist/commands/dev.js

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
+import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { _ as functionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
-import { isClaimableEnvTarget } from "../claimable/state.js";
+import { y as functionBaseUrlKey } from "../_chunks/env_services-CbARRnq9.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-DsakkOVZ.js";
+import { a as resolveDevEnv } from "../_chunks/env-B75xufe_.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -95,21 +95,19 @@ const devEnvContext = (props, branchId, cwd) => {
 	};
 };
 /**
-* Say when a run issued a branch credential.
+* Say when this run obtained credential secrets it did not already hold.
 *
-* `dev` has nowhere to persist one — it writes no file — so on a branch with nothing to reuse
-* it mints per start and cannot name the previous one to revoke it. Every other command that
-* mints says so; this is the one that runs dozens of times a day, and the server banner listing
-* `NEON_AI_GATEWAY_TOKEN` reads as "fetched", not "just created, and the last one is still
-* live". The note names the one action that stops it, so it disappears once followed.
+* `dev` writes no file. With platform defaults, each start re-reveals the same secrets until
+* `env pull` persists them. In a region with no defaults, each start mints another credential
+* and cannot revoke the last one. The note names the one action that stops either loop.
 */
 const reportDevCredential = (credential) => {
 	if (!credential?.issued) return;
 	if (credential.revoked.length > 0) {
-		log.info("Issued a new branch credential — %s changed. Revoked the one it replaced (%s).", credential.keys.join(", "), credential.revoked.join(", "));
+		log.info("Wrote credential secrets — %s changed. Revoked the leftover it replaced (%s).", credential.keys.join(", "), credential.revoked.join(", "));
 		return;
 	}
-	log.warning(`Issued a branch credential for this run (%s) and left any previous one live — a dev server has nowhere to keep it. Run \`${getCliName()} env pull\` once to write it to your .env, and restarts will reuse it instead of issuing another.`, credential.keys.join(", "));
+	log.warning(`Resolved credential secrets for this run (%s) without writing them to a file. Run \`${getCliName()} env pull\` once so restarts reuse them instead of revealing or minting again.`, credential.keys.join(", "));
 };
 const handler = async (props) => {
 	if (props.source !== void 0) {

package/dist/commands/env.js

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { ensureGitignored } from "../context.js";
+import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, v as isFunctionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
-import { isClaimableEnvTarget } from "../claimable/state.js";
-import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
+import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-CbARRnq9.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DsakkOVZ.js";
+import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-B75xufe_.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -67,7 +67,7 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"  2. neon.ts, when this directory has one — including derived function",
 	"     URLs (the function does not have to be deployed).",
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
-	"     which mints a branch credential for it.",
+	"     which pulls the default AI Gateway credential.",
 	"",
 	"On an unclaimed Claimable Neon project, neon.ts is still the source",
 	"of truth when it only declares Postgres, Auth, and the Data API.",
@@ -78,8 +78,8 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"and writes nothing for them.",
 	"",
 	"The pull bundled into link / checkout / config apply follows 2 and 3",
-	"without the AI Gateway, so it never mints a credential you did not ask",
-	"for. Run `env pull` to add it."
+	"without the AI Gateway, so it never writes a gateway token you did",
+	"not ask for. Run `env pull` to add it."
 ].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables").example("$0 env pull -e DATABASE_URL", "Pull only the pooled Postgres connection string").example("$0 env pull -s auth -e DATABASE_URL", "Pull all Auth variables plus DATABASE_URL").example("$0 env pull -s functions", "Pull NEON_FUNCTION_<SLUG>_BASE_URL for every deployed function").example("$0 env pull -e NEON_FUNCTION_HELLO_BASE_URL", "Write that function's production invocation URL (no deploy required)").strict(), async (args) => {
 	const rawServices = servicesFlagValue(args.service);
 	const rawEnvKeys = envPullFlagValue(args.env);
@@ -164,7 +164,7 @@ const pull = async (props, opts = {}) => {
 	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
 	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
 	if (credential?.issued) {
-		log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
+		log.info("Wrote credential secrets — these now hold fresh values: %s", credential.keys.join(", "));
 		if (credential.revoked.length > 0) log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
 		else if (credential.superseded.length > 0) log.info("Left the credential it replaced live (%s): an explicitly scoped pull can't tell which other variables still use it. Revoke it in the Neon Console if nothing does.", credential.superseded.join(", "));
 	}

package/dist/commands/index.js

@@ -2,13 +2,13 @@ import { t as auth_exports } from "./auth.js";
 import { t as api_exports } from "./api.js";
 import { t as api_keys_exports } from "./api_keys.js";
 import { t as ask_exports } from "./ask.js";
-import { t as bootstrap_exports } from "./bootstrap.js";
-import { t as branches_exports } from "./branches.js";
-import { t as bucket_exports } from "./bucket.js";
 import { t as env_exports } from "./env.js";
 import { t as config_exports } from "./config.js";
 import { t as projects_exports } from "./projects.js";
 import { t as link_exports } from "./link.js";
+import { t as bootstrap_exports } from "./bootstrap.js";
+import { t as branches_exports } from "./branches.js";
+import { t as bucket_exports } from "./bucket.js";
 import { t as checkout_exports } from "./checkout.js";
 import { t as claim_exports } from "./claim.js";
 import { t as connection_string_exports } from "./connection_string.js";

package/dist/commands/init.js

@@ -1,21 +1,22 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { contextBranch, readContextFile } from "../context.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE } from "../config_template.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { fetchTemplates } from "../init/bootstrap.js";
 import { initChildEnv, spawnCliChild } from "../init/child.js";
 import { agentSetupLabel, configSummaryLabel, formatInitDone, printInitBanner, printInitDone, shouldPrintInitBanner } from "../init/chrome.js";
+import { hasNeonConfigFile } from "./config.js";
+import { runAuthenticatedLink } from "../init/link.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
-import { INIT_NEEDS_YES_OR_TERMINAL, assertNamedAgentTooling, directoryIsEmpty, initPluginAgents, initSkillsMcpAgents, linkInputArgv, planExistingInit, resolveNamedAgents } from "../init/plan.js";
+import { INIT_NEEDS_YES_OR_TERMINAL, assertNamedAgentTooling, directoryIsEmpty, initPluginAgents, initSkillsMcpAgents, planExistingInit, resolveNamedAgents } from "../init/plan.js";
 import { canPickAgentsInteractively } from "../utils/agent_picker.js";
-import { pickInitConfigInteractively, pickInitTemplateInteractively } from "../init/wizard.js";
+import { pickInitConfigInteractively, pickInitLinkInteractively, pickInitTemplateInteractively } from "../init/wizard.js";
 import { runAgentTooling, runInitSteps } from "../init/tooling.js";
-import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { handler as handler$1 } from "./bootstrap.js";
-import { hasNeonConfigFile } from "./config.js";
 import { INIT_CONFIG_SERVICES_CONFLICT, INIT_TEMPLATE_KEEPS_CONFIG, configPlanFromResolution, resolveInitConfigChoice, resolveInitTemplateChoice, shouldRefreshEnvAfterNewConfig } from "../init/choices.js";
 import { existsSync, readdirSync } from "node:fs";
 import { resolve } from "node:path";
@@ -34,7 +35,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	alias: "y",
 	type: "boolean",
 	default: false,
-	describe: "Empty dir: scaffold the default template. --skip-template: plugin, or skills and MCP, for project folders, else the host CLI agent. Exits if none. Then link --yes and config init --services none. link --yes still asks for a project unless one is already linked"
+	describe: "Empty dir: scaffold the default template. --skip-template: plugin, or skills and MCP, for project folders, else the host CLI agent. Exits if none. Then link with defaults and create the bare neon.ts policy. Project selection may still be required"
 }).option("skip-template", {
 	type: "boolean",
 	default: false,
@@ -42,6 +43,10 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 }).option("template", {
 	type: "string",
 	describe: "Template to scaffold into an empty directory. Conflicts with --skip-template"
+}).option("link", {
+	type: "boolean",
+	default: true,
+	describe: "Link a Neon project during setup. Use --no-link to skip without being asked"
 }).option("config", {
 	type: "boolean",
 	describe: "Existing app or --skip-template: create neon.ts after linking. Use --no-config to skip. Omitted in a terminal: you will be asked. Scaffolding a template keeps that template's neon.ts"
@@ -80,7 +85,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	alias: "o",
 	hidden: true,
 	describe: "Not supported; the commands init runs print their own output"
-}).example("$0 init", "Set up this directory (template picker if empty)").example("$0 init --skip-template", "Empty dir: agents, link, and neon.ts — no template files").example("$0 init -y", "Default template, or existing-app defaults").example("$0 init --agent cursor --agent claude-code", "Skip agent selection; install the plugin for those agents").epilogue(helpEpilogue("Empty directory: pick a starter template, or skip scaffolding and only set up agents, a Neon project, and neon.ts. That skip is not on `neon bootstrap`.", "Interactive agent setup: plugin (recommended), skills and MCP separately, or skip agent setup. Never both plugin and skills+MCP.", "neon.ts is optional when you skip the template or set up an existing app. Saying no skips the services picker and does not write the file. Scaffolding a template keeps that template's neon.ts.", "-y installs the plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent. Otherwise skills and MCP. If none are found, it exits: pass --agent <name>, run from a supported agent, or omit -y in a terminal to pick. Then link unless already linked. link --yes may still ask for a project.", "--agent / -a is forwarded to plugins, or to skills and mcp, not both. It skips agent selection, including with -y.", helpCsv("Plugin agents", initPluginAgents()), helpCsv("Skills and MCP agents", initSkillsMcpAgents()))).check((argv) => {
+}).example("$0 init", "Set up this directory (template picker if empty)").example("$0 init --skip-template", "Empty dir: agents, link, and neon.ts — no template files").example("$0 init -y", "Default template, or existing-app defaults").example("$0 init --agent cursor --agent claude-code", "Skip agent selection; install the plugin for those agents").epilogue(helpEpilogue("Empty directory: pick a starter template, or skip scaffolding and only set up agents, a Neon project, and neon.ts. That skip is not on `neon bootstrap`.", "Interactive agent setup: plugin (recommended), skills and MCP separately, or skip agent setup. Never both plugin and skills+MCP.", "neon.ts is optional when you skip the template or set up an existing app. Saying no skips the services picker and does not write the file. Scaffolding a template keeps that template's neon.ts.", "-y installs the plugin when Cursor, Claude Code, or Codex is in project folders, else the host CLI agent. Otherwise skills and MCP. If none are found, it exits: pass --agent <name>, run from a supported agent, or omit -y in a terminal to pick. Then link unless already linked. Project selection may still be required.", "--agent / -a is forwarded to plugins, or to skills and mcp, not both. It skips agent selection, including with -y.", helpCsv("Plugin agents", initPluginAgents()), helpCsv("Skills and MCP agents", initSkillsMcpAgents()))).check((argv) => {
 	if (argv.data !== void 0) throw new Error(removedProtocol());
 	if (argv.help !== true && (argv.output === "json" || argv.output === "yaml")) throw new Error(`\`${getCliName()} init\` does not support --output. The commands it runs print their own output.`);
 	return true;
@@ -101,7 +106,7 @@ const parsedInitServices = (raw) => {
 		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
 	});
 };
-const nestedBootstrapProps = (props, cwd, contextFile, template, linkExtra) => ({
+const nestedBootstrapProps = (props, cwd, contextFile, template, linkInputs) => ({
 	apiClient: props.apiClient,
 	apiKey: props.apiKey,
 	apiHost: props.apiHost,
@@ -113,19 +118,25 @@ const nestedBootstrapProps = (props, cwd, contextFile, template, linkExtra) => (
 	default: template.useDefault,
 	install: true,
 	git: true,
-	link: true,
+	link: props.link !== false,
 	printBanner: false,
 	skipDoneSummary: true,
 	linkNoConfig: true,
 	narrate: "human",
 	...template.selected ? { selectedTemplate: template.selected } : {},
 	...!template.selected && template.id !== void 0 ? { template: template.id } : {},
-	...linkExtra.length > 0 ? { linkExtra } : {},
+	linkInputs,
 	...props.agent !== void 0 ? { agent: props.agent } : {},
 	...props.configDir ? { configDir: props.configDir } : {},
 	...props.profile ? { profile: props.profile } : {},
+	...props.oauthHost ? { oauthHost: props.oauthHost } : {},
+	...props.clientId ? { clientId: props.clientId } : {},
+	...props.forceAuth !== void 0 ? { forceAuth: props.forceAuth } : {},
+	...props.allowUnsafeTls !== void 0 ? { allowUnsafeTls: props.allowUnsafeTls } : {},
 	...props.analytics === false ? { analytics: false } : {},
 	...props.run ? { run: props.run } : {},
+	...props.linkProject ? { linkProject: props.linkProject } : {},
+	...props.pickLink ? { pickLink: props.pickLink } : {},
 	...props.pickAgentSetup ? { pickAgentSetup: props.pickAgentSetup } : {},
 	...props.detectProjectAgents ? { detectProjectAgents: props.detectProjectAgents } : {},
 	...props.detectAgent ? { detectAgent: props.detectAgent } : {},
@@ -193,13 +204,14 @@ const handler = async (props) => {
 	};
 	const services = parsedInitServices(props.services);
 	if (props.config === false && services !== void 0) throw new Error(INIT_CONFIG_SERVICES_CONFLICT);
-	const linkExtra = linkInputArgv({
+	const linkInputs = {
 		...props.orgId ? { orgId: props.orgId } : {},
 		...props.projectId ? { projectId: props.projectId } : {},
 		...props.projectName ? { projectName: props.projectName } : {},
 		...props.regionId ? { regionId: props.regionId } : {},
 		...props.branch ? { branch: props.branch } : {}
-	});
+	};
+	const hasExplicitLinkInputs = props.orgId !== void 0 || props.projectId !== void 0 || props.projectName !== void 0 || props.regionId !== void 0 || props.branch !== void 0;
 	const templateChoice = resolveInitTemplateChoice({
 		empty: directoryIsEmpty(names),
 		yes,
@@ -214,7 +226,7 @@ const handler = async (props) => {
 		const result = await runBootstrap(nestedBootstrapProps(props, cwd, contextFile, {
 			useDefault: yes,
 			...templateChoice.kind === "template" ? { id: templateChoice.id } : {}
-		}, linkExtra));
+		}, linkInputs));
 		printNestedBootstrapDone(result, cwd, templateChoice.kind === "template" ? templateChoice.id : "default");
 		return;
 	}
@@ -228,13 +240,13 @@ const handler = async (props) => {
 			const result = await runBootstrap(nestedBootstrapProps(props, cwd, contextFile, {
 				selected: picked.template,
 				useDefault: false
-			}, linkExtra));
+			}, linkInputs));
 			printNestedBootstrapDone(result, cwd, picked.template.id);
 			return;
 		}
 	}
 	const alreadyLinked = isLinked(contextFile);
-	const shouldLink = !alreadyLinked || linkExtra.length > 0;
+	const shouldLink = props.link !== false && (!alreadyLinked || hasExplicitLinkInputs);
 	const existingConfig = hasNeonConfigFile(cwd);
 	const canAskConfig = props.pickConfig !== void 0 || canPickAgentsInteractively();
 	const agentSetup = await runAgentTooling({
@@ -251,18 +263,27 @@ const handler = async (props) => {
 		...props.detectAgent ? { detectAgent: props.detectAgent } : {},
 		...props.hasProjectPlugins ? { hasProjectPlugins: props.hasProjectPlugins } : {}
 	});
-	await runInitSteps(planExistingInit({
-		linked: !shouldLink,
+	const canAskLink = props.pickLink !== void 0 || canPickAgentsInteractively();
+	const acceptedLink = shouldLink && (yes || !canAskLink || await (props.pickLink ?? pickInitLinkInteractively)());
+	if (acceptedLink) await (props.linkProject ?? runAuthenticatedLink)({
+		apiClient: props.apiClient,
+		apiKey: props.apiKey,
+		apiHost: props.apiHost,
+		output: props.output,
+		contextFile,
 		yes,
-		agentSetup: "skip",
-		config: { kind: "skip" },
-		...linkExtra.length > 0 ? { linkExtra } : {}
-	}), {
+		clear: false,
+		checks: true,
+		envPull: true,
+		config: false,
 		cwd,
-		run,
-		forward,
-		authEnv,
-		narrate: "human"
+		...linkInputs,
+		...props.configDir ? { configDir: props.configDir } : {},
+		...props.profile ? { profile: props.profile } : {},
+		...props.oauthHost ? { oauthHost: props.oauthHost } : {},
+		...props.clientId ? { clientId: props.clientId } : {},
+		...props.forceAuth !== void 0 ? { forceAuth: props.forceAuth } : {},
+		...props.allowUnsafeTls !== void 0 ? { allowUnsafeTls: props.allowUnsafeTls } : {}
 	});
 	const configResolution = resolveInitConfigChoice({
 		flag: props.config,
@@ -317,7 +338,7 @@ Run \`${getCliName()} env pull\` once resolved.`, message);
 				label: "Project",
 				value: projectRow({
 					alreadyLinked,
-					linkedNow: shouldLink
+					linkedNow: acceptedLink
 				})
 			},
 			{

package/dist/commands/ip_allow.js

@@ -2,8 +2,8 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { writer } from "../writer.js";
-import { projectUpdateRequest } from "../parameters.gen.js";
 import { fillSingleProject } from "../utils/enrichers.js";
+import { projectUpdateRequest } from "../parameters.gen.js";
 //#region src/commands/ip_allow.ts
 var ip_allow_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,

package/dist/commands/link.js

@@ -16,6 +16,7 @@ var link_exports = /* @__PURE__ */ __exportAll({
 	command: () => command,
 	describe: () => describe,
 	handler: () => handler,
+	runLink: () => runLink,
 	shouldOfferConfigInit: () => shouldOfferConfigInit
 });
 const PROJECTS_LIST_LIMIT = 100;
@@ -94,7 +95,7 @@ const builder = (argv) => argv.usage("$0 link [options]").options({
 	["$0 link --no-checks --org-id org-… --project-id polished-snowflake-12345678", "Write the context offline (no API calls, no verification)"],
 	["$0 link --clear", "Forget the current org/project/branch context"]
 ]).epilogue(helpEpilogue("Non-interactive (CI, scripts, agents):", ...nonInteractiveLinkCommands().map((command) => `  ${command}`), orgScopedKeyHint)).strict();
-const handler = async (props) => {
+const runLink = async (props) => {
 	if (props.clear) {
 		clearContext(props.contextFile);
 		return;
@@ -110,19 +111,16 @@ const handler = async (props) => {
 		await runNonInteractive(props, inputs, existing);
 		return;
 	}
-	if (!canPromptInteractively()) {
-		log.error([
-			"Missing inputs and no interactive terminal for prompts.",
-			"",
-			"Use:",
-			nonInteractiveLinkHelp(),
-			orgScopedKeyHint
-		].join("\n"));
-		process.exit(1);
-		return;
-	}
+	if (!canPromptInteractively()) throw new LinkInputError([
+		"Missing inputs and no interactive terminal for prompts.",
+		"",
+		"Use:",
+		nonInteractiveLinkHelp(),
+		orgScopedKeyHint
+	].join("\n"));
 	await runInteractive(props, inputs);
 };
+const handler = runLink;
 const parseInputs = (props) => {
 	let fromParams = {};
 	if (props.params !== void 0 && props.params !== "") {
@@ -430,7 +428,9 @@ const runNonInteractive = async (props, inputs, existing) => {
 	}
 };
 const runInteractive = async (props, inputs) => {
-	if (!props.yes) await confirmRelinkIfNeeded(props);
+	if (!props.yes) {
+		if (!await confirmRelinkIfNeeded(props)) return;
+	}
 	const orgResolution = await resolveOrg(props, inputs.orgId);
 	let orgId;
 	if (orgResolution.kind === "resolved") {
@@ -505,7 +505,7 @@ const runInteractive = async (props, inputs) => {
 };
 const confirmRelinkIfNeeded = async (props) => {
 	const existing = readContextFile(props.contextFile);
-	if (!existing.orgId || !existing.projectId) return;
+	if (!existing.orgId || !existing.projectId) return true;
 	const { proceed } = await prompts({
 		onState: onPromptState,
 		type: "confirm",
@@ -515,8 +515,9 @@ const confirmRelinkIfNeeded = async (props) => {
 	});
 	if (!proceed) {
 		process.stdout.write("Aborted. Existing link preserved.\n");
-		process.exit(0);
+		return false;
 	}
+	return true;
 };
 const promptOrgFromList = async (orgs) => {
 	if (!orgs.length) throw new Error(`You don't belong to any organizations. Create one in the Neon Console first: https://console.neon.tech/`);
@@ -734,6 +735,7 @@ const finalizeLink = async (props, summary) => {
 	const { config: _offerConfig, ...rest } = props;
 	await autoPullEnvAfterPin({
 		...rest,
+		...props.cwd ? { cwd: props.cwd } : {},
 		projectId: summary.projectId,
 		branch: summary.branch,
 		envPull: props.envPull
@@ -756,7 +758,7 @@ const finalizeInteractiveLink = async (props, summary) => {
 */
 const shouldOfferConfigInit = (input) => !input.hasConfig && input.offer;
 const maybeOfferConfigInit = async (props, summary) => {
-	const cwd = process.cwd();
+	const cwd = props.cwd ?? process.cwd();
 	if (!shouldOfferConfigInit({
 		hasConfig: hasNeonConfigFile(cwd),
 		offer: props.config !== false
@@ -777,6 +779,7 @@ const maybeOfferConfigInit = async (props, summary) => {
 		const { config: _offerConfig, ...rest } = props;
 		await autoPullEnvAfterPin({
 			...rest,
+			cwd,
 			projectId: summary.projectId,
 			branch: summary.branch,
 			envPull: props.envPull
@@ -795,4 +798,4 @@ const mustString = (value, name) => {
 	return value;
 };
 //#endregion
-export { builder, command, describe, handler, shouldOfferConfigInit, link_exports as t };
+export { builder, command, describe, handler, runLink, shouldOfferConfigInit, link_exports as t };

package/dist/commands/mcp.js

@@ -2,12 +2,12 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { NEON_MCP_CATEGORIES, NEON_MCP_URL, existingNeonApiKey, installNeonMcpServer, neonMcpUrl, parseMcpCategories, trackedProjectMcpConfig } from "../mcp/install.js";
 import { mcpInstallableAgents, resolveInstallTargets } from "../mcp/targets.js";
 import { canPickAgentsInteractively } from "../utils/agent_picker.js";
-import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { mintMcpApiKey, mintedKeyRevokeCommand, withdrawMintedKey } from "../mcp/mint.js";
 import { confirmMcpInstall } from "../mcp/wizard.js";
 import { resolveMcpPlan } from "../mcp/plan.js";

package/dist/commands/plugins.js

@@ -1,5 +1,6 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
@@ -8,7 +9,6 @@ import "../init/agents.js";
 import { pluginsInstallableAgents } from "../plugins/targets.js";
 import { canPickAgentsInteractively } from "../utils/agent_picker.js";
 import { NEON_PLUGIN_NAME, PLUGIN_SKILLS, PLUGIN_SOURCE, neonPluginsRetryCommand, pluginsAddArgs, runPluginsCli } from "../plugins/run.js";
-import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { resolvePluginsPlan } from "../plugins/plan.js";
 import { confirmPluginsInstall } from "../plugins/wizard.js";
 //#region src/commands/plugins.ts

package/dist/commands/skills.js

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
 import "../init/agents.js";
 import { mappedSkillsAgentNames, skillsInstallableAgents } from "../skills/targets.js";
 import { canPickAgentsInteractively } from "../utils/agent_picker.js";
-import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { skillsHelpValues, skillsYesHelp } from "../skills/catalog.js";
 import { confirmSkillsInstall, confirmSkillsUpdate } from "../skills/wizard.js";
 import { assertSkillsCanRun, resolveSkillsPlan } from "../skills/plan.js";

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-DsakkOVZ.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-B75xufe_.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,2 +1,2 @@
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-CAWrZTWa.js";
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-CbARRnq9.js";
 export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };