neon 4.18.1 → 4.20.0

package/README.md

@@ -583,7 +583,7 @@ If you'd rather not keep env vars on disk, inject them at runtime instead with `
 
 ## Config as code (`config` / `deploy`)
 
-Describe a branch's desired state in a `neon.ts` policy and reconcile it from the CLI — the Neon equivalent of `terraform status` / `plan` / `apply`. A policy splits into a **static** existential set — top-level `auth` / `dataApi` toggles and the beta `preview` block (Functions, buckets, AI Gateway) that decide what _exists_ — and a **dynamic** `branch` closure that tunes each branch (compute settings, TTL, protection, `parent`) based on the branch it's evaluated for (`name`, `isDefault`, …):
+Describe a branch's desired state in a `neon.ts` policy and reconcile it from the CLI — the Neon equivalent of `terraform status` / `plan` / `apply`. A policy splits into a **static** existential set — top-level `auth` / `dataApi` / `aiGateway` / `functions` / `buckets` (the last three still work under deprecated `preview`) that decide what _exists_ — and a **dynamic** `branch` closure that tunes each branch (compute settings, TTL, protection, `parent`) based on the branch it's evaluated for (`name`, `isDefault`, …):
 
 ```ts
 // neon.ts
@@ -610,6 +610,8 @@ export default defineConfig({
 ? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›
 ◯   Managed Better Auth
      Authentication with users and sessions stored in Postgres.
+◯   Data API
+     PostgREST-compatible HTTP API. Also declares Auth; the default provider needs it.
 ◯   Functions
      Long-running, without timeouts, and closer to your database.
 ◯   Object Storage
@@ -627,6 +629,9 @@ neon config init
 # Declare services with no prompt
 neon config init --services auth,functions,object-storage,ai-gateway
 
+# Data API also writes auth: true (the default provider requires it)
+neon config init --services data-api
+
 # Repeat the flag instead, and shorten it — every services flag takes all three spellings
 neon config init -s auth -s functions
 
@@ -724,7 +729,7 @@ neon config plan --project-id polished-snowflake-12345678 --output json
 neon deploy --branch my-feature --update-existing
 ```
 
-Function deploys declared under `preview.functions` are bundled with esbuild by default. A directory `source` is discovered as `index.ts`, then `index.js`, then `index.mjs`. Set `bundler: "none"` to ship a prebuilt directory as-is. `neon function deploy --no-bundle` is the same switch without a `neon.ts`.
+Function deploys declared under `functions` are bundled with esbuild by default. A directory `source` is discovered as `index.ts`, then `index.js`, then `index.mjs`. Set `bundler: "none"` to ship a prebuilt directory as-is. `neon function deploy --no-bundle` is the same switch without a `neon.ts`.
 
 Point a domain you already own at a function with `neon function domains` (alias `domain`):
 

package/dist/_chunks/{env-B75xufe_.js → env-DRpFX-_d.js}

@@ -1,10 +1,10 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
-import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-CbARRnq9.js";
+import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-DlXECBPi.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
+import { ErrorCode, createNeonApiFromOptions, isPlatformError, loadConfigFromFile } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";
-import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError as isPlatformError$1, loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
 /**
@@ -375,7 +375,7 @@ const resolveClaimableNeonEnvVars = async (ctx) => {
 *      buckets) into a config, then `fetchEnv` resolves what is actually enabled —
 *      so a branch with a bucket gets its `AWS_*` storage vars pulled with no policy.
 *      Function invocation URLs are listed live (`functionUrls: "all-live"`) because
-*      `pullConfig` cannot round-trip them into `preview.functions`. With
+*      `pullConfig` cannot round-trip them into `functions`. With
 *      {@link DevEnvContext.implyAiGateway}, the AI Gateway is added on top, since
 *      `pullConfig` cannot read it back.
 *   3. otherwise -> throw {@link MissingBranchContextError}.
@@ -394,7 +394,7 @@ const resolveNeonEnvVars = async (ctx) => {
 	const config = await loadNeonConfig(ctx);
 	if (config) {
 		if (!ctx.projectId || !ctx.branchId) throw new MissingBranchContextError(`Found a neon.ts but could not resolve the project/branch. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
-		await assertPolicyMatchesBranch(withoutPreviewFunctions(config), ctx);
+		await assertPolicyMatchesBranch(withoutDeclaredFunctions(config), ctx);
 		return await fetchAndProject(config, ctx);
 	}
 	if (ctx.projectId && ctx.branchId) {
@@ -465,7 +465,7 @@ const credentialsUnreachable = async (ctx, branch) => {
 	}
 };
 /** The adapter for direct branch reads: the injected one in tests, else built from options. */
-const apiFor = (ctx) => ctx.api ?? createNeonApiFromOptions$1("neon env", {
+const apiFor = (ctx) => ctx.api ?? createNeonApiFromOptions("neon env", {
 	...ctx.apiKey ? { apiKey: ctx.apiKey } : {},
 	...ctx.apiHost ? { apiHost: ctx.apiHost } : {}
 });
@@ -535,7 +535,7 @@ const readAiGatewayAvailable = async (api, projectId, branchId) => {
 		await api.listCredentials(projectId, branchId);
 		return true;
 	} catch (error) {
-		if (isPlatformError$1(error) && error.code === ErrorCode$1.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
+		if (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
 		throw error;
 	}
 };
@@ -576,16 +576,14 @@ const configForServices = (services, branchId, branch, selection) => {
 		if (branch.dataApiEnabled === false) notOnBranch("data-api", "Data API integration");
 		config.dataApi = true;
 	}
-	const preview = {};
 	if (services.includes("object-storage")) {
 		if (branch.buckets.length === 0) notOnBranch("object-storage", "object-storage buckets");
-		preview.buckets = Object.fromEntries(branch.buckets.map((bucket) => [bucket.name, { access: bucket.accessLevel }]));
+		config.buckets = Object.fromEntries(branch.buckets.map((bucket) => [bucket.name, { access: bucket.accessLevel }]));
 	}
 	if (services.includes("ai-gateway")) {
 		if (!branch.aiGatewayAvailable) aiGatewayUnavailable();
-		preview.aiGateway = true;
+		config.aiGateway = true;
 	}
-	if (Object.keys(preview).length > 0) config.preview = preview;
 	return config;
 };
 /**
@@ -624,15 +622,15 @@ const resolveDevEnv = async (ctx) => {
 	}
 };
 /** Functions are omitted because `plan` treats undeployed functions as resources to create. */
-const withoutPreviewFunctions = (config) => {
-	const preview = config.preview;
-	if (!preview?.functions) return config;
-	const previewWithoutFunctions = { ...preview };
-	delete previewWithoutFunctions.functions;
-	return {
-		...config,
-		preview: previewWithoutFunctions
-	};
+const withoutDeclaredFunctions = (config) => {
+	const next = { ...config };
+	if (next.functions !== void 0) delete next.functions;
+	if (next.preview?.functions) {
+		const previewWithoutFunctions = { ...next.preview };
+		delete previewWithoutFunctions.functions;
+		next.preview = previewWithoutFunctions;
+	}
+	return next;
 };
 /**
 * Tier-1 guard. Dry-run the policy against the branch's live state and stop if

package/dist/_chunks/{env_services-CbARRnq9.js → env_services-DlXECBPi.js}

@@ -185,7 +185,7 @@ async function fetchEnvKeysState(config, options, keys) {
 		let storage = null;
 		if (wantsStorage) {
 			storage = await api.getProjectBranchStorage(projectId, branch.id);
-			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets."].join(" "), { details: {
+			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets."].join(" "), { details: {
 				projectId,
 				branchId: branch.id
 			} });

package/dist/commands/checkout.js

@@ -77,6 +77,7 @@ const handler = async (props) => {
 	const failure = created && !policyApplied ? await applyPolicyOrDescribeFailure({
 		projectId,
 		branchId,
+		branchName,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.color !== void 0 ? { color: props.color } : {},

package/dist/commands/config.js

@@ -21,8 +21,8 @@ import { zipBundle } from "../utils/zip.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
 import chalk from "chalk";
-import { packagesToStage, resolveConfig } from "@neon/config";
 import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, loadConfigFromFile as loadConfigFromFile$1, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
 //#region src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
@@ -161,7 +161,7 @@ const resolveServices = async (props) => {
 	return pickServicesInteractively();
 };
 /**
-* Write the hello-world handler the scaffolded `preview.functions` entry points at. An
+* Write the hello-world handler the scaffolded `functions` entry points at. An
 * existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
 * better outcome than overwriting a file the user wrote.
 */
@@ -389,10 +389,76 @@ const planCmd = async (props) => {
 		branchId
 	});
 };
+const warnDeprecatedPreview = (config, target) => {
+	const message = previewGaWarningForConfig(config, target);
+	if (message) log.warning("%s", message);
+};
+const warningTargetFromResolved = (branch) => ({
+	name: branch.branchName,
+	id: branch.branchId,
+	exists: true,
+	...branch.isDefault !== void 0 ? { isDefault: branch.isDefault } : {},
+	...branch.isProtected !== void 0 ? { isProtected: branch.isProtected } : {},
+	...branch.parentId ? { parentId: branch.parentId } : {},
+	...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+});
+const warningTargetForExistingBranch = async (props) => {
+	if (props.runtimeApi) {
+		const branch = (await props.runtimeApi.listBranches(props.projectId)).find((listed) => listed.id === props.branchId);
+		if (branch) return {
+			name: branch.name,
+			id: branch.id,
+			exists: true,
+			isDefault: branch.isDefault,
+			isProtected: branch.protected,
+			...branch.parentId ? { parentId: branch.parentId } : {},
+			...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+		};
+	}
+	if (props.apiKey) {
+		const { data } = await getApiClient({
+			apiKey: props.apiKey,
+			...props.apiHost ? { apiHost: props.apiHost } : {}
+		}).listProjectBranches({ projectId: props.projectId });
+		const found = data.branches.find((listed) => listed.id === props.branchId);
+		if (found) return {
+			name: found.name ?? props.branchName ?? props.branchId,
+			id: found.id,
+			exists: true,
+			isDefault: found.default === true,
+			isProtected: found.protected === true,
+			...found.parent_id ? { parentId: found.parent_id } : {},
+			...found.expires_at ? { expiresAt: found.expires_at } : {}
+		};
+	}
+	return {
+		name: props.branchName ?? props.branchId,
+		id: props.branchId,
+		exists: true,
+		isDefault: false
+	};
+};
+const warnDeprecatedPreviewOnCreate = async (config, props) => {
+	try {
+		const listed = await warningTargetForExistingBranch(props);
+		warnDeprecatedPreview(config, {
+			...listed,
+			exists: false
+		});
+	} catch {
+		warnDeprecatedPreview(config, {
+			name: props.branchName,
+			id: props.branchId,
+			exists: false,
+			isDefault: false
+		});
+	}
+};
 const applyCmd = async (props) => {
 	const config = await loadConfig(props);
 	const branch = await resolveBranchRef(props);
 	announceTargetBranch(props, branch, "Applying to branch");
+	warnDeprecatedPreview(config, warningTargetFromResolved(branch));
 	const branchId = branch.branchId;
 	if (utilizedServices(config).includes("AI Gateway")) await assertAiGatewayProvisionable({
 		apiClient: props.apiClient,
@@ -429,7 +495,7 @@ const applyCmd = async (props) => {
 * the plan/apply table. Postgres is always present (every branch has it); the rest are listed
 * only when the policy declares them. This deliberately surfaces services that produce **no**
 * plan step — notably the AI Gateway, which is always available and only needs a scoped branch
-* credential (not a provisioning step) — so adding `preview.aiGateway` to a neon.ts isn't
+* credential (not a provisioning step) — so adding `aiGateway` to a neon.ts isn't
 * mistaken for being silently dropped. Service enablement is static top-level config (it never
 * lives in the per-branch closure), so reading it straight off `config` is accurate.
 */
@@ -547,6 +613,18 @@ const applyPolicyOnCreate = async (props) => {
 		if (/Could not find a Neon config file/i.test(message)) return;
 		throw err;
 	}
+	try {
+		warnDeprecatedPreview(config, await warningTargetForExistingBranch({
+			projectId: props.projectId,
+			branchId: props.branchId,
+			...props.branchName ? { branchName: props.branchName } : {},
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		}));
+	} catch {
+		warnDeprecatedPreview(config);
+	}
 	await assertAiGatewayProvisionableFromCreds({
 		projectId: props.projectId,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
@@ -634,10 +712,26 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 		});
 		log.info("Created branch %s (%s) from neon.ts policy.", branchName, branchId);
 		logPolicyResult(result, { color: props.color !== false });
+		await warnDeprecatedPreviewOnCreate(config, {
+			projectId: props.projectId,
+			branchId,
+			branchName,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		});
 		return { branchId };
 	} catch (err) {
 		if (isPartialBranchCreateError(err)) {
 			log.info("Created branch %s (%s) from neon.ts policy.", err.branchName, err.branchId);
+			await warnDeprecatedPreviewOnCreate(config, {
+				projectId: props.projectId,
+				branchId: err.branchId,
+				branchName: err.branchName,
+				...props.apiKey ? { apiKey: props.apiKey } : {},
+				...props.apiHost ? { apiHost: props.apiHost } : {},
+				...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+			});
 			return {
 				branchId: err.branchId,
 				policyFailure: err.reason

package/dist/commands/dev.js

@@ -3,10 +3,10 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { y as functionBaseUrlKey } from "../_chunks/env_services-CbARRnq9.js";
+import { y as functionBaseUrlKey } from "../_chunks/env_services-DlXECBPi.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-B75xufe_.js";
+import { a as resolveDevEnv } from "../_chunks/env-DRpFX-_d.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -149,9 +149,9 @@ const runSingleSource = async (props) => {
 const runFromConfig = async (props) => {
 	const branchId = await resolveBranchId(props);
 	const resolved = await resolveFunctionsFromConfig(process.cwd());
-	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `preview.functions`.");
+	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `functions`.");
 	const { configPath, functions } = resolved;
-	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `preview.functions`, or pass --source <path>.");
+	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `functions`, or pass --source <path>.");
 	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
 	reportDevCredential(credential);
 	const units = await planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);

package/dist/commands/env.js

@@ -5,11 +5,11 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-CbARRnq9.js";
+import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-DlXECBPi.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-B75xufe_.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DRpFX-_d.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts

package/dist/config_services.js

@@ -1,3 +1,4 @@
+import { authoredAiGateway, authoredBuckets, authoredFunctions } from "@neon/config";
 //#region src/config_services.ts
 const isToggleEnabled = (toggle) => {
 	if (toggle === void 0) return false;
@@ -9,9 +10,9 @@ const declaredNeonServices = (config) => {
 	const services = [];
 	if (isToggleEnabled(config.auth)) services.push("auth");
 	if (isToggleEnabled(config.dataApi)) services.push("data-api");
-	if (Object.keys(config.preview?.buckets ?? {}).length > 0) services.push("object-storage");
-	if (Object.keys(config.preview?.functions ?? {}).length > 0) services.push("functions");
-	if (isToggleEnabled(config.preview?.aiGateway)) services.push("ai-gateway");
+	if (Object.keys(authoredBuckets(config) ?? {}).length > 0) services.push("object-storage");
+	if (Object.keys(authoredFunctions(config) ?? {}).length > 0) services.push("functions");
+	if (isToggleEnabled(authoredAiGateway(config))) services.push("ai-gateway");
 	return services;
 };
 const dataApiSettingsToSnake = (settings) => {

package/dist/config_template.js

@@ -15,24 +15,21 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 /**
 * The services `config init` can declare in the `neon.ts` it scaffolds — the subset of
 * {@link NEON_SERVICES} a policy has a field for. {@link renderNeonConfig} owns the mapping
-* from these names to the `neon.ts` fields (`aiGateway`, `buckets`).
+* from these names to the `neon.ts` fields (`aiGateway`, `functions`, `buckets`, `dataApi`).
 *
-* Postgres is absent because every branch has it, so there is nothing to declare. `data-api`
-* is absent because enabling it with the default `authProvider: "neon"` requires `auth` — a
-* pairing the picker would have to enforce rather than offer.
+* Postgres is absent because every branch has it, so there is nothing to declare. Selecting
+* `data-api` also writes `auth: true`: the default Data API provider requires Neon Auth, and
+* `defineConfig` type-errors the file without it.
 */
-const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres" && service !== "data-api");
+const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres");
 /**
 * What `config init --services none` produces. One constant because it is both the help text
 * and what tells the parser `none` is a value here — passing the literal at each call site
 * lets the two drift into documenting something the parser does not accept.
 */
 const CONFIG_INIT_NONE_MEANS = "the bare starter policy";
-/** Why the two a policy cannot declare are not selectable, for the refusal message. */
-const CONFIG_INIT_UNAVAILABLE = {
-	postgres: "every branch has Postgres, so a policy has nothing to declare for it",
-	"data-api": "enabling it with the default provider requires auth, so declare auth here and turn the Data API on with `neon data-api create`"
-};
+/** Why a policy cannot declare a real Neon service, for the refusal message. */
+const CONFIG_INIT_UNAVAILABLE = { postgres: "every branch has Postgres, so a policy has nothing to declare for it" };
 /** Slug, display name, and source path of the function scaffolded for `functions`. */
 const FUNCTION_SLUG = "hello";
 const FUNCTION_NAME = "Hello World";
@@ -56,27 +53,33 @@ const block = (level, key, body) => [
 	...body,
 	...at(level, "},")
 ];
-/** The `preview` block for the selected services, or "" when none of them is a preview feature. */
-const renderPreview = (services) => {
+/** GA service keys for the selected init services, or "" when none of them is selected. */
+const renderGaServices = (services) => {
 	const lines = [];
-	if (services.includes("ai-gateway")) lines.push(...at(2, "aiGateway: true,"));
-	if (services.includes("functions")) lines.push(...block(2, "functions", [...at(3, `${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`)]));
-	if (services.includes("object-storage")) lines.push(...block(2, "buckets", [...at(3, `// "private" is the default; use "public_read" for anonymous reads`, `${BUCKET_NAME}: { access: "private" },`)]));
+	if (services.includes("ai-gateway")) lines.push(...at(1, "aiGateway: true,"));
+	if (services.includes("functions")) lines.push(...block(1, "functions", [...at(2, `${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`)]));
+	if (services.includes("object-storage")) lines.push(...block(1, "buckets", [...at(2, `// "private" is the default; use "public_read" for anonymous reads`, `${BUCKET_NAME}: { access: "private" },`)]));
 	if (lines.length === 0) return "";
-	return `${block(1, "preview", lines).join("\n")}\n`;
+	return `${lines.join("\n")}\n`;
 };
 /**
 * Render the `neon.ts` policy `config init` writes. With no services this is the starter
-* policy — an explicit `auth: false`, no `preview` block, and a `branch` closure that gives
+* policy — an explicit `auth: false`, no service keys beyond that, and a `branch` closure that gives
 * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
 * non-interactive run produce the identical file.
+*
+* `data-api` writes `dataApi: true` and forces `auth: true`. The default provider is Neon
+* Auth; omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
 */
-const renderNeonConfig = (services) => `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
+const renderNeonConfig = (services) => {
+	const auth = services.includes("auth") || services.includes("data-api");
+	const dataApi = services.includes("data-api") ? "  dataApi: true,\n" : "";
+	return `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
 
 export default defineConfig({
   // Declare your Neon services here
-  auth: ${services.includes("auth")},
-${renderPreview(services)}  // Branch policy: per-branch tuning
+  auth: ${auth},
+${dataApi}${renderGaServices(services)}  // Branch policy: per-branch tuning
   branch: (branch) => {
     if (branch.isDefault) {
       // Default branch: no overrides, uses project defaults
@@ -92,6 +95,7 @@ ${renderPreview(services)}  // Branch policy: per-branch tuning
   },
 });
 `;
+};
 /** Render a scalar the way it has to appear in TypeScript source. */
 const renderScalar = (value) => typeof value === "string" ? `"${value}"` : String(value);
 /**
@@ -121,15 +125,15 @@ const renderSeededBranch = (view) => {
 		...at(1, "}),")
 	].join("\n")}\n`;
 };
-/** The `preview` block for a policy seeded from live state. */
-const renderSeededPreview = (view, branchName) => {
+/** GA service keys for a policy seeded from live state. */
+const renderSeededGaServices = (view, branchName) => {
 	const lines = [];
 	const buckets = Object.entries(view.preview?.buckets ?? {});
-	if (buckets.length > 0) lines.push(...block(2, "buckets", buckets.flatMap(([name, bucket]) => at(3, `${renderKey(name)}: { access: "${bucket.access}" },`))));
+	if (buckets.length > 0) lines.push(...block(1, "buckets", buckets.flatMap(([name, bucket]) => at(2, `${renderKey(name)}: { access: "${bucket.access}" },`))));
 	const functions = Object.entries(view.preview?.functions ?? {});
-	if (functions.length > 0) lines.push(...at(2, `// ${branchName} has ${functions.length} deployed function${functions.length === 1 ? "" : "s"}.`, "// Declaring one needs the local source path, which the branch does not know:", "// functions: {", ...functions.map(([slug, fn]) => `//   ${renderKey(slug)}: { name: "${fn.name}", source: "./${slug}.ts" },`), "// },"));
+	if (functions.length > 0) lines.push(...at(1, `// ${branchName} has ${functions.length} deployed function${functions.length === 1 ? "" : "s"}.`, "// Declaring one needs the local source path, which the branch does not know:", "// functions: {", ...functions.map(([slug, fn]) => `//   ${renderKey(slug)}: { name: "${fn.name}", source: "./${slug}.ts" },`), "// },"));
 	if (lines.length === 0) return "";
-	return `${block(1, "preview", lines).join("\n")}\n`;
+	return `${lines.join("\n")}\n`;
 };
 /**
 * Render a `neon.ts` from a branch's live state (`config init --from-branch`).
@@ -148,16 +152,16 @@ const renderSeededPreview = (view, branchName) => {
 */
 const renderNeonConfigFromView = (view, branchName) => {
 	const services = [view.auth ? "  auth: true," : "", view.dataApi ? "  dataApi: true," : ""].filter((line) => line !== "");
-	const preview = renderSeededPreview(view, branchName);
+	const gaServices = renderSeededGaServices(view, branchName);
 	const branch = renderSeededBranch(view);
-	if (services.length === 0 && preview === "" && branch === "") return {
+	if (services.length === 0 && gaServices === "" && branch === "") return {
 		source: renderNeonConfig([]),
 		seeded: false
 	};
 	const protectedNote = view.branch?.protected ? `// ${branchName} is protected on Neon. Not declared here: a policy \`protected\` would\n// apply to every branch this policy is applied to.\n` : "";
 	const body = [
 		...services,
-		...preview === "" ? [] : [preview.trimEnd()],
+		...gaServices === "" ? [] : [gaServices.trimEnd()],
 		...branch === "" ? [] : [branch.trimEnd()]
 	].join("\n");
 	return {
@@ -165,7 +169,7 @@ const renderNeonConfigFromView = (view, branchName) => {
 
 // Seeded by \`neon config init --from-branch\` from ${branchName}.
 // The AI Gateway is not readable from a branch (always available, credential-gated), so add
-// \`preview: { aiGateway: true }\` if the policy should declare it.
+// \`aiGateway: true\` if the policy should declare it.
 ${protectedNote}export default defineConfig({
 ${body}
 });

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-B75xufe_.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-DRpFX-_d.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,2 +1,2 @@
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-CbARRnq9.js";
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-DlXECBPi.js";
 export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };

package/dist/utils/ai_gateway_notice.js

@@ -1,7 +1,7 @@
 import { log } from "../log.js";
 //#region src/utils/ai_gateway_notice.ts
 /**
-* Friendly guidance shown when a branch enables the AI Gateway (`preview.aiGateway`).
+* Friendly guidance shown when a branch enables the AI Gateway (`aiGateway`).
 *
 * The gateway is credential-gated, not provisioned: enabling it always mints a working
 * branch credential, so `apply` / `checkout` / `env pull` succeed regardless of plan. The
@@ -50,7 +50,7 @@ const hasFlagshipModels = (modelIds) => modelIds.some((id) => id.includes("opus"
 * gateway won't serve model requests until the account is on a paid plan. `upgradeUrl` is the
 * org-scoped Console billing page (see {@link aiGatewayUpgradeUrl}).
 */
-const freePlanBlockMessage = (upgradeUrl) => `This neon.ts enables the AI Gateway, which isn't available on the Free plan — the gateway won't serve model requests. Upgrade to a paid plan and re-run, or remove \`preview.aiGateway\` from neon.ts. Upgrade here: ${upgradeUrl}`;
+const freePlanBlockMessage = (upgradeUrl) => `This neon.ts enables the AI Gateway, which isn't available on the Free plan — the gateway won't serve model requests. Upgrade to a paid plan and re-run, or remove \`aiGateway\` from neon.ts. Upgrade here: ${upgradeUrl}`;
 /**
 * Build the AI Gateway courtesy notice for an account's plan and (optionally) its live model
 * catalog, or `null` when nothing needs saying.

package/dist/utils/enrichers.js

@@ -30,13 +30,20 @@ const resolveBranchRef = async (props) => {
 	const branch = typeof props.branch === "string" ? props.branch : props.id;
 	const { data } = await props.apiClient.listProjectBranches({ projectId: props.projectId });
 	const branches = data.branches;
+	const listingFields = (listed) => ({
+		isDefault: listed.default === true,
+		isProtected: listed.protected === true,
+		...listed.parent_id ? { parentId: listed.parent_id } : {},
+		...listed.expires_at ? { expiresAt: listed.expires_at } : {}
+	});
 	if (branch) {
 		const ref = branch.toString();
 		const found = looksLikeBranchId(ref) ? branches.find((b) => b.id === ref) : branches.find((b) => b.name === ref);
 		if (found) return {
 			branchId: found.id,
 			branchName: found.name ?? found.id,
-			usedDefault: false
+			usedDefault: false,
+			...listingFields(found)
 		};
 		if (looksLikeBranchId(ref)) return {
 			branchId: ref,
@@ -50,7 +57,8 @@ const resolveBranchRef = async (props) => {
 	return {
 		branchId: defaultBranch.id,
 		branchName: defaultBranch.name ?? defaultBranch.id,
-		usedDefault: true
+		usedDefault: true,
+		...listingFields(defaultBranch)
 	};
 };
 const resolveSingleDatabase = async (props) => {

package/dist/utils/service_picker.js

@@ -12,6 +12,11 @@ const CHOICES = [
 		title: "Managed Better Auth",
 		description: "Authentication with users and sessions stored in Postgres."
 	},
+	{
+		value: "data-api",
+		title: "Data API",
+		description: "PostgREST-compatible HTTP API. Also declares Auth; the default provider needs it."
+	},
 	{
 		value: "functions",
 		title: "Functions",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.18.1",
+  "version": "4.20.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config-runtime": "1.4.1",
+    "@neon/config-runtime": "1.5.0",
     "@neon/sdk": "6.0.0",
-    "@neon/config": "1.5.1"
+    "@neon/config": "1.6.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -98,9 +98,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.18",
     "@neon/e2e-harness": "0.0.0",
-    "@neon-internals/env-core": "0.0.17",
-    "@neon/functions": "0.10.0"
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",