neon 4.19.0 → 4.21.0

package/README.md

@@ -583,7 +583,7 @@ If you'd rather not keep env vars on disk, inject them at runtime instead with `
 
 ## Config as code (`config` / `deploy`)
 
-Describe a branch's desired state in a `neon.ts` policy and reconcile it from the CLI — the Neon equivalent of `terraform status` / `plan` / `apply`. A policy splits into a **static** existential set — top-level `auth` / `dataApi` toggles and the beta `preview` block (Functions, buckets, AI Gateway) that decide what _exists_ — and a **dynamic** `branch` closure that tunes each branch (compute settings, TTL, protection, `parent`) based on the branch it's evaluated for (`name`, `isDefault`, …):
+Describe a branch's desired state in a `neon.ts` policy and reconcile it from the CLI — the Neon equivalent of `terraform status` / `plan` / `apply`. A policy splits into a **static** existential set — top-level `auth` / `dataApi` / `aiGateway` / `functions` / `buckets` / `triggers` (`aiGateway`, `functions`, and `buckets` still work under deprecated `preview`) that decide what _exists_ — and a **dynamic** `branch` closure that tunes each branch (compute settings, TTL, protection, `parent`) based on the branch it's evaluated for (`name`, `isDefault`, …):
 
 ```ts
 // neon.ts
@@ -729,7 +729,7 @@ neon config plan --project-id polished-snowflake-12345678 --output json
 neon deploy --branch my-feature --update-existing
 ```
 
-Function deploys declared under `preview.functions` are bundled with esbuild by default. A directory `source` is discovered as `index.ts`, then `index.js`, then `index.mjs`. Set `bundler: "none"` to ship a prebuilt directory as-is. `neon function deploy --no-bundle` is the same switch without a `neon.ts`.
+Function deploys declared under `functions` are bundled with esbuild by default. A directory `source` is discovered as `index.ts`, then `index.js`, then `index.mjs`. Set `bundler: "none"` to ship a prebuilt directory as-is. `neon function deploy --no-bundle` is the same switch without a `neon.ts`.
 
 Point a domain you already own at a function with `neon function domains` (alias `domain`):
 
@@ -967,21 +967,23 @@ All sub-commands honor the [global options](#global-options), including `--outpu
 
 ## Function triggers (`triggers`)
 
-`neon triggers` (alias `neon trigger`) manages **scheduled function triggers** on a branch — cron jobs that invoke a Neon Function. Beta. The only trigger type is `schedule`; cron is a five-field UTC expression.
+`neon triggers` (alias `neon trigger`) manages Function triggers on a branch. Types are `schedule` (a five-field UTC cron expression) and `storage_object_created` (an object-storage bucket, with an optional object-key prefix).
 
 Every sub-command resolves the project through the standard chain (`--project-id`, then the `.neon` context file, then a single-project auto-detect) and the branch through `--branch <id|name>`, the `.neon` pin, or the project's default branch.
 
 ```bash
 neon triggers create --function-slug uptime --name uptime-check --cron '*/15 * * * *'
+neon triggers create --function-slug ingest --name on-upload --bucket assets --prefix 'logos/' --function-path /object
 neon triggers list
 neon triggers get trigger-test-123
 neon triggers update trigger-test-123 --cron '0 3 * * *'
+neon triggers update trigger-storage-123 --bucket assets --prefix 'incoming/'
 neon triggers enable trigger-test-123
 neon triggers disable trigger-test-123
 neon triggers delete trigger-test-123
 ```
 
-`enable` / `disable` are wrappers over `update --enabled`. List shows `inherited` when the effective config was authored on an ancestor branch.
+`enable` / `disable` are wrappers over `update --enabled`. List shows `inherited` when the effective config was authored on an ancestor branch. `create` takes `--cron` or `--bucket`, not both.
 
 ## Branch credentials (`credentials`)
 

package/dist/_chunks/{env-B75xufe_.js → env-DRpFX-_d.js}

@@ -1,10 +1,10 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
-import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-CbARRnq9.js";
+import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-DlXECBPi.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
+import { ErrorCode, createNeonApiFromOptions, isPlatformError, loadConfigFromFile } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";
-import { ErrorCode as ErrorCode$1, createNeonApiFromOptions as createNeonApiFromOptions$1, isPlatformError as isPlatformError$1, loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
 /**
@@ -375,7 +375,7 @@ const resolveClaimableNeonEnvVars = async (ctx) => {
 *      buckets) into a config, then `fetchEnv` resolves what is actually enabled —
 *      so a branch with a bucket gets its `AWS_*` storage vars pulled with no policy.
 *      Function invocation URLs are listed live (`functionUrls: "all-live"`) because
-*      `pullConfig` cannot round-trip them into `preview.functions`. With
+*      `pullConfig` cannot round-trip them into `functions`. With
 *      {@link DevEnvContext.implyAiGateway}, the AI Gateway is added on top, since
 *      `pullConfig` cannot read it back.
 *   3. otherwise -> throw {@link MissingBranchContextError}.
@@ -394,7 +394,7 @@ const resolveNeonEnvVars = async (ctx) => {
 	const config = await loadNeonConfig(ctx);
 	if (config) {
 		if (!ctx.projectId || !ctx.branchId) throw new MissingBranchContextError(`Found a neon.ts but could not resolve the project/branch. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
-		await assertPolicyMatchesBranch(withoutPreviewFunctions(config), ctx);
+		await assertPolicyMatchesBranch(withoutDeclaredFunctions(config), ctx);
 		return await fetchAndProject(config, ctx);
 	}
 	if (ctx.projectId && ctx.branchId) {
@@ -465,7 +465,7 @@ const credentialsUnreachable = async (ctx, branch) => {
 	}
 };
 /** The adapter for direct branch reads: the injected one in tests, else built from options. */
-const apiFor = (ctx) => ctx.api ?? createNeonApiFromOptions$1("neon env", {
+const apiFor = (ctx) => ctx.api ?? createNeonApiFromOptions("neon env", {
 	...ctx.apiKey ? { apiKey: ctx.apiKey } : {},
 	...ctx.apiHost ? { apiHost: ctx.apiHost } : {}
 });
@@ -535,7 +535,7 @@ const readAiGatewayAvailable = async (api, projectId, branchId) => {
 		await api.listCredentials(projectId, branchId);
 		return true;
 	} catch (error) {
-		if (isPlatformError$1(error) && error.code === ErrorCode$1.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
+		if (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable && (error.details.status === 404 || error.details.status === 501)) return false;
 		throw error;
 	}
 };
@@ -576,16 +576,14 @@ const configForServices = (services, branchId, branch, selection) => {
 		if (branch.dataApiEnabled === false) notOnBranch("data-api", "Data API integration");
 		config.dataApi = true;
 	}
-	const preview = {};
 	if (services.includes("object-storage")) {
 		if (branch.buckets.length === 0) notOnBranch("object-storage", "object-storage buckets");
-		preview.buckets = Object.fromEntries(branch.buckets.map((bucket) => [bucket.name, { access: bucket.accessLevel }]));
+		config.buckets = Object.fromEntries(branch.buckets.map((bucket) => [bucket.name, { access: bucket.accessLevel }]));
 	}
 	if (services.includes("ai-gateway")) {
 		if (!branch.aiGatewayAvailable) aiGatewayUnavailable();
-		preview.aiGateway = true;
+		config.aiGateway = true;
 	}
-	if (Object.keys(preview).length > 0) config.preview = preview;
 	return config;
 };
 /**
@@ -624,15 +622,15 @@ const resolveDevEnv = async (ctx) => {
 	}
 };
 /** Functions are omitted because `plan` treats undeployed functions as resources to create. */
-const withoutPreviewFunctions = (config) => {
-	const preview = config.preview;
-	if (!preview?.functions) return config;
-	const previewWithoutFunctions = { ...preview };
-	delete previewWithoutFunctions.functions;
-	return {
-		...config,
-		preview: previewWithoutFunctions
-	};
+const withoutDeclaredFunctions = (config) => {
+	const next = { ...config };
+	if (next.functions !== void 0) delete next.functions;
+	if (next.preview?.functions) {
+		const previewWithoutFunctions = { ...next.preview };
+		delete previewWithoutFunctions.functions;
+		next.preview = previewWithoutFunctions;
+	}
+	return next;
 };
 /**
 * Tier-1 guard. Dry-run the policy against the branch's live state and stop if

package/dist/_chunks/{env_services-CbARRnq9.js → env_services-DlXECBPi.js}

@@ -185,7 +185,7 @@ async function fetchEnvKeysState(config, options, keys) {
 		let storage = null;
 		if (wantsStorage) {
 			storage = await api.getProjectBranchStorage(projectId, branch.id);
-			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets."].join(" "), { details: {
+			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets."].join(" "), { details: {
 				projectId,
 				branchId: branch.id
 			} });

package/dist/commands/checkout.js

@@ -77,6 +77,7 @@ const handler = async (props) => {
 	const failure = created && !policyApplied ? await applyPolicyOrDescribeFailure({
 		projectId,
 		branchId,
+		branchName,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.color !== void 0 ? { color: props.color } : {},

package/dist/commands/config.js

@@ -21,8 +21,8 @@ import { zipBundle } from "../utils/zip.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
 import chalk from "chalk";
-import { packagesToStage, resolveConfig } from "@neon/config";
 import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, loadConfigFromFile as loadConfigFromFile$1, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
 //#region src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
@@ -161,7 +161,7 @@ const resolveServices = async (props) => {
 	return pickServicesInteractively();
 };
 /**
-* Write the hello-world handler the scaffolded `preview.functions` entry points at. An
+* Write the hello-world handler the scaffolded `functions` entry points at. An
 * existing `hello.ts` is left alone: the declared function keeps pointing at it, which is the
 * better outcome than overwriting a file the user wrote.
 */
@@ -389,10 +389,76 @@ const planCmd = async (props) => {
 		branchId
 	});
 };
+const warnDeprecatedPreview = (config, target) => {
+	const message = previewGaWarningForConfig(config, target);
+	if (message) log.warning("%s", message);
+};
+const warningTargetFromResolved = (branch) => ({
+	name: branch.branchName,
+	id: branch.branchId,
+	exists: true,
+	...branch.isDefault !== void 0 ? { isDefault: branch.isDefault } : {},
+	...branch.isProtected !== void 0 ? { isProtected: branch.isProtected } : {},
+	...branch.parentId ? { parentId: branch.parentId } : {},
+	...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+});
+const warningTargetForExistingBranch = async (props) => {
+	if (props.runtimeApi) {
+		const branch = (await props.runtimeApi.listBranches(props.projectId)).find((listed) => listed.id === props.branchId);
+		if (branch) return {
+			name: branch.name,
+			id: branch.id,
+			exists: true,
+			isDefault: branch.isDefault,
+			isProtected: branch.protected,
+			...branch.parentId ? { parentId: branch.parentId } : {},
+			...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+		};
+	}
+	if (props.apiKey) {
+		const { data } = await getApiClient({
+			apiKey: props.apiKey,
+			...props.apiHost ? { apiHost: props.apiHost } : {}
+		}).listProjectBranches({ projectId: props.projectId });
+		const found = data.branches.find((listed) => listed.id === props.branchId);
+		if (found) return {
+			name: found.name ?? props.branchName ?? props.branchId,
+			id: found.id,
+			exists: true,
+			isDefault: found.default === true,
+			isProtected: found.protected === true,
+			...found.parent_id ? { parentId: found.parent_id } : {},
+			...found.expires_at ? { expiresAt: found.expires_at } : {}
+		};
+	}
+	return {
+		name: props.branchName ?? props.branchId,
+		id: props.branchId,
+		exists: true,
+		isDefault: false
+	};
+};
+const warnDeprecatedPreviewOnCreate = async (config, props) => {
+	try {
+		const listed = await warningTargetForExistingBranch(props);
+		warnDeprecatedPreview(config, {
+			...listed,
+			exists: false
+		});
+	} catch {
+		warnDeprecatedPreview(config, {
+			name: props.branchName,
+			id: props.branchId,
+			exists: false,
+			isDefault: false
+		});
+	}
+};
 const applyCmd = async (props) => {
 	const config = await loadConfig(props);
 	const branch = await resolveBranchRef(props);
 	announceTargetBranch(props, branch, "Applying to branch");
+	warnDeprecatedPreview(config, warningTargetFromResolved(branch));
 	const branchId = branch.branchId;
 	if (utilizedServices(config).includes("AI Gateway")) await assertAiGatewayProvisionable({
 		apiClient: props.apiClient,
@@ -429,7 +495,7 @@ const applyCmd = async (props) => {
 * the plan/apply table. Postgres is always present (every branch has it); the rest are listed
 * only when the policy declares them. This deliberately surfaces services that produce **no**
 * plan step — notably the AI Gateway, which is always available and only needs a scoped branch
-* credential (not a provisioning step) — so adding `preview.aiGateway` to a neon.ts isn't
+* credential (not a provisioning step) — so adding `aiGateway` to a neon.ts isn't
 * mistaken for being silently dropped. Service enablement is static top-level config (it never
 * lives in the per-branch closure), so reading it straight off `config` is accurate.
 */
@@ -547,6 +613,18 @@ const applyPolicyOnCreate = async (props) => {
 		if (/Could not find a Neon config file/i.test(message)) return;
 		throw err;
 	}
+	try {
+		warnDeprecatedPreview(config, await warningTargetForExistingBranch({
+			projectId: props.projectId,
+			branchId: props.branchId,
+			...props.branchName ? { branchName: props.branchName } : {},
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		}));
+	} catch {
+		warnDeprecatedPreview(config);
+	}
 	await assertAiGatewayProvisionableFromCreds({
 		projectId: props.projectId,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
@@ -634,10 +712,26 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 		});
 		log.info("Created branch %s (%s) from neon.ts policy.", branchName, branchId);
 		logPolicyResult(result, { color: props.color !== false });
+		await warnDeprecatedPreviewOnCreate(config, {
+			projectId: props.projectId,
+			branchId,
+			branchName,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		});
 		return { branchId };
 	} catch (err) {
 		if (isPartialBranchCreateError(err)) {
 			log.info("Created branch %s (%s) from neon.ts policy.", err.branchName, err.branchId);
+			await warnDeprecatedPreviewOnCreate(config, {
+				projectId: props.projectId,
+				branchId: err.branchId,
+				branchName: err.branchName,
+				...props.apiKey ? { apiKey: props.apiKey } : {},
+				...props.apiHost ? { apiHost: props.apiHost } : {},
+				...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+			});
 			return {
 				branchId: err.branchId,
 				policyFailure: err.reason

package/dist/commands/dev.js

@@ -3,10 +3,10 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { y as functionBaseUrlKey } from "../_chunks/env_services-CbARRnq9.js";
+import { y as functionBaseUrlKey } from "../_chunks/env_services-DlXECBPi.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-B75xufe_.js";
+import { a as resolveDevEnv } from "../_chunks/env-DRpFX-_d.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -149,9 +149,9 @@ const runSingleSource = async (props) => {
 const runFromConfig = async (props) => {
 	const branchId = await resolveBranchId(props);
 	const resolved = await resolveFunctionsFromConfig(process.cwd());
-	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `preview.functions`.");
+	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `functions`.");
 	const { configPath, functions } = resolved;
-	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `preview.functions`, or pass --source <path>.");
+	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `functions`, or pass --source <path>.");
 	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
 	reportDevCredential(credential);
 	const units = await planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);

package/dist/commands/env.js

@@ -5,11 +5,11 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-CbARRnq9.js";
+import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-DlXECBPi.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-B75xufe_.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DRpFX-_d.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts

package/dist/commands/triggers.js

@@ -100,8 +100,8 @@ function enabledPatch(type, enabled) {
 		enabled
 	};
 }
-function updatePatch(type, props) {
-	if (type === "schedule") {
+function updatePatch(existing, props) {
+	if (existing.type === "schedule") {
 		const body = { type: "schedule" };
 		if (props["function-slug"] !== void 0) body.function_slug = props["function-slug"];
 		if (props.name !== void 0) body.name = props.name;
@@ -115,6 +115,10 @@ function updatePatch(type, props) {
 	if (props.name !== void 0) body.name = props.name;
 	if (props["function-path"] !== void 0) body.function_path = props["function-path"];
 	if (props.enabled !== void 0) body.enabled = props.enabled;
+	if (props.bucket !== void 0 || props.prefix !== void 0) body.storage_object_created = {
+		bucket_name: props.bucket ?? existing.storage_object_created.bucket_name,
+		...props.prefix !== void 0 ? { prefix: props.prefix } : existing.storage_object_created.prefix !== void 0 ? { prefix: existing.storage_object_created.prefix } : {}
+	};
 	return body;
 }
 function noFieldsToUpdateMessage(type) {
@@ -127,6 +131,8 @@ function noFieldsToUpdateMessage(type) {
 	] : [
 		"--function-slug",
 		"--name",
+		"--bucket",
+		"--prefix",
 		"--function-path",
 		"--enabled"
 	];
@@ -148,7 +154,7 @@ const builder = (argv) => argv.usage("$0 triggers <sub-command> [options]").opti
 }).middleware(fillSingleProject).command("list", "List triggers on the branch", (yargs) => yargs, (args) => list(args)).command("get <id>", "Show a trigger", (yargs) => yargs.positional("id", {
 	describe: "Trigger ID",
 	type: "string"
-}), (args) => get(args)).command("create", "Create a trigger that invokes a function on a cron schedule", (yargs) => yargs.options({
+}), (args) => get(args)).command("create", "Create a trigger that invokes a function on a cron schedule or when an object is created", (yargs) => yargs.options({
 	"function-slug": {
 		describe: "Slug of the function to invoke",
 		type: "string",
@@ -161,8 +167,15 @@ const builder = (argv) => argv.usage("$0 triggers <sub-command> [options]").opti
 	},
 	cron: {
 		describe: "Five-field UTC cron expression, e.g. '*/15 * * * *'",
-		type: "string",
-		demandOption: true
+		type: "string"
+	},
+	bucket: {
+		describe: "Object-storage bucket to watch (storage_object_created)",
+		type: "string"
+	},
+	prefix: {
+		describe: "Object-key prefix to match (requires --bucket on create)",
+		type: "string"
 	},
 	"function-path": {
 		describe: "Path the invocation is sent to (default '/')",
@@ -188,6 +201,14 @@ const builder = (argv) => argv.usage("$0 triggers <sub-command> [options]").opti
 		describe: "Five-field UTC cron expression",
 		type: "string"
 	},
+	bucket: {
+		describe: "Object-storage bucket to watch (storage_object_created)",
+		type: "string"
+	},
+	prefix: {
+		describe: "Object-key prefix to match",
+		type: "string"
+	},
 	"function-path": {
 		describe: "Path the invocation is sent to",
 		type: "string"
@@ -221,23 +242,47 @@ const get = async (props) => {
 };
 const create = async (props) => {
 	const branchId = await branchIdFromProps(props);
-	const body = {
-		type: "schedule",
-		function_slug: props["function-slug"],
-		name: props.name,
-		schedule: { cron: props.cron }
-	};
-	if (props["function-path"] !== void 0) body.function_path = props["function-path"];
-	if (props.enabled !== void 0) body.enabled = props.enabled;
+	const body = createBody(props);
 	const { data } = await retryOnLock(() => props.apiClient.createProjectBranchTrigger(props.projectId, branchId, body));
 	writeTrigger(props, data.trigger);
 };
+function createBody(props) {
+	if (props.cron !== void 0 && props.bucket !== void 0) throw new Error("Pass --cron or --bucket, not both.");
+	if (props.prefix !== void 0 && props.bucket === void 0) throw new Error("--prefix requires --bucket.");
+	if (props.cron !== void 0) {
+		const body = {
+			type: "schedule",
+			function_slug: props["function-slug"],
+			name: props.name,
+			schedule: { cron: props.cron }
+		};
+		if (props["function-path"] !== void 0) body.function_path = props["function-path"];
+		if (props.enabled !== void 0) body.enabled = props.enabled;
+		return body;
+	}
+	if (props.bucket !== void 0) {
+		const body = {
+			type: "storage_object_created",
+			function_slug: props["function-slug"],
+			name: props.name,
+			storage_object_created: {
+				bucket_name: props.bucket,
+				...props.prefix !== void 0 ? { prefix: props.prefix } : {}
+			}
+		};
+		if (props["function-path"] !== void 0) body.function_path = props["function-path"];
+		if (props.enabled !== void 0) body.enabled = props.enabled;
+		return body;
+	}
+	throw new Error("Pass --cron for a schedule trigger, or --bucket for a storage_object_created trigger.");
+}
 const update = async (props) => {
 	const branchId = await branchIdFromProps(props);
 	const { data: existing } = await withTriggerNotFound(props.id, branchId, () => props.apiClient.getProjectBranchTrigger(props.projectId, branchId, props.id));
 	const trigger = existing.trigger;
 	if (props.cron !== void 0 && trigger.type !== "schedule") throw new Error(`Trigger ${props.id} is type ${trigger.type}; --cron applies to schedule triggers.`);
-	const body = updatePatch(trigger.type, props);
+	if ((props.bucket !== void 0 || props.prefix !== void 0) && trigger.type !== "storage_object_created") throw new Error(`Trigger ${props.id} is type ${trigger.type}; --bucket and --prefix apply to storage_object_created triggers.`);
+	const body = updatePatch(trigger, props);
 	if (Object.keys(body).filter((k) => k !== "type").length === 0) throw new Error(noFieldsToUpdateMessage(trigger.type));
 	const { data } = await withTriggerNotFound(props.id, branchId, () => retryOnLock(() => props.apiClient.updateProjectBranchTrigger(props.projectId, branchId, props.id, body)));
 	writeTrigger(props, data.trigger);

package/dist/config_services.js

@@ -1,3 +1,4 @@
+import { authoredAiGateway, authoredBuckets, authoredFunctions } from "@neon/config";
 //#region src/config_services.ts
 const isToggleEnabled = (toggle) => {
 	if (toggle === void 0) return false;
@@ -9,9 +10,9 @@ const declaredNeonServices = (config) => {
 	const services = [];
 	if (isToggleEnabled(config.auth)) services.push("auth");
 	if (isToggleEnabled(config.dataApi)) services.push("data-api");
-	if (Object.keys(config.preview?.buckets ?? {}).length > 0) services.push("object-storage");
-	if (Object.keys(config.preview?.functions ?? {}).length > 0) services.push("functions");
-	if (isToggleEnabled(config.preview?.aiGateway)) services.push("ai-gateway");
+	if (Object.keys(authoredBuckets(config) ?? {}).length > 0) services.push("object-storage");
+	if (Object.keys(authoredFunctions(config) ?? {}).length > 0) services.push("functions");
+	if (isToggleEnabled(authoredAiGateway(config))) services.push("ai-gateway");
 	return services;
 };
 const dataApiSettingsToSnake = (settings) => {

package/dist/config_template.js

@@ -15,7 +15,7 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 /**
 * The services `config init` can declare in the `neon.ts` it scaffolds — the subset of
 * {@link NEON_SERVICES} a policy has a field for. {@link renderNeonConfig} owns the mapping
-* from these names to the `neon.ts` fields (`aiGateway`, `buckets`, `dataApi`).
+* from these names to the `neon.ts` fields (`aiGateway`, `functions`, `buckets`, `dataApi`).
 *
 * Postgres is absent because every branch has it, so there is nothing to declare. Selecting
 * `data-api` also writes `auth: true`: the default Data API provider requires Neon Auth, and
@@ -53,18 +53,18 @@ const block = (level, key, body) => [
 	...body,
 	...at(level, "},")
 ];
-/** The `preview` block for the selected services, or "" when none of them is a preview feature. */
-const renderPreview = (services) => {
+/** GA service keys for the selected init services, or "" when none of them is selected. */
+const renderGaServices = (services) => {
 	const lines = [];
-	if (services.includes("ai-gateway")) lines.push(...at(2, "aiGateway: true,"));
-	if (services.includes("functions")) lines.push(...block(2, "functions", [...at(3, `${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`)]));
-	if (services.includes("object-storage")) lines.push(...block(2, "buckets", [...at(3, `// "private" is the default; use "public_read" for anonymous reads`, `${BUCKET_NAME}: { access: "private" },`)]));
+	if (services.includes("ai-gateway")) lines.push(...at(1, "aiGateway: true,"));
+	if (services.includes("functions")) lines.push(...block(1, "functions", [...at(2, `${FUNCTION_SLUG}: { name: "${FUNCTION_NAME}", source: "./${FUNCTION_FILENAME}" },`)]));
+	if (services.includes("object-storage")) lines.push(...block(1, "buckets", [...at(2, `// "private" is the default; use "public_read" for anonymous reads`, `${BUCKET_NAME}: { access: "private" },`)]));
 	if (lines.length === 0) return "";
-	return `${block(1, "preview", lines).join("\n")}\n`;
+	return `${lines.join("\n")}\n`;
 };
 /**
 * Render the `neon.ts` policy `config init` writes. With no services this is the starter
-* policy — an explicit `auth: false`, no `preview` block, and a `branch` closure that gives
+* policy — an explicit `auth: false`, no service keys beyond that, and a `branch` closure that gives
 * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
 * non-interactive run produce the identical file.
 *
@@ -79,7 +79,7 @@ const renderNeonConfig = (services) => {
 export default defineConfig({
   // Declare your Neon services here
   auth: ${auth},
-${dataApi}${renderPreview(services)}  // Branch policy: per-branch tuning
+${dataApi}${renderGaServices(services)}  // Branch policy: per-branch tuning
   branch: (branch) => {
     if (branch.isDefault) {
       // Default branch: no overrides, uses project defaults
@@ -125,15 +125,15 @@ const renderSeededBranch = (view) => {
 		...at(1, "}),")
 	].join("\n")}\n`;
 };
-/** The `preview` block for a policy seeded from live state. */
-const renderSeededPreview = (view, branchName) => {
+/** GA service keys for a policy seeded from live state. */
+const renderSeededGaServices = (view, branchName) => {
 	const lines = [];
 	const buckets = Object.entries(view.preview?.buckets ?? {});
-	if (buckets.length > 0) lines.push(...block(2, "buckets", buckets.flatMap(([name, bucket]) => at(3, `${renderKey(name)}: { access: "${bucket.access}" },`))));
+	if (buckets.length > 0) lines.push(...block(1, "buckets", buckets.flatMap(([name, bucket]) => at(2, `${renderKey(name)}: { access: "${bucket.access}" },`))));
 	const functions = Object.entries(view.preview?.functions ?? {});
-	if (functions.length > 0) lines.push(...at(2, `// ${branchName} has ${functions.length} deployed function${functions.length === 1 ? "" : "s"}.`, "// Declaring one needs the local source path, which the branch does not know:", "// functions: {", ...functions.map(([slug, fn]) => `//   ${renderKey(slug)}: { name: "${fn.name}", source: "./${slug}.ts" },`), "// },"));
+	if (functions.length > 0) lines.push(...at(1, `// ${branchName} has ${functions.length} deployed function${functions.length === 1 ? "" : "s"}.`, "// Declaring one needs the local source path, which the branch does not know:", "// functions: {", ...functions.map(([slug, fn]) => `//   ${renderKey(slug)}: { name: "${fn.name}", source: "./${slug}.ts" },`), "// },"));
 	if (lines.length === 0) return "";
-	return `${block(1, "preview", lines).join("\n")}\n`;
+	return `${lines.join("\n")}\n`;
 };
 /**
 * Render a `neon.ts` from a branch's live state (`config init --from-branch`).
@@ -152,16 +152,16 @@ const renderSeededPreview = (view, branchName) => {
 */
 const renderNeonConfigFromView = (view, branchName) => {
 	const services = [view.auth ? "  auth: true," : "", view.dataApi ? "  dataApi: true," : ""].filter((line) => line !== "");
-	const preview = renderSeededPreview(view, branchName);
+	const gaServices = renderSeededGaServices(view, branchName);
 	const branch = renderSeededBranch(view);
-	if (services.length === 0 && preview === "" && branch === "") return {
+	if (services.length === 0 && gaServices === "" && branch === "") return {
 		source: renderNeonConfig([]),
 		seeded: false
 	};
 	const protectedNote = view.branch?.protected ? `// ${branchName} is protected on Neon. Not declared here: a policy \`protected\` would\n// apply to every branch this policy is applied to.\n` : "";
 	const body = [
 		...services,
-		...preview === "" ? [] : [preview.trimEnd()],
+		...gaServices === "" ? [] : [gaServices.trimEnd()],
 		...branch === "" ? [] : [branch.trimEnd()]
 	].join("\n");
 	return {
@@ -169,7 +169,7 @@ const renderNeonConfigFromView = (view, branchName) => {
 
 // Seeded by \`neon config init --from-branch\` from ${branchName}.
 // The AI Gateway is not readable from a branch (always available, credential-gated), so add
-// \`preview: { aiGateway: true }\` if the policy should declare it.
+// \`aiGateway: true\` if the policy should declare it.
 ${protectedNote}export default defineConfig({
 ${body}
 });

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-B75xufe_.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-DRpFX-_d.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,2 +1,2 @@
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-CbARRnq9.js";
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-DlXECBPi.js";
 export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };

package/dist/utils/ai_gateway_notice.js

@@ -1,7 +1,7 @@
 import { log } from "../log.js";
 //#region src/utils/ai_gateway_notice.ts
 /**
-* Friendly guidance shown when a branch enables the AI Gateway (`preview.aiGateway`).
+* Friendly guidance shown when a branch enables the AI Gateway (`aiGateway`).
 *
 * The gateway is credential-gated, not provisioned: enabling it always mints a working
 * branch credential, so `apply` / `checkout` / `env pull` succeed regardless of plan. The
@@ -50,7 +50,7 @@ const hasFlagshipModels = (modelIds) => modelIds.some((id) => id.includes("opus"
 * gateway won't serve model requests until the account is on a paid plan. `upgradeUrl` is the
 * org-scoped Console billing page (see {@link aiGatewayUpgradeUrl}).
 */
-const freePlanBlockMessage = (upgradeUrl) => `This neon.ts enables the AI Gateway, which isn't available on the Free plan — the gateway won't serve model requests. Upgrade to a paid plan and re-run, or remove \`preview.aiGateway\` from neon.ts. Upgrade here: ${upgradeUrl}`;
+const freePlanBlockMessage = (upgradeUrl) => `This neon.ts enables the AI Gateway, which isn't available on the Free plan — the gateway won't serve model requests. Upgrade to a paid plan and re-run, or remove \`aiGateway\` from neon.ts. Upgrade here: ${upgradeUrl}`;
 /**
 * Build the AI Gateway courtesy notice for an account's plan and (optionally) its live model
 * catalog, or `null` when nothing needs saying.

package/dist/utils/enrichers.js

@@ -30,13 +30,20 @@ const resolveBranchRef = async (props) => {
 	const branch = typeof props.branch === "string" ? props.branch : props.id;
 	const { data } = await props.apiClient.listProjectBranches({ projectId: props.projectId });
 	const branches = data.branches;
+	const listingFields = (listed) => ({
+		isDefault: listed.default === true,
+		isProtected: listed.protected === true,
+		...listed.parent_id ? { parentId: listed.parent_id } : {},
+		...listed.expires_at ? { expiresAt: listed.expires_at } : {}
+	});
 	if (branch) {
 		const ref = branch.toString();
 		const found = looksLikeBranchId(ref) ? branches.find((b) => b.id === ref) : branches.find((b) => b.name === ref);
 		if (found) return {
 			branchId: found.id,
 			branchName: found.name ?? found.id,
-			usedDefault: false
+			usedDefault: false,
+			...listingFields(found)
 		};
 		if (looksLikeBranchId(ref)) return {
 			branchId: ref,
@@ -50,7 +57,8 @@ const resolveBranchRef = async (props) => {
 	return {
 		branchId: defaultBranch.id,
 		branchName: defaultBranch.name ?? defaultBranch.id,
-		usedDefault: true
+		usedDefault: true,
+		...listingFields(defaultBranch)
 	};
 };
 const resolveSingleDatabase = async (props) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.19.0",
+  "version": "4.21.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config-runtime": "1.4.1",
-    "@neon/sdk": "6.0.0",
-    "@neon/config": "1.5.1"
+    "@neon/config": "1.7.0",
+    "@neon/config-runtime": "1.6.0",
+    "@neon/sdk": "6.0.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -98,7 +98,7 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.17",
+    "@neon-internals/env-core": "0.0.19",
     "@neon/e2e-harness": "0.0.0",
     "@neon/functions": "0.11.0"
   },