neon 4.4.0 → 4.5.2

package/dist/commands/auth.js

@@ -1,15 +1,17 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CVXNvU2r.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-D2vw1UOw.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-B1JxWELN.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { o as isOwnedCredentialPath } from "../_chunks/paths-g3DRqJiD.js";
 import { setAuthContext } from "../auth_context.js";
-import { isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand } from "../context.js";
+import { currentContextFile, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
+import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-D95AeZ5v.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
+import { assertionHasExpired, claimableCredentialsPath, readClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
@@ -218,6 +220,7 @@ const ensureAuth = async (props) => {
 	if (isMcpOauth(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
+	if (isClaimCommand(props)) return;
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
 	const isInit = props._[0] === "init";
@@ -229,8 +232,42 @@ const ensureAuth = async (props) => {
 		});
 		return;
 	}
+	const inputs = credentialInputs();
+	const contextFile = typeof props.contextFile === "function" ? props.contextFile() : props.contextFile ?? currentContextFile();
+	const localContext = readContextFile(contextFile);
+	if (shouldUseClaimableCredentials(inputs, props.profile, localContext)) {
+		const linked = resolveClaimableContext(localContext);
+		if (linked === null) throw new Error("The linked Claimable Neon context could not be resolved.");
+		const stored = readClaimableCredentials(props.configDir, linked.projectId);
+		const path = claimableCredentialsPath(props.configDir, linked.projectId);
+		if (stored === null) throw new Error(`The linked project is claimable, but its identity assertion is missing from ${path}. Run \`neon claim create\` in a new directory, or \`neon link\` after claiming the project.`);
+		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${linked.projectId} has expired. Run \`neon claim delete ${linked.projectId} --yes\` to drop the local record.`);
+		const client = new ClaimableClient(stored.origin);
+		if (client.origin !== new ClaimableClient(linked.origin).origin) throw new Error(`The linked .neon file and ${path} name different Claimable Neon services. Delete .neon or the assertion file and run \`neon claim create\` in a new directory.`);
+		let token;
+		try {
+			token = await client.exchange(stored.identityAssertion);
+		} catch (error) {
+			if (error instanceof ClaimableServiceError && error.code === "project_claimed") throw new Error("This project was claimed. Run `neon claim status` to drop the local assertion, then `neon auth` or `neon link`.");
+			throw error;
+		}
+		props.apiKey = token.accessToken;
+		props.apiHost = `${client.origin}/v1`;
+		props.apiClient = getApiClient({
+			apiKey: token.accessToken,
+			apiHost: props.apiHost
+		});
+		setAuthContext({
+			source: "claimable",
+			configDir: props.configDir,
+			credentialsPath: path
+		});
+		log.debug("Using the linked Claimable Neon project's short-lived access token");
+		return;
+	}
+	if (localContext.claimable !== void 0) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
 	const selection = selectCredential({
-		...credentialInputs(),
+		...inputs,
 		profileFlag: props.profile
 	});
 	const displaced = displacedProfileWarning(selection);

package/dist/commands/bootstrap.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
 import { BootstrapInputError, FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
 import { DO_NOT_SUBSTITUTE_HINT, formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";

package/dist/commands/claim.js

@@ -0,0 +1,466 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { applyContext, contextBranch, ensureGitignored, readContextFile } from "../context.js";
+import { declaredNeonServices } from "../config_services.js";
+import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
+import { mergeEnvFile, resolveEnvFilePath } from "../env_file.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
+import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
+import { writer } from "../writer.js";
+import { noPassthrough } from "../utils/flags.js";
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { homedir } from "node:os";
+import open from "open";
+import prompts from "prompts";
+import { loadConfigFromFile } from "@neon/config-runtime";
+//#region src/commands/claim.ts
+var claim_exports = /* @__PURE__ */ __exportAll({
+	CLAIM_CREATE_FIELDS: () => CLAIM_CREATE_FIELDS,
+	CLAIM_LIST_FIELDS: () => CLAIM_LIST_FIELDS,
+	aliases: () => aliases,
+	builder: () => builder,
+	claimCreateFields: () => claimCreateFields,
+	claimableCapabilities: () => claimableCapabilities,
+	command: () => command,
+	describe: () => describe,
+	findNeonConfig: () => findNeonConfig,
+	handler: () => handler
+});
+const CAPABILITY_FOR_SERVICE = {
+	postgres: "postgres",
+	auth: "auth",
+	"data-api": "data_api",
+	functions: "functions",
+	"object-storage": "storage",
+	"ai-gateway": "ai_gateway"
+};
+const CAPABILITY_ORDER = [
+	"postgres",
+	"data_api",
+	"auth",
+	"storage",
+	"functions",
+	"ai_gateway"
+];
+const SERVICE_FOR_CAPABILITY = {
+	postgres: "postgres",
+	auth: "auth",
+	data_api: "data-api",
+	functions: "functions",
+	storage: "object-storage",
+	ai_gateway: "ai-gateway"
+};
+const isClaimableCapability = (value) => value in SERVICE_FOR_CAPABILITY;
+const cliServiceName = (capability) => isClaimableCapability(capability) ? SERVICE_FOR_CAPABILITY[capability] : capability;
+const claimableCapabilities = (services) => {
+	const requested = /* @__PURE__ */ new Set(["postgres"]);
+	for (const service of services) requested.add(CAPABILITY_FOR_SERVICE[service]);
+	return CAPABILITY_ORDER.filter((capability) => requested.has(capability));
+};
+const CONFIG_FILENAMES = [
+	"neon.ts",
+	"neon.mts",
+	"neon.js",
+	"neon.mjs"
+];
+const findNeonConfig = (cwd = process.cwd()) => {
+	let current = resolve(cwd);
+	const stop = resolve(homedir());
+	while (true) {
+		for (const name of CONFIG_FILENAMES) {
+			const candidate = join(current, name);
+			if (existsSync(candidate)) return candidate;
+		}
+		if (existsSync(join(current, ".git")) || current === stop) return void 0;
+		const parent = dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+};
+const servicesFromConfig = async (explicitPath) => {
+	const path = explicitPath ?? findNeonConfig();
+	if (!path) return [];
+	const { config } = await loadConfigFromFile({ path });
+	return declaredNeonServices(config);
+};
+const removeFileIfPresent = (path) => {
+	try {
+		unlinkSync(path);
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+};
+const failureMessage = (error) => error instanceof Error ? error.message : String(error);
+const CLAIM_LIST_FIELDS = [
+	"project_id",
+	"branch_id",
+	"state",
+	"project_expires_at",
+	"origin"
+];
+const CLAIM_CREATE_FIELDS = [
+	"project_id",
+	"branch_id",
+	"state",
+	"project_expires_at",
+	"granted_capabilities",
+	"denied_capabilities",
+	"env_file"
+];
+const claimCreateFields = (denied) => CLAIM_CREATE_FIELDS.filter((field) => field !== "denied_capabilities" || denied.length > 0);
+const command = "claim";
+const aliases = ["claimable"];
+const describe = "Create and claim temporary Neon projects";
+const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option("claimable-host", {
+	describe: "Claimable Neon service origin",
+	type: "string",
+	default: process.env.CLAIMABLE_NEON_HOST ?? "https://claimable.neon.tech",
+	hidden: true
+}).command("create", "Create a temporary Neon project without an account", (y) => y.option("service", servicesOption({
+	key: "service",
+	allowed: NEON_SERVICES,
+	describe: "Services to request for the claimable project",
+	also: "Postgres is always included. Services unavailable before claim are recorded and reported."
+})).option("file", {
+	describe: "Target dotenv file. Defaults to an existing .env, otherwise .env.local",
+	type: "string"
+}).option("config", {
+	describe: "Path to neon.ts. Defaults to walking up from the current directory",
+	type: "string"
+}).option("env-pull", {
+	describe: "Write the provisioned DATABASE_URL and service URLs to a dotenv file",
+	type: "boolean",
+	default: true
+}).strict().check(noPassthrough("claim create")), async (args) => {
+	const rawServices = servicesFlagValue(args.service);
+	const services = rawServices ? parseServices(rawServices, {
+		allowed: NEON_SERVICES,
+		flag: "--service",
+		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
+	}) : [];
+	const configuredServices = await servicesFromConfig(typeof args.config === "string" ? args.config : void 0);
+	await create({
+		...args,
+		services: [.../* @__PURE__ */ new Set([...services, ...configuredServices])]
+	});
+}).command("status [project-id]", "Show a claimable project's lifecycle and claim status", (y) => y.positional("project-id", {
+	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
+	type: "string"
+}).strict().check(noPassthrough("claim status")), async (args) => await status(args)).command("accept [project-id]", "Create a claim code and open the URL where a human signs in and takes the project", (y) => y.positional("project-id", {
+	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
+	type: "string"
+}).option("open", {
+	describe: "Open the verification URL in a browser",
+	type: "boolean",
+	default: true
+}).strict().check(noPassthrough("claim accept")), async (args) => await accept(args)).command("list", "List claimable projects saved on this machine", (y) => y.strict().check(noPassthrough("claim list")), async (args) => list(args)).command("delete [project-id]", "Permanently delete an unclaimed project, or drop a local record that can no longer reach the service", (y) => y.positional("project-id", {
+	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
+	type: "string"
+}).option("yes", {
+	alias: "y",
+	describe: "Skip the confirmation prompt",
+	type: "boolean",
+	default: false
+}).strict().check(noPassthrough("claim delete")), async (args) => await deleteProject(args)).demandCommand(1, "Run `neon claim --help` to see the subcommands.");
+const handler = (_args) => {};
+const rejectExplicitAccountCredential = (props) => {
+	if (credentialInputs().apiKeyFlag.trim() !== "" || props.profile?.trim()) throw new Error("Claimable Neon does not use a Neon account credential. Remove --api-key or --profile.");
+};
+const resolveTarget = (props) => {
+	rejectExplicitAccountCredential(props);
+	const requested = props.projectId?.trim();
+	const context = readContextFile(props.contextFile);
+	const linked = resolveClaimableContext(context);
+	const projectId = requested || linked?.projectId;
+	if (projectId === void 0) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
+	const credentials = readClaimableCredentials(props.configDir, projectId);
+	if (credentials === null) throw new Error(`The identity assertion for ${projectId} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
+	const client = new ClaimableClient(credentials.origin);
+	const contextMatches = linked?.projectId === projectId;
+	if (contextMatches && linked !== null && client.origin !== new ClaimableClient(linked.origin).origin) throw new Error("The .neon context and saved identity assertion name different Claimable Neon services. Delete .neon or the assertion file and run `neon claim create` in a new directory.");
+	return {
+		projectId,
+		credentials,
+		client,
+		contextMatches
+	};
+};
+const requireLiveIdentity = (credentials) => {
+	if (assertionHasExpired(credentials)) throw new Error(`The identity assertion for ${credentials.projectId} has expired. Run \`neon claim delete ${credentials.projectId} --yes\` to drop the local record.`);
+};
+const isUnusableIdentity = (error) => error instanceof ClaimableServiceError && (error.code === "invalid_grant" || error.code === "project_expired" || error.code === "not_found");
+const clearLocalRecord = (props, projectId, contextMatches) => {
+	removeClaimableCredentials(props.configDir, projectId);
+	if (contextMatches && existsSync(props.contextFile)) applyContext(props.contextFile, {});
+};
+const create = async (props) => {
+	rejectExplicitAccountCredential(props);
+	const existing = readContextFile(props.contextFile);
+	if (existing.projectId || existing.orgId || existing.claimable) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
+	const contextFileExisted = existsSync(props.contextFile);
+	const envFile = props.envPull ? resolveEnvFilePath(process.cwd(), props.file) : void 0;
+	const envFileExisted = envFile ? existsSync(envFile) : false;
+	const previousEnv = envFileExisted && envFile ? readFileSync(envFile) : void 0;
+	const client = new ClaimableClient(props.claimableHost);
+	const registration = await client.register({
+		capabilities: claimableCapabilities(props.services ?? []),
+		source: "neon_cli"
+	});
+	const stored = {
+		version: 1,
+		origin: client.origin,
+		registrationId: registration.registrationId,
+		projectId: registration.project.id,
+		branchId: registration.project.branchId,
+		identityAssertion: registration.identityAssertion,
+		expiresAt: registration.project.expiresAt,
+		assertionExpires: registration.assertionExpires
+	};
+	let localStateWritten = false;
+	let contextWritten = false;
+	let envWriteAttempted = false;
+	let accessToken;
+	try {
+		writeClaimableCredentials(props.configDir, stored);
+		localStateWritten = true;
+		applyContext(props.contextFile, {
+			projectId: registration.project.id,
+			branch: registration.project.branchId,
+			claimable: {
+				version: 1,
+				origin: client.origin
+			}
+		});
+		contextWritten = true;
+		const token = await client.exchange(registration.identityAssertion);
+		accessToken = token.accessToken;
+		const credentials = await client.credentials(registration.project.id, token.accessToken);
+		if (credentials.projectId !== registration.project.id || credentials.branchId !== registration.project.branchId) throw new Error("Claimable Neon returned credentials for a different project. The project was not kept.");
+		if (envFile) {
+			const env = {
+				DATABASE_URL: credentials.databaseUrl,
+				...credentials.services.dataApi ? { NEON_DATA_API_URL: credentials.services.dataApi.url } : {},
+				...credentials.services.auth ? {
+					NEON_AUTH_BASE_URL: credentials.services.auth.baseUrl,
+					NEON_AUTH_JWKS_URL: credentials.services.auth.jwksUrl
+				} : {}
+			};
+			envWriteAttempted = true;
+			mergeEnvFile(envFile, env);
+			ensureGitignored(envFile);
+		}
+		const granted = registration.capabilities.filter((decision) => decision.granted).map((decision) => cliServiceName(decision.capability));
+		const denied = registration.capabilities.filter((decision) => !decision.granted).map((decision) => ({
+			capability: cliServiceName(decision.capability),
+			reason: decision.reason,
+			message: decision.message
+		}));
+		writer(props).end({
+			project_id: registration.project.id,
+			branch_id: registration.project.branchId,
+			state: "unclaimed",
+			project_expires_at: registration.project.expiresAt,
+			granted_capabilities: granted,
+			denied_capabilities: denied,
+			...envFile ? { env_file: envFile } : {}
+		}, {
+			fields: claimCreateFields(denied),
+			renderColumns: { denied_capabilities: (row) => row.denied_capabilities.map((decision) => `${decision.capability}: ${decision.message}`).join(", ") }
+		});
+	} catch (error) {
+		let remoteDeleted = false;
+		try {
+			const cleanupToken = accessToken ?? (await client.exchange(registration.identityAssertion)).accessToken;
+			await client.deleteProject(registration.project.id, cleanupToken);
+			remoteDeleted = true;
+		} catch (cleanupError) {
+			log.error("Claimable project %s could not be cleaned up after create failed: %s", registration.project.id, failureMessage(cleanupError));
+			if (localStateWritten && contextWritten) log.error("Retry cleanup with `neon claim delete --yes` from this directory.");
+		}
+		if (remoteDeleted) try {
+			if (localStateWritten) removeClaimableCredentials(props.configDir, registration.project.id);
+			if (contextWritten) {
+				if (contextFileExisted) applyContext(props.contextFile, existing);
+				else removeFileIfPresent(props.contextFile);
+			}
+			if (envWriteAttempted && envFile) {
+				if (envFileExisted && previousEnv) writeFileSync(envFile, previousEnv);
+				else removeFileIfPresent(envFile);
+			}
+		} catch (rollbackError) {
+			log.error("Project cleanup succeeded, but local rollback failed: %s", failureMessage(rollbackError));
+		}
+		throw error;
+	}
+};
+const status = async (props) => {
+	const { projectId, credentials, client, contextMatches } = resolveTarget(props);
+	if (assertionHasExpired(credentials)) {
+		writer(props).end({
+			project_id: projectId,
+			state: "expired",
+			reconciled: false,
+			project_expires_at: credentials.expiresAt
+		}, { fields: [
+			"project_id",
+			"state",
+			"reconciled",
+			"project_expires_at"
+		] });
+		return;
+	}
+	try {
+		const token = await client.exchange(credentials.identityAssertion);
+		let claimState = "unclaimed";
+		let reconciled = false;
+		let claimExpiresAt;
+		try {
+			const claim = await client.claimStatus(projectId, token.accessToken);
+			claimState = claim.state;
+			reconciled = claim.reconciled;
+			claimExpiresAt = claim.expiresAt;
+		} catch (error) {
+			if (!(error instanceof ClaimableServiceError) || error.code !== "not_found") throw error;
+		}
+		if (reconciled) finishClaimedContext(props, projectId, contextMatches);
+		writer(props).end({
+			project_id: projectId,
+			state: claimState,
+			reconciled,
+			project_expires_at: credentials.expiresAt,
+			...claimExpiresAt ? { claim_expires_at: claimExpiresAt } : {}
+		}, { fields: [
+			"project_id",
+			"state",
+			"reconciled",
+			"project_expires_at",
+			"claim_expires_at"
+		] });
+	} catch (error) {
+		if (error instanceof ClaimableServiceError && error.code === "project_claimed") {
+			finishClaimedContext(props, projectId, contextMatches);
+			writer(props).end({
+				project_id: projectId,
+				state: "claimed",
+				reconciled: true
+			}, { fields: [
+				"project_id",
+				"state",
+				"reconciled"
+			] });
+			return;
+		}
+		if (isUnusableIdentity(error)) {
+			writer(props).end({
+				project_id: projectId,
+				state: "expired",
+				reconciled: false,
+				project_expires_at: credentials.expiresAt
+			}, { fields: [
+				"project_id",
+				"state",
+				"reconciled",
+				"project_expires_at"
+			] });
+			return;
+		}
+		throw error;
+	}
+};
+const accept = async (props) => {
+	const { projectId, credentials, client } = resolveTarget(props);
+	requireLiveIdentity(credentials);
+	const token = await client.exchange(credentials.identityAssertion);
+	const claim = await client.createClaim(projectId, token.accessToken);
+	writer(props).end({
+		project_id: projectId,
+		user_code: claim.userCode,
+		verification_url: claim.verificationUriComplete,
+		expires_in_seconds: claim.expiresIn
+	}, { fields: [
+		"project_id",
+		"user_code",
+		"verification_url",
+		"expires_in_seconds"
+	] });
+	if (props.open && !isCi()) open(claim.verificationUriComplete).catch(() => {
+		log.info("Could not open a browser. Open %s", claim.verificationUriComplete);
+	});
+	else if (props.open) log.info("Browser opening is disabled in CI. Open %s", claim.verificationUriComplete);
+};
+const list = (props) => {
+	rejectExplicitAccountCredential(props);
+	const projects = listClaimableCredentials(props.configDir).map((item) => {
+		const projectMs = Date.parse(item.expiresAt);
+		const projectExpired = Number.isFinite(projectMs) && projectMs <= Date.now();
+		return {
+			project_id: item.projectId,
+			branch_id: item.branchId,
+			state: assertionHasExpired(item) || projectExpired ? "expired" : "unclaimed",
+			project_expires_at: item.expiresAt,
+			origin: item.origin
+		};
+	});
+	writer(props).end(projects, {
+		fields: CLAIM_LIST_FIELDS,
+		emptyMessage: "No Claimable Neon projects are saved on this machine."
+	});
+};
+const deleteProject = async (props) => {
+	const { projectId, credentials, client, contextMatches } = resolveTarget(props);
+	if (!props.yes) {
+		if (isCi() || !process.stdin.isTTY) throw new Error("Deleting a claimable project requires confirmation. Re-run interactively or pass --yes.");
+		const { proceed } = await prompts({
+			type: "confirm",
+			name: "proceed",
+			message: `Permanently delete ${projectId}?`,
+			initial: false
+		});
+		if (!proceed) {
+			log.info("Claimable project was not deleted.");
+			return;
+		}
+	}
+	if (assertionHasExpired(credentials)) {
+		clearLocalRecord(props, projectId, contextMatches);
+		writer(props).end({
+			project_id: projectId,
+			state: "cleared"
+		}, { fields: ["project_id", "state"] });
+		return;
+	}
+	try {
+		const token = await client.exchange(credentials.identityAssertion);
+		await client.deleteProject(projectId, token.accessToken);
+	} catch (error) {
+		if (!isUnusableIdentity(error)) throw error;
+		clearLocalRecord(props, projectId, contextMatches);
+		writer(props).end({
+			project_id: projectId,
+			state: "cleared"
+		}, { fields: ["project_id", "state"] });
+		return;
+	}
+	clearLocalRecord(props, projectId, contextMatches);
+	writer(props).end({
+		project_id: projectId,
+		state: "deleted"
+	}, { fields: ["project_id", "state"] });
+};
+const finishClaimedContext = (props, projectId, contextMatches) => {
+	removeClaimableCredentials(props.configDir, projectId);
+	if (contextMatches && existsSync(props.contextFile)) {
+		const context = readContextFile(props.contextFile);
+		applyContext(props.contextFile, {
+			projectId: context.projectId,
+			...contextBranch(context) ? { branch: contextBranch(context) } : {}
+		});
+	}
+	log.info("Dropped the local identity assertion. The next command needs `neon auth` or `neon link`.");
+};
+//#endregion
+export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, describe, findNeonConfig, handler, claim_exports as t };

package/dist/commands/config.js

@@ -5,6 +5,7 @@ import { getApiClient } from "../api.js";
 import { contextBranch, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { toNeonConfigView } from "../config_format.js";
+import { declaredNeonServices } from "../config_services.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
@@ -425,17 +426,6 @@ const applyCmd = async (props) => {
 	});
 };
 /**
-* A static service toggle (`auth` / `dataApi` / `preview.aiGateway`) is "on" unless
-* explicitly disabled: `true` / `{}` / `{ enabled: true }` enable it; `false` /
-* `{ enabled: false }` / absent leave it off. Mirrors the runtime's `isServiceEnabled`
-* (which isn't exported), kept tiny and pure so it can be read straight off the policy.
-*/
-const isToggleEnabled = (toggle) => {
-	if (toggle === void 0) return false;
-	if (typeof toggle === "boolean") return toggle;
-	return toggle.enabled !== false;
-};
-/**
 * Human-readable list of the services a `neon.ts` policy utilizes on the branch, shown under
 * the plan/apply table. Postgres is always present (every branch has it); the rest are listed
 * only when the policy declares them. This deliberately surfaces services that produce **no**
@@ -445,13 +435,15 @@ const isToggleEnabled = (toggle) => {
 * lives in the per-branch closure), so reading it straight off `config` is accurate.
 */
 const utilizedServices = (config) => {
-	const services = ["Postgres"];
-	if (isToggleEnabled(config.auth)) services.push("Neon Auth");
-	if (isToggleEnabled(config.dataApi)) services.push("Data API");
-	if (Object.keys(config.preview?.buckets ?? {}).length > 0) services.push("Object Storage");
-	if (Object.keys(config.preview?.functions ?? {}).length > 0) services.push("Functions");
-	if (isToggleEnabled(config.preview?.aiGateway)) services.push("AI Gateway");
-	return services;
+	const labels = {
+		postgres: "Postgres",
+		auth: "Neon Auth",
+		"data-api": "Data API",
+		"object-storage": "Object Storage",
+		functions: "Functions",
+		"ai-gateway": "AI Gateway"
+	};
+	return [labels.postgres, ...declaredNeonServices(config).map((service) => labels[service])];
 };
 /**
 * Render a {@link PushResult}. JSON/YAML output emits the raw result (plus a `services`

package/dist/commands/index.js

@@ -9,6 +9,7 @@ import { t as config_exports } from "./config.js";
 import { t as projects_exports } from "./projects.js";
 import { t as link_exports } from "./link.js";
 import { t as checkout_exports } from "./checkout.js";
+import { t as claim_exports } from "./claim.js";
 import { t as connection_string_exports } from "./connection_string.js";
 import { t as data_api_exports } from "./data_api.js";
 import { t as databases_exports } from "./databases.js";
@@ -60,6 +61,7 @@ var commands_default = [
 	checkout_exports,
 	link_exports,
 	open_exports,
+	claim_exports,
 	init_exports,
 	mcp_exports,
 	plugins_exports,