neon 4.7.0 → 4.9.0

package/README.md

@@ -133,6 +133,18 @@ automation:
 neon branches create --project-id <project-id> --name production --protected
 ```
 
+Project and branch creation include connection credentials in their output by
+default for backward compatibility. When the output may be logged or passed to
+an agent, use `--no-secrets` to return only the created resource metadata:
+
+```bash
+neon projects create --name my-project --output json --no-secrets
+neon branches create --project-id <project-id> --name preview --output json --no-secrets
+```
+
+The flag omits the complete `connection_uris` block rather than redacting one
+field. Retrieve a connection string separately when it is actually needed.
+
 ### Enable logical replication
 
 Enable logical replication for every endpoint in an existing project:
@@ -257,7 +269,7 @@ The Neon CLI supports autocompletion, which you can configure in a few easy step
 
 - **org** is inferred from the project (so `--project-id` alone is enough); it's omitted only when the project has no organization (personal account).
 - **project** is taken from `--project-id` (or chosen interactively).
-- **branch** is left to an explicit [`neon checkout <branch>`](#checkout) — `link` never silently pins a project's default branch (that would make later commands quietly target, say, production). It only records a branch when you pass `--branch`, when one is already pinned for the same project (preserved), when you pick one in the interactive picker, or for a freshly **created** project (whose single branch is unambiguous).
+- **branch** is taken from `--branch`, an existing pin for the same project, or the project's branch list: one branch is pinned automatically; several prompt in a TTY, pin the default with `-y`, or stay unpinned for [`neon checkout <branch>`](#checkout). A project with no branches is linked without a pin and says so.
 
 When a branch ends up pinned, `link` also runs [`env pull`](#env-pull) so the branch's Neon env vars (`DATABASE_URL`, …) land in a local `.env`. With no branch pinned there is nothing to pull, so `link` instead nudges you to run `neon checkout`. Pass `--no-env-pull` to skip the pull (for example when injecting env at runtime with `neon-env run` or `neon dev`).
 
@@ -282,22 +294,34 @@ Linked .neon:
 
 When you link an **existing** project that has more than one branch, the interactive flow adds a
 final step to pick which branch to pin — the same `＋ Create a new branch…` + list selector used by
-`neon checkout` (a single-branch project is pinned automatically, no prompt). Non-interactive
-`link --project-id …` does **not** prompt or default a branch; it links org + project and leaves
-branch selection to `neon checkout`:
+`neon checkout` (a single-branch project is pinned automatically, no prompt):
 
 ```bash
+$ neon link
 ? Which organization would you like to link? › Personal Org (org-abc123)
 ? Which project would you like to link? › my-app (polished-snowflake-12345678)
 ? Which branch would you like to link? › [default] main (br-main-branch-87654321)
 ```
 
+`link --project-id …` skips org and project. One branch is pinned with no prompt. Several branches
+in a TTY show the branch prompt; `-y` pins the default; no TTY leaves the pin empty for
+`neon checkout`:
+
+```bash
+$ neon link --project-id polished-snowflake-12345678
+? Which branch would you like to link? › [default] main (br-main-branch-87654321)
+```
+
 **Non-interactive (flags or `--params` JSON)** — for scripts and CI:
 
 ```bash
-# Link to an existing project (org is inferred from the project; no branch pinned)
+# Link to an existing project (org is inferred). Pins the only branch;
+# several branches prompt in a TTY, or stay unpinned without one.
 neon link --project-id polished-snowflake-12345678
 
+# Same, pin the project's default branch when several exist
+neon link --project-id polished-snowflake-12345678 -y
+
 # Same, but also pin a branch (name or id — resolved and stored as its name)
 neon link --project-id polished-snowflake-12345678 --branch main
 
@@ -327,7 +351,7 @@ Every supplied identifier is checked before anything is written, with actionable
 ```bash
 neon orgs list --output json
 neon projects list --org-id <org-id> --output json
-neon link --project-id <project-id>
+neon link --project-id <project-id> [--branch <name> | -y]
 neon link --org-id <org-id> --project-name <name> --region-id aws-us-east-2
 ```
 
@@ -352,7 +376,7 @@ How today's `set-context` uses map onto `link`:
 
 | `set-context` (deprecated)              | Recommended `link` equivalent                                                 |
 | --------------------------------------- | ----------------------------------------------------------------------------- |
-| `neon set-context --project-id <id>` | `neon link --project-id <id>` (infers org + verifies; branch via checkout) |
+| `neon set-context --project-id <id>` | `neon link --project-id <id>` (infers org + verifies; pins the only branch) |
 | `neon set-context --org-id <id>`     | `neon link --org-id <id>`                                                  |
 | `neon set-context --branch-id <id>`  | `neon link --branch <name\|id>`                                            |
 | `neon set-context` (clear)           | `neon link --clear`                                                        |
@@ -657,7 +681,9 @@ When a package cannot be bundled — a native addon with no esbuild loader, or a
 
 ## Scaffold a project (`bootstrap`)
 
-`neon bootstrap` copies a Neon starter template into a new (or current) directory — conceptually like `degit`, but it only pulls from a small set of templates we maintain in the public [`neondatabase/examples`](https://github.com/neondatabase/examples) repo. It requires no Neon login: it just downloads files from GitHub.
+`neon bootstrap` copies a Neon starter template into a new (or current) directory — conceptually like `degit`, but it only pulls from a small set of templates we maintain in the public [`neondatabase/examples`](https://github.com/neondatabase/examples) repo. The template copy needs no Neon login: it downloads files from GitHub.
+
+After scaffolding, an interactive terminal offers agent tooling (the Neon plugin, or skills and MCP separately — never both) and then `neon link`. `--default` / `-y` skips the template, install, git, and agent pickers, then runs `link --yes`. `link --yes` still asks for a project unless one is already linked. `--no-agent-setup` and `--no-link` skip those. Non-interactive without `--default` prints next steps and does not install, set up agents, or link.
 
 Pass a target directory (or `.` for the current one). In an interactive terminal you pick the template from a list; in CI / non-interactive contexts pass `--template <id>`.
 
@@ -665,7 +691,7 @@ Pass a target directory (or `.` for the current one). In an interactive terminal
 # Pick a template interactively and scaffold it into ./my-app
 $ neon bootstrap my-app
 
-# Scaffold a specific template into the current directory (no prompts)
+# Scaffold a specific template into the current directory (skips the template picker)
 $ neon bootstrap . --template hono
 
 # List templates
@@ -677,64 +703,28 @@ $ neon bootstrap --list-templates --output json
 
 The target directory must be empty unless you pass `--force` (a lone `.git` is ignored, so a freshly `git init`ed folder is fine). Symlinks and executable bits in the template are preserved.
 
-## Set up a project for your coding agent (`init`)
+## Set up a project (`init`)
 
-`neon init` wires an existing project up to Neon: it signs you in, installs the Neon MCP server and agent skills into your editor, adds the Neon Local Connect extension for VS Code and Cursor, creates or picks a project, writes `DATABASE_URL` into `.env`, and offers to scaffold migrations.
+`neon init` sets up this directory for Neon.
 
-```bash
-$ neon init
-```
-
-Run in a terminal it prompts you through those steps. This is what the retired `neon-init` package used to do; `npx neon init` replaces it.
+An empty directory (nothing except `.git`) runs `neon bootstrap .` and stops. With `-y` that is `neon bootstrap . --default`. Bootstrap handles scaffolding, agent tooling, and linking.
 
-Two side effects worth knowing before you run it. It **installs or upgrades `neon` globally**, with whichever package manager invoked it — the flow drives Neon by shelling out to the CLI rather than calling the API in-process. And it **writes `.neon`** in the project directory, the same context file `neon link` and `neon checkout` use.
+An existing app installs agent tooling, then `neon link` unless `.neon` already has a projectId, then `neon config init`. Interactive `config init` opens the services picker; `-y` uses `--services none` (starter policy).
 
-### Agent mode
-
-`--agent` turns the same flow into a state machine an AI coding assistant drives. It prints **one JSON object on stdout** and nothing else: a phase response carrying a `status` and a `nextAction` telling the agent what to do next — usually another `neon init` invocation, spelled out as a `command`. The two read-only steps, `status` and `finalize`, return a snapshot instead.
+In an interactive terminal it offers one of: the Neon plugin (`neon plugins`), skills and MCP separately (`neon skills`, then `neon mcp`), or skip agent setup. It never runs plugin and skills+MCP together.
 
 ```bash
-$ neon init --agent --data '{"step":"status"}'
-{
-  "auth": { "authenticated": true },
-  "tooling": { "mcpServer": { "configured": true, "scope": "global" }, "skills": { "installed": false, "scope": null } },
-  "project": { "databaseUrl": false },
-  "migrations": { "tool": "prisma", "hasMigrations": false },
-  "recommendations": [
-    { "priority": "high", "message": "No DATABASE_URL found in .env", "command": "neon init --agent --data '{\"step\":\"db\"}'" },
-    { "priority": "medium", "message": "Neon agent skills not detected in this project", "command": "neon init --agent --data '{\"step\":\"skills\",\"install\":true}'" },
-    { "priority": "medium", "message": "prisma detected but no migrations found", "command": "neon init --agent --data '{\"step\":\"migrations\"}'" }
-  ]
-}
+$ neon init
+$ neon init -y
 ```
 
-`--agent` is implied when stdin is not a TTY and a known agent is detected from the environment (Claude Code, Codex, Cline, Cursor, VS Code, Windsurf).
-
-`--data` takes a JSON object whose `step` selects the phase: `auth`, `db`, `setup`, `getting-started`, `mcp`, `skills`, `migrations`, `neon-auth`, `status`, or `finalize`. Remaining keys are that phase's options. Without `--data`, the orchestrator picks the next phase itself. An unrecognised `step` is refused with the full list.
+`-y` skips the template picker and the agent-setup offer. Empty dir: `bootstrap --default`. Existing app: plugin when a project-level plugin agent is detected (Cursor, Claude Code, Codex); otherwise skills and MCP. VS Code, GitHub Copilot CLI, and Grok only take the plugin user-level (`neon plugins --global`), so `-y` uses skills and MCP for those.
 
-**Failures are JSON too**, so an agent never has to distinguish "it broke" from "it returned nothing":
+`-y` forwards `-y` to `plugins` or `skills`/`mcp`, `--default` to `bootstrap`, `--yes` to `link`, and `--services none` to `config init`. `link --yes` only skips the "already linked" confirmation; it still asks for a project unless one is already linked.
 
-```bash
-$ neon init --agent --data '{not json'
-{
-  "success": false,
-  "error": "Invalid JSON in --data flag at position 1. Expected a JSON object."
-}
-$ echo $?
-1
-```
+A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
-That message reports where parsing stopped and nothing more. `--data` carries whatever you put in it, and the JSON parser's own message quotes a window of the input, so echoing either would put a connection string or an API key on stdout.
-
-**One exception to "JSON on stdout".** Credentials are resolved before any command runs, so a failure in that step — an unknown `--profile` or `NEON_PROFILE`, `--api-key` and `--profile` together, a `credentials.json` that cannot be read, or an OS keyring item that cannot be read — prints `ERROR: …` on stderr, leaves stdout empty, and exits 1. Treat a non-zero exit with empty stdout as a credential problem and read stderr.
-
-| Option | |
-| --- | --- |
-| `--agent`, `-a` | Emit the JSON state machine instead of prompting |
-| `--data <json>` | Route to one phase, with that phase's options |
-| `--skip-migrations` | Leave the migrations phase out of the flow |
-| `--preview` | Enable preview features (scaffolding a project from a template) |
-| `--profile <name>` | Run as that stored account. See [Which credential an invocation uses](#which-credential-an-invocation-uses). |
+`skills` needs Node.js 22.20 or newer. See [`bootstrap`](#scaffold-a-project-bootstrap), [`plugins`](#install-the-neon-plugin-plugins), [`skills`](#install-neon-agent-skills-skills), [`link`](#linking-a-project), and [`mcp`](#install-the-neon-mcp-server-mcp) for what those commands write.
 
 ## Install the Neon MCP server (`mcp`)
 
@@ -1116,7 +1106,7 @@ When both are only environment variables the key wins, which keeps a CI pipeline
 
 `neon auth` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon auth --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
 
-`neon init` follows the same profile selection: `--profile` and `NEON_PROFILE` pick the stored account. Every `npx neon` it runs, and every command it tells an agent to run (`npx neon …`, `neon init --agent …`), includes `--profile <name>` when a profile was named by `--profile` or `NEON_PROFILE`, and `--config-dir <path>` when you passed `--config-dir`; nothing is added when those were not set. It still ignores `--api-key` and `NEON_API_KEY` for its own credential read and runs as that stored profile (`DEFAULT` when a key was named with no profile). Those keys are also not written onto the emitted commands — putting a key in agent JSON would print it. An ambient `NEON_API_KEY` is inherited by the subprocesses.
+`neon init` forwards `--profile` and `--config-dir` to the commands it runs. An explicit `--api-key` is passed to those children through `NEON_API_KEY`, not argv.
 
 ## API keys (`api-keys`)
 
@@ -1213,8 +1203,8 @@ Id   Name      Project         Created At            Last Used At          Last
 | open                                                                       |                                                                                                              | Open the linked project in Console |
 | config                                                                     | `init`, `status`, `plan`, `apply`                                                                            | Drive a branch from `neon.ts`      |
 | deploy                                                                     |                                                                                                              | Alias for `config apply`           |
-| bootstrap                                                                  |                                                                                                              | Scaffold a project from a template |
-| init                                                                       |                                                                                                              | Set up a project for a coding agent |
+| bootstrap                                                                  |                                                                                                              | Scaffold a template, then agent tooling and link |
+| init                                                                       |                                                                                                              | Empty dir: bootstrap. Existing: agents, link, neon.ts |
 | mcp                                                                        |                                                                                                              | Install the Neon MCP server         |
 | plugins                                                                    |                                                                                                              | Install the Neon plugin             |
 | skills                                                                     | `update`                                                                                                     | Install Neon agent skills           |

package/dist/_chunks/{auth_selection-ktL6uoEe.js → auth_selection-pitMFzDe.js}

@@ -1,4 +1,4 @@
-import "./profiles-D95AeZ5v.js";
+import "./profiles-CvnFEQyd.js";
 //#region ../../internals/cli-core/dist/auth_selection.js
 /**
 * # Which credential an invocation authenticates with

package/dist/_chunks/{credential_io-B1JxWELN.js → credential_io-YeAxg9Xn.js}

@@ -1,6 +1,6 @@
 import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { o as isOwnedCredentialPath } from "./paths-g3DRqJiD.js";
-import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-D95AeZ5v.js";
+import { a as isOwnedCredentialPath } from "./paths-DMq0Lt7a.js";
+import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-CvnFEQyd.js";
 import { tryLoadKeyring } from "../keyring.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname } from "node:path";

package/dist/_chunks/{paths-g3DRqJiD.js → paths-DMq0Lt7a.js}

@@ -148,4 +148,4 @@ const isOwnedCredentialPath = (configDirectory, file) => {
 	return legacy !== void 0 && isInsideConfigDir(legacy, file);
 };
 //#endregion
-export { isInsideConfigDir as a, defaultDir as i, configDir as n, isOwnedCredentialPath as o, credentialsPath as r, resolveConfigFile as s, CREDENTIALS_FILE as t };
+export { isOwnedCredentialPath as a, isInsideConfigDir as i, credentialsPath as n, resolveConfigFile as o, defaultDir as r, CREDENTIALS_FILE as t };

package/dist/_chunks/{profiles-D95AeZ5v.js → profiles-CvnFEQyd.js}

@@ -1,5 +1,5 @@
 import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { i as defaultDir, r as credentialsPath, s as resolveConfigFile } from "./paths-g3DRqJiD.js";
+import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-DMq0Lt7a.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 //#region ../../internals/cli-core/dist/cli_config.js

package/dist/analytics.js

@@ -1,9 +1,9 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-B1JxWELN.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-YeAxg9Xn.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { r as credentialsPath } from "./_chunks/paths-g3DRqJiD.js";
+import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 import { getAuthContext } from "./auth_context.js";
 import { isCurrentBranchProbe } from "./context.js";

package/dist/auth_context.js

@@ -1,4 +1,4 @@
-import { o as isOwnedCredentialPath } from "./_chunks/paths-g3DRqJiD.js";
+import { a as isOwnedCredentialPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 //#region src/auth_context.ts
 const locationFromContext = (context) => {

package/dist/commands/auth.js

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-B1JxWELN.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-YeAxg9Xn.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
-import { o as isOwnedCredentialPath } from "../_chunks/paths-g3DRqJiD.js";
+import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
 import { setAuthContext } from "../auth_context.js";
 import { currentContextFile, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-D95AeZ5v.js";
+import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsPath, readClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
@@ -220,10 +220,17 @@ const ensureAuth = async (props) => {
 	if (isMcpOauth(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
+	if (props._[0] === "init") {
+		selectCredential({
+			...credentialInputs(),
+			profileFlag: props.profile
+		});
+		log.debug("init: skipping global auth; child commands authenticate");
+		return;
+	}
 	if (isClaimCommand(props)) return;
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
-	const isInit = props._[0] === "init";
 	const isMcp = isMcpCommand(props);
 	if (props._[0] === "auth") {
 		props.apiClient = getApiClient({
@@ -334,10 +341,6 @@ const ensureAuth = async (props) => {
 		log.debug("bootstrap: no usable credentials; continuing without auth");
 		return;
 	}
-	if (isInit) {
-		log.debug("init: skipping global auth; init manages its own auth flow");
-		return;
-	}
 	if (isMcp) {
 		log.debug("mcp: no usable credentials; minting requires auth or --oauth");
 		return;

package/dist/commands/bootstrap.js

@@ -2,9 +2,12 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { writer } from "../writer.js";
 import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
+import { spawnCliChild } from "../init/child.js";
+import { projectContextFile } from "../init/plan.js";
+import { runScaffoldFollowUp } from "../init/tooling.js";
 import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
@@ -19,7 +22,7 @@ var bootstrap_exports = /* @__PURE__ */ __exportAll({
 });
 const removedAgent = () => `\`${getCliName()} bootstrap --agent\` was removed. List templates with \`${getCliName()} bootstrap --list-templates --output json\`. Scaffold with \`${getCliName()} bootstrap <directory> --template <id>\` or \`${getCliName()} bootstrap <directory> --default\`.`;
 const command = "bootstrap [directory]";
-const describe = "Scaffold a new project from a Neon starter template";
+const describe = "Scaffold a new project from a Neon starter template, then install agent tooling and link a Neon project";
 const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").positional("directory", {
 	describe: "Directory to scaffold into. Use \".\" for the current directory. Omit to be prompted.",
 	type: "string"
@@ -45,7 +48,7 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 	},
 	default: {
 		alias: "y",
-		describe: "Quick start: scaffold the default template (or --template) and run the usual setup (install dependencies, git init) without prompting. Linking is left to you since it needs a project choice.",
+		describe: "Quick start: scaffold the default template (or --template), then install, git, agent tooling, and link --yes. Skips those pickers; link --yes still asks for a project unless one is already linked",
 		type: "boolean",
 		default: false
 	},
@@ -63,8 +66,13 @@ const builder = (argv) => argv.usage("$0 bootstrap [directory] [options]").posit
 		describe: `Run \`${getCliName()} link\` in the scaffolded directory after installing. In interactive mode this is offered as a prompt; use --no-link to skip without being asked.`,
 		type: "boolean",
 		default: true
+	},
+	"agent-setup": {
+		type: "boolean",
+		default: true,
+		describe: "After scaffolding, install the Neon plugin or skills and MCP. Use --no-agent-setup to skip"
 	}
-}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Quick start: scaffold the default template and run setup without prompting").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").check((argv) => {
+}).example("$0 bootstrap my-app", "Create ./my-app from an interactively chosen template").example("$0 bootstrap . --template hono", "Scaffold the Hono template into the current directory").example("$0 bootstrap my-app --default", "Skip the pickers; link --yes still asks for a project unless one is already linked").example("$0 bootstrap --list-templates --output json", "Print the template catalog as JSON").check((argv) => {
 	if (argv.agent === true) throw new Error(removedAgent());
 	return true;
 }).strict();
@@ -163,12 +171,6 @@ const resolveTargetDir = async (props, interactive, template) => {
 	return resolve(process.cwd(), dir === "." ? "" : dir);
 };
 const defaultDirName = (template) => template.source.subdir.split("/").pop() || template.id;
-/**
-* Download and materialize the template into `targetDir`. The actual
-* download/extract/write lives in `src/init/bootstrap.ts`, shared with `neon init`
-* (exec-bit and symlink fidelity, graceful symlink fallback); here we just
-* frame it with progress logging. Returns the number of files written.
-*/
 const scaffold = async (template, targetDir) => {
 	log.info("Fetching template \"%s\" from GitHub…", template.id);
 	const filesWritten = await scaffoldTemplate(template, targetDir, { onWarn: (message) => {
@@ -198,16 +200,33 @@ const runPostScaffoldSteps = async (props, targetDir, interactive) => {
 		installed = await runCommand(pm, installArgs(pm), targetDir);
 	}
 	if (props.git && !isGitRepo(targetDir) && await confirm("Initialize a git repository?")) await initGitRepo(targetDir);
-	if (props.link) {
-		if (!installed && hasNeonConfig(targetDir)) log.info(`Skipping the Neon link step: \`${getCliName()} link\` reads this project's neon.ts to pull env vars, which needs its dependencies. Run \`${formatInstallCommand(pm)}\`, then \`${getCliName()} link\`.`);
-		else if (await confirm(`Link this project to a Neon project now? (runs ${getCliName()} link)`)) {
-			await runNeonLink(props, targetDir);
-			printNextSteps(targetDir, pm, {
-				installed,
-				suggestLink: false
-			});
-			return;
-		}
+	const skipLink = shouldSkipLinkForDeps(targetDir, installed);
+	if (props.link && skipLink) logSkippedLink(pm);
+	const kids = bootstrapChildren(props, targetDir);
+	await runScaffoldFollowUp({
+		cwd: targetDir,
+		yes: false,
+		skipAgentSetup: props.agentSetup === false,
+		shouldLink: false,
+		linkYes: false,
+		...kids,
+		...props.pickAgentSetup ? { pickAgentSetup: props.pickAgentSetup } : {},
+		...props.hasProjectPlugins ? { hasProjectPlugins: props.hasProjectPlugins } : {}
+	});
+	if (props.link && !skipLink && await confirm(`Link this project to a Neon project now? (runs ${getCliName()} link)`)) {
+		await runScaffoldFollowUp({
+			cwd: targetDir,
+			yes: false,
+			skipAgentSetup: true,
+			shouldLink: true,
+			linkYes: false,
+			...kids
+		});
+		printNextSteps(targetDir, pm, {
+			installed,
+			suggestLink: false
+		});
+		return;
 	}
 	printNextSteps(targetDir, pm, {
 		installed,
@@ -215,20 +234,27 @@ const runPostScaffoldSteps = async (props, targetDir, interactive) => {
 	});
 };
 const installPrompt = (inferred) => inferred ? `Install dependencies with ${inferred}?` : "Install dependencies?";
-/**
-* `--default` quick start: run install + git init without prompting, honoring
-* --no-install / --no-git. Linking is intentionally skipped — it needs an
-* org/project choice we can't make non-interactively — so we point at it in the
-* closing hint instead.
-*/
+/** `link --yes` still asks for a project unless one is already linked. */
 const runDefaultSteps = async (props, targetDir, pm) => {
-	log.info("Quick start (--default): running setup without prompting.");
+	log.info("Quick start (--default): skipping the template, install, git, and agent pickers. link --yes still asks for a project unless one is already linked.");
 	let installed = false;
 	if (props.install) installed = await runCommand(pm, installArgs(pm), targetDir);
 	if (props.git && !isGitRepo(targetDir)) await initGitRepo(targetDir);
+	const skipLink = shouldSkipLinkForDeps(targetDir, installed);
+	if (props.link && skipLink) logSkippedLink(pm);
+	await runScaffoldFollowUp({
+		cwd: targetDir,
+		yes: true,
+		skipAgentSetup: props.agentSetup === false,
+		shouldLink: props.link && !skipLink,
+		linkYes: true,
+		...bootstrapChildren(props, targetDir),
+		...props.pickAgentSetup ? { pickAgentSetup: props.pickAgentSetup } : {},
+		...props.hasProjectPlugins ? { hasProjectPlugins: props.hasProjectPlugins } : {}
+	});
 	printNextSteps(targetDir, pm, {
 		installed,
-		suggestLink: true
+		suggestLink: !(props.link && !skipLink)
 	});
 };
 const isGitRepo = (dir) => existsSync(join(dir, ".git"));
@@ -239,6 +265,24 @@ const NEON_CONFIG_FILENAMES = [
 	"neon.mjs"
 ];
 const hasNeonConfig = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(join(dir, name)));
+const shouldSkipLinkForDeps = (dir, installed) => !installed && hasNeonConfig(dir);
+const logSkippedLink = (pm) => {
+	log.info(`Skipping the Neon link step: \`${getCliName()} link\` reads this project's neon.ts to pull env vars, which needs its dependencies. Run \`${formatInstallCommand(pm)}\`, then \`${getCliName()} link\`.`);
+};
+const bootstrapChildren = (props, targetDir) => {
+	const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
+	return {
+		run: props.run ?? spawnCliChild,
+		forward: {
+			...props.configDir ? { configDir: props.configDir } : {},
+			...props.profile ? { profile: props.profile } : {},
+			apiHost: props.apiHost,
+			contextFile: projectContextFile(targetDir, props.contextFile),
+			...props.analytics === false ? { analytics: false } : {}
+		},
+		...explicitKey ? { authEnv: { NEON_API_KEY: explicitKey } } : {}
+	};
+};
 /**
 * Initialize a git repository in the scaffolded directory. Just `git init` — we
 * deliberately don't auto-commit, both to avoid failing on a machine with no
@@ -279,21 +323,6 @@ const selectPackageManager = async () => {
 	});
 	return pm ?? "npm";
 };
-/**
-* Re-invoke this same CLI as `neon link` inside the scaffolded directory, so the
-* new project's `.neon` context (and pulled `.env`) land in the right place and
-* link's own interactive picker drives org/project/branch selection. Re-execing
-* (rather than calling the handler in-process) keeps link running with `cwd` set
-* to the target dir, which is where its env pull writes.
-*/
-const runNeonLink = async (props, targetDir) => {
-	const args = [process.argv[1], "link"];
-	if (props.configDir) args.push("--config-dir", props.configDir);
-	if (props.profile) args.push("--profile", props.profile);
-	args.push("--api-host", props.apiHost, "--output", props.output);
-	const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
-	await runCommand(process.execPath, args, targetDir, explicitKey ? { NEON_API_KEY: explicitKey } : void 0);
-};
 const printScaffolded = (template, targetDir) => {
 	log.info("");
 	log.info("Done. Scaffolded \"%s\" into %s.", template.title, isCurrentDir(targetDir) ? "the current directory" : displayDir(targetDir));

package/dist/commands/branches.js

@@ -44,6 +44,11 @@ const builder = (argv) => argv.usage("$0 branches <sub-command> [options]").opti
 } }).middleware(fillSingleProject).middleware((args) => {
 	args.branchId ??= args.id;
 }).command("list", "List branches", (yargs) => yargs, (args) => list(args)).command("create", "Create a branch", (yargs) => yargs.options({
+	secrets: {
+		describe: "Include connection credentials in command output. Use --no-secrets to omit them",
+		type: "boolean",
+		default: true
+	},
 	name: branchCreateRequest["branch.name"],
 	parent: {
 		describe: "Parent branch name or id or timestamp or LSN. Defaults to the default branch",
@@ -220,21 +225,31 @@ const create = async (props) => {
 	}));
 	if (branches.find((b) => b.id === data.branch.parent_id)?.protected) log.warning("The parent branch is protected; a unique role password has been generated for the new branch.");
 	const out = writer(props);
-	out.write(data.branch, {
-		fields: BRANCH_FIELDS,
-		title: "branch",
-		emptyMessage: "No branches have been found."
-	});
-	if (data.endpoints?.length > 0) out.write(data.endpoints, {
-		fields: ["id", "created_at"],
-		title: "endpoints",
-		emptyMessage: "No endpoints have been found."
-	});
-	if (data.connection_uris?.length) out.write(data.connection_uris, {
-		fields: ["connection_uri"],
-		title: "connection_uris",
-		emptyMessage: "No connection uris have been found"
+	const endpoints = data.endpoints ?? [];
+	const connectionUris = data.connection_uris ?? [];
+	const writeEndpoints = endpoints.length > 0;
+	const writeUris = props.secrets && connectionUris.length > 0;
+	if (!props.secrets && (props.output === "json" || props.output === "yaml") && !writeEndpoints) out.write({ branch: data.branch }, {
+		fields: ["branch"],
+		title: "branch"
 	});
+	else {
+		out.write(data.branch, {
+			fields: BRANCH_FIELDS,
+			title: "branch",
+			emptyMessage: "No branches have been found."
+		});
+		if (writeEndpoints) out.write(endpoints, {
+			fields: ["id", "created_at"],
+			title: "endpoints",
+			emptyMessage: "No endpoints have been found."
+		});
+		if (writeUris) out.write(connectionUris, {
+			fields: ["connection_uri"],
+			title: "connection_uris",
+			emptyMessage: "No connection uris have been found"
+		});
+	}
 	out.end();
 	if (props.psql) {
 		if (!data.connection_uris?.length) throw new Error(`Branch ${data.branch.id} doesn't have a connection uri`);

package/dist/commands/claim.js

@@ -5,7 +5,7 @@ import { applyContext, contextBranch, ensureGitignored, readContextFile } from "
 import { declaredNeonServices } from "../config_services.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-ktL6uoEe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
 import { writer } from "../writer.js";