neon 4.8.0 → 4.9.0

package/README.md

@@ -133,6 +133,18 @@ automation:
 neon branches create --project-id <project-id> --name production --protected
 ```
 
+Project and branch creation include connection credentials in their output by
+default for backward compatibility. When the output may be logged or passed to
+an agent, use `--no-secrets` to return only the created resource metadata:
+
+```bash
+neon projects create --name my-project --output json --no-secrets
+neon branches create --project-id <project-id> --name preview --output json --no-secrets
+```
+
+The flag omits the complete `connection_uris` block rather than redacting one
+field. Retrieve a connection string separately when it is actually needed.
+
 ### Enable logical replication
 
 Enable logical replication for every endpoint in an existing project:

package/dist/commands/branches.js

@@ -44,6 +44,11 @@ const builder = (argv) => argv.usage("$0 branches <sub-command> [options]").opti
 } }).middleware(fillSingleProject).middleware((args) => {
 	args.branchId ??= args.id;
 }).command("list", "List branches", (yargs) => yargs, (args) => list(args)).command("create", "Create a branch", (yargs) => yargs.options({
+	secrets: {
+		describe: "Include connection credentials in command output. Use --no-secrets to omit them",
+		type: "boolean",
+		default: true
+	},
 	name: branchCreateRequest["branch.name"],
 	parent: {
 		describe: "Parent branch name or id or timestamp or LSN. Defaults to the default branch",
@@ -220,21 +225,31 @@ const create = async (props) => {
 	}));
 	if (branches.find((b) => b.id === data.branch.parent_id)?.protected) log.warning("The parent branch is protected; a unique role password has been generated for the new branch.");
 	const out = writer(props);
-	out.write(data.branch, {
-		fields: BRANCH_FIELDS,
-		title: "branch",
-		emptyMessage: "No branches have been found."
-	});
-	if (data.endpoints?.length > 0) out.write(data.endpoints, {
-		fields: ["id", "created_at"],
-		title: "endpoints",
-		emptyMessage: "No endpoints have been found."
-	});
-	if (data.connection_uris?.length) out.write(data.connection_uris, {
-		fields: ["connection_uri"],
-		title: "connection_uris",
-		emptyMessage: "No connection uris have been found"
+	const endpoints = data.endpoints ?? [];
+	const connectionUris = data.connection_uris ?? [];
+	const writeEndpoints = endpoints.length > 0;
+	const writeUris = props.secrets && connectionUris.length > 0;
+	if (!props.secrets && (props.output === "json" || props.output === "yaml") && !writeEndpoints) out.write({ branch: data.branch }, {
+		fields: ["branch"],
+		title: "branch"
 	});
+	else {
+		out.write(data.branch, {
+			fields: BRANCH_FIELDS,
+			title: "branch",
+			emptyMessage: "No branches have been found."
+		});
+		if (writeEndpoints) out.write(endpoints, {
+			fields: ["id", "created_at"],
+			title: "endpoints",
+			emptyMessage: "No endpoints have been found."
+		});
+		if (writeUris) out.write(connectionUris, {
+			fields: ["connection_uri"],
+			title: "connection_uris",
+			emptyMessage: "No connection uris have been found"
+		});
+	}
 	out.end();
 	if (props.psql) {
 		if (!data.connection_uris?.length) throw new Error(`Branch ${data.branch.id} doesn't have a connection uri`);

package/dist/commands/projects.js

@@ -62,6 +62,11 @@ const builder = (argv) => {
 	}), async (args) => {
 		await handleMissingOrgId(args, list);
 	}).command("create", "Create a project", (yargs) => yargs.options({
+		secrets: {
+			describe: "Include connection credentials in command output. Use --no-secrets to omit them",
+			type: "boolean",
+			default: true
+		},
 		"block-public-connections": {
 			describe: projectCreateRequest["project.settings.block_public_connections"].description,
 			type: "boolean"
@@ -230,14 +235,20 @@ const create = async (props) => {
 	const { data } = await props.apiClient.createProject({ project });
 	if (props.setContext) updateContextFile(props.contextFile, { projectId: data.project.id });
 	const out = writer(props);
-	out.write(data.project, {
-		fields: PROJECT_FIELDS,
+	if (!props.secrets && (props.output === "json" || props.output === "yaml")) out.write({ project: data.project }, {
+		fields: ["project"],
 		title: "Project"
 	});
-	out.write(data.connection_uris, {
-		fields: ["connection_uri"],
-		title: "Connection URIs"
-	});
+	else {
+		out.write(data.project, {
+			fields: PROJECT_FIELDS,
+			title: "Project"
+		});
+		if (props.secrets) out.write(data.connection_uris, {
+			fields: ["connection_uri"],
+			title: "Connection URIs"
+		});
+	}
 	out.end();
 	if (props.psql) {
 		const connection_uri = data.connection_uris[0].connection_uri;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.8.0",
+  "version": "4.9.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.0.5",
     "@neon/config-runtime": "1.0.5",
-    "@neon/sdk": "3.0.0"
+    "@neon/sdk": "3.0.0",
+    "@neon/config": "1.0.5"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -96,9 +96,9 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/cli-core": "0.0.0",
     "@neon-internals/env-core": "0.0.5",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon/e2e-harness": "0.0.0",
+    "@neon-internals/cli-core": "0.0.0"
   },
   "publishConfig": {
     "access": "public",