neon 6.0.0 → 6.2.0

package/README.md

@@ -936,12 +936,15 @@ The plugins CLI installs every plugin it finds in the Neon plugin package. Today
 
 `neon snapshots` (alias `neon snapshot`) manages **snapshots** — point-in-time backups of a branch that you can list, rename, expire, restore into a branch, or schedule automatically. Snapshots are a Beta Neon feature and were previously only available in the Console and REST API; this command group brings them to the CLI.
 
-Every sub-command resolves the project through the standard chain (`--project-id`, then the `.neon` context file, then a single-project auto-detect). Branch-scoped sub-commands (`create`, `schedule`) default to the branch pinned in `.neon`, falling back to the project's default branch, and accept `--branch <id|name>`. The `get`, `update`, `delete`, and `restore` sub-commands take a snapshot **id or name** as their positional argument (an id wins; an ambiguous name errors and asks you to use the id).
+Every sub-command resolves the project through the standard chain (`--project-id`, then the `.neon` context file, then a single-project auto-detect). Branch-scoped sub-commands (`create`, `schedule`) default to the branch pinned in `.neon`, falling back to the project's default branch, and accept `--branch <id|name>`. The `get`, `update`, `delete`, and `restore` sub-commands take a snapshot **id, unique name, or slug** as their positional argument. An id wins. A unique name still wins over another snapshot's matching slug, so a name you already use keeps targeting that snapshot. Slug is used when no name matches. An ambiguous name errors and asks you to use the id.
 
 ```bash
 # Snapshot the head of the current/default branch
 neon snapshots create --name pre-migration
 
+# Give the snapshot a slug (unique in the project; omit to let the API generate one)
+neon snapshots create --branch main --name "Before migration" --slug before-migration
+
 # Snapshot a specific branch at a point in time (RFC 3339 timestamp OR LSN — mutually exclusive)
 neon snapshots create --branch main --timestamp 2025-01-01T00:00:00Z
 neon snapshots create --branch main --lsn 0/1F3C8A0 --expires-at 2025-12-31T23:59:59Z
@@ -949,6 +952,7 @@ neon snapshots create --branch main --lsn 0/1F3C8A0 --expires-at 2025-12-31T23:5
 # List / inspect
 neon snapshots list
 neon snapshots get pre-migration
+neon snapshots get before-migration
 
 # Rename or change expiration (omit both to error; --expires-at and --clear-expiration conflict)
 neon snapshots update snap-1234 --name nightly

package/dist/_chunks/{env-DRpFX-_d.js → env-CtOH9xsl.js}

@@ -1,7 +1,8 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
-import { C as resolveBranchPolicy, S as policyEnvKeys, _ as defaultStorageCredential, a as envKeysForSelection, b as isFunctionBaseUrlKey, d as servicesForEnvKeys, f as NEON_ENV_VAR_KEYS, g as defaultAiGatewayCredential, h as credentialName, i as ENV_PULL_SERVICES, m as credentialEnvKeys, p as createApiFromOptions, u as serviceForEnvKey, v as fetchEnvKeysState, w as toEntries, x as isLiveCredential, y as functionBaseUrlKey } from "./env_services-DlXECBPi.js";
+import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-N19A7qND.js";
+import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { ErrorCode, createNeonApiFromOptions, isPlatformError, loadConfigFromFile } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";

package/dist/_chunks/{env_services-DlXECBPi.js → env-N19A7qND.js}

@@ -1,4 +1,3 @@
-import { NEON_SERVICES } from "../neon_services.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
 //#region ../../internals/env-core/dist/env.js
 /**
@@ -102,6 +101,18 @@ function requiredValue(value, description) {
 	if (value === null) throw new Error(`fetchEnv: missing ${description}.`);
 	return value;
 }
+/**
+* The {@link fetchEnv} body, with the key selection as a plain argument and no generic
+* narrowing. Exists for callers that compute the selection at runtime — notably
+* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
+* branch — since the public overload's `keys` is bound to a literal union those callers cannot
+* produce without asserting.
+*
+* `keys === null` selects everything the policy enables.
+*/
+async function fetchEnvKeys(config, options, keys) {
+	return (await fetchEnvKeysState(config, options, keys)).env;
+}
 async function fetchEnvKeysState(config, options, keys) {
 	const api = options.api ?? createApiFromOptions(options);
 	const projectId = options.projectId;
@@ -562,122 +573,4 @@ function toEntries(env) {
 	return out;
 }
 //#endregion
-//#region src/env_services.ts
-const ENV_PULL_SERVICES = NEON_SERVICES;
-const ENV_PULL_KEYS = [
-	...Object.values(NEON_ENV_VAR_KEYS.postgres),
-	NEON_ENV_VAR_KEYS.branch.name,
-	...Object.values(NEON_ENV_VAR_KEYS.auth),
-	...Object.values(NEON_ENV_VAR_KEYS.dataApi),
-	...Object.values(NEON_ENV_VAR_KEYS.storage),
-	...Object.values(NEON_ENV_VAR_KEYS.aiGateway)
-];
-const ENV_PULL_KEY_HELP = `${ENV_PULL_KEYS.join(", ")}, or NEON_FUNCTION_<SLUG>_BASE_URL`;
-/** The OS-level env vars each service contributes to a pulled `.env`. */
-const SERVICE_ENV_KEYS = {
-	postgres: Object.values(NEON_ENV_VAR_KEYS.postgres),
-	auth: Object.values(NEON_ENV_VAR_KEYS.auth),
-	"data-api": Object.values(NEON_ENV_VAR_KEYS.dataApi),
-	"object-storage": Object.values(NEON_ENV_VAR_KEYS.storage),
-	"ai-gateway": Object.values(NEON_ENV_VAR_KEYS.aiGateway),
-	functions: []
-};
-/**
-* The subset of {@link SERVICE_ENV_KEYS} a pull *owns*, and so may prune from the target file
-* when the branch no longer has it. Object storage is deliberately absent: it is emitted under
-* the third-party `AWS_*` names, which collide with credentials a user may set by hand, so
-* `env pull` only ever writes them. Function URL keys cannot live here because slugs are
-* discovered at runtime.
-*/
-const SERVICE_OWNED_ENV_KEYS = {
-	...SERVICE_ENV_KEYS,
-	"object-storage": [],
-	functions: []
-};
-/**
-* Branch identity. Not a service — every branch has a name — so a scoped pull refreshes it
-* alongside whatever services were selected.
-*/
-const BRANCH_ENV_KEY = NEON_ENV_VAR_KEYS.branch.name;
-const ENV_KEY_SERVICE = {
-	DATABASE_URL: "postgres",
-	DATABASE_URL_UNPOOLED: "postgres",
-	NEON_BRANCH: null,
-	NEON_AUTH_BASE_URL: "auth",
-	NEON_AUTH_JWKS_URL: "auth",
-	NEON_DATA_API_URL: "data-api",
-	AWS_ACCESS_KEY_ID: "object-storage",
-	AWS_SECRET_ACCESS_KEY: "object-storage",
-	AWS_ENDPOINT_URL_S3: "object-storage",
-	AWS_REGION: "object-storage",
-	NEON_AI_GATEWAY_TOKEN: "ai-gateway",
-	NEON_AI_GATEWAY_BASE_URL: "ai-gateway"
-};
-const serviceForEnvKey = (key) => isFunctionBaseUrlKey(key) ? "functions" : ENV_KEY_SERVICE[key];
-/** Services that must be resolved to produce the selected env keys. */
-const servicesForEnvKeys = (keys) => ENV_PULL_SERVICES.filter((service) => keys.some((key) => serviceForEnvKey(key) === service));
-/** Every env var the selected services contribute, plus branch identity. */
-const envServiceKeys = (services) => {
-	const keys = /* @__PURE__ */ new Set([BRANCH_ENV_KEY]);
-	for (const service of services) for (const key of SERVICE_ENV_KEYS[service]) keys.add(key);
-	return keys;
-};
-/**
-* The env vars a pull scoped to `services` may prune. Narrower than the unscoped set on
-* purpose: `env pull -s ai-gateway` says nothing about `DATABASE_URL`, so it must leave it
-* alone rather than treat its absence from this pull as "the branch no longer has it".
-* Function URL keys cannot live here because slugs are discovered at runtime.
-*/
-const ownedEnvServiceKeys = (services) => services.flatMap((service) => SERVICE_OWNED_ENV_KEYS[service]);
-const envKeysForSelection = (services, envKeys) => {
-	const selected = services.length > 0 ? envServiceKeys(services) : /* @__PURE__ */ new Set();
-	for (const key of envKeys) selected.add(key);
-	if (selected.has(NEON_ENV_VAR_KEYS.storage.accessKeyId) !== selected.has(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) throw new Error("AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together: they are two halves of one newly issued object-storage credential. Add the missing key to --env, or use --service object-storage.");
-	const staticKeys = ENV_PULL_KEYS.filter((key) => selected.has(key));
-	const functionKeys = [...selected].filter(isFunctionBaseUrlKey).sort((left, right) => left.localeCompare(right));
-	return [...staticKeys, ...functionKeys];
-};
-/** Parse repeated or comma-separated `--env` values into canonical env-key order. */
-const parseEnvPullKeys = (raw, flag) => {
-	const names = raw.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
-	const supported = `Supported values: ${ENV_PULL_KEY_HELP}.`;
-	if (names.length === 0) throw new Error(`${flag} needs at least one env variable. ${supported}`);
-	const unknown = names.filter((name) => !ENV_PULL_KEYS.some((key) => key === name) && !isFunctionBaseUrlKey(name));
-	if (unknown.length > 0) {
-		const displayNames = unknown.map(redactUnknownEnvValue);
-		const suggestions = [...new Set(unknown.map(suggestEnvPullKey).filter((key) => key !== null))];
-		const suggestion = suggestions.length > 0 ? ` Did you mean ${suggestions.join(" or ")}?` : "";
-		throw new Error(`Unknown env variable${unknown.length === 1 ? "" : "s"} ${displayNames.join(", ")}.${suggestion} ${supported}`);
-	}
-	const staticKeys = ENV_PULL_KEYS.filter((key) => names.includes(key));
-	const functionKeys = [...new Set(names.filter(isFunctionBaseUrlKey))].sort((left, right) => left.localeCompare(right));
-	return [...staticKeys, ...functionKeys];
-};
-const isKnownEnvPullKey = (key) => ENV_PULL_KEYS.some((supportedKey) => supportedKey === key) || isFunctionBaseUrlKey(key);
-const redactUnknownEnvValue = (value) => {
-	const separator = value.indexOf("=");
-	if (separator !== -1) {
-		const key = value.slice(0, separator);
-		return isKnownEnvPullKey(key) ? `${key}=<redacted>` : "<redacted invalid value>";
-	}
-	return "<redacted invalid value>";
-};
-const suggestEnvPullKey = (value) => {
-	if (value.includes("=")) return null;
-	if (parseFunctionBaseUrlKey(value) !== null) return null;
-	const closest = ENV_PULL_KEYS.map((key) => [key, editDistance(value, key)]).sort((a, b) => a[1] - b[1])[0];
-	return closest && closest[1] <= 2 ? closest[0] : null;
-};
-const editDistance = (left, right) => {
-	let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
-	for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
-		const current = [leftIndex];
-		for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) current[rightIndex] = Math.min((previous[rightIndex] ?? 0) + 1, (current[rightIndex - 1] ?? 0) + 1, (previous[rightIndex - 1] ?? 0) + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1));
-		previous = current;
-	}
-	return previous[right.length] ?? right.length;
-};
-/** Narrow yargs' array option value without accepting any other runtime shape. */
-const envPullFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
-//#endregion
-export { resolveBranchPolicy as C, policyEnvKeys as S, defaultStorageCredential as _, envKeysForSelection as a, isFunctionBaseUrlKey as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, defaultAiGatewayCredential as g, credentialName as h, ENV_PULL_SERVICES as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_KEY_HELP as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, fetchEnvKeysState as v, toEntries as w, isLiveCredential as x, functionBaseUrlKey as y };
+export { defaultAiGatewayCredential as a, fetchEnvKeysState as c, isLiveCredential as d, parseFunctionBaseUrlKey as f, toEntries as h, credentialName as i, functionBaseUrlKey as l, resolveBranchPolicy as m, createApiFromOptions as n, defaultStorageCredential as o, policyEnvKeys as p, credentialEnvKeys as r, fetchEnvKeys as s, NEON_ENV_VAR_KEYS as t, isFunctionBaseUrlKey as u };

package/dist/commands/auth.js

@@ -5,7 +5,7 @@ import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
+import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
 import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
@@ -297,6 +297,8 @@ const ensureAuth = async (props) => {
 	if (isCurrentBranchProbe(props)) return;
 	if (isConfigInit(props)) return;
 	if (isProfileCommand(props)) return;
+	if (isGitLocalCommand(props)) return;
+	if (isUnfollowedGitHookSync(props)) return;
 	if (isMcpOauth(props)) return;
 	if (isInspectDbUrl(props)) return;
 	if (props._[0] === "open") return;

package/dist/commands/bootstrap.js

@@ -2,12 +2,10 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { recordCommandSuccessExtras, recordScaffoldedTemplate } from "../analytics.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { writer } from "../writer.js";
 import { FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
-import { spawnCliChild } from "../init/child.js";
 import { agentSetupDoneLabel, formatInitDone, printInitBanner, printInitDone, shouldPrintInitBanner } from "../init/chrome.js";
 import { formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { runAuthenticatedLink } from "../init/link.js";
@@ -271,7 +269,9 @@ const runDefaultSteps = async (props, targetDir, pm, neonConfig, template, named
 };
 const executePostScaffold = async (props, targetDir, choices) => {
 	const kids = {
-		...bootstrapChildren(props, targetDir),
+		output: "table",
+		auth: bootstrapAuth(props, targetDir),
+		operations: props.operations,
 		...props.narrate ? { narrate: props.narrate } : {}
 	};
 	let installed = false;
@@ -370,20 +370,22 @@ const hasNeonConfig = (dir) => NEON_CONFIG_FILENAMES.some((name) => existsSync(j
 const logSkippedLink = (pm) => {
 	log.info(`Skipping the Neon link step: \`${getCliName()} link\` reads this project's neon.ts to pull env vars, which needs its dependencies. Run \`${formatInstallCommand(pm)}\`, then \`${getCliName()} link\`.`);
 };
-const bootstrapChildren = (props, targetDir) => {
-	const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
-	return {
-		run: props.run ?? spawnCliChild,
-		forward: {
-			...props.configDir ? { configDir: props.configDir } : {},
-			...props.profile ? { profile: props.profile } : {},
-			apiHost: props.apiHost,
-			contextFile: projectContextFile(targetDir, props.contextFile),
-			...props.analytics === false ? { analytics: false } : {}
-		},
-		...explicitKey ? { authEnv: { NEON_API_KEY: explicitKey } } : {}
-	};
-};
+/**
+* plugins/skills need no Neon auth at all; mcp resolves it itself, in-process, exactly as
+* the standalone `neon mcp` does (see `init/auth.ts`) — this is that shared context.
+*/
+const bootstrapAuth = (props, targetDir) => ({
+	apiClient: props.apiClient,
+	apiKey: props.apiKey,
+	apiHost: props.apiHost,
+	contextFile: projectContextFile(targetDir, props.contextFile),
+	...props.configDir ? { configDir: props.configDir } : {},
+	...props.profile ? { profile: props.profile } : {},
+	...props.oauthHost ? { oauthHost: props.oauthHost } : {},
+	...props.clientId ? { clientId: props.clientId } : {},
+	...props.forceAuth !== void 0 ? { forceAuth: props.forceAuth } : {},
+	...props.allowUnsafeTls !== void 0 ? { allowUnsafeTls: props.allowUnsafeTls } : {}
+});
 /**
 * Initialize a git repository in the scaffolded directory. Just `git init` — we
 * deliberately don't auto-commit, both to avoid failing on a machine with no

package/dist/commands/checkout.js

@@ -4,9 +4,12 @@ import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { applyContext, contextBranch, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { loadEnvFileIntoProcess } from "../env_file.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js";
+import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
+import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { applyPolicyOnCreate, createBranchFromPolicyOnCheckout, envFlag } from "./config.js";
 import { handler as handler$1 } from "./link.js";
@@ -66,7 +69,34 @@ const handler = async (props) => {
 	if (previousBranch) log.info("%s Currently on branch %s", chalk.dim("→"), chalk.cyan.bold(previousBranch));
 	if (props.create && !props.id?.trim()) throw new Error(`No branch specified. Pass a branch name with --create (e.g. \`${getCliName()} checkout dev --create\`).`);
 	const projectId = await resolveProjectId(props);
-	const { branchId, branchName, created, policyApplied, policyFailure } = await resolveBranchId(props, projectId);
+	if (props.create && props.env) try {
+		loadEnvFileIntoProcess(props.env);
+	} catch (err) {
+		log.debug("checkout: could not preload --env for hook discovery (continuing): %s", err instanceof Error ? err.message : String(err));
+	}
+	const cwd = process.cwd();
+	const git = readGitContext(cwd);
+	const event = buildCheckoutEvent(git, props.id);
+	const config = await loadHookConfig(cwd);
+	const hooks = config?.experimental?.hooks;
+	if (props.id) {
+		const renamed = await runCheckoutBeforeHook({
+			hooks,
+			event,
+			git,
+			cwd
+		});
+		if (renamed && renamed !== props.id) {
+			log.info("%s checkout.before hook mapped %s → %s", chalk.dim("→"), chalk.cyan(props.id), chalk.cyan.bold(renamed));
+			props.id = renamed;
+		}
+	}
+	const { branchId, branchName, created, policyApplied, policyFailure } = await resolveBranchId(props, projectId, {
+		hooks,
+		git,
+		event,
+		cwd
+	});
 	const orgId = await resolveOrgId(props, projectId);
 	applyContext(props.contextFile, {
 		projectId,
@@ -89,6 +119,39 @@ const handler = async (props) => {
 		branch: branchId,
 		envPull: props.envPull
 	});
+	const needsCreateAfter = created && hooks?.create?.after;
+	if (config && (hooks?.checkout?.after || needsCreateAfter)) {
+		const env = await resolveHookEnv(config, {
+			projectId,
+			branch: branchId,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {}
+		});
+		if (env) {
+			const branch = await buildHookBranch({
+				apiClient: props.apiClient,
+				projectId,
+				branchId,
+				created
+			});
+			if (hooks?.checkout?.after) await runCheckoutAfterHook({
+				hooks,
+				branch,
+				env,
+				git,
+				event,
+				cwd
+			});
+			if (needsCreateAfter) await runCreateAfterHook({
+				hooks,
+				branch,
+				env,
+				git,
+				event,
+				cwd
+			});
+		}
+	}
 	if (failure) throw new Error(formatCheckoutPolicyFailure({
 		branchName,
 		branchId,
@@ -109,7 +172,7 @@ const applyPolicyOrDescribeFailure = async (props) => {
 		return err instanceof Error ? err.message : String(err);
 	}
 };
-const resolveBranchId = async (props, projectId) => {
+const resolveBranchId = async (props, projectId, hookCtx) => {
 	const branches = await listAllProjectBranches(props.apiClient, projectId);
 	if (!props.id) {
 		const picked = await pickBranchInteractively(branches, {
@@ -125,7 +188,7 @@ const resolveBranchId = async (props, projectId) => {
 				policyApplied: false
 			};
 		}
-		return createCheckoutBranch(props, projectId, picked.name, branches);
+		return createCheckoutBranch(props, projectId, picked.name, branches, hookCtx);
 	}
 	const ref = props.id;
 	if (looksLikeBranchId(ref)) {
@@ -145,7 +208,7 @@ const resolveBranchId = async (props, projectId) => {
 		created: false,
 		policyApplied: false
 	};
-	if (props.create) return createCheckoutBranch(props, projectId, ref, branches);
+	if (props.create) return createCheckoutBranch(props, projectId, ref, branches, hookCtx);
 	const missingName = notFoundMessage(ref, branches, { suggestCreate: true });
 	if (isCi() || !process.stdout.isTTY) throw new Error(missingName);
 	log.error(missingName);
@@ -156,7 +219,7 @@ const resolveBranchId = async (props, projectId) => {
 		initial: true
 	});
 	if (!create) throw new Error(`Aborted: branch "${ref}" was not found and not created.`);
-	return createCheckoutBranch(props, projectId, ref, branches);
+	return createCheckoutBranch(props, projectId, ref, branches, hookCtx);
 };
 /**
 * Create the branch to check out. When a `neon.ts` exists, route through the policy-driven
@@ -165,7 +228,14 @@ const resolveBranchId = async (props, projectId) => {
 * a bare branch off the default — the handler then applies the policy (a no-op with no
 * `neon.ts`).
 */
-const createCheckoutBranch = async (props, projectId, name, branches) => {
+const createCheckoutBranch = async (props, projectId, name, branches, hookCtx) => {
+	await runCreateBeforeHook({
+		hooks: hookCtx.hooks,
+		branchName: name,
+		git: hookCtx.git,
+		event: hookCtx.event,
+		cwd: hookCtx.cwd
+	});
 	const fromPolicy = await createBranchFromPolicyOnCheckout({
 		projectId,
 		branchName: name,

package/dist/commands/config.js

@@ -16,6 +16,8 @@ import { announceTargetBranch } from "../utils/branch_notice.js";
 import { renderAppliedChanges, renderBranchSettingConflicts, renderCustomDomainFollowup } from "../utils/config_diff.js";
 import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { bundleEntry } from "../utils/esbuild.js";
+import { readGitContext } from "../utils/git.js";
+import { resolveHookEnv, runDeployAfterHook, runDeployBeforeHook } from "../utils/hooks.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
 import { autoPullEnvAfterPin } from "./env.js";
@@ -485,6 +487,27 @@ const applyCmd = async (props) => {
 		apiClient: props.apiClient,
 		projectId: props.projectId
 	});
+	const cwd = process.cwd();
+	const git = readGitContext(cwd);
+	const event = { type: "neon-deploy" };
+	const hooks = config.experimental?.hooks;
+	const hookBranch = {
+		projectId: props.projectId,
+		id: branch.branchId,
+		name: branch.branchName,
+		created: false,
+		isDefault: branch.isDefault ?? false,
+		isProtected: branch.isProtected ?? false,
+		...branch.parentId ? { parentId: branch.parentId } : {},
+		...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+	};
+	await runDeployBeforeHook({
+		hooks,
+		branch: hookBranch,
+		git,
+		event,
+		cwd
+	});
 	let result;
 	try {
 		result = await apply(config, {
@@ -510,6 +533,24 @@ const applyCmd = async (props) => {
 		...props,
 		envPull: props.envPull !== false
 	});
+	if (hooks?.deploy?.after) {
+		const env = await resolveHookEnv(config, {
+			projectId: props.projectId,
+			branch: branchId,
+			...props.apiKey ? { apiKey: props.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { api: props.runtimeApi } : {}
+		});
+		if (env) await runDeployAfterHook({
+			hooks,
+			branch: hookBranch,
+			env,
+			result,
+			git,
+			event,
+			cwd
+		});
+	}
 };
 /**
 * Human-readable list of the services a `neon.ts` policy utilizes on the branch, shown under

package/dist/commands/dev.js

@@ -3,18 +3,18 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { y as functionBaseUrlKey } from "../_chunks/env_services-DlXECBPi.js";
+import { l as functionBaseUrlKey } from "../_chunks/env-N19A7qND.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-DRpFX-_d.js";
+import { a as resolveDevEnv } from "../_chunks/env-CtOH9xsl.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
-import { spawn, spawnSync } from "node:child_process";
 import { bundleAsIs, describeNativeFinding, findUndeclaredNativePackages, resolveEsbuildEntry } from "@neon/config-runtime";
+import { spawn, spawnSync } from "node:child_process";
 import { once } from "node:events";
 import { createServer } from "node:net";
 //#region src/commands/dev.ts

package/dist/commands/env.js

@@ -5,11 +5,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, b as isFunctionBaseUrlKey, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP } from "../_chunks/env_services-DlXECBPi.js";
+import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-N19A7qND.js";
+import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-DRpFX-_d.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-CtOH9xsl.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts