neon 7.0.8 → 8.0.0

package/README.md

@@ -76,6 +76,8 @@ neon projects list --api-key <neon_api_key>
 
 For information about obtaining an Neon API key, see [Authentication](https://neon.com/docs/reference/api/get-started), in the _Neon API Reference_.
 
+To check which account and credential a command uses, run `neon me` with the same `--profile` or `--api-key` option and environment as that command. The `Authentication` row names the source, such as `OAuth (profile DEFAULT)`, `API key (profile work)`, `API key (--api-key)`, or `API key (NEON_API_KEY)`.
+
 ## Create a project without an account
 
 `neon claim create` provisions a temporary Claimable Neon project for an agent without
@@ -594,7 +596,9 @@ If you'd rather not keep env vars on disk, inject them at runtime instead with `
 
 **`neon dev` resolves the same set, by the same rules** — including the AI Gateway on a branch with no `neon.ts`. A function running locally gets the same Postgres / Auth / Data API / storage / AI Gateway vars a deploy would inject. Each `NEON_FUNCTION_<SLUG>_BASE_URL` this process is serving is rewritten to `http://localhost:<port>`: every neon.ts function, or the matching slug when `--source` names one. `neon env pull` and `neon-env run` write the production URL (`https://<branchId>-<slug>.compute.…`). `dev` writes nothing, but it does *read* your `.env` / `.env.local` to reuse the branch credential behind the AI Gateway and object storage. Without a file to read from it issues one on every start and leaves the last one live — it has nowhere to keep it, and so cannot name it to revoke it. It says so when it happens; run `env pull` (or just `link` / `checkout`) once and restarts reuse the credential instead.
 
-**Where `.neon` lives**: `link` writes `.neon` into the **current working directory** by default. If an existing `.neon` is found in any parent directory, that file is reused — so commands run from a sub-directory of a linked project still pick up the project's context. To pin the location explicitly, pass `--context-file <path>`.
+**Where `.neon` lives**: `link` writes `.neon` into the **current working directory** by default. If an existing `.neon` is found in any parent directory, that file is reused — so commands run from a sub-directory of a linked project still pick up the project's context. To pin the location explicitly, pass `--context-file <path>`. `neon init` always writes `.neon` into the current directory.
+
+**The project directory** is the directory holding that `.neon`, or the current directory when there is none. The project's `neon.ts` and the default `.env` / `.env.local` live there and nowhere else: a `neon.ts` in a parent directory never applies. An explicit `--config` or `--file` path still wins.
 
 **`.gitignore` scaffolding**: when `.neon` is **created** for the first time, the CLI also makes sure a `.gitignore` sits alongside it listing `.neon`. If `.gitignore` doesn't exist it's created with a single `.neon` line; if it does exist, `.neon` is appended only when missing (no duplicates, your other entries are left alone). On subsequent updates to an existing `.neon`, `.gitignore` is left untouched — so if you deliberately un-ignore `.neon` (e.g. to commit shared context), the entry is not re-added on every command.
 
@@ -732,7 +736,7 @@ neon deploy
 2. `projectId` from the closest `.neon` file (found by walking up from the current directory — see "Where `.neon` lives" above)
 3. If still unresolved and the API key maps to exactly one project, that project is auto-detected
 
-The branch is chosen with `--branch <id|name>`; without it the project's default branch is used. The policy itself is found by walking up from the current directory for a `neon.ts`, or pass `--config <path>` to point at one explicitly.
+The branch is chosen with `--branch <id|name>`; without it the project's default branch is used. The policy is the `neon.ts` in the project directory (next to `.neon`, or the current directory without one); pass `--config <path>` to point at another file.
 
 **Apply-only flags** (also available on `deploy`):
 

package/dist/_chunks/{env-CtOH9xsl.js → env-BgiaRNT1.js}

@@ -1,10 +1,11 @@
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
+import { loadProjectConfig } from "../project.js";
 import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-N19A7qND.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
-import { ErrorCode, createNeonApiFromOptions, isPlatformError, loadConfigFromFile } from "@neon/config";
+import { ErrorCode, createNeonApiFromOptions, isPlatformError } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";
 import { plan, pullConfig } from "@neon/config-runtime";
 //#region ../../internals/env-core/dist/reuse-secrets.js
@@ -708,8 +709,9 @@ const looksLikeMissingDependency = (err) => {
 };
 const loadNeonConfig = async (ctx) => {
 	try {
-		const { config } = await loadConfigFromFile({
+		const { config } = await loadProjectConfig({
 			cwd: ctx.cwd,
+			...ctx.contextFile ? { contextFile: ctx.contextFile } : {},
 			...ctx.config ? { path: ctx.config } : {},
 			...ctx.omitUnsetFunctionEnv ? { unsetFunctionEnv: "omit" } : {}
 		});

package/dist/commands/auth.js

@@ -366,6 +366,7 @@ const ensureAuth = async (props) => {
 		log.debug("Using an API key to authorize requests");
 		setAuthContext({
 			source: "api-key",
+			apiKeyFrom: selection.source === "explicit-api-key" ? "flag" : "env",
 			configDir: props.configDir
 		});
 		props.apiClient = getApiClient({

package/dist/commands/checkout.js

@@ -77,7 +77,7 @@ const handler = async (props) => {
 	const cwd = process.cwd();
 	const git = readGitContext(cwd);
 	const event = buildCheckoutEvent(git, props.id);
-	const config = await loadHookConfig(cwd);
+	const config = await loadHookConfig(cwd, props.contextFile);
 	const hooks = config?.experimental?.hooks;
 	if (props.id) {
 		const renamed = await runCheckoutBeforeHook({
@@ -108,6 +108,7 @@ const handler = async (props) => {
 		projectId,
 		branchId,
 		branchName,
+		contextFile: props.contextFile,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.color !== void 0 ? { color: props.color } : {},
@@ -239,6 +240,7 @@ const createCheckoutBranch = async (props, projectId, name, branches, hookCtx) =
 	const fromPolicy = await createBranchFromPolicyOnCheckout({
 		projectId,
 		branchName: name,
+		contextFile: props.contextFile,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.color !== void 0 ? { color: props.color } : {},

package/dist/commands/claim.js

@@ -8,13 +8,12 @@ import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { claimableDataApiCreateBody, declaredNeonServices } from "../config_services.js";
+import { projectConfigPath } from "../project.js";
 import { resolveEnvFilePath } from "../env_file.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { pull } from "./env.js";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { homedir } from "node:os";
 import open from "open";
 import prompts from "prompts";
 import { loadConfigFromFile } from "@neon/config-runtime";
@@ -29,7 +28,6 @@ var claim_exports = /* @__PURE__ */ __exportAll({
 	command: () => command,
 	create: () => create,
 	describe: () => describe,
-	findNeonConfig: () => findNeonConfig,
 	handler: () => handler
 });
 const CAPABILITY_FOR_SERVICE = {
@@ -63,28 +61,8 @@ const claimableCapabilities = (services) => {
 	for (const service of services) requested.add(CAPABILITY_FOR_SERVICE[service]);
 	return CAPABILITY_ORDER.filter((capability) => requested.has(capability));
 };
-const CONFIG_FILENAMES = [
-	"neon.ts",
-	"neon.mts",
-	"neon.js",
-	"neon.mjs"
-];
-const findNeonConfig = (cwd = process.cwd()) => {
-	let current = resolve(cwd);
-	const stop = resolve(homedir());
-	while (true) {
-		for (const name of CONFIG_FILENAMES) {
-			const candidate = join(current, name);
-			if (existsSync(candidate)) return candidate;
-		}
-		if (existsSync(join(current, ".git")) || current === stop) return void 0;
-		const parent = dirname(current);
-		if (parent === current) return void 0;
-		current = parent;
-	}
-};
-const loadCreatePolicy = async (explicitPath) => {
-	const path = explicitPath ?? findNeonConfig();
+const loadCreatePolicy = async (explicitPath, contextFile) => {
+	const path = explicitPath ?? projectConfigPath(contextFile ? { contextFile } : {});
 	if (!path) return void 0;
 	const { config } = await loadConfigFromFile({ path });
 	return {
@@ -135,7 +113,7 @@ const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option(
 	describe: "Target dotenv file. Defaults to an existing .env, otherwise .env.local",
 	type: "string"
 }).option("config", {
-	describe: "Path to neon.ts for registration and the bundled env pull. Defaults to walking up from the current directory",
+	describe: "Path to neon.ts for registration and the bundled env pull. Defaults to the neon.ts in the project directory (next to .neon, or cwd without one)",
 	type: "string"
 }).option("env-pull", {
 	describe: "Write the same Neon env vars `env pull` would",
@@ -148,7 +126,7 @@ const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option(
 		flag: "--service",
 		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
 	}) : [];
-	const policy = await loadCreatePolicy(typeof args.config === "string" ? args.config : void 0);
+	const policy = await loadCreatePolicy(typeof args.config === "string" ? args.config : void 0, typeof args.contextFile === "string" ? args.contextFile : void 0);
 	const configuredServices = policy ? declaredNeonServices(policy.config) : [];
 	const dataApi = policy ? claimableDataApiCreateBody(policy.config) : void 0;
 	await create({
@@ -217,7 +195,10 @@ const create = async (props) => {
 	if (existing.projectId || existing.orgId) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
 	const contextFileExisted = existsSync(props.contextFile);
 	const cwd = props.cwd ?? process.cwd();
-	const envFile = props.envPull ? resolveEnvFilePath(cwd, props.file) : void 0;
+	const envFile = props.envPull ? resolveEnvFilePath({
+		cwd,
+		contextFile: props.contextFile
+	}, props.file) : void 0;
 	const envFileExisted = envFile ? existsSync(envFile) : false;
 	const previousEnv = envFileExisted && envFile ? readFileSync(envFile) : void 0;
 	const client = new ClaimableClient(props.claimableHost);
@@ -482,4 +463,4 @@ const finishClaimedContext = (props, projectId, contextMatches) => {
 	log.info("Dropped the local identity assertion. The next command needs `neon auth` or `neon link`.");
 };
 //#endregion
-export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, create, describe, findNeonConfig, handler, claim_exports as t };
+export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, create, describe, handler, claim_exports as t };

package/dist/commands/config.js

@@ -9,6 +9,7 @@ import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE,
 import { editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
+import { loadProjectConfig, neonConfigFilename, projectConfigPath, projectDir } from "../project.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
 import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { writer } from "../writer.js";
@@ -24,10 +25,9 @@ import { zipBundle } from "../utils/zip.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
-import { homedir } from "node:os";
 import chalk from "chalk";
 import { packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
-import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, loadConfigFromFile as loadConfigFromFile$1, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
+import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
 //#region src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
 	ConfigInstallFailed: () => ConfigInstallFailed,
@@ -42,9 +42,7 @@ var config_exports = /* @__PURE__ */ __exportAll({
 	envFlag: () => envFlag,
 	envPullFlag: () => envPullFlag,
 	handler: () => handler,
-	hasNeonConfigFile: () => hasNeonConfigFile,
 	initCmd: () => initCmd,
-	neonConfigFilename: () => neonConfigFilename,
 	planCmd: () => planCmd,
 	status: () => status
 });
@@ -117,16 +115,6 @@ const DEPENDENCY_FIELDS = [
 	"peerDependencies",
 	"optionalDependencies"
 ];
-/** Config filenames the runtime loads (mirrors @neon/config's loader). */
-const NEON_CONFIG_FILENAMES = [
-	"neon.ts",
-	"neon.mts",
-	"neon.js",
-	"neon.mjs"
-];
-const neonConfigFilename = (dir) => NEON_CONFIG_FILENAMES.find((name) => existsSync(join(dir, name)));
-/** Whether `dir` already has a Neon config file the runtime would load. */
-const hasNeonConfigFile = (dir) => neonConfigFilename(dir) !== void 0;
 var ConfigInstallFailed = class extends Error {
 	constructor(command) {
 		super("Could not install the Neon dependencies.");
@@ -216,6 +204,14 @@ const seedFromBranch = async (props) => {
 		branchName: live.branch.name
 	};
 };
+/** The install command to print, prefixed with a `cd` when the project is not the cwd. */
+const installCommandFrom = (dir, pm, missing) => {
+	const command = formatInstallCommand(pm, [...missing]);
+	const rel = relative(process.cwd(), dir);
+	if (rel === "") return command;
+	const target = rel.length <= dir.length ? rel : dir;
+	return `cd ${shellQuote(target)} && ${command}`;
+};
 /** Install the config packages the project is missing, or say how to. */
 const ensureConfigPackages = async (cwd, props) => {
 	const run = props.run ?? runCommand;
@@ -226,16 +222,21 @@ const ensureConfigPackages = async (cwd, props) => {
 	}
 	const pm = props.packageManager ?? resolvePackageManager(cwd);
 	const args = installArgs(pm, missing);
+	const installHint = installCommandFrom(cwd, pm, missing);
 	if (props.install === false) {
-		if (!props.silent) log.info("Install the Neon config packages to use neon.ts: %s", formatInstallCommand(pm, missing));
+		if (!props.silent) log.info("Install the Neon config packages to use neon.ts: %s", installHint);
 		return;
 	}
+	const pkgPath = join(cwd, "package.json");
+	if (!existsSync(pkgPath)) {
+		writeFileSync(pkgPath, "{}\n");
+		if (!props.silent) log.info("Created package.json.");
+	}
 	ensureDirectoryGitignored(join(cwd, "node_modules"));
 	if (!props.silent) log.info("Installing %s with %s…", missing.join(", "), pm);
 	if (!await run(pm, args, cwd)) {
-		const command = formatInstallCommand(pm, missing);
-		if (props.requireInstall) throw new ConfigInstallFailed(command);
-		log.warning("Could not install the config packages automatically. Run by hand: %s", command);
+		if (props.requireInstall) throw new ConfigInstallFailed(installHint);
+		log.warning("Could not install the config packages automatically. Run by hand: %s", installHint);
 	}
 };
 /**
@@ -244,7 +245,7 @@ const ensureConfigPackages = async (cwd, props) => {
 * Local-only unless `--from-branch` is set (see {@link isConfigInit}).
 */
 const initCmd = async (props) => {
-	const cwd = props.cwd ?? process.cwd();
+	const cwd = props.cwd ?? projectDir(props.contextFile ? { contextFile: props.contextFile } : {});
 	const existing = neonConfigFilename(cwd);
 	if (existing) {
 		if (!props.silent) {
@@ -274,26 +275,11 @@ const initCmd = async (props) => {
 const FUNCTION_SLUG_PATTERN = /^[a-z0-9]{1,20}$/;
 const SCRIPT_EXTENSION = /\.(?:ts|mts|cts|js|mjs|cjs)$/;
 const TYPESCRIPT_EXTENSION = /\.(?:ts|mts|cts)$/;
-/**
-* The nearest neon.ts, found the way the config loader finds it: walk up from `start`, stop
-* at the first directory holding `.git` (or at the home directory).
-*/
-const findNeonConfigUpward = (start) => {
-	let dir = resolve(start);
-	for (;;) {
-		const name = neonConfigFilename(dir);
-		if (name) return join(dir, name);
-		if (existsSync(join(dir, ".git")) || dir === homedir()) return void 0;
-		const parent = dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-};
 const asRelativeModulePath = (path) => path.startsWith("./") || path.startsWith("../") || path.startsWith("/") ? path : `./${path}`;
 const shellQuote = (value) => /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
 /**
 * `explicitConfig` is the `--config` the user passed. The commands suggested afterwards must
-* carry it, or they would act on whichever `neon.ts` a walk up from cwd finds instead.
+* carry it, or they would act on the project directory's `neon.ts` instead.
 */
 const planAdd = (target, configPath, explicitConfig) => {
 	const language = TYPESCRIPT_EXTENSION.test(configPath) ? "ts" : "js";
@@ -346,12 +332,16 @@ const planAdd = (target, configPath, explicitConfig) => {
 */
 const addCmd = async (props) => {
 	const cwd = props.cwd ?? process.cwd();
+	const location = {
+		cwd,
+		...props.contextFile ? { contextFile: props.contextFile } : {}
+	};
 	let existing;
 	if (props.config) {
 		existing = resolve(cwd, props.config);
 		if (!existsSync(existing)) throw new Error(`--config ${props.config} does not exist.`);
-	} else existing = findNeonConfigUpward(cwd);
-	const configPath = existing ?? join(cwd, "neon.ts");
+	} else existing = projectConfigPath(location);
+	const configPath = existing ?? join(projectDir(location), "neon.ts");
 	const shown = (path) => relative(cwd, path) || path;
 	const plan = planAdd(props.target, configPath, props.config);
 	const { source, changes } = editNeonConfig(existing ? readFileSync(existing, "utf8") : renderNeonConfig([]), plan.edit);
@@ -385,7 +375,7 @@ const addSharedOptions = (yargs) => yargs.strict().options({
 	"project-id": { hidden: true },
 	branch: { hidden: true },
 	config: {
-		describe: "Path to the neon.ts to edit (defaults to walking up from cwd; created in cwd when there is none)",
+		describe: "Path to the neon.ts to edit (defaults to the neon.ts next to .neon, or in cwd without one; created there when missing)",
 		type: "string"
 	},
 	install: {
@@ -398,7 +388,8 @@ const addSharedOptions = (yargs) => yargs.strict().options({
 const addProps = (args, target) => ({
 	target,
 	install: args.install,
-	...args.config !== void 0 ? { config: args.config } : {}
+	...args.config !== void 0 ? { config: args.config } : {},
+	...args.contextFile !== void 0 ? { contextFile: args.contextFile } : {}
 });
 const command = "config";
 const describe = "Manage a branch with a neon.ts policy";
@@ -424,13 +415,13 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 	}
 }), (args) => status(args)).command("plan", "Show what `config apply` would change (dry run)", (yargs) => yargs.options({
 	config: {
-		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		describe: "Path to a neon.ts policy (defaults to the neon.ts next to .neon, or in cwd without one)",
 		type: "string"
 	},
 	...envFlag
 }), (args) => planCmd(args)).command("apply", "Apply a neon.ts policy to the branch", (yargs) => yargs.options({
 	config: {
-		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		describe: "Path to a neon.ts policy (defaults to the neon.ts next to .neon, or in cwd without one)",
 		type: "string"
 	},
 	...envFlag,
@@ -539,7 +530,10 @@ const loadEnvFileIfGiven = (env) => {
 };
 const loadConfig = async (props) => {
 	loadEnvFileIfGiven(props.env);
-	const { config } = await loadConfigFromFile$1({ ...props.config ? { path: props.config } : {} });
+	const { config } = await loadProjectConfig({
+		contextFile: props.contextFile,
+		...props.config ? { path: props.config } : {}
+	});
 	return config;
 };
 const status = async (props) => {
@@ -849,7 +843,10 @@ const applyPolicyOnCreate = async (props) => {
 	loadEnvFileIfGiven(props.env);
 	let config;
 	try {
-		({config} = await loadConfigFromFile$1({ ...props.cwd ? { cwd: props.cwd } : {} }));
+		({config} = await loadProjectConfig({
+			...props.cwd ? { cwd: props.cwd } : {},
+			...props.contextFile ? { contextFile: props.contextFile } : {}
+		}));
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (/Could not find a Neon config file/i.test(message)) return;
@@ -930,7 +927,10 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 	loadEnvFileIfGiven(props.env);
 	let config;
 	try {
-		({config} = await loadConfigFromFile$1({ ...props.cwd ? { cwd: props.cwd } : {} }));
+		({config} = await loadProjectConfig({
+			...props.cwd ? { cwd: props.cwd } : {},
+			...props.contextFile ? { contextFile: props.contextFile } : {}
+		}));
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (/Could not find a Neon config file/i.test(message)) return null;
@@ -983,4 +983,4 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 	}
 };
 //#endregion
-export { ConfigInstallFailed, addCmd, applyCmd, applyFlags, applyPolicyOnCreate, builder, command, createBranchFromPolicyOnCheckout, describe, envFlag, envPullFlag, handler, hasNeonConfigFile, initCmd, neonConfigFilename, planCmd, status, config_exports as t };
+export { ConfigInstallFailed, addCmd, applyCmd, applyFlags, applyPolicyOnCreate, builder, command, createBranchFromPolicyOnCheckout, describe, envFlag, envPullFlag, handler, initCmd, planCmd, status, config_exports as t };

package/dist/commands/deploy.js

@@ -21,7 +21,7 @@ const builder = (argv) => argv.usage("$0 deploy [options]").options({
 		type: "string"
 	},
 	config: {
-		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		describe: "Path to a neon.ts policy (defaults to the neon.ts next to .neon, or in cwd without one)",
 		type: "string"
 	},
 	...envFlag,

package/dist/commands/dev.js

@@ -6,7 +6,7 @@ import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-N19A7qND.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-CtOH9xsl.js";
+import { a as resolveDevEnv } from "../_chunks/env-BgiaRNT1.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -75,9 +75,13 @@ const builder = (argv) => argv.usage("$0 dev [--source <path>] [options]").examp
 *   reason; `dev` was the one that didn't.
 */
 const devEnvContext = (props, branchId, cwd) => {
-	const envFile = resolveEnvFilePath(cwd);
-	return {
+	const location = {
 		cwd,
+		...props.contextFile ? { contextFile: props.contextFile } : {}
+	};
+	const envFile = resolveEnvFilePath(location);
+	return {
+		...location,
 		implyAiGateway: true,
 		env: {
 			...process.env,
@@ -124,7 +128,7 @@ const runSingleSource = async (props) => {
 	const branchId = await resolveBranchId(props);
 	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
 	reportDevCredential(credential);
-	const match = await findConfigFunctionBySource(process.cwd(), source);
+	const match = await findConfigFunctionBySource(process.cwd(), source, props.contextFile);
 	const { overlay, port } = await sourceFunctionUrlOverlay(match, props.port);
 	const unit = {
 		slug: null,
@@ -148,7 +152,7 @@ const runSingleSource = async (props) => {
 */
 const runFromConfig = async (props) => {
 	const branchId = await resolveBranchId(props);
-	const resolved = await resolveFunctionsFromConfig(process.cwd());
+	const resolved = await resolveFunctionsFromConfig(process.cwd(), void 0, props.contextFile);
 	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `functions`.");
 	const { configPath, functions } = resolved;
 	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `functions`, or pass --source <path>.");
@@ -156,7 +160,7 @@ const runFromConfig = async (props) => {
 	reportDevCredential(credential);
 	const units = await planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);
 	const replan = async (searchBase, keepPorts) => {
-		const re = await resolveFunctionsFromConfig(process.cwd());
+		const re = await resolveFunctionsFromConfig(process.cwd(), void 0, props.contextFile);
 		if (re === null) return null;
 		return planFunctionsToUnits(re.functions, neonEnv, searchBase, keepPorts);
 	};

package/dist/commands/env.js

@@ -10,7 +10,7 @@ import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagV
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-CtOH9xsl.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BgiaRNT1.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -42,7 +42,7 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	}
 }).middleware(fillSingleProject).command("pull", "Write the branch's Neon env variables to a local .env file", (yargs) => yargs.usage("$0 env pull [options]").options({
 	file: {
-		describe: "Target .env file to write. Defaults to an existing .env, otherwise .env.local. Only Neon variables are updated; other lines are preserved.",
+		describe: "Target .env file to write, relative to cwd. Defaults to an existing .env, otherwise .env.local, in the project directory (next to .neon, or cwd without one). Only Neon variables are updated; other lines are preserved.",
 		type: "string"
 	},
 	service: servicesOption({
@@ -58,15 +58,16 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 		string: true
 	},
 	config: {
-		describe: "Path to a neon.ts policy (defaults to walking up from cwd)",
+		describe: "Path to a neon.ts policy (defaults to the neon.ts next to .neon, or in cwd without one)",
 		type: "string"
 	}
 }).epilogue([
 	"",
 	"What gets pulled, in precedence order:",
 	"  1. --service / --env, when given — their union, ignoring neon.ts.",
-	"  2. neon.ts, when this directory has one — including derived function",
-	"     URLs (the function does not have to be deployed).",
+	"  2. neon.ts, when the project directory (next to .neon, or cwd",
+	"     without one) has one — including derived function URLs (the",
+	"     function does not have to be deployed).",
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
 	"     which pulls the default AI Gateway credential.",
 	"",
@@ -135,11 +136,15 @@ const pull = async (props, opts = {}) => {
 	const branch = await resolveBranchRef(props);
 	if (opts.announce) announceTargetBranch(props, branch, "Pulling env from branch");
 	const branchId = branch.branchId;
-	const targetPath = resolveEnvFilePath(cwd, props.file);
+	const location = {
+		cwd,
+		contextFile: props.contextFile
+	};
+	const targetPath = resolveEnvFilePath(location, props.file);
 	const fileExisted = existsSync(targetPath);
 	const existingEnv = fileExisted ? readEnvFile(targetPath) : {};
 	const { vars, credential, skipped } = await resolveNeonEnvVars({
-		cwd,
+		...location,
 		projectId: props.projectId,
 		branchId,
 		env: {

package/dist/commands/init.js

@@ -17,7 +17,11 @@ var init_exports = /* @__PURE__ */ __exportAll({
 const command = "init";
 const describe = "Set up coding agents and this directory for Neon. -y is Recommended. -y with Custom flags applies those answers without prompts.";
 const removedProtocol = () => `\`${getCliName()} init --data\` was removed. Run \`${getCliName()} init\` or \`${getCliName()} init -y\`.`;
-const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file", { hidden: true }).option("yes", {
+const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file", {
+	hidden: true,
+	type: "string",
+	default: ".neon"
+}).option("yes", {
 	alias: "y",
 	type: "boolean",
 	default: false,

package/dist/commands/link.js

@@ -7,12 +7,13 @@ import "../config.js";
 import { applyContext, contextBranch, readContextFile, setContext, updateContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpEpilogue } from "../utils/help_text.js";
+import { hasNeonConfigFile, projectDir } from "../project.js";
 import { writer } from "../writer.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
 import { autoPullEnvAfterPin } from "./env.js";
-import { hasNeonConfigFile, initCmd } from "./config.js";
+import { initCmd } from "./config.js";
 import { REGIONS } from "./projects.js";
 import prompts from "prompts";
 //#region src/commands/link.ts
@@ -848,9 +849,12 @@ const finalizeInteractiveLink = async (props, summary) => {
 */
 const shouldOfferConfigInit = (input) => !input.hasConfig && input.offer;
 const maybeOfferConfigInit = async (props, summary) => {
-	const cwd = props.cwd ?? process.cwd();
+	const dir = projectDir({
+		...props.cwd ? { cwd: props.cwd } : {},
+		contextFile: props.contextFile
+	});
 	if (!shouldOfferConfigInit({
-		hasConfig: hasNeonConfigFile(cwd),
+		hasConfig: hasNeonConfigFile(dir),
 		offer: props.config !== false
 	})) return;
 	const { value } = await prompts({
@@ -862,14 +866,13 @@ const maybeOfferConfigInit = async (props, summary) => {
 	});
 	if (value !== true) return;
 	await initCmd({
-		cwd,
+		cwd: dir,
 		install: true
 	});
 	if (summary.branch && summary.projectId) {
 		const { config: _offerConfig, ...rest } = props;
 		await autoPullEnvAfterPin({
 			...rest,
-			cwd,
 			projectId: summary.projectId,
 			branch: summary.branch,
 			envPull: props.envPull

package/dist/commands/user.js

@@ -1,11 +1,14 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { getAuthContext } from "../auth_context.js";
 import { writer } from "../writer.js";
 //#region src/commands/user.ts
 var user_exports = /* @__PURE__ */ __exportAll({
+	authenticationLabel: () => authenticationLabel,
 	builder: () => builder,
 	command: () => "me",
 	describe: () => describe,
-	handler: () => handler
+	handler: () => handler,
+	userDetails: () => userDetails
 });
 const command = "me";
 const describe = "Show current user";
@@ -15,12 +18,42 @@ const handler = async (args) => {
 };
 const me = async (props) => {
 	const { data } = await props.apiClient.getCurrentUserInfo();
-	writer(props).end(data, { fields: [
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: [
+			"login",
+			"email",
+			"name",
+			"projects_limit"
+		] });
+		return;
+	}
+	writer(props).end(userDetails(data, getAuthContext()), { fields: [
 		"login",
 		"email",
 		"name",
-		"projects_limit"
+		"projects_limit",
+		"authentication"
 	] });
 };
+/** Table-only view; the field names become the row labels. */
+const userDetails = (user, auth) => ({
+	login: user.login,
+	email: user.email,
+	name: [user.name, user.last_name].filter(Boolean).join(" "),
+	projects_limit: user.projects_limit === 0 ? void 0 : user.projects_limit,
+	authentication: auth ? authenticationLabel(auth) : void 0
+});
+const authenticationLabel = (auth) => {
+	const profile = auth.profile ? ` (profile ${auth.profile})` : "";
+	switch (auth.source) {
+		case "stored-credentials": return `OAuth${profile}`;
+		case "profile-api-key": return `API key${profile}`;
+		case "api-key":
+			if (auth.apiKeyFrom === "flag") return "API key (--api-key)";
+			if (auth.apiKeyFrom === "env") return "API key (NEON_API_KEY)";
+			return "API key";
+		case "claimable": return "Claimable project";
+	}
+};
 //#endregion
-export { builder, command, describe, handler, user_exports as t };
+export { authenticationLabel, builder, command, describe, handler, user_exports as t, userDetails };

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-CtOH9xsl.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-BgiaRNT1.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/dev/functions.js

@@ -1,6 +1,7 @@
+import { loadProjectConfig } from "../project.js";
 import { existsSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
-import { loadConfigFromFile, resolveConfig } from "@neon/config";
+import { resolveConfig } from "@neon/config";
 //#region src/dev/functions.ts
 /**
 * Load `neon.ts` (if any) and resolve the list of functions it declares into
@@ -11,8 +12,8 @@ import { loadConfigFromFile, resolveConfig } from "@neon/config";
 * `branchName` is used only to evaluate a policy that switches on `branch.name`; the
 * function list is otherwise branch-independent, so a placeholder is fine when unknown.
 */
-const resolveFunctionsFromConfig = async (cwd, branchName) => {
-	const loaded = await loadNeonConfig(cwd);
+const resolveFunctionsFromConfig = async (cwd, branchName, contextFile) => {
+	const loaded = await loadNeonConfig(cwd, contextFile);
 	if (!loaded) return null;
 	const { config, configDir, configPath } = loaded;
 	return {
@@ -31,8 +32,8 @@ const resolveFunctionsFromConfig = async (cwd, branchName) => {
 * The neon.ts function whose `source` is this file, if any. Sibling sources are not
 * required to exist: `neon dev --source` is serving one file, not the whole set.
 */
-const findConfigFunctionBySource = async (cwd, source) => {
-	const loaded = await loadNeonConfig(cwd);
+const findConfigFunctionBySource = async (cwd, source, contextFile) => {
+	const loaded = await loadNeonConfig(cwd, contextFile);
 	if (!loaded) return void 0;
 	return (resolveConfig(loaded.config, {
 		name: "local",
@@ -63,9 +64,12 @@ const devPort = (dev) => dev?.port;
 * to resolve each function's relative `source`). Returns `null` when no config file is
 * found; surfaces real load errors (e.g. a syntax error).
 */
-const loadNeonConfig = async (cwd) => {
+const loadNeonConfig = async (cwd, contextFile) => {
 	try {
-		const { config, resolvedPath } = await loadConfigFromFile({ cwd });
+		const { config, resolvedPath } = await loadProjectConfig({
+			cwd,
+			...contextFile ? { contextFile } : {}
+		});
 		return {
 			config,
 			configDir: dirname(resolvedPath),

package/dist/env_file.js

@@ -1,15 +1,18 @@
+import { projectDir } from "./project.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/env_file.ts
 /**
-* Default dotenv file `env pull` writes to: `.env` when one already exists in the working
+* Default dotenv file `env pull` writes to: `.env` when one already exists in the project
 * directory (update where secrets already live), otherwise `.env.local` — matching the
-* `vercel env pull` convention. An explicit `--file` always wins over this.
+* `vercel env pull` convention. An explicit `--file` always wins over this and is
+* relative to `cwd`.
 */
-const resolveEnvFilePath = (cwd, file) => {
-	if (file) return resolve(cwd, file);
-	if (existsSync(join(cwd, ".env"))) return join(cwd, ".env");
-	return join(cwd, ".env.local");
+const resolveEnvFilePath = (location, file) => {
+	if (file) return resolve(location.cwd, file);
+	const dir = projectDir(location);
+	if (existsSync(join(dir, ".env"))) return join(dir, ".env");
+	return join(dir, ".env.local");
 };
 /**
 * Merge `updates` into the dotenv content at `path`, preserving every other line

package/dist/init/run.js

@@ -8,6 +8,7 @@ import { readLinkedClaimableCredentials } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue } from "../neon_services.js";
 import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE } from "../config_template.js";
+import { hasNeonConfigFile, neonConfigFilename } from "../project.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
 import { mcpInstallableAgents } from "../mcp/targets.js";
 import { missingPluginsCommands, pluginsInstallableAgents } from "../plugins/targets.js";
@@ -16,7 +17,7 @@ import { FALLBACK_SKILLS_AGENTS, assertNamedAgentTooling, funnelAgentSetup, plan
 import { inferPackageManager, resolvePackageManager } from "../utils/package_manager.js";
 import { CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, YES_LINK_NEEDS_AUTH, claimableNext, claimableThenServicesNext, envPullFailedNext, existingConfigNext, extraServicesNext, installFailedNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, namedAgentsUnavailable, skippedLinkNext, unattendedUnauthedNext } from "./copy.js";
 import { agentsRowValue, configRowValue, formatInitDone, headingForKind, printInitBanner, printInitDone, printInitProgress, projectRowValue, shouldPrintInitBanner } from "./chrome.js";
-import { ConfigInstallFailed, hasNeonConfigFile, initCmd, neonConfigFilename } from "../commands/config.js";
+import { ConfigInstallFailed, initCmd } from "../commands/config.js";
 import { runAuthenticatedLink } from "./link.js";
 import { pullInitEnv } from "./auth.js";
 import { InitCancelled, raceSigint, restoreCursor } from "./cancelled.js";

package/dist/project.js

@@ -0,0 +1,49 @@
+import { currentContextFile } from "./context.js";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { ConfigLoadError, loadConfigFromFile } from "@neon/config";
+//#region src/project.ts
+/** Config filenames the runtime loads (mirrors @neon/config's loader). */
+const NEON_CONFIG_FILENAMES = [
+	"neon.ts",
+	"neon.mts",
+	"neon.js",
+	"neon.mjs"
+];
+const neonConfigFilename = (dir) => NEON_CONFIG_FILENAMES.find((name) => existsSync(join(dir, name)));
+/** Whether `dir` already has a Neon config file the runtime would load. */
+const hasNeonConfigFile = (dir) => neonConfigFilename(dir) !== void 0;
+/**
+* The project a command acts on: the directory holding its `.neon` (the nearest one at or
+* above cwd unless `--context-file` says otherwise), else cwd. Its `neon.ts` and default
+* `.env.local` live there and nowhere else, so a stray file in a parent directory never
+* applies.
+*/
+const projectDir = ({ cwd = process.cwd(), contextFile } = {}) => dirname(contextFile ? resolve(cwd, contextFile) : currentContextFile(cwd));
+/** Absolute path of the project's `neon.ts` (or other supported extension), if any. */
+const projectConfigPath = (location = {}) => {
+	const dir = projectDir(location);
+	const name = neonConfigFilename(dir);
+	return name === void 0 ? void 0 : join(dir, name);
+};
+/**
+* Load the project's Neon config. An explicit `path` (`--config`) wins; otherwise only
+* {@link projectDir} is checked. Callers match "Could not find a Neon config file" to tell
+* a missing config from a broken one.
+*/
+const loadProjectConfig = async (options) => {
+	const { cwd, unsetFunctionEnv } = options;
+	const path = options.path ?? projectConfigPath(options);
+	if (path === void 0) throw new ConfigLoadError([
+		`Could not find a Neon config file in ${projectDir(options)}.`,
+		`Looked for: ${NEON_CONFIG_FILENAMES.join(", ")} next to the project's .neon (or in the current directory when there is no .neon).`,
+		"Create one with `neon config init`, or pass `--config <path>`."
+	].join("\n"));
+	return await loadConfigFromFile({
+		path,
+		...cwd !== void 0 ? { cwd } : {},
+		...unsetFunctionEnv !== void 0 ? { unsetFunctionEnv } : {}
+	});
+};
+//#endregion
+export { hasNeonConfigFile, loadProjectConfig, neonConfigFilename, projectConfigPath, projectDir };

package/dist/utils/hooks.js

@@ -1,6 +1,7 @@
 import { log } from "../log.js";
+import { loadProjectConfig } from "../project.js";
 import { s as fetchEnvKeys } from "../_chunks/env-N19A7qND.js";
-import { loadConfigFromFile, runHook } from "@neon/config-runtime";
+import { runHook } from "@neon/config-runtime";
 //#region src/utils/hooks.ts
 /**
 * Load the nearest `neon.ts` for hook discovery, or `undefined` when there is none — or when
@@ -13,9 +14,12 @@ import { loadConfigFromFile, runHook } from "@neon/config-runtime";
 * `.experimental?.hooks` off the result for the hooks block, and pass the whole thing to
 * {@link resolveHookEnv} so `after` hooks resolve exactly the namespaces the policy declares.
 */
-const loadHookConfig = async (cwd) => {
+const loadHookConfig = async (cwd, contextFile) => {
 	try {
-		const { config } = await loadConfigFromFile({ cwd });
+		const { config } = await loadProjectConfig({
+			cwd,
+			...contextFile ? { contextFile } : {}
+		});
 		return config;
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "7.0.8",
+  "version": "8.0.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -64,9 +64,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
+    "@neon/sdk": "7.0.0",
     "@neon/config-runtime": "1.7.3",
-    "@neon/config": "1.8.3",
-    "@neon/sdk": "7.0.0"
+    "@neon/config": "1.8.3"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -99,10 +99,10 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
+    "@neon-internals/cli-core": "0.0.0",
     "@neon-internals/env-core": "0.0.26",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/functions": "0.11.0",
-    "@neon-internals/cli-core": "0.0.0"
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",