neon 8.0.12 → 8.2.0

package/README.md

@@ -63,10 +63,10 @@ leaves `neon` running the other install, such as npm. While duplicates remain, t
 Run the following command to authenticate a connection to Neon:
 
 ```bash
-neon auth
+neon login
 ```
 
-The `auth` command launches a browser window where you can authorize the Neon CLI to access your Neon account. Running a Neon CLI command without authenticating with [neon auth](https://neon.com/docs/cli/auth) automatically launches the browser authentication process.
+`neon auth` is an alias of `neon login`. The `login` command launches a browser window where you can authorize the Neon CLI to access your Neon account. Running a Neon CLI command without authenticating with [neon login](https://neon.com/docs/cli/auth) automatically launches the browser authentication process, except for `neon me`, which reports that you are not signed in.
 
 Alternatively, you can authenticate a connection with a Neon API key using the `--api-key` option when running a Neon CLI command. For example, an API key is used with the following `neon projects list` command:
 
@@ -76,7 +76,7 @@ neon projects list --api-key <neon_api_key>
 
 For information about obtaining an Neon API key, see [Authentication](https://neon.com/docs/reference/api/get-started), in the _Neon API Reference_.
 
-To check which account and credential a command uses, run `neon me` with the same `--profile` or `--api-key` option and environment as that command. The `Authentication` row names the source, such as `OAuth (profile DEFAULT)`, `API key (profile work)`, `API key (--api-key)`, or `API key (NEON_API_KEY)`.
+To check which account and credential a command uses, run `neon me` with the same `--profile` or `--api-key` option and environment as that command. The `Authentication` row names the source, such as `OAuth (profile DEFAULT)`, `API key (profile work)`, `API key (--api-key)`, or `API key (NEON_API_KEY)`. When no credential is usable, `neon me` exits 1 with `Not signed in` and the `neon login` command to run; it never starts a sign-in itself.
 
 ## Create a project without an account
 
@@ -474,11 +474,11 @@ The resolved branch is then written (by name) to the same `.neon` file `link` us
 
 ```bash
 $ neon checkout main --project-id polished-snowflake-12345678
-INFO: Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
 $ neon checkout dev --create --project-id polished-snowflake-12345678
-INFO: Created branch dev (br-dev-branch-12345678).
-INFO: Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+Created branch dev (br-dev-branch-12345678).
+Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
 $ cat .neon
 {
@@ -658,13 +658,15 @@ neon config init --services data-api
 # Repeat the flag instead, and shorten it — every services flag takes all three spellings
 neon config init -s auth -s functions
 
-# Explicitly ask for the bare starter policy
-neon config init --services none
+# Postgres only: the starter policy, with no prompt
+neon config init --services postgres
 
 # Scaffold but print the install command instead of running it
 neon config init --no-install
 ```
 
+`postgres` declares nothing, since every branch has Postgres, so it can stand alone or sit next to other services. `neon init --services` takes the same values.
+
 Object storage is spelled `object-storage` here, matching [`env pull --service`](#env-pull) and the rest of the CLI. The old `storage` still works and warns; it will be removed.
 
 Choosing **Functions** also writes the handler the policy points at, since `source` is only resolved when `apply` bundles it — a declared function with no file on disk fails at deploy:
@@ -696,9 +698,9 @@ Each command prints what it changed and the next step:
 
 ```
 $ neon config add function sendemail
-INFO: Created functions/sendemail.ts.
-INFO: Updated neon.ts: added functions.sendemail.
-INFO: Next: `neon dev` to run it locally, `neon config apply` to deploy.
+Created functions/sendemail.ts.
+Updated neon.ts: added functions.sendemail.
+Next: `neon dev` to run it locally, `neon config apply` to deploy.
 ```
 
 - **Functions** take a slug of 1-20 lowercase letters and digits, the same rule `plan` enforces. The handler file is written first and an existing file is never overwritten, so pointing `--source` at code you already have works. A `.js` `neon.ts` gets a `.js` handler.
@@ -738,12 +740,18 @@ neon deploy
 
 The branch is chosen with `--branch <id|name>`; without it the project's default branch is used. The policy is the `neon.ts` in the project directory (next to `.neon`, or the current directory without one); pass `--config <path>` to point at another file.
 
-**Apply-only flags** (also available on `deploy`):
+**Confirmations** (also on `deploy`). Two things need a yes before `apply` changes anything: applying to a branch Neon marks as protected, and overriding settings the branch already has (compute, TTL, `protected`, Data API settings, custom-domain targets, and disabling an existing Data API). Adding services and deploying functions is not an override, so on an unprotected branch it never asks. In a terminal, `apply` shows the settings it would override and asks once, default No. Without a terminal (CI, agents, pipes) or with `-o json|yaml`, it exits 1 before changing anything and names the flag to pass:
+
+- `--update-existing` — override settings that differ from `neon.ts`.
+- `--allow-protected` — apply to a protected branch.
+- `-y`, `--yes` — both.
 
-- `--update-existing` — auto-confirm overriding existing remote settings on the branch. Without it, drift on settings already present remotely (compute, TTL, `protected`) is reported as a **conflict** and `apply` makes no changes until you resolve it or pass this flag.
-- `--allow-protected` — auto-confirm applying to a branch Neon marks as protected. Without it, `apply` refuses to touch a protected branch.
+```bash
+neon deploy --env .env.prod --allow-protected   # production main is protected, no drift expected
+neon deploy -y                                   # protected branch and drift, no questions
+```
 
-**Output**: `status` prints the project, branch, and reverse-engineered config. `plan` / `apply` render a **`git diff`-style report** (matching [`neon diff`](#diff)): service changes (Neon Auth, Data API, buckets, functions) list as green `+` additions, while **branch setting changes** (TTL, `protected`, compute) show grouped under a `~ <branch>` header, one sorted `field → value` line each. A bare `apply` that hits drift on settings already present remotely prints those as a sorted **before→after** diff (`current → desired`, old in red / new in green) and exits non-zero until you pass `--update-existing`. Pass `--output json` (or `--output yaml`) to emit the full machine-readable result (`PushResult`) instead, for piping into other tools or CI.
+**Output**: `status` prints the project, branch, and reverse-engineered config. `plan` / `apply` render a **`git diff`-style report** (matching [`neon diff`](#diff)): service changes (Neon Auth, Data API, buckets, functions) list as green `+` additions, while **branch setting changes** (TTL, `protected`, compute) show grouped under a `~ <branch>` header, one sorted `field → value` line each. When `apply` would override settings already present remotely, it prints them as a sorted **before→after** diff (`current → desired`, old in red / new in green) before asking or, without a terminal, before exiting non-zero. Pass `--output json` (or `--output yaml`) to emit the full machine-readable result (`PushResult`) instead, for piping into other tools or CI.
 
 **`config status --current-branch`** (alias `neon status --current-branch`) prints _only_ the branch pinned in the local `.neon` file — no network, no auth, no analytics — and exits non-zero when none is pinned. This behavior lets it safely drive a shell prompt. Example [starship](https://starship.rs) segment:
 
@@ -831,7 +839,7 @@ The target directory must be empty unless you pass `--force` (a lone `.git` is i
 
 Recommended installs the Neon plugin for every detected agent (global config, project folders, and the host CLI). Plugin-capable agents get the plugin; the rest get skills and MCP. If none are detected, it installs the default Neon skills for Cursor and Codex in this directory (`./.agents/skills`) and does not configure MCP. It then links a project when the CLI is authenticated, and writes a default `neon.ts` (Postgres only) using the package manager already in the directory.
 
-Unauthenticated `-y` skips linking and prints the next step: sign up at https://neon.com/signup, then `neon auth`, `neon link`, or `neon claim create` (no account, expires in 72 hours unless claimed). `-y` never opens a browser. `-y` with `--project-id` or other account flags links when the CLI is already signed in; otherwise it errors and names `neon auth` or `--claimable`.
+Unauthenticated `-y` skips linking and prints the next step: sign up at https://neon.com/signup, then `neon login`, `neon link`, or `neon claim create` (no account, expires in 72 hours unless claimed). `-y` never opens a browser. `-y` with `--project-id` or other account flags links when the CLI is already signed in; otherwise it errors and names `neon login` or `--claimable`.
 
 Custom asks how to add Neon to coding agents (plugin, skills and MCP separately, or skip), then how to get a project (sign in and link, or a claimable project when you are not signed in), then which services `neon.ts` should declare. Skills and MCP use separate agent pickers, and either can be skipped. Postgres is listed first as always included. The package manager is inferred from the directory; Custom asks only when none is detected. `--skill` selects skills (not the plugin) and skips that picker. MCP flags (`--mcp-config-location`, `--mcp-auth`, `--mcp-project-scoped`) select skills and MCP. `--mcp-config-location` is where the config is written: `global` maps to `neon mcp`, and `project` maps to `neon mcp --project`. With `-y`, the location defaults to `global`; interactive Custom asks. If some selected agents cannot write that location, init warns and skips MCP for those agents while continuing with the supported agents. It fails when none of the selected agents support the location. `--mcp-project-scoped` limits MCP tools to the linked Neon project by passing its ID to `neon mcp --project-id`. Omitted is false, including in Custom; there is no prompt. `--no-agent-setup` skips agent setup.
 
@@ -1198,18 +1206,18 @@ Credential Manager, Linux Secret Service) only when its `profiles.json` pointer
 That is per profile. Reads never migrate.
 
 ```bash
-neon auth --keyring                         # sign DEFAULT into the OS keyring
-neon auth --keyring --profile work          # sign work into the OS keyring
+neon login --keyring                         # sign DEFAULT into the OS keyring
+neon login --keyring --profile work          # sign work into the OS keyring
 neon profile create work --keyring          # create a named profile in the keyring
 neon profile remove work --yes              # drop a keyring profile, then create it again as a file
 ```
 
-File to keyring is `neon auth --keyring` or `neon profile create … --keyring`: a new
+File to keyring is `neon login --keyring` or `neon profile create … --keyring`: a new
 sign-in, then the previous credential is revoked and the owned file is deleted.
-`create` on an existing name always revokes after a successful write. `auth` revokes
+`create` on an existing name always revokes after a successful write. `login` revokes
 when it writes to the keyring, including a re-login that follows an existing pointer.
-`auth` that overwrites a file does not. Keyring to file is `remove`, then create or
-auth again. `create` and `auth` without `--keyring` follow an existing `"keyring"`
+`login` that overwrites a file does not. Keyring to file is `remove`, then create or
+log in again. `create` and `login` without `--keyring` follow an existing `"keyring"`
 pointer, so a keyring profile cannot leave the OS store until `remove` succeeds.
 
 `--api-key` and `NEON_API_KEY` skip both stores. A GitHub-release `neon-<platform>`
@@ -1218,7 +1226,7 @@ Use the npm-installed `neon`. Older releases treat the sentinel as a relative pa
 
 A `"keyring"` pointer whose OS item cannot be read is not treated as signed-out. Commands that
 would otherwise open a browser fail: could not read the OS keyring item. Unlock it and
-retry, or run `neon auth --profile DEFAULT`. To reset the profile: `neon profile remove DEFAULT --yes`.
+retry, or run `neon login --profile DEFAULT`. To reset the profile: `neon profile remove DEFAULT --yes`.
 A missing `credentials.json` with no `profiles.json` is still
 signed-out, and those commands start OAuth.
 
@@ -1258,7 +1266,7 @@ the key never leaves the CLI.
 **A profile is one kind or the other, never both.** `type` in the credentials file states which:
 
 ```json
-// oauth: what a plain `create` (or `neon auth --profile`) writes. An absent `type` means this.
+// oauth: what a plain `create` (or `neon login --profile`) writes. An absent `type` means this.
 { "access_token": "…", "refresh_token": "…", "expires_at": 1786…, "user_id": "…" }
 
 // api_key: what `--api-key` writes
@@ -1299,7 +1307,7 @@ Passing both flags fails rather than picking a winner: `--api-key` supplies a cr
 
 When both are only environment variables the key wins, which keeps a CI pipeline that injects `NEON_API_KEY` working even if a `NEON_PROFILE` leaks into the environment — but the disregarded profile is named on stderr rather than passed over silently.
 
-`neon auth` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon auth --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
+`neon login` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon login --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
 
 `neon init` forwards `--profile` and `--config-dir` to agent and config children and uses them directly for its link flow. An explicit `--api-key` is passed to authenticated children through `NEON_API_KEY`, not argv.
 
@@ -1341,7 +1349,7 @@ Project  proj-in-org
 
 napi_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 WARNING: Store this key now: it is not shown again.
-INFO: Limited to proj-in-org: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.
+Limited to proj-in-org: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.
 ```
 
 `--org-id` and `--project-id` are mutually exclusive. A project-scoped key *is* an organization key, and its organization is looked up from the project rather than chosen separately. With neither flag you get an account key.
@@ -1387,7 +1395,7 @@ Id   Name      Project         Created At            Last Used At          Last
 
 | Command                                                                    | Subcommands                                                                                                  | Description                        |
 | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------- |
-| [auth](https://neon.com/docs/reference/cli-auth)                           |                                                                                                              | Authenticate                       |
+| [login](https://neon.com/docs/reference/cli-auth) (`auth`)                 |                                                                                                              | Authenticate                       |
 | claim (`claimable`)                                                        | `create`, `status`, `accept`, `list`, `delete`                                                               | Manage claimable projects          |
 | profile                                                                    | `list`, `create`, `rotate-key`, `remove`                                                                     | Manage named sets of credentials   |
 | api-keys                                                                   | `list`, `create`, `revoke`                                                                                   | Manage API keys                    |
@@ -1449,7 +1457,7 @@ Global options are supported with any Neon CLI command.
 
 - <a id="config-dir"></a>`--config-dir`
 
-  Specifies the path to the `neon` configuration directory, which holds the `credentials.json` written by `neon auth` and, when a second profile exists or DEFAULT is keyring, `profiles.json`. The default is `$XDG_CONFIG_HOME/neon`, or `~/.config/neon`; run `neon --help` to see the resolved path. This option is only necessary if you keep your configuration somewhere else.
+  Specifies the path to the `neon` configuration directory, which holds the `credentials.json` written by `neon login` and, when a second profile exists or DEFAULT is keyring, `profiles.json`. The default is `$XDG_CONFIG_HOME/neon`, or `~/.config/neon`; run `neon --help` to see the resolved path. This option is only necessary if you keep your configuration somewhere else.
 
   The directory was called `neonctl` before the CLI was renamed. An existing one is still read, and is used **in place** — nothing is moved or copied, so there is never a second credentials file to go stale. A directory you pass explicitly is used exactly as given and never falls back to the legacy name, so pointing a CI run at a scratch directory cannot pick up local credentials.
 
@@ -1462,7 +1470,7 @@ Global options are supported with any Neon CLI command.
   Selects a named set of credentials, for holding more than one Neon account at a time. A profile is a pointer to a credentials file, recorded in `profiles.json` next to it.
 
   ```bash
-  neon auth --profile work        # create it, or sign in again
+  neon login --profile work        # create it, or sign in again
   neon profile list               # names, accounts, and where each one's credentials live
   neon projects list --profile work
   NEON_PROFILE=work neon projects list
@@ -1472,7 +1480,7 @@ Global options are supported with any Neon CLI command.
 
 - <a id="api-key"></a>`--api-key`
 
-  Specifies your Neon API key. You can authenticate using a Neon API key when running a Neon CLI command instead of using `neon auth`. For information about obtaining an Neon API key, see [Authentication](https://neon.com/docs/reference/api/get-started), in the _Neon API Reference_.
+  Specifies your Neon API key. You can authenticate using a Neon API key when running a Neon CLI command instead of using `neon login`. For information about obtaining an Neon API key, see [Authentication](https://neon.com/docs/reference/api/get-started), in the _Neon API Reference_.
 
   ```bash
   neon <command> --api-key <neon_api_key>

package/dist/_chunks/{auth_selection-pitMFzDe.js → auth_selection-YX5_KZgD.js}

@@ -1,4 +1,4 @@
-import "./profiles-CvnFEQyd.js";
+import "./profiles-DIB1av2Q.js";
 //#region ../../internals/cli-core/dist/auth_selection.js
 /**
 * # Which credential an invocation authenticates with
@@ -32,8 +32,8 @@ import "./profiles-CvnFEQyd.js";
 * the environment. It warns instead of staying silent, because a disregarded account
 * selection is precisely what nobody noticed last time.
 *
-* `auth` and the `profile` subcommands do not use any of this. They read the same flags with
-* different meanings — `neon auth --profile work` names where to *write* a credential, and
+* `login` and the `profile` subcommands do not use any of this. They read the same flags with
+* different meanings — `neon login --profile work` names where to *write* a credential, and
 * `neon profile create work --api-key …` names one to *store* — so their callers skip
 * selection entirely rather than passing exemptions down here.
 */

package/dist/_chunks/{credential_io-D8AR-jvB.js → credential_io-ByNuojoE.js}

@@ -1,6 +1,6 @@
 import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
 import { a as isOwnedCredentialPath } from "./paths-DMq0Lt7a.js";
-import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-CvnFEQyd.js";
+import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-DIB1av2Q.js";
 import { tryLoadKeyring } from "../keyring.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname } from "node:path";
@@ -202,7 +202,7 @@ var KeyringUnavailableError = class extends Error {
 };
 var KeyringUnreadableError = class extends Error {
 	constructor(profile) {
-		const replace = `\`neon auth --profile ${profile}\``;
+		const replace = `\`neon login --profile ${profile}\``;
 		super(`Could not read the OS keyring item for profile "${profile}". Unlock the keyring and retry, or run ${replace}. To reset the profile: \`neon profile remove ${profile} --yes\`.`);
 		this.name = "KeyringUnreadableError";
 	}

package/dist/_chunks/{profiles-CvnFEQyd.js → profiles-DIB1av2Q.js}

@@ -82,7 +82,7 @@ const inspectProfiles = (dir) => {
 *
 * A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
 * worst case is a named profile turning up missing, which is recoverable — whereas throwing
-* would lock the user out of `neon auth` itself. Writing is the opposite: see
+* would lock the user out of `neon login` itself. Writing is the opposite: see
 * {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
 */
 const readProfiles = (dir, onWarn = () => {}) => {
@@ -96,7 +96,7 @@ const readProfiles = (dir, onWarn = () => {}) => {
 *
 * Call this **before** anything that writes a credential, opens a browser, or spends an API
 * call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
-* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
+* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon login
 * --profile` has already signed in over it — a refusal that arrives after the destruction it
 * exists to prevent. The path resolution itself is the unsound part, since with the metadata
 * unreadable the conventional filename is a guess about which account that file belongs to.

package/dist/_shared/auth_selection.js

@@ -32,8 +32,8 @@ import "./profiles.js";
 * the environment. It warns instead of staying silent, because a disregarded account
 * selection is precisely what nobody noticed last time.
 *
-* `auth` and the `profile` subcommands do not use any of this. They read the same flags with
-* different meanings — `neon auth --profile work` names where to *write* a credential, and
+* `login` and the `profile` subcommands do not use any of this. They read the same flags with
+* different meanings — `neon login --profile work` names where to *write* a credential, and
 * `neon profile create work --api-key …` names one to *store* — so their callers skip
 * selection entirely rather than passing exemptions down here.
 */

package/dist/_shared/profiles.js

@@ -13,7 +13,7 @@ import { isAbsolute, relative, resolve } from "node:path";
 * ```
 * ~/.config/neon/
 * ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
-* ├── credentials.work.json     # created by `neon auth --profile work`
+* ├── credentials.work.json     # created by `neon login --profile work`
 * └── profiles.json             # created only once a second profile exists
 * ```
 *
@@ -105,7 +105,7 @@ const inspectProfiles = (dir) => {
 *
 * A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
 * worst case is a named profile turning up missing, which is recoverable — whereas throwing
-* would lock the user out of `neon auth` itself. Writing is the opposite: see
+* would lock the user out of `neon login` itself. Writing is the opposite: see
 * {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
 */
 const readProfiles = (dir, onWarn = () => {}) => {
@@ -119,7 +119,7 @@ const readProfiles = (dir, onWarn = () => {}) => {
 *
 * Call this **before** anything that writes a credential, opens a browser, or spends an API
 * call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
-* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
+* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon login
 * --profile` has already signed in over it — a refusal that arrives after the destruction it
 * exists to prevent. The path resolution itself is the unsound part, since with the metadata
 * unreadable the conventional filename is a guess about which account that file belongs to.

package/dist/analytics.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";

package/dist/auth_context.js

@@ -31,8 +31,8 @@ const authFailureMessage = (context) => {
 	if (context?.source === "profile-api-key") return `Authentication failed: the Neon API rejected profile "${profile}"'s API key${where}. Replace it with \`neon profile create ${profile} --mint\`, or store another with \`neon profile create ${profile} --api-key -\`.`;
 	if (context?.source === "claimable") return `Authentication failed: Claimable Neon rejected the linked project's short-lived access token${where}. Retry the command to exchange the saved identity assertion again; if it still fails, run \`neon claim status\`.`;
 	if (context?.source === "stored-credentials") {
-		if (context.storage === "keyring") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session (OS keyring). Sign in again with \`neon auth --profile ${profile}\`.`;
-		return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. Sign in again with \`neon auth --profile ${profile}\`.`;
+		if (context.storage === "keyring") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session (OS keyring). Sign in again with \`neon login --profile ${profile}\`.`;
+		return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. Sign in again with \`neon login --profile ${profile}\`.`;
 	}
 	return "Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.";
 };

package/dist/auth_recovery.js

@@ -1,4 +1,4 @@
-import { t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
+import { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
 import { log } from "./log.js";
 import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { AuthRefreshError } from "./auth.js";
@@ -49,7 +49,7 @@ const recoverFrom401 = async (canRetry) => {
 	} catch (err) {
 		if (err instanceof AuthRefreshError) {
 			log.error(err.message);
-			if (err.terminal) log.error(`Run \`neon auth --profile ${context.profile ?? "DEFAULT"}\` to sign in again.`);
+			if (err.terminal) log.error(`Run \`neon login --profile ${context.profile ?? "DEFAULT"}\` to sign in again.`);
 			return false;
 		}
 		log.debug("Refresh after 401 failed: %s", err instanceof Error ? err.message : "unknown error");

package/dist/commands/api_keys.js

@@ -242,7 +242,7 @@ const withdraw = async (props, orgId, keyId) => {
 		const { data } = orgId ? await props.apiClient.revokeOrgApiKey(orgId, keyId) : await props.apiClient.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/commands/auth.js

@@ -1,15 +1,15 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-D8AR-jvB.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
 import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
+import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { withExclusiveLock } from "../refresh_lock.js";
@@ -45,8 +45,8 @@ const locationForAuth = (configDir, name, keyring, options = {}) => {
 	if (options.create === true) return newProfileLocation(configDir, name, "file");
 	return locationForName(configDir, name);
 };
-const command = "auth";
-const aliases = ["login"];
+const command = "login";
+const aliases = ["auth"];
 const describe = "Sign in with a browser. See --help for API keys and profiles";
 const wrapAuthHelp = (text) => wrapHelpText(text, helpWidth());
 const authHelpEpilogue = () => {
@@ -54,9 +54,9 @@ const authHelpEpilogue = () => {
 	return helpEpilogue(wrapAuthHelp("Non-interactive (CI, scripts, agents):"), wrapAuthHelp("Use an existing API key or an API-key profile."), `  ${cli} projects list --profile agent`, wrapAuthHelp(`${cli} profile create <name> --mint needs a browser during setup, then stores an API key and drops the session. It cannot run in CI. Default key is account-wide; --org-id or --project-id (not both) restricts it.`), wrapAuthHelp(`A profile holds a browser session or an API key. Select it with --profile <name> or NEON_PROFILE. List profiles with ${cli} profile list.`), wrapAuthHelp("On commands that use a credential, --api-key or --profile overrides NEON_API_KEY and NEON_PROFILE. Pass either --api-key or --profile, not both. When neither flag is passed and both NEON_API_KEY and NEON_PROFILE are set, the key wins and stderr names the ignored profile. When no flag or environment variable selects a credential, DEFAULT is used."), wrapAuthHelp(`${cli} profile create <name> replaces an existing profile of that name and tries to revoke the credential it held. An imported key with no recorded id stays live. Pick a new name to keep the old profile.`), wrapAuthHelp(`See ${cli} profile --help and ${cli} profile create --help.`));
 };
 const builder = (yargs) => yargs.option("context-file", { hidden: true }).option("keyring", {
-	describe: "Store the credential in the OS keyring. Per profile; later auth without the flag stays there. See `neon profile list`.",
+	describe: "Store the credential in the OS keyring. Per profile; a later login without the flag stays there. See `neon profile list`.",
 	type: "boolean"
-}).example("$0 auth", "Sign in with a browser").example("$0 auth --profile work", "Save a browser session in profile work").example("$0 projects list --api-key \"$KEY\"", "Use an existing API key for this command").example("NEON_API_KEY=\"$KEY\" $0 projects list", "Use an existing API key from the environment").example("$0 profile create agent --api-key \"$KEY\"", "Store an existing API key").example("echo \"$KEY\" | $0 profile create agent --api-key -", "Store a key read from stdin").example("$0 profile create ci --mint", "Sign in once in a browser and store a new API key").epilogue(authHelpEpilogue());
+}).example("$0 login", "Sign in with a browser").example("$0 login --profile work", "Save a browser session in profile work").example("$0 projects list --api-key \"$KEY\"", "Use an existing API key for this command").example("NEON_API_KEY=\"$KEY\" $0 projects list", "Use an existing API key from the environment").example("$0 profile create agent --api-key \"$KEY\"", "Store an existing API key").example("echo \"$KEY\" | $0 profile create agent --api-key -", "Store a key read from stdin").example("$0 profile create ci --mint", "Sign in once in a browser and store a new API key").epilogue(authHelpEpilogue());
 const handler = async (args) => {
 	await authFlow(args);
 };
@@ -160,7 +160,7 @@ const fetchIdentity = async (apiClient) => {
 			...email ? { email } : {}
 		};
 	} catch (err) {
-		if (isNeonApiError(err) && err.status === 401) throw new Error("Signed in, but the Neon API rejected the new access token. Try `neon auth` again.");
+		if (isNeonApiError(err) && err.status === 401) throw new Error("Signed in, but the Neon API rejected the new access token. Try `neon login` again.");
 		log.warning("Signed in, but could not look up the account: %s", err instanceof Error ? err.message : String(err));
 		return {};
 	}
@@ -317,7 +317,7 @@ const ensureAuth = async (props) => {
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
 	const isMcp = isMcpCommand(props);
-	if (props._[0] === "auth") {
+	if (props._[0] === "login" || props._[0] === "auth") {
 		props.apiClient = getApiClient({
 			apiKey: props.apiKey,
 			apiHost: props.apiHost
@@ -337,7 +337,7 @@ const ensureAuth = async (props) => {
 		try {
 			token = await client.exchange(stored.identityAssertion);
 		} catch (error) {
-			if (error instanceof ClaimableServiceError && error.code === "project_claimed") throw new Error("This project was claimed. Run `neon claim status` to drop the local assertion, then `neon auth` or `neon link`.");
+			if (error instanceof ClaimableServiceError && error.code === "project_claimed") throw new Error("This project was claimed. Run `neon claim status` to drop the local assertion, then `neon login` or `neon link`.");
 			throw error;
 		}
 		props.apiKey = token.accessToken;
@@ -449,6 +449,12 @@ const ensureAuth = async (props) => {
 		log.debug("mcp: no usable credentials; minting requires auth or --oauth");
 		return;
 	}
+	if (props._[0] === "me") {
+		const state = loaded === null ? "has no stored credential" : "holds a session that has expired";
+		log.info(`Not signed in: profile "${selection.profile}" ${state}. Run \`${getCliName()} login --profile ${selection.profile}\` to sign in, or use an API key with --api-key or NEON_API_KEY.`);
+		process.exitCode = 1;
+		return;
+	}
 	const apiKey = await authFlow({
 		...props,
 		profile: selection.profile

package/dist/commands/checkout.js

@@ -223,7 +223,7 @@ const resolveBranchId = async (props, projectId, hookCtx) => {
 	if (props.create) return createCheckoutBranch(props, projectId, ref, branches, hookCtx);
 	const missingName = notFoundMessage(ref, branches, { suggestCreate: true });
 	if (isCi() || !process.stdout.isTTY) throw new Error(missingName);
-	log.error(missingName);
+	log.info(missingName);
 	const { create } = await prompts({
 		type: "confirm",
 		name: "create",
@@ -310,7 +310,7 @@ const resolveProjectId = async (props) => {
 	if (autoDetected) return autoDetected;
 	const missingProjectMessage = `Could not determine which Neon project to check out a branch from. Provide one via the --project-id flag or a .neon file (created by \`${getCliName()} link\` / \`${getCliName()} set-context\`).`;
 	if (isCi() || !process.stdout.isTTY) throw new Error(missingProjectMessage);
-	log.error(missingProjectMessage);
+	log.info(missingProjectMessage);
 	const { runLink } = await prompts({
 		type: "confirm",
 		name: "runLink",

package/dist/commands/claim.js

@@ -3,7 +3,7 @@ import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { applyContext, contextBranch, readContextFile } from "../context.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
@@ -460,7 +460,7 @@ const finishClaimedContext = (props, projectId, contextMatches) => {
 			...contextBranch(context) ? { branch: contextBranch(context) } : {}
 		});
 	}
-	log.info("Dropped the local identity assertion. The next command needs `neon auth` or `neon link`.");
+	log.info("Dropped the local identity assertion. The next command needs `neon login` or `neon link`.");
 };
 //#endregion
 export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, create, describe, handler, claim_exports as t };

package/dist/commands/config.js

@@ -4,8 +4,8 @@ import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
-import { NEON_SERVICE_LABELS, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
+import { NEON_SERVICES, NEON_SERVICE_LABELS, deprecatedServiceMessage, servicesFlagValue, servicesOption } from "../neon_services.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -27,7 +27,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import chalk from "chalk";
 import { packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
-import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
+import { PushAbortedError, PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
 //#region src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
 	ConfigInstallFailed: () => ConfigInstallFailed,
@@ -88,12 +88,18 @@ const envFlag = { env: {
 /** Apply-only flags, exported so `deploy` can reuse the exact same surface. */
 const applyFlags = {
 	"update-existing": {
-		describe: "Auto-confirm overriding existing remote settings on the branch",
+		describe: "Override branch settings that differ from neon.ts without asking",
 		type: "boolean",
 		default: false
 	},
 	"allow-protected": {
-		describe: "Auto-confirm applying to a branch marked protected on Neon",
+		describe: "Apply to a branch marked protected on Neon without asking",
+		type: "boolean",
+		default: false
+	},
+	yes: {
+		alias: "y",
+		describe: "Answer yes to every confirmation: --update-existing and --allow-protected",
 		type: "boolean",
 		default: false
 	}
@@ -152,13 +158,7 @@ const missingDependencies = (cwd) => {
 * starter policy, which is what `config init` has always written.
 */
 const resolveServices = async (props) => {
-	if (props.services !== void 0) return parseServices(props.services, {
-		allowed: CONFIG_INIT_SERVICES,
-		whyUnavailable: CONFIG_INIT_UNAVAILABLE,
-		flag: "--services",
-		noneMeans: CONFIG_INIT_NONE_MEANS,
-		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
-	});
+	if (props.services !== void 0) return parseConfigInitServices(props.services, (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical)));
 	if (props.pickServices) return props.pickServices();
 	if (isCi() || !process.stdout.isTTY) return [];
 	return pickServicesInteractively();
@@ -475,10 +475,9 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 	},
 	services: servicesOption({
 		key: "services",
-		allowed: CONFIG_INIT_SERVICES,
-		noneMeans: CONFIG_INIT_NONE_MEANS,
+		allowed: NEON_SERVICES,
 		describe: "Services the scaffolded neon.ts declares",
-		also: "Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
+		also: "postgres alone writes the starter policy; every branch has Postgres. Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
 	}),
 	"from-branch": {
 		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. The only mode of `config init` that calls the Neon API.",
@@ -760,14 +759,8 @@ const applyCmd = async (props) => {
 		...branch.parentId ? { parentId: branch.parentId } : {},
 		...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
 	};
-	await runDeployBeforeHook({
-		hooks,
-		branch: hookBranch,
-		git,
-		event,
-		cwd
-	});
 	let result;
+	let declined = false;
 	try {
 		result = await apply(config, {
 			projectId: props.projectId,
@@ -775,15 +768,29 @@ const applyCmd = async (props) => {
 			...props.apiKey ? { apiKey: props.apiKey } : {},
 			...props.apiHost ? { apiHost: props.apiHost } : {},
 			...props.runtimeApi ? { api: props.runtimeApi } : {},
-			...props.updateExisting ? { updateExisting: true } : {},
-			...props.allowProtected ? { allowProtectedBranch: true } : {},
+			...props.updateExisting || props.yes ? { updateExisting: true } : {},
+			...props.allowProtected || props.yes ? { allowProtectedBranch: true } : {},
+			confirm: async (context) => {
+				if (context.overrides.length > 0) reportConflicts(props, context.overrides);
+				if (!canPromptForApply(props)) return false;
+				const proceed = await askToApply(context);
+				declined = !proceed;
+				return proceed;
+			},
+			beforeMutations: () => runDeployBeforeHook({
+				hooks,
+				branch: hookBranch,
+				git,
+				event,
+				cwd
+			}),
 			bundleFunction: neonctlBundler
 		});
 	} catch (err) {
+		if (err instanceof PushAbortedError) throw new Error(declined ? `Aborted: nothing was applied to branch "${err.branchName}".` : abortedApplyMessage(err));
 		if (err instanceof PushConflictError) {
 			reportConflicts(props, err.conflicts);
-			const overrideable = err.conflicts.every((c) => reasonAllowsUpdateExisting(c.reason));
-			throw new Error(overrideable ? "Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above." : "The policy conflicts with remote state. --update-existing will not resolve every conflict shown above.");
+			throw new Error("The policy conflicts with remote state. --update-existing will not resolve every conflict shown above.");
 		}
 		throw err;
 	}
@@ -870,6 +877,29 @@ const reportPushResult = (props, result, mode, services) => {
 	if (noChanges) log.info(`No changes — branch ${result.branchName} already matches the policy.`);
 	out.text(`\nUtilized services: ${services.join(", ")}\n`);
 };
+/** A prompt needs both ends of a terminal, and would corrupt `-o json|yaml` on stdout. */
+const canPromptForApply = (props) => !isCi() && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY) && props.output !== "json" && props.output !== "yaml";
+const askToApply = async (context) => {
+	const branch = JSON.stringify(context.branchName);
+	const message = context.protectedBranch && context.overrideUpdates ? `Branch ${branch} is protected, and this overrides the settings shown above. Apply anyway?` : context.protectedBranch ? `Branch ${branch} is protected. Apply to it anyway?` : `Override the settings shown above on branch ${branch}?`;
+	const { default: prompts } = await import("prompts");
+	const { proceed } = await prompts({
+		type: "confirm",
+		name: "proceed",
+		message,
+		initial: false
+	});
+	return proceed === true;
+};
+/** Without a terminal there is no one to ask, so name the flags that answer the question. */
+const abortedApplyMessage = (err) => {
+	const branch = JSON.stringify(err.branchName);
+	const isProtected = err.reasons.includes("protected-branch");
+	const overrides = err.reasons.includes("override-updates");
+	if (isProtected && overrides) return `Branch ${branch} is protected and its settings differ from the policy. Re-run with -y (or --allow-protected --update-existing) to apply the changes shown above.`;
+	if (isProtected) return `Branch ${branch} is protected. Re-run with --allow-protected (or -y) to apply to it.`;
+	return "Branch settings conflict with the policy. Re-run with --update-existing (or -y) to apply the changes shown above.";
+};
 /**
 * Render the branch-setting {@link ConflictReport}s a bare `apply` refused to override (drift
 * without `--update-existing`) as the git-style before→after diff. JSON/YAML output emits the

package/dist/commands/dev.js

@@ -550,7 +550,7 @@ const reconcileOnce = async (running, replan, ops) => {
 	try {
 		desired = await replan(nextSearchBase(running), keepPortsFromRunning(running));
 	} catch (err) {
-		log.info(chalk.red("neon.ts change ignored: ") + (err instanceof Error ? err.message : String(err)) + chalk.dim(" (fix it and save again)"));
+		log.warning("neon.ts change ignored: " + (err instanceof Error ? err.message : String(err)) + chalk.dim(" (fix it and save again)"));
 		return;
 	}
 	if (ops.isShuttingDown()) return;

package/dist/commands/git.js

@@ -110,7 +110,7 @@ const uninstall = (_props) => {
 			log.info("Removed the neon git post-checkout hook. Git → Neon sync is off.");
 			break;
 		case "foreign":
-			log.warning("Left the existing `post-checkout` hook in place (not managed by neon). Git → Neon sync flag cleared.");
+			log.info("Left the existing `post-checkout` hook in place (not managed by neon). Git → Neon sync flag cleared.");
 			break;
 		case "absent": log.info("No neon git hook was installed. Git → Neon sync flag cleared.");
 	}
@@ -295,7 +295,7 @@ const cleanup = async (props) => {
 	const orphanNeonNames = new Set(orphaned.map(([, neonBranch]) => neonBranch));
 	const branches = (await props.apiClient.listProjectBranches({ projectId: props.projectId })).data.branches;
 	const { toDelete, skipped } = partitionBranchesToPrune(branches, orphanNeonNames);
-	for (const { name, reason } of skipped) log.warning("Keeping Neon branch %s (%s) — never auto-deleted.", name, reason);
+	for (const { name, reason } of skipped) log.info("Keeping Neon branch %s (%s) — never auto-deleted.", name, reason);
 	if (toDelete.length === 0) {
 		log.info("No orphaned Neon branches to delete.");
 		return;

package/dist/commands/init.js

@@ -1,8 +1,7 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
-import { servicesOption } from "../neon_services.js";
-import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES } from "../config_template.js";
+import { NEON_SERVICES, servicesOption } from "../neon_services.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
 import { initPluginAgents, initSkillsMcpAgents } from "../init/plan.js";
 import { listSkillIds } from "../skills/catalog.js";
@@ -52,10 +51,9 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	describe: "Create neon.ts after linking. Use --no-config to skip. Omitted in Custom: you will be asked"
 }).option("services", servicesOption({
 	key: "services",
-	allowed: CONFIG_INIT_SERVICES,
+	allowed: NEON_SERVICES,
 	describe: "Services to declare in neon.ts",
-	noneMeans: CONFIG_INIT_NONE_MEANS,
-	also: "Implies creating neon.ts. Cannot be combined with --no-config."
+	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
 })).option("org-id", {
 	describe: "Forwarded to link: organization ID to link to",
 	type: "string"

package/dist/commands/manifest.js

@@ -11,8 +11,8 @@ import { Parser } from "yargs/helpers";
 */
 const commandManifest = [
 	{
-		command: "auth",
-		aliases: ["login"],
+		command: "login",
+		aliases: ["auth"],
 		describe: "Sign in with a browser. See --help for API keys and profiles",
 		load: () => import("./auth.js")
 	},

package/dist/commands/mcp.js

@@ -139,7 +139,7 @@ const setupNeonMcp = async (options) => {
 		cwd
 	}) : void 0;
 	if (plan.auth === "api-key" && !existing) {
-		if (!options.apiClient || !options.apiKey) throw new Error(`Authentication required. Run \`${getCliName()} auth\`, pass --api-key or use --oauth to install without a Neon credential.`);
+		if (!options.apiClient || !options.apiKey) throw new Error(`Authentication required. Run \`${getCliName()} login\`, pass --api-key or use --oauth to install without a Neon credential.`);
 		if (!canPickAgentsInteractively() && options.yes !== true && (options.agent ?? []).length === 0) throw new Error("No interactive terminal. Pass -y to mint into every detected agent, --agent <name> to name them or --oauth to install without minting.");
 	}
 	let auth;

package/dist/commands/profile.js

@@ -1,14 +1,14 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-D8AR-jvB.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath, n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "../_chunks/profiles-CvnFEQyd.js";
+import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "../_chunks/profiles-DIB1av2Q.js";
 import { auth, revokeToken } from "../auth.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
 import { authFlow, usableCredential } from "./auth.js";
 import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
@@ -70,7 +70,7 @@ const builder = (argv) => argv.usage("$0 profile <sub-command> [options]").comma
 		throw new Error(`--force is no longer a flag. \`neon profile create ${name}\` always replaces an existing profile and revokes the credential it held. Drop --force.`);
 	}
 	return true;
-}).example("$0 profile create work", "Sign in with the browser, like `neon auth --profile work`").example("$0 profile create work --api-key \"$KEY\"", "Store a key you already have").example("echo \"$KEY\" | $0 profile create work --api-key -", "Or pipe it, so it never reaches the process arguments").example("$0 profile create ci --mint --org-id org-abc-123", "One browser sign-in, then an org-scoped key and no session left behind").example("$0 profile create work --keyring", "Store the credential in the OS keyring instead of a file"), async (args) => await create(args)).command("rotate-key <name>", "Mint a fresh API key for a profile, at the same scope, and revoke the one it replaces", (y) => y.positional("name", {
+}).example("$0 profile create work", "Sign in with the browser, like `neon login --profile work`").example("$0 profile create work --api-key \"$KEY\"", "Store a key you already have").example("echo \"$KEY\" | $0 profile create work --api-key -", "Or pipe it, so it never reaches the process arguments").example("$0 profile create ci --mint --org-id org-abc-123", "One browser sign-in, then an org-scoped key and no session left behind").example("$0 profile create work --keyring", "Store the credential in the OS keyring instead of a file"), async (args) => await create(args)).command("rotate-key <name>", "Mint a fresh API key for a profile, at the same scope, and revoke the one it replaces", (y) => y.positional("name", {
 	describe: "Profile to rotate",
 	type: "string",
 	demandOption: true
@@ -466,7 +466,10 @@ const createByMinting = async (props) => {
 		});
 		warnAboutReach(scope);
 	} finally {
-		if (minted !== void 0 && !keyIsReachable) log.info(await withdrawKey(session, mintedScope, minted.id) ? `Revoked the key that was minted but not stored (id ${minted.id}).` : `Minted key ${minted.id} could be neither stored nor revoked, and may still be live. Remove it with: neon api-keys revoke ${minted.id}${mintedScope.orgId ? ` --org-id ${mintedScope.orgId}` : ""}`);
+		if (minted !== void 0 && !keyIsReachable) {
+			if (await withdrawKey(session, mintedScope, minted.id)) log.info(`Revoked the key that was minted but not stored (id ${minted.id}).`);
+			else log.warning(`Minted key ${minted.id} could be neither stored nor revoked, and may still be live. Remove it with: neon api-keys revoke ${minted.id}${mintedScope.orgId ? ` --org-id ${mintedScope.orgId}` : ""}`);
+		}
 		const revoked = await revokeToken(oauthProps, tokenSet);
 		log.info(revoked ? "Signed the browser session back out, so nothing but the key remains." : "Could not sign the browser session back out; it will expire on its own.");
 	}
@@ -604,7 +607,8 @@ const remove = async (props) => {
 				apiKey: stored.apiKey,
 				apiHost: props.apiHost
 			});
-			log.info(await withdrawKey(client, scope, keyId) ? `Revoked the API key (id ${keyId})` : `Could not revoke the API key (id ${keyId}) — it may still be live. Remove it with: neon api-keys revoke ${keyId}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}`);
+			if (await withdrawKey(client, scope, keyId)) log.info(`Revoked the API key (id ${keyId})`);
+			else log.warning(`Could not revoke the API key (id ${keyId}) — it may still be live. Remove it with: neon api-keys revoke ${keyId}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}`);
 		}
 	} else if (stored !== null) {
 		const revoked = await revokeTokenSet(stored.tokens, props);

package/dist/commands/user.js

@@ -17,6 +17,7 @@ const handler = async (args) => {
 	await me(args);
 };
 const me = async (props) => {
+	if (!props.apiClient) return;
 	const { data } = await props.apiClient.getCurrentUserInfo();
 	if (props.output === "json" || props.output === "yaml") {
 		writer(props).end(data, { fields: [

package/dist/config_template.js

@@ -1,4 +1,4 @@
-import { NEON_SERVICES } from "./neon_services.js";
+import { NEON_SERVICES, parseServices } from "./neon_services.js";
 //#region src/config_template.ts
 /**
 * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
@@ -23,13 +23,15 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 */
 const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres");
 /**
-* What `config init --services none` produces. One constant because it is both the help text
-* and what tells the parser `none` is a value here — passing the literal at each call site
-* lets the two drift into documenting something the parser does not accept.
+* Parse `--services` on `init` and `config init` into the services to declare. `postgres` is
+* accepted, alone or with others, and declares nothing: `--services postgres` is how a
+* script asks for the Postgres-only starter policy.
 */
-const CONFIG_INIT_NONE_MEANS = "the bare starter policy";
-/** Why a policy cannot declare a real Neon service, for the refusal message. */
-const CONFIG_INIT_UNAVAILABLE = { postgres: "every branch has Postgres, so a policy has nothing to declare for it" };
+const parseConfigInitServices = (raw, onDeprecated) => parseServices(raw, {
+	allowed: NEON_SERVICES,
+	flag: "--services",
+	...onDeprecated ? { onDeprecated } : {}
+}).filter((service) => service !== "postgres");
 /** Slug, display name, and source path of the function scaffolded for `functions`. */
 const FUNCTION_SLUG = "hello";
 const FUNCTION_NAME = "Hello World";
@@ -200,4 +202,4 @@ const renderFunctionSource = (slug, language) => {
 };
 const FUNCTION_TEMPLATE = renderFunctionSource(FUNCTION_SLUG, "ts");
 //#endregion
-export { BUCKET_NAME, CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };
+export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };

package/dist/credential_io.js

@@ -1,2 +1,2 @@
-import { t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
+import { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
 export { storeFor };

package/dist/index.js

@@ -154,7 +154,7 @@ async function handleError(msg, err, canRetry) {
 		log.error(err.message);
 		if (err.terminal) {
 			const context = getAuthContext();
-			log.error(`Run \`neon auth --profile ${context?.profile ?? "DEFAULT"}\` to sign in again.`);
+			log.error(`Run \`neon login --profile ${context?.profile ?? "DEFAULT"}\` to sign in again.`);
 		}
 		sendError(err, "AUTH_FAILED");
 		return false;

package/dist/init/choices.js

@@ -10,7 +10,7 @@ const resolveInitConfigChoice = (input) => {
 	};
 	if (input.yes) return {
 		kind: "write",
-		services: ["none"]
+		services: ["postgres"]
 	};
 	if (input.flag === true) return { kind: "write" };
 	if (input.canAsk) return { kind: "ask" };
@@ -21,10 +21,6 @@ const configPlanFromResolution = (resolution, accepted) => {
 	if (resolution.kind === "skip") return { kind: "skip" };
 	return resolution;
 };
-const isBareInitServices = (services) => {
-	if (services === void 0 || services.length === 0) return true;
-	return services.every((service) => service === "none");
-};
 const shouldRefreshEnvAfterNewConfig = (input) => input.wroteNewFile && typeof input.projectId === "string" && input.projectId.length > 0 && typeof input.branch === "string" && input.branch.length > 0;
 const shouldPullEnvAfterInitConfig = (input) => !input.extraServices && !input.alreadyPulled && shouldRefreshEnvAfterNewConfig({
 	wroteNewFile: input.wroteNewFile,
@@ -32,4 +28,4 @@ const shouldPullEnvAfterInitConfig = (input) => !input.extraServices && !input.a
 	...input.branch !== void 0 ? { branch: input.branch } : {}
 });
 //#endregion
-export { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, isBareInitServices, resolveInitConfigChoice, shouldPullEnvAfterInitConfig, shouldRefreshEnvAfterNewConfig };
+export { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, resolveInitConfigChoice, shouldPullEnvAfterInitConfig, shouldRefreshEnvAfterNewConfig };

package/dist/init/copy.js

@@ -49,8 +49,8 @@ const SERVICES_MESSAGE = "Which services should neon.ts declare? (space to toggl
 const PACKAGE_MANAGER_MESSAGE = "Which package manager should install the Neon dependencies?";
 const NO_AGENTS_FALLBACK_STATUS = "No coding agents detected. Installing the default Neon skills for Cursor and Codex in this directory.";
 const NO_AGENT_SETUP_CONFLICT = "--no-agent-setup cannot be combined with --agent, --skill, or MCP flags.";
-const NON_TTY_LINK_NEEDS_AUTH = "No interactive terminal. Sign in with `neon auth`, then re-run, or pass --claimable.";
-const YES_LINK_NEEDS_AUTH = "-y cannot sign in. Sign in with `neon auth`, then re-run, or pass --claimable.";
+const NON_TTY_LINK_NEEDS_AUTH = "No interactive terminal. Sign in with `neon login`, then re-run, or pass --claimable.";
+const YES_LINK_NEEDS_AUTH = "-y cannot sign in. Sign in with `neon login`, then re-run, or pass --claimable.";
 const MCP_SCOPED_NEEDS_PROJECT = "--mcp-project-scoped requires a linked project. Link a project first, or omit --mcp-project-scoped.";
 const namedAgentsUnavailable = (ids) => `--agent ${ids.join(", ")} cannot install this tooling. Pass agents that support it, or omit --agent.`;
 const mcpConfigLocationUnavailable = (ids, location) => location === "project" ? `--agent ${ids.join(", ")} cannot install project-level MCP config. Use --mcp-config-location global, or choose an agent that supports project config.` : `--agent ${ids.join(", ")} cannot install global MCP config. Choose an agent that supports global config.`;
@@ -80,7 +80,7 @@ const PROGRESS = {
 const unattendedUnauthedNext = () => [
 	"Link a project with a Neon account and an authenticated CLI.",
 	"Sign up: https://neon.com/signup",
-	`${getCliName()} auth`,
+	`${getCliName()} login`,
 	`${getCliName()} link`,
 	"",
 	"Or create a claimable project without an account. It expires in 72 hours unless claimed.",

package/dist/init/detect.js

@@ -1,7 +1,7 @@
-import { t as storeFor } from "../_chunks/credential_io-D8AR-jvB.js";
+import { t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
 import { isCi } from "../env.js";
-import { h as resolveProfile, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
-import { i as selectCredential, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { h as resolveProfile, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
+import { i as selectCredential, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { detectInstalledAgents, uniqueAgentIds } from "../mcp/agents.js";
 import "./agents.js";
 import { directoryIsEmpty } from "./plan.js";

package/dist/init/plan.js

@@ -1,5 +1,4 @@
 import { getCliName } from "../utils/cli_name.js";
-import { NO_SERVICES } from "../neon_services.js";
 import { tryResolveAddMcpAgentId, uniqueAgentIds } from "../mcp/agents.js";
 import { mcpInstallableAgents } from "../mcp/targets.js";
 import { supportsSkills } from "./agents.js";
@@ -363,13 +362,13 @@ const planConfigInitStep = (input) => {
 		"config",
 		"init",
 		"--services",
-		input.services.length === 0 ? NO_SERVICES : input.services.join(",")
+		input.services.length === 0 ? "postgres" : input.services.join(",")
 	];
 	if (input.yes) return [
 		"config",
 		"init",
 		"--services",
-		NO_SERVICES
+		"postgres"
 	];
 	return ["config", "init"];
 };

package/dist/init/run.js

@@ -6,8 +6,8 @@ import { recordCommandSuccessExtras, takeCommandSuccessExtras } from "../analyti
 import "../claimable/api.js";
 import { readLinkedClaimableCredentials } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
-import { deprecatedServiceMessage, parseServices, servicesFlagValue } from "../neon_services.js";
-import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE } from "../config_template.js";
+import { servicesFlagValue } from "../neon_services.js";
+import { CONFIG_INIT_SERVICES, parseConfigInitServices } from "../config_template.js";
 import { hasNeonConfigFile, neonConfigFilename } from "../project.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
 import { mcpInstallableAgents } from "../mcp/targets.js";
@@ -24,7 +24,7 @@ import { InitCancelled, raceSigint, restoreCursor } from "./cancelled.js";
 import { pickAgentSetupInteractively, pickInitAgentsInteractively, pickInitConfigInteractively, pickInitMcpAuthInteractively, pickInitMcpConfigLocationInteractively, pickInitModeInteractively, pickInitPackageManagerInteractively, pickInitProjectSetupInteractively, pickInitServicesInteractively, pickInitSkillsInteractively } from "./wizard.js";
 import { runToolingSteps } from "./tooling.js";
 import { create } from "../commands/claim.js";
-import { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, isBareInitServices, resolveInitConfigChoice, shouldPullEnvAfterInitConfig } from "./choices.js";
+import { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, resolveInitConfigChoice, shouldPullEnvAfterInitConfig } from "./choices.js";
 import { detectInitEnvironment } from "./detect.js";
 import { createInitFunnel, emitInitStart, finishInitFunnel, initStartProperties } from "./funnel.js";
 import { assertAgentSetupFlags, hasInitMcpFlags, inferInitAgentSetup, resolveInitMode } from "./mode.js";
@@ -34,17 +34,6 @@ const isLinked = (contextFile) => {
 	const projectId = readContextFile(contextFile).projectId;
 	return typeof projectId === "string" && projectId.length > 0;
 };
-const parsedInitServices = (raw) => {
-	const values = servicesFlagValue(raw);
-	if (values === void 0) return;
-	return parseServices(values, {
-		allowed: CONFIG_INIT_SERVICES,
-		whyUnavailable: CONFIG_INIT_UNAVAILABLE,
-		flag: "--services",
-		noneMeans: CONFIG_INIT_NONE_MEANS,
-		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
-	});
-};
 const expandTelemetryServices = (services) => {
 	if (services.includes("data-api") && !services.includes("auth")) return CONFIG_INIT_SERVICES.filter((service) => service === "auth" || services.includes(service));
 	return [...services];
@@ -172,8 +161,9 @@ const runInit = async (props) => {
 		...props.forceAuth !== void 0 ? { forceAuth: props.forceAuth } : {},
 		...props.allowUnsafeTls !== void 0 ? { allowUnsafeTls: props.allowUnsafeTls } : {}
 	};
-	const servicesFlag = parsedInitServices(props.services);
+	const servicesFlag = servicesFlagValue(props.services);
 	if (props.config === false && servicesFlag !== void 0) throw new Error(INIT_CONFIG_SERVICES_CONFLICT);
+	if (servicesFlag !== void 0) parseConfigInitServices(servicesFlag);
 	const linkInputs = {
 		...props.orgId ? { orgId: props.orgId } : {},
 		...props.projectId ? { projectId: props.projectId } : {},
@@ -459,25 +449,22 @@ const runInit = async (props) => {
 			const picked = await (props.pickServices ?? pickInitServicesInteractively)();
 			configPlan = {
 				kind: "write",
-				services: picked.length === 0 ? ["none"] : picked
+				services: picked.length === 0 ? ["postgres"] : picked
 			};
 		}
 		if (recommended && configPlan.kind === "write" && !existingConfig) configPlan = {
 			kind: "write",
-			services: servicesFlag ?? ["none"]
+			services: servicesFlag ?? ["postgres"]
 		};
 		let wroteNewFile = false;
 		let extraServices = false;
 		let selectedServices = null;
 		if (configPlan.kind === "write") {
-			const planned = existingConfig ? void 0 : configPlan.services ?? ["none"];
+			const planned = existingConfig ? void 0 : configPlan.services ?? ["postgres"];
 			if (planned !== void 0) {
-				extraServices = !isBareInitServices(planned);
-				selectedServices = extraServices ? expandTelemetryServices(parseServices(planned, {
-					allowed: CONFIG_INIT_SERVICES,
-					flag: "--services",
-					noneMeans: CONFIG_INIT_NONE_MEANS
-				})) : [];
+				const declared = parseConfigInitServices(planned);
+				extraServices = declared.length > 0;
+				selectedServices = expandTelemetryServices(declared);
 				funnel.services = selectedServices;
 				wroteNewFile = true;
 			} else selectedServices = null;

package/dist/log.js

@@ -9,7 +9,7 @@ const log = {
 		process.stderr.write(`WARNING: ${format(...args)}\n`);
 	},
 	info: (...args) => {
-		process.stderr.write(`INFO: ${format(...args)}\n`);
+		process.stderr.write(`${format(...args)}\n`);
 	},
 	error: (...args) => {
 		process.stderr.write(`ERROR: ${format(...args)}\n`);

package/dist/mcp/mint.js

@@ -4,7 +4,7 @@ import { getCliName } from "../utils/cli_name.js";
 import { mintedKeyName } from "../profile_keys.js";
 import { orgIdForProject } from "../commands/api_keys.js";
 //#region src/mcp/mint.ts
-const cannotMintMessage = "This CLI credential cannot mint API keys. Organization and project-scoped keys cannot create other keys. Sign in with `neon auth` or pass a personal API key.";
+const cannotMintMessage = "This CLI credential cannot mint API keys. Organization and project-scoped keys cannot create other keys. Sign in with `neon login` or pass a personal API key.";
 function mintedKeyRevokeCommand(key) {
 	return key.orgId ? `${getCliName()} api-keys revoke ${key.id} --org-id ${key.orgId}` : `${getCliName()} api-keys revoke ${key.id}`;
 }
@@ -14,7 +14,7 @@ const withdraw = async (client, keyId, orgId) => {
 		const { data } = orgId ? await client.revokeOrgApiKey(orgId, keyId) : await client.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/neon_services.js

@@ -40,8 +40,6 @@ const NEON_SERVICE_LABELS = {
 * vocabulary, and absent from help text, errors, and docs so nobody learns it fresh.
 */
 const DEPRECATED_SERVICE_ALIASES = { storage: "object-storage" };
-/** An explicit empty selection, for commands where "declare nothing" is a real answer. */
-const NO_SERVICES = "none";
 /**
 * What to tell someone still using a retired spelling. A message rather than a log call, so
 * the parser stays free of the CLI's writer and each command can surface it in its own voice.
@@ -57,18 +55,14 @@ const deprecatedServiceMessage = (used, canonical) => `"${used}" is the old name
 *
 * An unrecognized name is rejected rather than dropped: a typo would otherwise act on
 * everything *except* the service that was asked for, and report success. A name that is a
-* real service but not one this command supports says so specifically — "postgres is on
-* every branch" is a different problem from a typo, and has a different fix.
+* real service but not one this command supports says so, since that is a different problem
+* from a typo.
 */
 const parseServices = (raw, options) => {
-	const { allowed, flag, noneMeans, whyUnavailable = {}, onDeprecated } = options;
-	const supported = `Supported values: ${allowed.join(", ")}${noneMeans !== void 0 ? `, ${NO_SERVICES}` : ""}.`;
+	const { allowed, flag, onDeprecated } = options;
+	const supported = `Supported values: ${allowed.join(", ")}.`;
 	const names = raw.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
 	if (names.length === 0) throw new Error(`${flag} needs at least one service. ${supported}`);
-	if (noneMeans !== void 0 && names.includes("none")) {
-		if (new Set(names).size > 1) throw new Error(`${flag} ${NO_SERVICES} cannot be combined with other services.`);
-		return [];
-	}
 	const deprecated = /* @__PURE__ */ new Map();
 	const resolved = names.map((name) => {
 		const canonical = DEPRECATED_SERVICE_ALIASES[name];
@@ -77,23 +71,19 @@ const parseServices = (raw, options) => {
 		return canonical;
 	});
 	const unsupported = resolved.filter((name) => !allowed.some((service) => service === name));
-	if (unsupported.length > 0) throw new Error(`${unsupportedMessage(unsupported, flag, whyUnavailable)} ${supported}`);
+	if (unsupported.length > 0) throw new Error(`${unsupportedMessage(unsupported, flag)} ${supported}`);
 	for (const [used, canonical] of deprecated) onDeprecated?.(used, canonical);
 	return NEON_SERVICES.filter((service) => allowed.includes(service) && resolved.includes(service));
 };
 /**
 * The sentences explaining why a selection was refused. A real Neon service this command
 * cannot act on is a different mistake from a typo — different cause, different fix — so the
-* two are never answered with the same word, and each service carries its reason where the
-* command supplied one.
+* two are never answered with the same word.
 */
-const unsupportedMessage = (unsupported, flag, whyUnavailable) => {
+const unsupportedMessage = (unsupported, flag) => {
 	const known = unsupported.filter((name) => NEON_SERVICES.some((service) => service === name));
 	const unknown = unsupported.filter((name) => !known.some((service) => service === name));
-	return [unknown.length > 0 ? `Unknown service${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")}.` : void 0, ...known.map((service) => {
-		const why = whyUnavailable[service];
-		return `${service} is not something ${flag} can select${why ? `: ${why}` : ""}.`;
-	})].filter((part) => part !== void 0).join(" ");
+	return [unknown.length > 0 ? `Unknown service${unknown.length === 1 ? "" : "s"} ${unknown.join(", ")}.` : void 0, ...known.map((service) => `${service} is not something ${flag} can select.`)].filter((part) => part !== void 0).join(" ");
 };
 /** Every spelling of the services flag, so a habit picked up on one command works on another. */
 const SERVICE_FLAG_NAMES = [
@@ -110,7 +100,6 @@ const servicesOption = (params) => ({
 	alias: SERVICE_FLAG_NAMES.filter((name) => name !== params.key),
 	describe: [
 		`${params.describe}: ${params.allowed.join(", ")}.`,
-		params.noneMeans !== void 0 ? `Pass "${NO_SERVICES}" for ${params.noneMeans}.` : void 0,
 		"Repeat the flag or comma-separate.",
 		params.also
 	].filter((part) => part !== void 0).join(" "),
@@ -124,4 +113,4 @@ const servicesOption = (params) => ({
 */
 const servicesFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
 //#endregion
-export { NEON_SERVICES, NEON_SERVICE_LABELS, NO_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption };
+export { NEON_SERVICES, NEON_SERVICE_LABELS, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption };

package/dist/retire_credential.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-D8AR-jvB.js";
+import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-ByNuojoE.js";
 import { log } from "./log.js";
 import { getApiClient } from "./api.js";
 import { revokeToken } from "./auth.js";
@@ -57,7 +57,8 @@ const retirePreviousCredential = async (props, name, existing, replacementKey) =
 			apiKey: existing.apiKey,
 			apiHost: props.apiHost
 		});
-		log.info(await withdrawKey(client, existing.scope, existing.keyId) ? `Revoked the key it replaces (id ${existing.keyId})` : `Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
+		if (await withdrawKey(client, existing.scope, existing.keyId)) log.info(`Revoked the key it replaces (id ${existing.keyId})`);
+		else log.warning(`Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
 		return;
 	}
 	const revoked = await revokeTokenSet(existing.tokens, props);
@@ -70,7 +71,7 @@ const withdrawKey = async (client, scope, keyId) => {
 		const { data } = scope.orgId ? await client.revokeOrgApiKey(scope.orgId, keyId) : await client.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/utils/config_diff.js

@@ -130,7 +130,6 @@ const renderAppliedChanges = (changes, title, opts) => {
 	lines.push(...renderBranchGroups(byBranch, paint));
 	return lines.join("\n");
 };
-const isOverrideableConflict = (conflict) => conflict.reason.includes("Pass `updateExisting: true`");
 const CUSTOM_DOMAIN_REASON = /^custom domain "([^"]+)"/;
 const labeledConflictField = (conflict) => {
 	if (conflict.field !== "customDomain") return conflict.field;
@@ -145,8 +144,7 @@ const renderBranchSettingConflicts = (conflicts, opts) => {
 		const existing = byBranch.get(conflict.identifier) ?? [];
 		byBranch.set(conflict.identifier, [...existing, ...expandField(labeledConflictField(conflict), conflict.current, conflict.desired)]);
 	}
-	const heading = conflicts.every(isOverrideableConflict) ? "Branch settings differ (re-run with --update-existing to apply)" : "Branch settings differ";
-	return [paint.title(heading), ...renderBranchGroups(byBranch, paint)].join("\n");
+	return [paint.title("Branch settings differ"), ...renderBranchGroups(byBranch, paint)].join("\n");
 };
 const renderCustomDomainFollowup = (result, opts) => {
 	const paint = palette(opts.color);

package/dist/utils/middlewares.js

@@ -1,4 +1,4 @@
-import { r as recordCredentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
+import { r as recordCredentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 //#region src/utils/middlewares.ts
 /**
 * Forwarding Yargs's default would turn ambient configuration into an explicit child override.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.0.12",
+  "version": "8.2.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -64,9 +64,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.8.4",
-    "@neon/config-runtime": "1.7.6",
-    "@neon/sdk": "7.0.1"
+    "@neon/config-runtime": "1.8.0",
+    "@neon/sdk": "7.0.1",
+    "@neon/config": "1.8.6"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -100,8 +100,8 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.27",
     "@neon/e2e-harness": "0.0.0",
+    "@neon-internals/env-core": "0.0.29",
     "@neon/functions": "0.11.0"
   },
   "publishConfig": {