neon 8.0.8 → 8.0.10

package/dist/_chunks/{env-HVRMArlT.js → env-BWqJqBDJ.js}

@@ -2,7 +2,7 @@ import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig } from "../project.js";
-import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-Dkl0TY44.js";
+import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-HYNFtxu5.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { ErrorCode, createNeonApiFromOptions, isPlatformError } from "@neon/config";
@@ -42,9 +42,9 @@ import { plan, pullConfig } from "@neon/config-runtime";
 * ```
 */
 async function fetchEnvReusingSecrets(config, options) {
-	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, ...fetchOptions } = options;
+	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, resolvedBranch, ...fetchOptions } = options;
 	const api = options.api ?? createApiFromOptions(options);
-	const { branch, desired } = await resolveBranchPolicy(config, options, api);
+	const { branch, desired } = await resolveBranchPolicy(config, options, api, resolvedBranch);
 	const allPolicyKeys = policyEnvKeys(desired);
 	const requested = requestedKeys ? new Set(requestedKeys) : null;
 	const selectedPolicyKeys = requested === null ? allPolicyKeys : [...allPolicyKeys.filter((key) => requested.has(key)), ...[...requested].filter(isFunctionBaseUrlKey).sort()];
@@ -66,6 +66,7 @@ async function fetchEnvReusingSecrets(config, options) {
 			credential: {
 				issued: false,
 				keys: [],
+				fresh: [],
 				revoked: [],
 				superseded: []
 			},
@@ -111,6 +112,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: false,
 			keys: secretKeys,
+			fresh: [],
 			revoked: [],
 			superseded: []
 		},
@@ -124,6 +126,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: true,
 			keys: secretKeys,
+			fresh: secretKeys.filter((key) => !keptSecretKeys.includes(key)),
 			revoked: revokeSuperseded ? [...ours] : [],
 			superseded: revokeSuperseded ? [] : [...ours]
 		},
@@ -245,6 +248,7 @@ const CLAIMABLE_RESOLVE_ORDER = [
 const emptyClaimableCredential = () => ({
 	issued: false,
 	keys: [],
+	fresh: [],
 	revoked: [],
 	superseded: []
 });
@@ -410,10 +414,21 @@ const resolveNeonEnvVars = async (ctx) => {
 			branchId: ctx.branchId,
 			...apiOptions(ctx)
 		});
-		if (!ctx.implyAiGateway) return await fetchAndProject(pulled.config, ctx, { functionUrls: "all-live" });
+		const resolvedBranch = {
+			id: pulled.branch.id,
+			name: pulled.branch.name,
+			isDefault: pulled.branch.isDefault,
+			protected: pulled.branch.protected,
+			...pulled.branch.expiresAt ? { expiresAt: pulled.branch.expiresAt } : {}
+		};
+		if (!ctx.implyAiGateway) return await fetchAndProject(pulled.config, ctx, {
+			functionUrls: "all-live",
+			resolvedBranch
+		});
 		return await resolveWithImpliedGateway(pulled.config, ctx, {
 			projectId: ctx.projectId,
-			branchId: ctx.branchId
+			branchId: ctx.branchId,
+			resolvedBranch
 		});
 	}
 	throw new MissingBranchContextError(`No project/branch context found. Link a branch (\`${getCliName()} link\` / \`${getCliName()} checkout\`) or pass --project-id and --branch.`);
@@ -450,9 +465,15 @@ const withAiGateway = (config) => ({
 */
 const resolveWithImpliedGateway = async (config, ctx, branch) => {
 	const unreachable = await credentialsUnreachable(ctx, branch);
-	if (unreachable === null) return await fetchAndProject(withAiGateway(config), ctx, { functionUrls: "all-live" });
+	if (unreachable === null) return await fetchAndProject(withAiGateway(config), ctx, {
+		functionUrls: "all-live",
+		resolvedBranch: branch.resolvedBranch
+	});
 	log.warning(`Could not reach the AI Gateway's credentials, so %s were not resolved. Everything else was. Either this project does not have the AI Gateway, or the call failed — \`${getCliName()} env pull -s ai-gateway\` will say which.\nDetails: %s`, [NEON_ENV_VAR_KEYS.aiGateway.apiKey, NEON_ENV_VAR_KEYS.aiGateway.baseUrl].join(" and "), unreachable);
-	const pulled = await fetchAndProject(config, ctx, { functionUrls: "all-live" });
+	const pulled = await fetchAndProject(config, ctx, {
+		functionUrls: "all-live",
+		resolvedBranch: branch.resolvedBranch
+	});
 	return {
 		...pulled,
 		skipped: [...pulled.skipped ?? [], "ai-gateway"]
@@ -670,7 +691,8 @@ const fetchAndProject = async (config, ctx, opts = {}) => {
 		...opts.keys ? { keys: opts.keys } : {},
 		...opts.revokeSuperseded === false ? { revokeSuperseded: false } : {},
 		...opts.functionUrls ? { functionUrls: opts.functionUrls } : {},
-		...opts.listedFunctions ? { listedFunctions: opts.listedFunctions } : {}
+		...opts.listedFunctions ? { listedFunctions: opts.listedFunctions } : {},
+		...opts.resolvedBranch ? { resolvedBranch: opts.resolvedBranch } : {}
 	});
 	return {
 		vars: result.vars,

package/dist/_chunks/{env-Dkl0TY44.js → env-HYNFtxu5.js}

@@ -96,6 +96,22 @@ function parseFunctionBaseUrlKey(key) {
 function isFunctionBaseUrlKey(key) {
 	return parseFunctionBaseUrlKey(key) !== null;
 }
+/**
+* Starts a read now and keeps an unread rejection from crashing the process; the caller
+* awaits it (and sees the error) when its turn comes. The read is called synchronously and
+* its own promise returned, so errors surface in the same order as a direct call; a
+* synchronous throw becomes the returned rejection.
+*/
+function started(read) {
+	let promise;
+	try {
+		promise = read();
+	} catch (error) {
+		promise = Promise.reject(error);
+	}
+	promise.catch(() => void 0);
+	return promise;
+}
 /** Fail loudly when selected-key dependency planning and execution disagree. */
 function requiredValue(value, description) {
 	if (value === null) throw new Error(`fetchEnv: missing ${description}.`);
@@ -141,6 +157,12 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 		selectedFunctionKeys,
 		wants
 	});
+	const wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;
+	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
+	const wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));
+	const functionsRead = functionUrlMode === "all-live" && wantsAnyFunctionUrl && options.listedFunctions === void 0 ? listFunctionInvocationUrls(api, projectId, branch.id) : null;
+	functionsRead?.catch(() => void 0);
+	const storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;
 	const needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;
 	const needsConnectionTarget = wantsPooled || needsUnpooled;
 	const needsDatabase = needsConnectionTarget || wantsDataApi;
@@ -190,8 +212,6 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 		}
 		result.dataApi = { url: dataApiSnapshot.url };
 	}
-	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-	const wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));
 	const wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));
 	const wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));
 	const wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);
@@ -199,7 +219,7 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 	if (wantsStorage || wantsGateway) {
 		let storage = null;
 		if (wantsStorage) {
-			storage = await api.getProjectBranchStorage(projectId, branch.id);
+			storage = await requiredValue(storageRead, "storage read");
 			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets."].join(" "), { details: {
 				projectId,
 				branchId: branch.id
@@ -230,11 +250,10 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 			result.aiGateway = gateway;
 		}
 	}
-	const wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;
 	const functions = {};
 	let functionUrlsUnavailable = false;
 	if (functionUrlMode === "all-live" && wantsAnyFunctionUrl) {
-		const listed = options.listedFunctions === void 0 ? await listFunctionInvocationUrls(api, projectId, branch.id) : listedFromSnapshots(options.listedFunctions);
+		const listed = options.listedFunctions === void 0 ? await requiredValue(functionsRead, "function listing") : listedFromSnapshots(options.listedFunctions);
 		if (listed.status === "unavailable") {
 			if (selection === null) functionUrlsUnavailable = true;
 		} else for (const fn of listed.functions) {
@@ -297,13 +316,8 @@ async function listFunctionInvocationUrls(api, projectId, branchId) {
 * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}
 * so the two agree on which branch they're talking about and what it has enabled.
 */
-async function resolveBranchPolicy(config, options, api) {
-	const projectId = options.projectId;
-	const branches = await api.listBranches(projectId);
-	if (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, "Deploy your neon.ts policy (or create a branch) first, or pick a different project id."].join(" "), { details: { projectId } });
-	const branchRef = options.branch ?? options.branchId;
-	if (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, ["fetchEnv: no branch provided.", "Pass `branch` with a branch name (e.g. `main`) or id (`br-…`)."].join(" "), { details: { projectId } });
-	const branch = resolveBranch(branchRef, branches);
+async function resolveBranchPolicy(config, options, api, resolved) {
+	const branch = resolved ?? await listAndResolveBranch(options, api);
 	return {
 		branch,
 		desired: resolveConfig(config, {
@@ -317,6 +331,14 @@ async function resolveBranchPolicy(config, options, api) {
 		})
 	};
 }
+async function listAndResolveBranch(options, api) {
+	const projectId = options.projectId;
+	const branches = await api.listBranches(projectId);
+	if (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, "Deploy your neon.ts policy (or create a branch) first, or pick a different project id."].join(" "), { details: { projectId } });
+	const branchRef = options.branch ?? options.branchId;
+	if (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, ["fetchEnv: no branch provided.", "Pass `branch` with a branch name (e.g. `main`) or id (`br-…`)."].join(" "), { details: { projectId } });
+	return resolveBranch(branchRef, branches);
+}
 /**
 * Scopes a minted fallback credential should carry. Only object storage and the AI Gateway
 * *require* secrets; functions never force a credential. `functions:invoke` rides along only
@@ -402,12 +424,14 @@ async function resolveBranchCredentialSecrets(args) {
 		secretAccessKey: "",
 		apiToken: ""
 	};
-	if (needsStorage && storageDefault) {
-		const revealed = await args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId);
+	const storageReveal = needsStorage && storageDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId)) : null;
+	const gatewayReveal = needsGateway && gatewayDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)) : null;
+	if (storageReveal) {
+		const revealed = await storageReveal;
 		secrets.accessKeyId = revealed.tokenId;
 		secrets.secretAccessKey = revealed.s3SecretAccessKey;
 	}
-	if (needsGateway && gatewayDefault) secrets.apiToken = (await args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)).apiToken;
+	if (gatewayReveal) secrets.apiToken = (await gatewayReveal).apiToken;
 	const missingStorage = needsStorage && storageDefault === null;
 	const missingGateway = needsGateway && gatewayDefault === null;
 	if (missingStorage || missingGateway) {

package/dist/commands/config.js

@@ -4,7 +4,7 @@ import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
-import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
+import { NEON_SERVICE_LABELS, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { CONFIG_INIT_NONE_MEANS, CONFIG_INIT_SERVICES, CONFIG_INIT_UNAVAILABLE, FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
@@ -820,17 +820,7 @@ const applyCmd = async (props) => {
 * mistaken for being silently dropped. Service enablement is static top-level config (it never
 * lives in the per-branch closure), so reading it straight off `config` is accurate.
 */
-const utilizedServices = (config) => {
-	const labels = {
-		postgres: "Postgres",
-		auth: "Neon Auth",
-		"data-api": "Data API",
-		"object-storage": "Object Storage",
-		functions: "Functions",
-		"ai-gateway": "AI Gateway"
-	};
-	return [labels.postgres, ...declaredNeonServices(config).map((service) => labels[service])];
-};
+const utilizedServices = (config) => [NEON_SERVICE_LABELS.postgres, ...declaredNeonServices(config).map((service) => NEON_SERVICE_LABELS[service])];
 /**
 * Render a {@link PushResult}. JSON/YAML output emits the raw result (plus a `services`
 * summary) verbatim so it can be piped; the human-readable path renders the actual changes

package/dist/commands/dev.js

@@ -3,12 +3,12 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { l as functionBaseUrlKey } from "../_chunks/env-Dkl0TY44.js";
-import { a as resolveDevEnv } from "../_chunks/env-HVRMArlT.js";
-import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
-import { resolveWatchInputs } from "../dev/inputs.js";
+import { l as functionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
+import { a as resolveDevEnv } from "../_chunks/env-BWqJqBDJ.js";
+import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
+import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/env.js

@@ -5,12 +5,13 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-Dkl0TY44.js";
+import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-HVRMArlT.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BWqJqBDJ.js";
+import { formatPulledEnv } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -167,13 +168,13 @@ const pull = async (props, opts = {}) => {
 		return { status: "empty" };
 	}
 	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId), existingEnv, props.services !== void 0 ? selectionServices : void 0, props.envKeys !== void 0 ? selectionEnvKeys : void 0) });
-	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
-	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
-	if (credential?.issued) {
-		log.info("Wrote credential secrets — these now hold fresh values: %s", credential.keys.join(", "));
-		if (credential.revoked.length > 0) log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
-		else if (credential.superseded.length > 0) log.info("Left the credential it replaced live (%s): an explicitly scoped pull can't tell which other variables still use it. Revoke it in the Neon Console if nothing does.", credential.superseded.join(", "));
-	}
+	process.stderr.write(formatPulledEnv({
+		status: "written",
+		written,
+		removed,
+		file: targetPath,
+		...credential && credential.keys.length > 0 ? { credential } : {}
+	}, cwd));
 	if (!fileExisted) ensureGitignored(targetPath);
 	const gatewayBaseUrl = neonVars.NEON_AI_GATEWAY_BASE_URL;
 	const gatewayToken = neonVars.NEON_AI_GATEWAY_TOKEN;
@@ -189,6 +190,7 @@ const pull = async (props, opts = {}) => {
 	return {
 		status: "written",
 		written,
+		removed,
 		file: targetPath,
 		...credential && credential.keys.length > 0 ? { credential } : {},
 		...skipped && skipped.length > 0 ? { skipped } : {}

package/dist/commands/env_output.js

@@ -0,0 +1,64 @@
+import { NEON_SERVICES, NEON_SERVICE_LABELS } from "../neon_services.js";
+import { u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { BRANCH_ENV_KEY, ENV_PULL_KEYS, serviceForEnvKey } from "../env_services.js";
+import { isAbsolute, relative } from "node:path";
+import { homedir } from "node:os";
+//#region src/commands/env_output.ts
+/** Wide enough for the longest label ("Object Storage") plus a gutter, so blocks align. */
+const LABEL_WIDTH = 16;
+const row = (label, value) => `  ${label.padEnd(LABEL_WIDTH)}${value}`;
+/** Relative to `cwd` when the file is inside it, else absolute with the home directory as `~`. */
+const displayPath = (file, cwd) => {
+	const rel = relative(cwd, file);
+	if (rel !== "" && !rel.startsWith("..") && !isAbsolute(rel)) return rel;
+	const home = homedir();
+	return file.startsWith(`${home}/`) ? `~${file.slice(home.length)}` : file;
+};
+const BRANCH_GROUP = "Branch";
+const OTHER_GROUP = "Other";
+const GROUP_ORDER = [
+	NEON_SERVICE_LABELS.postgres,
+	BRANCH_GROUP,
+	...NEON_SERVICES.filter((service) => service !== "postgres").map((service) => NEON_SERVICE_LABELS[service]),
+	OTHER_GROUP
+];
+const groupOf = (key) => {
+	if (key === BRANCH_ENV_KEY) return BRANCH_GROUP;
+	if (isFunctionBaseUrlKey(key)) return NEON_SERVICE_LABELS.functions;
+	const pullKey = ENV_PULL_KEYS.find((candidate) => candidate === key);
+	const service = pullKey ? serviceForEnvKey(pullKey) : null;
+	return service ? NEON_SERVICE_LABELS[service] : OTHER_GROUP;
+};
+/** Canonical key order, so a row reads the same whether a key was rewritten or reused. */
+const keyRank = (key) => {
+	const index = ENV_PULL_KEYS.findIndex((candidate) => candidate === key);
+	return index === -1 ? ENV_PULL_KEYS.length : index;
+};
+const byKeyRank = (a, b) => keyRank(a) - keyRank(b) || a.localeCompare(b);
+const groupKeys = (keys) => {
+	const groups = /* @__PURE__ */ new Map();
+	for (const key of [...keys].sort(byKeyRank)) {
+		const group = groupOf(key);
+		groups.set(group, [...groups.get(group) ?? [], key]);
+	}
+	return groups;
+};
+const formatPulledEnv = (outcome, cwd) => {
+	const fresh = new Set(outcome.credential?.fresh ?? []);
+	const count = outcome.written.length;
+	const lines = [`Pulled ${count} Neon variable${count === 1 ? "" : "s"} into ${displayPath(outcome.file, cwd)}`];
+	const groups = groupKeys(outcome.written);
+	for (const group of GROUP_ORDER) {
+		const keys = groups.get(group);
+		if (!keys) continue;
+		lines.push(row(group, keys.map((key) => fresh.has(key) ? `${key}*` : key).join(", ")));
+	}
+	if (outcome.removed.length > 0) lines.push(row("Removed", `${outcome.removed.join(", ")} (not produced by this pull)`));
+	if (fresh.size > 0) lines.push("  * new credential value");
+	const credential = outcome.credential;
+	if (credential?.issued && credential.revoked.length > 0) lines.push(`Revoked the credential it replaced (${credential.revoked.join(", ")}).`);
+	else if (credential?.issued && credential.superseded.length > 0) lines.push(`Left the credential it replaced live (${credential.superseded.join(", ")}): an explicitly scoped pull can't tell which other variables still use it. Revoke it in the Neon Console if nothing does.`);
+	return `${lines.join("\n")}\n`;
+};
+//#endregion
+export { displayPath, formatPulledEnv, row };

package/dist/commands/link.js

@@ -5,6 +5,7 @@ import { isNeonApiError, messageFromBody } from "../api.js";
 import { r as defaultDir } from "../_chunks/paths-DMq0Lt7a.js";
 import "../config.js";
 import { applyContext, contextBranch, readContextFile, setContext, updateContextFile } from "../context.js";
+import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpEpilogue } from "../utils/help_text.js";
 import { hasNeonConfigFile, projectDir } from "../project.js";
@@ -14,6 +15,7 @@ import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
 import { autoPullEnvAfterPin } from "./env.js";
 import { initCmd } from "./config.js";
+import { formatLinkSummary } from "./link_output.js";
 import { REGIONS } from "./projects.js";
 import prompts from "prompts";
 //#region src/commands/link.ts
@@ -304,13 +306,28 @@ const failWithBranchCandidates = (props, projectId, branches, reason) => {
 };
 const listAllBranches = async (props, projectId) => listAllProjectBranches(props.apiClient, projectId);
 /**
+* The branch listing for {@link resolvePinnedBranch}, started alongside the project check
+* except on Claimable Neon, which does not complete concurrent Management API reads. Only
+* the listing starts early: branch selection, which can prompt or create a branch, still
+* waits for the check, and a listing error is reported only after the check passes.
+*/
+const branchListing = (props, projectId) => {
+	if (isClaimableEnvTarget({
+		apiHost: props.apiHost,
+		contextFile: props.contextFile,
+		configDir: props.configDir ?? ""
+	})) return () => listAllBranches(props, projectId);
+	const listing = listAllBranches(props, projectId);
+	listing.catch(() => void 0);
+	return () => listing;
+};
+/**
 * Resolve a branch reference (name *or* id) to the matching branch, while
 * confirming it actually exists in the project. Unlike the shared
 * `branchIdResolve`, this also verifies references that already look like ids
 * (so a typo'd `br-…` doesn't silently get written).
 */
-const resolveBranchRef = async (props, projectId, branchRef) => {
-	const branches = await listAllBranches(props, projectId);
+const resolveBranchRef = (props, projectId, branchRef, branches) => {
 	const match = branches.find((b) => b.id === branchRef) ?? branches.find((b) => b.name === branchRef);
 	if (match) return match;
 	return failWithBranchCandidates(props, projectId, branches, `Branch '${branchRef}' not found in project '${projectId}'. Pass --branch with a name or ID from the list:`);
@@ -336,43 +353,54 @@ const branchPersistValue = (branch) => {
 * the field is simply omitted.
 */
 const resolveOrgForProject = async (props, inputs, projectId) => {
-	const projectOrg = (await fetchProjectOrThrow(props, projectId)).org_id ?? void 0;
+	const project = await fetchProjectOrThrow(props, projectId);
+	const projectOrg = project.org_id ?? void 0;
+	const projectName = project.name;
 	if (inputs.orgId) {
 		if (projectOrg && projectOrg !== inputs.orgId) throw new LinkInputError(`Project '${projectId}' belongs to organization '${projectOrg}', not '${inputs.orgId}'. Omit --org-id to use the project's own org, or pass the matching ID.`);
 		if (!projectOrg) throw new LinkInputError(`Project '${projectId}' does not report an organization matching --org-id ${inputs.orgId}. Omit --org-id to link using the project's own context.`);
-		return inputs.orgId;
+		return {
+			orgId: inputs.orgId,
+			projectName
+		};
 	}
-	if (projectOrg) return projectOrg;
+	return {
+		orgId: projectOrg,
+		projectName
+	};
 };
+const pinnedRef = (branch) => ({
+	branchId: branch.id,
+	branchName: branch.name ?? branch.id,
+	usedDefault: false
+});
+const resolution = (branch) => ({
+	branch: branchPersistValue(branch),
+	ref: pinnedRef(branch)
+});
 /**
 * Keep a same-project pin only after it still resolves on the project.
 */
-const resolvePinnedBranch = async (props, inputs, existing, projectId) => {
-	if (inputs.branch) {
-		const branch = await resolveBranchRef(props, projectId, inputs.branch);
-		return { branch: branchPersistValue(branch) };
-	}
+const resolvePinnedBranch = async (props, inputs, existing, projectId, listBranches) => {
+	const branches = await listBranches();
+	if (inputs.branch) return resolution(resolveBranchRef(props, projectId, inputs.branch, branches));
 	if (projectId === existing.projectId) {
 		const pinned = contextBranch(existing);
-		if (pinned) {
-			const branch = await resolveBranchRef(props, projectId, pinned);
-			return { branch: branchPersistValue(branch) };
-		}
+		if (pinned) return resolution(resolveBranchRef(props, projectId, pinned, branches));
 	}
-	return resolveBranchFromList(props, projectId);
+	return resolveBranchFromList(props, projectId, branches);
 };
-const resolveBranchFromList = async (props, projectId) => {
-	const branches = await listAllBranches(props, projectId);
+const resolveBranchFromList = async (props, projectId, branches) => {
 	if (branches.length === 0) throw new LinkInputError(`Project '${projectId}' has no branches to link. Create or restore a branch before retrying, or select another project with --project-id.`);
 	if (branches.length === 1) {
 		const [only] = branches;
 		if (!only) throw new LinkInputError(`Project '${projectId}' has no branches to link. Create or restore a branch before retrying, or select another project with --project-id.`);
-		return { branch: branchPersistValue(only) };
+		return resolution(only);
 	}
 	if (props.yes) {
 		const def = branches.find((b) => b.default);
 		if (!def) return failWithBranchCandidates(props, projectId, branches, `Project '${projectId}' has no default branch. Pass --branch with a name or ID from the list:`);
-		return { branch: branchPersistValue(def) };
+		return resolution(def);
 	}
 	if (canPromptInteractively()) {
 		const picked = await pickBranchInteractively(branches, {
@@ -381,13 +409,19 @@ const resolveBranchFromList = async (props, projectId) => {
 		});
 		if (picked.kind === "existing") {
 			const existing = branches.find((b) => b.id === picked.branchId);
-			return { branch: existing ? branchPersistValue(existing) : picked.branchId };
+			return existing ? resolution(existing) : {
+				branch: picked.branchId,
+				ref: pinnedRef({ id: picked.branchId })
+			};
 		}
-		const created = await createBranch(props.apiClient, projectId, picked.name, branches);
-		return { branch: branchPersistValue({
-			id: created,
+		const createdBranch = {
+			id: await createBranch(props.apiClient, projectId, picked.name, branches),
 			name: picked.name
-		}) };
+		};
+		return {
+			branch: branchPersistValue(createdBranch),
+			ref: pinnedRef(createdBranch)
+		};
 	}
 	return failWithBranchCandidates(props, projectId, branches, `Project '${projectId}' has multiple branches. Pass --branch <name-or-id>, or -y to pin its default branch.`);
 };
@@ -410,6 +444,10 @@ const runNonInteractive = async (props, inputs, existing) => {
 			orgId,
 			projectId: created.project.id,
 			branch: created.branchName,
+			branchRef: pinnedRef({
+				id: created.branchId,
+				name: created.branchName
+			}),
 			created: true,
 			projectName: created.project.name,
 			regionId: created.project.region_id
@@ -417,8 +455,9 @@ const runNonInteractive = async (props, inputs, existing) => {
 		return;
 	}
 	if (inputs.projectId) {
-		const orgId = await resolveOrgForProject(props, inputs, inputs.projectId);
-		const resolved = await resolvePinnedBranch(props, inputs, existing, inputs.projectId);
+		const listBranches = branchListing(props, inputs.projectId);
+		const { orgId, projectName } = await resolveOrgForProject(props, inputs, inputs.projectId);
+		const resolved = await resolvePinnedBranch(props, inputs, existing, inputs.projectId, listBranches);
 		applyContext(props.contextFile, {
 			orgId,
 			projectId: inputs.projectId,
@@ -428,15 +467,18 @@ const runNonInteractive = async (props, inputs, existing) => {
 			contextFile: props.contextFile,
 			orgId,
 			projectId: inputs.projectId,
+			projectName,
 			branch: resolved.branch,
+			branchRef: resolved.ref,
 			created: false
 		});
 		return;
 	}
 	if (inputs.branch && existing.projectId) {
 		const projectId = existing.projectId;
-		const orgId = await resolveOrgForProject(props, inputs, projectId);
-		const resolved = await resolvePinnedBranch(props, inputs, existing, projectId);
+		const listBranches = branchListing(props, projectId);
+		const { orgId, projectName } = await resolveOrgForProject(props, inputs, projectId);
+		const resolved = await resolvePinnedBranch(props, inputs, existing, projectId, listBranches);
 		applyContext(props.contextFile, {
 			orgId,
 			projectId,
@@ -446,7 +488,9 @@ const runNonInteractive = async (props, inputs, existing) => {
 			contextFile: props.contextFile,
 			orgId,
 			projectId,
+			projectName,
 			branch: resolved.branch,
+			branchRef: resolved.ref,
 			created: false
 		});
 		return;
@@ -481,6 +525,10 @@ const runInteractive = async (props, inputs) => {
 			orgId,
 			projectId: created.project.id,
 			branch: created.branchName,
+			branchRef: pinnedRef({
+				id: created.branchId,
+				name: created.branchName
+			}),
 			created: true,
 			projectName: created.project.name,
 			regionId: created.project.region_id
@@ -491,7 +539,7 @@ const runInteractive = async (props, inputs) => {
 	const action = await promptProjectChoice(projects, inputs.projectName, { allowCreate: !inputs.branch });
 	if (action.type === "existing") {
 		const existing = readContextFile(props.contextFile);
-		const resolved = await resolvePinnedBranch(props, inputs, existing, action.projectId);
+		const resolved = await resolvePinnedBranch(props, inputs, existing, action.projectId, () => listAllBranches(props, action.projectId));
 		applyContext(props.contextFile, {
 			orgId,
 			projectId: action.projectId,
@@ -502,6 +550,7 @@ const runInteractive = async (props, inputs) => {
 			orgId,
 			projectId: action.projectId,
 			branch: resolved.branch,
+			branchRef: resolved.ref,
 			created: false,
 			projectName: action.name,
 			regionId: action.regionId
@@ -526,6 +575,10 @@ const runInteractive = async (props, inputs) => {
 		orgId,
 		projectId: created.project.id,
 		branch: created.branchName,
+		branchRef: pinnedRef({
+			id: created.branchId,
+			name: created.branchName
+		}),
 		created: true,
 		projectName: created.project.name,
 		regionId: created.project.region_id
@@ -800,19 +853,8 @@ const createProject = async (props, args) => {
 		branchName: data.branch.name ?? data.branch.id
 	};
 };
-const printSummary = (_props, summary) => {
-	const lines = [];
-	if (summary.created) lines.push(`Created project ${summary.projectId}${summary.projectName ? ` ("${summary.projectName}")` : ""}${summary.regionId ? ` in ${summary.regionId}` : ""}.`);
-	lines.push(`Linked ${summary.contextFile}:`);
-	if (summary.orgId) lines.push(`  orgId:     ${summary.orgId}`);
-	lines.push(`  projectId: ${summary.projectId}`);
-	lines.push(`  branch:    ${summary.branch}`);
-	if (summary.noChecks) {
-		lines.push("");
-		lines.push("Written offline (--no-checks): nothing was verified.");
-	}
-	lines.push("");
-	process.stdout.write(`${lines.join("\n")}\n`);
+const printSummary = (props, summary) => {
+	process.stdout.write(`${formatLinkSummary(summary, props.cwd ?? process.cwd())}\n`);
 };
 /**
 * Print the link summary, then run the bundled `env pull` so a completed `link` ends with
@@ -830,7 +872,7 @@ const finalizeLink = async (props, summary) => {
 		projectId: summary.projectId,
 		branch: summary.branch,
 		envPull: props.envPull
-	});
+	}, summary.branchRef);
 };
 /**
 * Interactive `link` finalize: the shared {@link finalizeLink} (summary + env
@@ -876,7 +918,7 @@ const maybeOfferConfigInit = async (props, summary) => {
 			projectId: summary.projectId,
 			branch: summary.branch,
 			envPull: props.envPull
-		});
+		}, summary.branchRef);
 	}
 };
 const onPromptState = (state) => {

package/dist/commands/link_output.js

@@ -0,0 +1,17 @@
+import { displayPath, row } from "./env_output.js";
+//#region src/commands/link_output.ts
+const formatLinkSummary = (summary, cwd) => {
+	const lines = [];
+	if (summary.created) lines.push(`Created project ${summary.projectName ?? summary.projectId}${summary.regionId ? ` in ${summary.regionId}` : ""}`);
+	lines.push(`Linked ${displayPath(summary.contextFile, cwd)}`);
+	lines.push(row("Project", summary.projectName ? `${summary.projectName} (${summary.projectId})` : summary.projectId));
+	lines.push(row("Branch", summary.branch));
+	if (summary.orgId) lines.push(row("Org", summary.orgId));
+	if (summary.noChecks) {
+		lines.push("");
+		lines.push("Written offline (--no-checks): nothing was verified.");
+	}
+	return `${lines.join("\n")}\n`;
+};
+//#endregion
+export { formatLinkSummary };

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-HVRMArlT.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-BWqJqBDJ.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES } from "./neon_services.js";
-import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-Dkl0TY44.js";
+import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-HYNFtxu5.js";
 //#region src/env_services.ts
 const ENV_PULL_SERVICES = NEON_SERVICES;
 const ENV_PULL_KEYS = [

package/dist/neon_services.js

@@ -25,6 +25,15 @@ const NEON_SERVICES = [
 	"object-storage",
 	"ai-gateway"
 ];
+/** How output names each service. */
+const NEON_SERVICE_LABELS = {
+	postgres: "Postgres",
+	auth: "Neon Auth",
+	"data-api": "Data API",
+	"object-storage": "Object Storage",
+	functions: "Functions",
+	"ai-gateway": "AI Gateway"
+};
 /**
 * Spellings that used to be canonical, and the service they now mean. Accepted so a scripted
 * `--services storage` keeps working, warned about so it does not quietly become a second
@@ -115,4 +124,4 @@ const servicesOption = (params) => ({
 */
 const servicesFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
 //#endregion
-export { NEON_SERVICES, NO_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption };
+export { NEON_SERVICES, NEON_SERVICE_LABELS, NO_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption };

package/dist/utils/ai_gateway_notice.js

@@ -131,11 +131,12 @@ const assertAiGatewayProvisionable = async (params) => {
 * fetching the plan or catalog is swallowed so it can never break the underlying command.
 */
 const warnAiGateway = async (params) => {
+	const modelsRead = params.gateway ? fetchGatewayModelIds(params.gateway.baseUrl, params.gateway.token) : null;
 	try {
 		const { data } = await params.apiClient.getProject(params.projectId);
 		const subscriptionType = data.project.owner?.subscription_type;
 		const orgId = data.project.org_id ?? void 0;
-		const modelIds = params.gateway ? await fetchGatewayModelIds(params.gateway.baseUrl, params.gateway.token) ?? void 0 : void 0;
+		const modelIds = modelsRead ? await modelsRead ?? void 0 : void 0;
 		const notice = buildAiGatewayNotice({
 			subscriptionType,
 			modelIds,

package/dist/utils/hooks.js

@@ -1,6 +1,6 @@
 import { log } from "../log.js";
 import { loadProjectConfig } from "../project.js";
-import { s as fetchEnvKeys } from "../_chunks/env-Dkl0TY44.js";
+import { s as fetchEnvKeys } from "../_chunks/env-HYNFtxu5.js";
 import { runHook } from "@neon/config-runtime";
 //#region src/utils/hooks.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.0.8",
+  "version": "8.0.10",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -64,9 +64,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/sdk": "7.0.0",
-    "@neon/config-runtime": "1.7.5",
-    "@neon/config": "1.8.3"
+    "@neon/config": "1.8.4",
+    "@neon/config-runtime": "1.7.6",
+    "@neon/sdk": "7.0.1"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -100,8 +100,8 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.26",
     "@neon/e2e-harness": "0.0.0",
+    "@neon-internals/env-core": "0.0.27",
     "@neon/functions": "0.11.0"
   },
   "publishConfig": {