neon 8.1.0 → 8.3.0

package/README.md

@@ -474,11 +474,11 @@ The resolved branch is then written (by name) to the same `.neon` file `link` us
 
 ```bash
 $ neon checkout main --project-id polished-snowflake-12345678
-INFO: Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+Checked out branch br-main-branch-87654321 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
 $ neon checkout dev --create --project-id polished-snowflake-12345678
-INFO: Created branch dev (br-dev-branch-12345678).
-INFO: Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
+Created branch dev (br-dev-branch-12345678).
+Checked out branch br-dev-branch-12345678 on project polished-snowflake-12345678. Updated /path/to/cwd/.neon.
 
 $ cat .neon
 {
@@ -698,9 +698,9 @@ Each command prints what it changed and the next step:
 
 ```
 $ neon config add function sendemail
-INFO: Created functions/sendemail.ts.
-INFO: Updated neon.ts: added functions.sendemail.
-INFO: Next: `neon dev` to run it locally, `neon config apply` to deploy.
+Created functions/sendemail.ts.
+Updated neon.ts: added functions.sendemail.
+Next: `neon dev` to run it locally, `neon config apply` to deploy.
 ```
 
 - **Functions** take a slug of 1-20 lowercase letters and digits, the same rule `plan` enforces. The handler file is written first and an existing file is never overwritten, so pointing `--source` at code you already have works. A `.js` `neon.ts` gets a `.js` handler.
@@ -740,11 +740,18 @@ neon deploy
 
 The branch is chosen with `--branch <id|name>`; without it the project's default branch is used. The policy is the `neon.ts` in the project directory (next to `.neon`, or the current directory without one); pass `--config <path>` to point at another file.
 
-**Apply-only flags** (also available on `deploy`):
+**Confirmations** (also on `deploy`). Two things need a yes before `apply` changes anything: applying to a branch Neon marks as protected, and overriding settings the branch already has (compute, TTL, `protected`, Data API settings, custom-domain targets, and disabling an existing Data API). Adding services and deploying functions is not an override, so on an unprotected branch it never asks. In a terminal, `apply` shows the settings it would override and asks once, default No. Without a terminal (CI, agents, pipes) or with `-o json|yaml`, it exits 1 before changing anything and names the flag to pass:
 
-- `--update-existing` (`-y`, `--yes`) — auto-confirm overriding existing remote settings on the branch. Without it, drift on settings already present remotely (compute, TTL, `protected`) is reported as a **conflict** and `apply` makes no changes until you resolve it or pass this flag.
-- `--allow-protected` — auto-confirm applying to a branch Neon marks as protected. Without it, `apply` refuses to touch a protected branch.
-**Output**: `status` prints the project, branch, and reverse-engineered config. `plan` / `apply` render a **`git diff`-style report** (matching [`neon diff`](#diff)): service changes (Neon Auth, Data API, buckets, functions) list as green `+` additions, while **branch setting changes** (TTL, `protected`, compute) show grouped under a `~ <branch>` header, one sorted `field → value` line each. A bare `apply` that hits drift on settings already present remotely prints those as a sorted **before→after** diff (`current → desired`, old in red / new in green) and exits non-zero until you pass `--update-existing`. Pass `--output json` (or `--output yaml`) to emit the full machine-readable result (`PushResult`) instead, for piping into other tools or CI.
+- `--update-existing` — override settings that differ from `neon.ts`.
+- `--allow-protected` — apply to a protected branch.
+- `-y`, `--yes` — both.
+
+```bash
+neon deploy --env .env.prod --allow-protected   # production main is protected, no drift expected
+neon deploy -y                                   # protected branch and drift, no questions
+```
+
+**Output**: `status` prints the project, branch, and reverse-engineered config. `plan` / `apply` render a **`git diff`-style report** (matching [`neon diff`](#diff)): service changes (Neon Auth, Data API, buckets, functions) list as green `+` additions, while **branch setting changes** (TTL, `protected`, compute) show grouped under a `~ <branch>` header, one sorted `field → value` line each. When `apply` would override settings already present remotely, it prints them as a sorted **before→after** diff (`current → desired`, old in red / new in green) before asking or, without a terminal, before exiting non-zero. Pass `--output json` (or `--output yaml`) to emit the full machine-readable result (`PushResult`) instead, for piping into other tools or CI.
 
 **`config status --current-branch`** (alias `neon status --current-branch`) prints _only_ the branch pinned in the local `.neon` file — no network, no auth, no analytics — and exits non-zero when none is pinned. This behavior lets it safely drive a shell prompt. Example [starship](https://starship.rs) segment:
 
@@ -1342,7 +1349,7 @@ Project  proj-in-org
 
 napi_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 WARNING: Store this key now: it is not shown again.
-INFO: Limited to proj-in-org: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.
+Limited to proj-in-org: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.
 ```
 
 `--org-id` and `--project-id` are mutually exclusive. A project-scoped key *is* an organization key, and its organization is looked up from the project rather than chosen separately. With neither flag you get an account key.
@@ -1481,7 +1488,7 @@ Global options are supported with any Neon CLI command.
 
 - <a id="analytics"></a>`--analytics`
 
-  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt`. To opt-out of analytics data collection, specify `--no-analytics` or `--analytics false`.
+  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt`. When the CLI fails on an internal bug (a JavaScript `TypeError`, `ReferenceError`, `RangeError`, or `SyntaxError`), it also sends that error to Neon's Sentry: the error type, the message only when it is a standard JavaScript message that names nothing but code (any other message is replaced), the stack trace with file paths cut to the package (`neon/dist/...`), the CLI and Node.js versions, and whether it ran in CI or a coding agent. To opt-out of analytics data collection and error reports, specify `--no-analytics` or `--analytics false`.
 
 - <a id="version"></a>`-v, --version`
 

package/dist/analytics.js

@@ -7,6 +7,7 @@ import { getAuthContext } from "./auth_context.js";
 import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
 import { isCurrentBranchProbe } from "./context.js";
+import { isUnexpectedError } from "./errors.js";
 import { Analytics } from "@segment/analytics-node";
 //#region src/analytics.ts
 const WRITE_KEY = "3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV";
@@ -190,6 +191,7 @@ const analyticsMiddleware = (args) => {
 /** How long closing waits for an unfinished account lookup before aborting it. */
 const ATTRIBUTION_WAIT_MS = 1e3;
 let closing;
+const errorReports = [];
 /**
 * Send queued events, then close the client and flush. Later calls share the first close: the
 * psql launcher starts one while psql runs, and a second `closeAndFlush` would only make the SDK
@@ -198,6 +200,7 @@ let closing;
 const closeAnalytics = (opts) => {
 	const analytics = client;
 	if (!analytics) return Promise.resolve();
+	if (closing && opts?.timeout !== void 0) return untilDeadline(closing, Date.now() + opts.timeout);
 	if (!closing) {
 		const started = Date.now();
 		closing = (async () => {
@@ -215,11 +218,27 @@ const closeAnalytics = (opts) => {
 			log.debug("Flushing CLI analytics");
 			const flush = opts?.timeout === void 0 ? void 0 : { timeout: Math.max(1, opts.timeout - (Date.now() - started)) };
 			await analytics.closeAndFlush(flush);
+			await settleErrorReports(opts?.timeout === void 0 ? void 0 : started + opts.timeout);
 			log.debug("Flushed CLI analytics");
 		})();
 	}
 	return closing;
 };
+const untilDeadline = async (work, deadline) => {
+	let timer;
+	await Promise.race([work, new Promise((resolve) => {
+		timer = setTimeout(resolve, Math.max(0, deadline - Date.now()));
+	})]);
+	clearTimeout(timer);
+};
+const settleErrorReports = async (deadline) => {
+	const reports = Promise.all(errorReports);
+	if (deadline === void 0) {
+		await reports;
+		return;
+	}
+	await untilDeadline(reports, deadline);
+};
 const getErrorAnalyticsEventContext = (_args) => ({
 	version: pkg_default.version,
 	ci: isCi(),
@@ -252,6 +271,13 @@ const sendError = (err, errCode) => {
 		});
 	});
 	log.debug("Sent CLI error event: %s", errCode);
+	if (errCode === "UNKNOWN_ERROR" && isUnexpectedError(err)) {
+		const report = import("./error_reporting.js").then(({ reportUnexpectedError }) => reportUnexpectedError(err, redactCredentialTokenIds)).catch((reportError) => {
+			log.debug("Could not report the error to Sentry: %s", reportError);
+		});
+		errorReports.push(report);
+		if (closing) closing = closing.then(() => report);
+	}
 };
 const trackEvent = (event, properties) => {
 	if (!client) return;

package/dist/auth.js

@@ -1,6 +1,6 @@
 import { log } from "./log.js";
-import { sendError } from "./analytics.js";
 import { matchErrorCode } from "./errors.js";
+import { sendError } from "./analytics.js";
 import { extendTokenSet } from "./utils/auth.js";
 import { createReadStream } from "node:fs";
 import { join } from "node:path";

package/dist/commands/api_keys.js

@@ -242,7 +242,7 @@ const withdraw = async (props, orgId, keyId) => {
 		const { data } = orgId ? await props.apiClient.revokeOrgApiKey(orgId, keyId) : await props.apiClient.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/commands/auth.js

@@ -451,7 +451,7 @@ const ensureAuth = async (props) => {
 	}
 	if (props._[0] === "me") {
 		const state = loaded === null ? "has no stored credential" : "holds a session that has expired";
-		process.stderr.write(`Not signed in: profile "${selection.profile}" ${state}. Run \`${getCliName()} login --profile ${selection.profile}\` to sign in, or use an API key with --api-key or NEON_API_KEY.\n`);
+		log.info(`Not signed in: profile "${selection.profile}" ${state}. Run \`${getCliName()} login --profile ${selection.profile}\` to sign in, or use an API key with --api-key or NEON_API_KEY.`);
 		process.exitCode = 1;
 		return;
 	}

package/dist/commands/branches.js

@@ -5,7 +5,7 @@ import { contextBranch, readContextFile } from "../context.js";
 import { branchCreateRequest } from "../parameters.gen.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
-import { looksLikeBranchId, looksLikeLSN, looksLikeTimestamp } from "../utils/formats.js";
+import { looksLikeBranchId, looksLikeLSN, looksLikeTimestamp, toIso } from "../utils/formats.js";
 import { branchIdFromProps, fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
 import { getComputeUnits } from "../utils/compute_units.js";
 import { psql } from "../utils/psql.js";
@@ -230,6 +230,14 @@ const list = async (props) => {
 		})
 	});
 };
+const parseAnnotation = (value) => {
+	try {
+		return JSON.parse(value);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse --annotation JSON: ${message}`);
+	}
+};
 const create = async (props) => {
 	const branches = await props.apiClient.listProjectBranches({ projectId: props.projectId }).then(({ data }) => data.branches);
 	const parentProps = (() => {
@@ -245,6 +253,7 @@ const create = async (props) => {
 		if (!branch) throw new Error(`Branch ${props.parent} not found`);
 		return { parent_id: branch.id };
 	})();
+	const annotationValue = props.annotation ? parseAnnotation(props.annotation) : void 0;
 	if (props.schemaOnly) {
 		if (!props.compute) throw new Error("Schema-only branches require a compute endpoint");
 		if (props.type !== EndpointType.ReadWrite) throw new Error("Schema-only branches require a read-write compute endpoint");
@@ -254,7 +263,7 @@ const create = async (props) => {
 			name: props.name,
 			...parentProps,
 			...props.schemaOnly ? { init_source: "schema-only" } : {},
-			...props["expires-at"] ? { expires_at: new Date(props["expires-at"]).toISOString() } : {},
+			...props["expires-at"] ? { expires_at: toIso(props["expires-at"], "--expires-at") } : {},
 			...props.protected !== void 0 ? { protected: props.protected } : {}
 		},
 		endpoints: props.compute ? [{
@@ -262,7 +271,7 @@ const create = async (props) => {
 			suspend_timeout_seconds: props.suspendTimeout === 0 ? void 0 : props.suspendTimeout,
 			...props.cu ? getComputeUnits(props.cu) : void 0
 		}] : [],
-		annotation_value: props.annotation ? JSON.parse(props.annotation) : void 0
+		annotation_value: annotationValue
 	}));
 	if (branches.find((b) => b.id === data.branch.parent_id)?.protected) log.warning("The parent branch is protected; a unique role password has been generated for the new branch.");
 	const out = writer(props);
@@ -437,7 +446,7 @@ const setExpiration = async (props) => {
 		...props,
 		id: props.branchId
 	});
-	const expiresAt = typeof props.expiresAt === "string" ? new Date(props.expiresAt).toISOString() : null;
+	const expiresAt = typeof props.expiresAt === "string" ? toIso(props.expiresAt, "--expires-at") : null;
 	const { data } = await retryOnLock(() => props.apiClient.updateProjectBranch(props.projectId, branchId, { branch: { expires_at: expiresAt } }));
 	writer(props).end(data.branch, {
 		fields: BRANCH_FIELDS,

package/dist/commands/checkout.js

@@ -223,7 +223,7 @@ const resolveBranchId = async (props, projectId, hookCtx) => {
 	if (props.create) return createCheckoutBranch(props, projectId, ref, branches, hookCtx);
 	const missingName = notFoundMessage(ref, branches, { suggestCreate: true });
 	if (isCi() || !process.stdout.isTTY) throw new Error(missingName);
-	log.error(missingName);
+	log.info(missingName);
 	const { create } = await prompts({
 		type: "confirm",
 		name: "create",
@@ -310,7 +310,7 @@ const resolveProjectId = async (props) => {
 	if (autoDetected) return autoDetected;
 	const missingProjectMessage = `Could not determine which Neon project to check out a branch from. Provide one via the --project-id flag or a .neon file (created by \`${getCliName()} link\` / \`${getCliName()} set-context\`).`;
 	if (isCi() || !process.stdout.isTTY) throw new Error(missingProjectMessage);
-	log.error(missingProjectMessage);
+	log.info(missingProjectMessage);
 	const { runLink } = await prompts({
 		type: "confirm",
 		name: "runLink",

package/dist/commands/config.js

@@ -27,7 +27,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import chalk from "chalk";
 import { packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
-import { PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
+import { PushAbortedError, PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
 //#region src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
 	ConfigInstallFailed: () => ConfigInstallFailed,
@@ -88,13 +88,18 @@ const envFlag = { env: {
 /** Apply-only flags, exported so `deploy` can reuse the exact same surface. */
 const applyFlags = {
 	"update-existing": {
-		alias: ["y", "yes"],
-		describe: "Auto-confirm overriding existing remote settings on the branch",
+		describe: "Override branch settings that differ from neon.ts without asking",
 		type: "boolean",
 		default: false
 	},
 	"allow-protected": {
-		describe: "Auto-confirm applying to a branch marked protected on Neon",
+		describe: "Apply to a branch marked protected on Neon without asking",
+		type: "boolean",
+		default: false
+	},
+	yes: {
+		alias: "y",
+		describe: "Answer yes to every confirmation: --update-existing and --allow-protected",
 		type: "boolean",
 		default: false
 	}
@@ -754,14 +759,8 @@ const applyCmd = async (props) => {
 		...branch.parentId ? { parentId: branch.parentId } : {},
 		...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
 	};
-	await runDeployBeforeHook({
-		hooks,
-		branch: hookBranch,
-		git,
-		event,
-		cwd
-	});
 	let result;
+	let declined = false;
 	try {
 		result = await apply(config, {
 			projectId: props.projectId,
@@ -769,15 +768,29 @@ const applyCmd = async (props) => {
 			...props.apiKey ? { apiKey: props.apiKey } : {},
 			...props.apiHost ? { apiHost: props.apiHost } : {},
 			...props.runtimeApi ? { api: props.runtimeApi } : {},
-			...props.updateExisting ? { updateExisting: true } : {},
-			...props.allowProtected ? { allowProtectedBranch: true } : {},
+			...props.updateExisting || props.yes ? { updateExisting: true } : {},
+			...props.allowProtected || props.yes ? { allowProtectedBranch: true } : {},
+			confirm: async (context) => {
+				if (context.overrides.length > 0) reportConflicts(props, context.overrides);
+				if (!canPromptForApply(props)) return false;
+				const proceed = await askToApply(context);
+				declined = !proceed;
+				return proceed;
+			},
+			beforeMutations: () => runDeployBeforeHook({
+				hooks,
+				branch: hookBranch,
+				git,
+				event,
+				cwd
+			}),
 			bundleFunction: neonctlBundler
 		});
 	} catch (err) {
+		if (err instanceof PushAbortedError) throw new Error(declined ? `Aborted: nothing was applied to branch "${err.branchName}".` : abortedApplyMessage(err));
 		if (err instanceof PushConflictError) {
 			reportConflicts(props, err.conflicts);
-			const overrideable = err.conflicts.every((c) => reasonAllowsUpdateExisting(c.reason));
-			throw new Error(overrideable ? "Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above." : "The policy conflicts with remote state. --update-existing will not resolve every conflict shown above.");
+			throw new Error("The policy conflicts with remote state. --update-existing will not resolve every conflict shown above.");
 		}
 		throw err;
 	}
@@ -864,6 +877,29 @@ const reportPushResult = (props, result, mode, services) => {
 	if (noChanges) log.info(`No changes — branch ${result.branchName} already matches the policy.`);
 	out.text(`\nUtilized services: ${services.join(", ")}\n`);
 };
+/** A prompt needs both ends of a terminal, and would corrupt `-o json|yaml` on stdout. */
+const canPromptForApply = (props) => !isCi() && Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY) && props.output !== "json" && props.output !== "yaml";
+const askToApply = async (context) => {
+	const branch = JSON.stringify(context.branchName);
+	const message = context.protectedBranch && context.overrideUpdates ? `Branch ${branch} is protected, and this overrides the settings shown above. Apply anyway?` : context.protectedBranch ? `Branch ${branch} is protected. Apply to it anyway?` : `Override the settings shown above on branch ${branch}?`;
+	const { default: prompts } = await import("prompts");
+	const { proceed } = await prompts({
+		type: "confirm",
+		name: "proceed",
+		message,
+		initial: false
+	});
+	return proceed === true;
+};
+/** Without a terminal there is no one to ask, so name the flags that answer the question. */
+const abortedApplyMessage = (err) => {
+	const branch = JSON.stringify(err.branchName);
+	const isProtected = err.reasons.includes("protected-branch");
+	const overrides = err.reasons.includes("override-updates");
+	if (isProtected && overrides) return `Branch ${branch} is protected and its settings differ from the policy. Re-run with -y (or --allow-protected --update-existing) to apply the changes shown above.`;
+	if (isProtected) return `Branch ${branch} is protected. Re-run with --allow-protected (or -y) to apply to it.`;
+	return "Branch settings conflict with the policy. Re-run with --update-existing (or -y) to apply the changes shown above.";
+};
 /**
 * Render the branch-setting {@link ConflictReport}s a bare `apply` refused to override (drift
 * without `--update-existing`) as the git-style before→after diff. JSON/YAML output emits the

package/dist/commands/dev.js

@@ -4,11 +4,11 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "../_chunks/env-BWqJqBDJ.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -550,7 +550,7 @@ const reconcileOnce = async (running, replan, ops) => {
 	try {
 		desired = await replan(nextSearchBase(running), keepPortsFromRunning(running));
 	} catch (err) {
-		log.info(chalk.red("neon.ts change ignored: ") + (err instanceof Error ? err.message : String(err)) + chalk.dim(" (fix it and save again)"));
+		log.warning("neon.ts change ignored: " + (err instanceof Error ? err.message : String(err)) + chalk.dim(" (fix it and save again)"));
 		return;
 	}
 	if (ops.isShuttingDown()) return;

package/dist/commands/env.js

@@ -7,11 +7,10 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BWqJqBDJ.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { announceTargetBranch } from "../utils/branch_notice.js";
-import { formatPulledEnv } from "./env_output.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BWqJqBDJ.js";
+import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -135,7 +134,7 @@ const pull = async (props, opts = {}) => {
 	const selectionEnvKeys = dropped ? dropped.envKeys : props.envKeys ?? [];
 	const selectedKeys = props.services !== void 0 || props.envKeys !== void 0 ? envKeysForSelection(selectionServices, selectionEnvKeys) : void 0;
 	const branch = opts.branch ?? await resolveBranchRef(props);
-	if (opts.announce) announceTargetBranch(props, branch, "Pulling env from branch");
+	const namedBranch = opts.announce ? branch : void 0;
 	const branchId = branch.branchId;
 	const location = {
 		cwd,
@@ -164,7 +163,7 @@ const pull = async (props, opts = {}) => {
 	});
 	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys, props.services !== void 0 ? selectionServices : void 0);
 	if (Object.keys(neonVars).length === 0) {
-		if (!(dropped !== null && dropped.services.length === 0 && dropped.envKeys.length === 0 && dropped.skipped.length > 0)) log.info("No Neon env variables to pull for this branch (no DATABASE_URL or enabled Auth / Data API).");
+		if (!(dropped !== null && dropped.services.length === 0 && dropped.envKeys.length === 0 && dropped.skipped.length > 0)) log.info(`No Neon env variables to pull from ${namedBranch ? pulledBranch(namedBranch) : "this branch"}: no DATABASE_URL or enabled Auth / Data API.`);
 		return { status: "empty" };
 	}
 	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId), existingEnv, props.services !== void 0 ? selectionServices : void 0, props.envKeys !== void 0 ? selectionEnvKeys : void 0) });
@@ -174,7 +173,7 @@ const pull = async (props, opts = {}) => {
 		removed,
 		file: targetPath,
 		...credential && credential.keys.length > 0 ? { credential } : {}
-	}, cwd));
+	}, cwd, namedBranch));
 	if (!fileExisted) ensureGitignored(targetPath);
 	const gatewayBaseUrl = neonVars.NEON_AI_GATEWAY_BASE_URL;
 	const gatewayToken = neonVars.NEON_AI_GATEWAY_TOKEN;

package/dist/commands/env_output.js

@@ -3,6 +3,7 @@ import { u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
 import { BRANCH_ENV_KEY, ENV_PULL_KEYS, serviceForEnvKey } from "../env_services.js";
 import { isAbsolute, relative } from "node:path";
 import { homedir } from "node:os";
+import chalk from "chalk";
 //#region src/commands/env_output.ts
 /** Wide enough for the longest label ("Object Storage") plus a gutter, so blocks align. */
 const LABEL_WIDTH = 16;
@@ -43,10 +44,12 @@ const groupKeys = (keys) => {
 	}
 	return groups;
 };
-const formatPulledEnv = (outcome, cwd) => {
+const pulledBranch = (branch) => `branch ${chalk.cyan.bold(branch.branchName)} ${chalk.dim(`(${branch.branchId}${branch.usedDefault ? ", project default" : ""})`)}`;
+const formatPulledEnv = (outcome, cwd, branch) => {
 	const fresh = new Set(outcome.credential?.fresh ?? []);
 	const count = outcome.written.length;
-	const lines = [`Pulled ${count} Neon variable${count === 1 ? "" : "s"} into ${displayPath(outcome.file, cwd)}`];
+	const source = branch ? ` from ${pulledBranch(branch)}` : "";
+	const lines = [`Pulled ${count} Neon variable${count === 1 ? "" : "s"} into ${displayPath(outcome.file, cwd)}${source}`];
 	const groups = groupKeys(outcome.written);
 	for (const group of GROUP_ORDER) {
 		const keys = groups.get(group);
@@ -61,4 +64,4 @@ const formatPulledEnv = (outcome, cwd) => {
 	return `${lines.join("\n")}\n`;
 };
 //#endregion
-export { displayPath, formatPulledEnv, row };
+export { displayPath, formatPulledEnv, pulledBranch, row };

package/dist/commands/git.js

@@ -110,7 +110,7 @@ const uninstall = (_props) => {
 			log.info("Removed the neon git post-checkout hook. Git → Neon sync is off.");
 			break;
 		case "foreign":
-			log.warning("Left the existing `post-checkout` hook in place (not managed by neon). Git → Neon sync flag cleared.");
+			log.info("Left the existing `post-checkout` hook in place (not managed by neon). Git → Neon sync flag cleared.");
 			break;
 		case "absent": log.info("No neon git hook was installed. Git → Neon sync flag cleared.");
 	}
@@ -295,7 +295,7 @@ const cleanup = async (props) => {
 	const orphanNeonNames = new Set(orphaned.map(([, neonBranch]) => neonBranch));
 	const branches = (await props.apiClient.listProjectBranches({ projectId: props.projectId })).data.branches;
 	const { toDelete, skipped } = partitionBranchesToPrune(branches, orphanNeonNames);
-	for (const { name, reason } of skipped) log.warning("Keeping Neon branch %s (%s) — never auto-deleted.", name, reason);
+	for (const { name, reason } of skipped) log.info("Keeping Neon branch %s (%s) — never auto-deleted.", name, reason);
 	if (toDelete.length === 0) {
 		log.info("No orphaned Neon branches to delete.");
 		return;

package/dist/commands/profile.js

@@ -466,7 +466,10 @@ const createByMinting = async (props) => {
 		});
 		warnAboutReach(scope);
 	} finally {
-		if (minted !== void 0 && !keyIsReachable) log.info(await withdrawKey(session, mintedScope, minted.id) ? `Revoked the key that was minted but not stored (id ${minted.id}).` : `Minted key ${minted.id} could be neither stored nor revoked, and may still be live. Remove it with: neon api-keys revoke ${minted.id}${mintedScope.orgId ? ` --org-id ${mintedScope.orgId}` : ""}`);
+		if (minted !== void 0 && !keyIsReachable) {
+			if (await withdrawKey(session, mintedScope, minted.id)) log.info(`Revoked the key that was minted but not stored (id ${minted.id}).`);
+			else log.warning(`Minted key ${minted.id} could be neither stored nor revoked, and may still be live. Remove it with: neon api-keys revoke ${minted.id}${mintedScope.orgId ? ` --org-id ${mintedScope.orgId}` : ""}`);
+		}
 		const revoked = await revokeToken(oauthProps, tokenSet);
 		log.info(revoked ? "Signed the browser session back out, so nothing but the key remains." : "Could not sign the browser session back out; it will expire on its own.");
 	}
@@ -604,7 +607,8 @@ const remove = async (props) => {
 				apiKey: stored.apiKey,
 				apiHost: props.apiHost
 			});
-			log.info(await withdrawKey(client, scope, keyId) ? `Revoked the API key (id ${keyId})` : `Could not revoke the API key (id ${keyId}) — it may still be live. Remove it with: neon api-keys revoke ${keyId}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}`);
+			if (await withdrawKey(client, scope, keyId)) log.info(`Revoked the API key (id ${keyId})`);
+			else log.warning(`Could not revoke the API key (id ${keyId}) — it may still be live. Remove it with: neon api-keys revoke ${keyId}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}`);
 		}
 	} else if (stored !== null) {
 		const revoked = await revokeTokenSet(stored.tokens, props);

package/dist/commands/snapshots.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
-import { looksLikeLSN, looksLikeTimestamp } from "../utils/formats.js";
+import { looksLikeLSN, looksLikeTimestamp, toIso } from "../utils/formats.js";
 import { branchIdResolve, fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { BRANCH_FIELDS } from "./branches.js";
 //#region src/commands/snapshots.ts
@@ -152,12 +152,6 @@ const handler = (args) => {
 };
 /** Narrow an unknown parsed JSON value to a plain object without type casting. */
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Normalize a user-supplied date to an ISO 8601 string, or throw a friendly error. */
-const toIso = (value, flag) => {
-	const ms = Date.parse(value);
-	if (Number.isNaN(ms)) throw new Error(`Invalid ${flag} value: "${value}". Use an RFC 3339 timestamp, e.g. 2025-12-31T23:59:59Z.`);
-	return new Date(ms).toISOString();
-};
 /**
 * Resolve a snapshot from an id **or** a name. Snapshot names are not guaranteed
 * unique, so an id match wins; a name that resolves to more than one snapshot is a

package/dist/error_reporting.js

@@ -0,0 +1,117 @@
+import { getCliAgent, isCi } from "./env.js";
+import pkg_default from "./pkg.js";
+import { Scope, createStackParser, createTransport } from "@sentry/core";
+import { ServerRuntimeClient, nodeStackLineParser } from "@sentry/core/server";
+//#region src/error_reporting.ts
+let dsn = "https://d2af98d872a47127826e36635023fcac@o1373725.ingest.us.sentry.io/4512222983290880";
+/** Lets tests send to a local collector; the CLI itself always reports to sentry.io. */
+const useErrorReportingDsnForTests = (testDsn) => {
+	dsn = testDsn;
+};
+const FLUSH_TIMEOUT_MS = 2e3;
+const fetchTransport = (options) => createTransport(options, async (request) => {
+	const response = await fetch(options.url, {
+		method: "POST",
+		body: typeof request.body === "string" ? request.body : new Uint8Array(request.body)
+	});
+	return {
+		statusCode: response.status,
+		headers: {
+			"x-sentry-rate-limits": response.headers.get("x-sentry-rate-limits"),
+			"retry-after": response.headers.get("retry-after")
+		}
+	};
+});
+/**
+* Stack frames carry absolute paths, which include the user's home directory. Keep the part
+* from the package onward (`neon/dist/index.js`); anything outside `node_modules` keeps only
+* its file name.
+*/
+const packageRelativePath = (path) => {
+	const normalized = path.replace(/\\/g, "/").replace(/^file:\/\//, "");
+	if (normalized.startsWith("node:")) return normalized;
+	const at = normalized.lastIndexOf("/node_modules/");
+	if (at >= 0) return normalized.slice(at + 14);
+	if (!normalized.includes("/")) return normalized;
+	return normalized.slice(normalized.lastIndexOf("/") + 1);
+};
+const scrubFrame = (frame) => {
+	if (frame.filename === void 0) return frame;
+	const filename = packageRelativePath(frame.filename);
+	return {
+		...frame,
+		filename,
+		...frame.abs_path !== void 0 ? { abs_path: packageRelativePath(frame.abs_path) } : {},
+		...filename.startsWith("neon/") ? { in_app: true } : {}
+	};
+};
+/**
+* V8 messages whose only variable part is an identifier from the code. Any other message can
+* quote user input (`JSON.parse` echoes what it failed on, Node's argument errors print the
+* received value), so it is replaced rather than sent.
+*/
+const SAFE_MESSAGES = [
+	/^Cannot read properties of (undefined|null) \(reading '[\w$]+'\)$/,
+	/^Cannot set properties of (undefined|null) \(setting '[\w$]+'\)$/,
+	/^[\w$.()]+ is not a function$/,
+	/^[\w$.()]+ is not iterable$/,
+	/^[\w$]+ is not defined$/,
+	/^Cannot access '[\w$]+' before initialization$/,
+	/^Assignment to constant variable\.$/,
+	/^Invalid time value$/,
+	/^Maximum call stack size exceeded$/
+];
+const OMITTED_MESSAGE = "(message omitted)";
+const safeMessage = (message) => SAFE_MESSAGES.some((pattern) => pattern.test(message)) ? message : OMITTED_MESSAGE;
+const stackFrameLines = (error) => {
+	const stack = error.stack ?? "";
+	const header = error.message ? `${error.name}: ${error.message}` : error.name;
+	return (stack.startsWith(header) ? stack.slice(header.length) : stack).split("\n").filter((line) => /^ {4}at /.test(line));
+};
+const sanitizeError = (error, redact) => {
+	const message = redact(safeMessage(error.message));
+	const sanitized = new Error(message);
+	sanitized.name = error.name;
+	sanitized.stack = [`${error.name}: ${message}`, ...stackFrameLines(error)].join("\n");
+	return sanitized;
+};
+const scrubEvent = (event) => {
+	const { server_name: _serverName, ...rest } = event;
+	return {
+		...rest,
+		...event.exception?.values ? { exception: { values: event.exception.values.map((exception) => ({
+			...exception,
+			...exception.stacktrace?.frames ? { stacktrace: {
+				...exception.stacktrace,
+				frames: exception.stacktrace.frames.map(scrubFrame)
+			} } : {}
+		})) } } : {}
+	};
+};
+const reportUnexpectedError = async (error, redact) => {
+	const client = new ServerRuntimeClient({
+		dsn,
+		release: `neon@${pkg_default.version}`,
+		environment: "production",
+		platform: "node",
+		runtime: {
+			name: "node",
+			version: process.version
+		},
+		stackParser: createStackParser(nodeStackLineParser()),
+		integrations: [],
+		transport: fetchTransport,
+		beforeSend: scrubEvent
+	});
+	client.init();
+	const scope = new Scope();
+	scope.setClient(client);
+	scope.setTags({
+		ci: String(isCi()),
+		agent: getCliAgent(process.env) ?? "none"
+	});
+	client.captureException(sanitizeError(error, redact), void 0, scope);
+	await client.flush(FLUSH_TIMEOUT_MS);
+};
+//#endregion
+export { packageRelativePath, reportUnexpectedError, useErrorReportingDsnForTests };

package/dist/errors.js

@@ -11,6 +11,12 @@ const matchErrorCode = (message) => {
 	return "UNKNOWN_ERROR";
 };
 /**
+* The CLI reports failures it handles by throwing a plain `Error` with the message to print.
+* One of JavaScript's own error types is a case it did not handle: a bug, or input it never
+* validated.
+*/
+const isUnexpectedError = (err) => err instanceof TypeError || err instanceof ReferenceError || err instanceof RangeError || err instanceof SyntaxError;
+/**
 * The single, human-readable line shown when the CLI couldn't reach the Neon API because
 * of a connection-level failure (DNS, refused/reset connection, offline). It replaces the
 * cryptic `fetch failed` / empty axios message a network blip otherwise surfaces (see
@@ -67,4 +73,4 @@ const isNetworkError = (err) => {
 	return false;
 };
 //#endregion
-export { NETWORK_ERROR_MESSAGE, isNetworkError, matchErrorCode };
+export { NETWORK_ERROR_MESSAGE, isNetworkError, isUnexpectedError, matchErrorCode };

package/dist/index.js

@@ -5,8 +5,8 @@ import { getAuthContext } from "./auth_context.js";
 import { r as defaultDir } from "./_chunks/paths-DMq0Lt7a.js";
 import { ensureConfigDir } from "./config.js";
 import { currentContextFile, enrichFromContext } from "./context.js";
-import { analyticsMiddleware, closeAnalytics, initAnalyticsClientMiddleware, sendError, takeCommandSuccessExtras, trackCommandSuccess } from "./analytics.js";
 import { NETWORK_ERROR_MESSAGE, isNetworkError, matchErrorCode } from "./errors.js";
+import { analyticsMiddleware, closeAnalytics, initAnalyticsClientMiddleware, sendError, takeCommandSuccessExtras, trackCommandSuccess } from "./analytics.js";
 import { AuthRefreshError, defaultClientID } from "./auth.js";
 import { getCliName } from "./utils/cli_name.js";
 import { ensureAuth } from "./commands/auth.js";

package/dist/init/copy.js

@@ -49,6 +49,7 @@ const SERVICES_MESSAGE = "Which services should neon.ts declare? (space to toggl
 const PACKAGE_MANAGER_MESSAGE = "Which package manager should install the Neon dependencies?";
 const NO_AGENTS_FALLBACK_STATUS = "No coding agents detected. Installing the default Neon skills for Cursor and Codex in this directory.";
 const NO_AGENT_SETUP_CONFLICT = "--no-agent-setup cannot be combined with --agent, --skill, or MCP flags.";
+const INIT_NEEDS_YES = "No interactive terminal. Re-run with -y to set up this directory with Recommended defaults: `neon init -y`. To pick each step instead, run `neon init` in a terminal, or see `neon init --help` for the flag that sets each step.";
 const NON_TTY_LINK_NEEDS_AUTH = "No interactive terminal. Sign in with `neon login`, then re-run, or pass --claimable.";
 const YES_LINK_NEEDS_AUTH = "-y cannot sign in. Sign in with `neon login`, then re-run, or pass --claimable.";
 const MCP_SCOPED_NEEDS_PROJECT = "--mcp-project-scoped requires a linked project. Link a project first, or omit --mcp-project-scoped.";
@@ -136,4 +137,4 @@ const headingForOutcome = (outcome) => {
 	}
 };
 //#endregion
-export { AGENT_DETECTED_DESCRIPTION, AGENT_MCP_PICKER_MESSAGE, AGENT_MCP_SKIP_MESSAGE, AGENT_OTHER_DESCRIPTION, AGENT_PICKER_MESSAGE, AGENT_PLUGIN_SKIP_MESSAGE, AGENT_SETUP_MESSAGE, AGENT_SETUP_PLUGIN_DESCRIPTION, AGENT_SETUP_PLUGIN_TITLE, AGENT_SETUP_SKILLS_DESCRIPTION, AGENT_SETUP_SKILLS_TITLE, AGENT_SETUP_SKIP_DESCRIPTION, AGENT_SETUP_SKIP_TITLE, AGENT_SKILLS_PICKER_MESSAGE, AGENT_SKILLS_SKIP_MESSAGE, CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, CONFIG_CONFIRM_HINT, CONFIG_CONFIRM_MESSAGE, HEADING_CANCELLED, HEADING_COMPLETE, HEADING_FAILED, HEADING_PENDING, INIT_SUBTITLE, MCP_AUTH_API_KEY_DESCRIPTION, MCP_AUTH_API_KEY_TITLE, MCP_AUTH_MESSAGE, MCP_AUTH_OAUTH_DESCRIPTION, MCP_AUTH_OAUTH_TITLE, MCP_SCOPED_NEEDS_PROJECT, MCP_SCOPE_GLOBAL_DESCRIPTION, MCP_SCOPE_GLOBAL_TITLE, MCP_SCOPE_MESSAGE, MCP_SCOPE_PROJECT_DESCRIPTION, MCP_SCOPE_PROJECT_TITLE, MODE_CUSTOM_DESCRIPTION, MODE_CUSTOM_TITLE, MODE_MESSAGE, MODE_RECOMMENDED_DESCRIPTION, MODE_RECOMMENDED_TITLE, NON_TTY_AGENT_SETUP, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, NO_AGENT_SETUP_CONFLICT, PACKAGE_MANAGER_MESSAGE, PROGRESS, PROJECT_SETUP_CLAIMABLE_DESCRIPTION, PROJECT_SETUP_CLAIMABLE_TITLE, PROJECT_SETUP_LINK_DESCRIPTION, PROJECT_SETUP_LINK_TITLE, PROJECT_SETUP_MESSAGE, SERVICES_HINT, SERVICES_MESSAGE, SKILLS_PICKER_MESSAGE, YES_LINK_NEEDS_AUTH, agentMissingCommandDescription, claimableNext, claimableThenServicesNext, envPullFailedNext, existingConfigNext, extraServicesNext, headingForOutcome, installFailedNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, namedAgentsUnavailable, skippedLinkNext, unattendedUnauthedNext };
+export { AGENT_DETECTED_DESCRIPTION, AGENT_MCP_PICKER_MESSAGE, AGENT_MCP_SKIP_MESSAGE, AGENT_OTHER_DESCRIPTION, AGENT_PICKER_MESSAGE, AGENT_PLUGIN_SKIP_MESSAGE, AGENT_SETUP_MESSAGE, AGENT_SETUP_PLUGIN_DESCRIPTION, AGENT_SETUP_PLUGIN_TITLE, AGENT_SETUP_SKILLS_DESCRIPTION, AGENT_SETUP_SKILLS_TITLE, AGENT_SETUP_SKIP_DESCRIPTION, AGENT_SETUP_SKIP_TITLE, AGENT_SKILLS_PICKER_MESSAGE, AGENT_SKILLS_SKIP_MESSAGE, CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, CONFIG_CONFIRM_HINT, CONFIG_CONFIRM_MESSAGE, HEADING_CANCELLED, HEADING_COMPLETE, HEADING_FAILED, HEADING_PENDING, INIT_NEEDS_YES, INIT_SUBTITLE, MCP_AUTH_API_KEY_DESCRIPTION, MCP_AUTH_API_KEY_TITLE, MCP_AUTH_MESSAGE, MCP_AUTH_OAUTH_DESCRIPTION, MCP_AUTH_OAUTH_TITLE, MCP_SCOPED_NEEDS_PROJECT, MCP_SCOPE_GLOBAL_DESCRIPTION, MCP_SCOPE_GLOBAL_TITLE, MCP_SCOPE_MESSAGE, MCP_SCOPE_PROJECT_DESCRIPTION, MCP_SCOPE_PROJECT_TITLE, MODE_CUSTOM_DESCRIPTION, MODE_CUSTOM_TITLE, MODE_MESSAGE, MODE_RECOMMENDED_DESCRIPTION, MODE_RECOMMENDED_TITLE, NON_TTY_AGENT_SETUP, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, NO_AGENT_SETUP_CONFLICT, PACKAGE_MANAGER_MESSAGE, PROGRESS, PROJECT_SETUP_CLAIMABLE_DESCRIPTION, PROJECT_SETUP_CLAIMABLE_TITLE, PROJECT_SETUP_LINK_DESCRIPTION, PROJECT_SETUP_LINK_TITLE, PROJECT_SETUP_MESSAGE, SERVICES_HINT, SERVICES_MESSAGE, SKILLS_PICKER_MESSAGE, YES_LINK_NEEDS_AUTH, agentMissingCommandDescription, claimableNext, claimableThenServicesNext, envPullFailedNext, existingConfigNext, extraServicesNext, headingForOutcome, installFailedNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, namedAgentsUnavailable, skippedLinkNext, unattendedUnauthedNext };

package/dist/init/mode.js

@@ -1,5 +1,4 @@
-import { INIT_NEEDS_YES_OR_TERMINAL } from "./plan.js";
-import { NON_TTY_AGENT_SETUP, NO_AGENT_SETUP_CONFLICT } from "./copy.js";
+import { INIT_NEEDS_YES, NON_TTY_AGENT_SETUP, NO_AGENT_SETUP_CONFLICT } from "./copy.js";
 //#region src/init/mode.ts
 const hasInitMcpFlags = (input) => input.mcpConfigLocation !== void 0 || input.mcpAuth !== void 0 || input.mcpProjectScoped === true;
 const hasSkillsFlag = (skills) => skills !== void 0 && skills.length > 0;
@@ -10,7 +9,7 @@ const resolveInitMode = (input) => {
 	if (input.yes) return { kind: "recommended" };
 	if (hasExistingSetupFlags(input)) return { kind: "custom" };
 	if (input.interactive) return { kind: "ask" };
-	throw new Error(INIT_NEEDS_YES_OR_TERMINAL);
+	throw new Error(INIT_NEEDS_YES);
 };
 const assertAgentSetupFlags = (input) => {
 	if (!input.skipAgents) return;

package/dist/log.js

@@ -9,7 +9,7 @@ const log = {
 		process.stderr.write(`WARNING: ${format(...args)}\n`);
 	},
 	info: (...args) => {
-		process.stderr.write(`INFO: ${format(...args)}\n`);
+		process.stderr.write(`${format(...args)}\n`);
 	},
 	error: (...args) => {
 		process.stderr.write(`ERROR: ${format(...args)}\n`);

package/dist/mcp/mint.js

@@ -14,7 +14,7 @@ const withdraw = async (client, keyId, orgId) => {
 		const { data } = orgId ? await client.revokeOrgApiKey(orgId, keyId) : await client.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/retire_credential.js

@@ -57,7 +57,8 @@ const retirePreviousCredential = async (props, name, existing, replacementKey) =
 			apiKey: existing.apiKey,
 			apiHost: props.apiHost
 		});
-		log.info(await withdrawKey(client, existing.scope, existing.keyId) ? `Revoked the key it replaces (id ${existing.keyId})` : `Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
+		if (await withdrawKey(client, existing.scope, existing.keyId)) log.info(`Revoked the key it replaces (id ${existing.keyId})`);
+		else log.warning(`Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
 		return;
 	}
 	const revoked = await revokeTokenSet(existing.tokens, props);
@@ -70,7 +71,7 @@ const withdrawKey = async (client, scope, keyId) => {
 		const { data } = scope.orgId ? await client.revokeOrgApiKey(scope.orgId, keyId) : await client.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		log.warning("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };

package/dist/utils/config_diff.js

@@ -130,7 +130,6 @@ const renderAppliedChanges = (changes, title, opts) => {
 	lines.push(...renderBranchGroups(byBranch, paint));
 	return lines.join("\n");
 };
-const isOverrideableConflict = (conflict) => conflict.reason.includes("Pass `updateExisting: true`");
 const CUSTOM_DOMAIN_REASON = /^custom domain "([^"]+)"/;
 const labeledConflictField = (conflict) => {
 	if (conflict.field !== "customDomain") return conflict.field;
@@ -145,8 +144,7 @@ const renderBranchSettingConflicts = (conflicts, opts) => {
 		const existing = byBranch.get(conflict.identifier) ?? [];
 		byBranch.set(conflict.identifier, [...existing, ...expandField(labeledConflictField(conflict), conflict.current, conflict.desired)]);
 	}
-	const heading = conflicts.every(isOverrideableConflict) ? "Branch settings differ (re-run with --update-existing to apply)" : "Branch settings differ";
-	return [paint.title(heading), ...renderBranchGroups(byBranch, paint)].join("\n");
+	return [paint.title("Branch settings differ"), ...renderBranchGroups(byBranch, paint)].join("\n");
 };
 const renderCustomDomainFollowup = (result, opts) => {
 	const paint = palette(opts.color);

package/dist/utils/formats.js

@@ -3,9 +3,15 @@ const HAIKU_REGEX = /^[a-z0-9]+-[a-z0-9]+-[a-z0-9]+$/;
 const looksLikeBranchId = (branch) => branch.startsWith("br-") && HAIKU_REGEX.test(branch.substring(3));
 const LSN_REGEX = /^[a-fA-F0-9]{1,8}\/[a-fA-F0-9]{1,8}$/;
 const looksLikeLSN = (lsn) => LSN_REGEX.test(lsn);
+/** Normalize a user-supplied date to an ISO 8601 string, or throw a friendly error. */
+const toIso = (value, flag) => {
+	const ms = Date.parse(value);
+	if (Number.isNaN(ms)) throw new Error(`Invalid ${flag} value: "${value}". Use an RFC 3339 timestamp, e.g. 2025-12-31T23:59:59Z.`);
+	return new Date(ms).toISOString();
+};
 const looksLikeTimestamp = (timestamp) => {
 	if (isNaN(Date.parse(timestamp))) return false;
 	return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?([+-]\d{2}:\d{2}|Z)$/.test(timestamp);
 };
 //#endregion
-export { looksLikeBranchId, looksLikeLSN, looksLikeTimestamp };
+export { looksLikeBranchId, looksLikeLSN, looksLikeTimestamp, toIso };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.1.0",
+  "version": "8.3.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -46,6 +46,7 @@
     "@clack/prompts": "0.10.1",
     "@hono/node-server": "2.0.4",
     "@segment/analytics-node": "1.3.0",
+    "@sentry/core": "11.2.0",
     "add-mcp": "2.0.0",
     "chalk": "5.3.0",
     "chokidar": "5.0.0",
@@ -64,8 +65,8 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.8.5",
-    "@neon/config-runtime": "1.7.7",
+    "@neon/config": "1.8.6",
+    "@neon/config-runtime": "1.8.0",
     "@neon/sdk": "7.0.1"
   },
   "optionalDependencies": {
@@ -100,9 +101,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.29",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/functions": "0.11.0",
-    "@neon-internals/env-core": "0.0.28"
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",