neonctl 2.24.1 → 2.25.0

package/commands/bucket.js

@@ -1,16 +1,21 @@
-import { createWriteStream } from 'node:fs';
-import { unlink } from 'node:fs/promises';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { stat, unlink } from 'node:fs/promises';
 import { basename } from 'node:path';
 import { pipeline } from 'node:stream/promises';
-import { isAxiosError } from 'axios';
+import axios, { isAxiosError } from 'axios';
 import { retryOnLock } from '../api.js';
 import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
 import { log } from '../log.js';
 import { writer } from '../writer.js';
-import { createProjectBranchBucket, listProjectBranchBuckets, deleteProjectBranchBucket, listProjectBranchBucketObjects, getProjectBranchBucketObject, deleteProjectBranchBucketObject, deleteProjectBranchBucketObjectsByPrefix, } from '../storage_api.js';
+import { createProjectBranchBucket, listProjectBranchBuckets, deleteProjectBranchBucket, listProjectBranchBucketObjects, getProjectBranchBucketObject, deleteProjectBranchBucketObject, deleteProjectBranchBucketObjectsByPrefix, presignUpload, } from '../storage_api.js';
 const OBJECT_FIELDS = ['key', 'size', 'last_modified', 'etag'];
 const BUCKET_FIELDS = ['name', 'access_level'];
 const ACCESS_LEVELS = ['private', 'public_read'];
+// Single-PUT upload cap. Objects larger than this must use multipart upload,
+// which is out of scope for v1; we reject them client-side before any HTTP so
+// the user gets an immediate, clear error rather than a server-side rejection
+// part-way through a large transfer.
+const MAX_OBJECT_BYTES = 100 * 1024 * 1024; // 100 MB
 // Ambient scope shared by every bucket sub-command. The bucket name (and the
 // object key/prefix) is always a positional, never a flag.
 const scopeOptions = {
@@ -85,7 +90,7 @@ export const builder = (argv) => argv
         .options(scopeOptions),
     handler: (args) => deleteBucket(args),
 })
-    .command('object <sub-command>', 'List, download or delete objects in a bucket', (yargs) => yargs
+    .command('object <sub-command>', 'List, download, upload or delete objects in a bucket', (yargs) => yargs
     .usage('$0 bucket object <sub-command> [options]')
     .command({
     command: 'list <target>',
@@ -129,6 +134,25 @@ export const builder = (argv) => argv
         type: 'string',
     },
 }), (args) => getObject(args))
+    .command('put <target>', 'Upload a local file to a bucket as an object', (yargs) => yargs
+    .usage('$0 bucket object put <bucket>/<key> [options]')
+    .positional('target', {
+    describe: 'The object to upload to: <bucket>/<key>',
+    type: 'string',
+    demandOption: true,
+})
+    .options({
+    ...scopeOptions,
+    file: {
+        describe: 'Path to the local file to upload',
+        type: 'string',
+        demandOption: true,
+    },
+    'content-type': {
+        describe: 'Content-Type to store the object with (e.g. text/plain)',
+        type: 'string',
+    },
+}), (args) => putObject(args))
     .command({
     command: 'delete <target>',
     aliases: ['rm'],
@@ -328,6 +352,95 @@ const getObject = async (props) => {
     }
     log.info(`Object "${key}" downloaded from bucket "${bucket}" on branch ${branchId} to ${destination}`);
 };
+const putObject = async (props) => {
+    const branchId = await branchIdFromProps(props);
+    const { bucket, rest: key } = splitBucketTarget(props.target);
+    if (bucket === '' || key === '') {
+        throw new Error('Object target must be in the form <bucket>/<key>.');
+    }
+    // Stat the file first so we fail fast on a missing/unreadable file and can
+    // enforce the single-PUT size cap BEFORE any network round-trip. We also
+    // reuse the byte count as the PUT Content-Length so the stream is uploaded
+    // without buffering the whole file in memory.
+    let fileSize;
+    try {
+        const fileStat = await stat(props.file);
+        if (!fileStat.isFile()) {
+            throw new Error(`"${props.file}" is not a regular file.`);
+        }
+        fileSize = fileStat.size;
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT') {
+            throw new Error(`File "${props.file}" does not exist.`);
+        }
+        throw err;
+    }
+    if (fileSize > MAX_OBJECT_BYTES) {
+        throw new Error(`File "${props.file}" is ${fileSize} bytes, which exceeds the ${MAX_OBJECT_BYTES}-byte (100 MB) single-upload limit. Larger objects are not supported yet.`);
+    }
+    // Ask the console for a presigned PUT URL plus the headers that must travel
+    // with the upload for the signature to verify. No SigV4 happens in neonctl.
+    let presign;
+    try {
+        ({ data: presign } = await presignUpload(props.apiClient, {
+            projectId: props.projectId,
+            branchId,
+            bucketName: bucket,
+            objectKey: key,
+            contentType: props.contentType,
+        }));
+    }
+    catch (err) {
+        if (isAxiosError(err)) {
+            const status = err.response?.status;
+            if (status === 404) {
+                throw new Error(objectNotFoundMessage(err, key, bucket, branchId));
+            }
+            // Any other HTTP error from the console (e.g. 403 when the caller lacks
+            // write permission on the bucket) carries the same JSON `{ message }`
+            // body, so surface that rather than a bare axios message. When the body
+            // has no usable message, fall back to a clean status-bearing error.
+            const serverMessage = serverErrorMessage(err.response?.data);
+            throw new Error(serverMessage ??
+                `Failed to presign upload for "${key}" in bucket "${bucket}" on branch ${branchId}${status !== undefined ? ` (HTTP ${status})` : ''}: ${err.message}`);
+        }
+        throw err;
+    }
+    // Stream the file straight into the PUT body; never buffer the whole file.
+    // The presigned URL targets the branch S3 data-plane endpoint directly, so
+    // this PUT goes through a plain axios call rather than the console api-client.
+    //
+    // `presign.headers` carries the signature-relevant headers (e.g. host,
+    // content-type); the server does not sign Content-Length, so we set it
+    // ourselves from the stat'd size to keep the upload streamed, not chunked.
+    // `maxRedirects: 0` ensures we never resend the file bytes and signed headers
+    // to a different host if the data-plane endpoint were to answer with a
+    // redirect.
+    try {
+        await axios.put(presign.url, createReadStream(props.file), {
+            headers: {
+                ...presign.headers,
+                'Content-Length': fileSize,
+            },
+            maxBodyLength: Infinity,
+            maxContentLength: Infinity,
+            maxRedirects: 0,
+        });
+    }
+    catch (err) {
+        // The upload targets the S3 data plane, whose error bodies are XML rather
+        // than the JSON `{ message }` the console returns, so surface the status
+        // (and axios message) rather than leaking a raw error. Never include the
+        // presigned URL, which carries the signature.
+        if (isAxiosError(err)) {
+            const status = err.response?.status;
+            throw new Error(`Failed to upload "${props.file}" to "${key}" in bucket "${bucket}" on branch ${branchId}${status !== undefined ? ` (HTTP ${status})` : ''}: ${err.message}`);
+        }
+        throw err;
+    }
+    log.info(`File "${props.file}" uploaded to "${key}" in bucket "${bucket}" on branch ${branchId}`);
+};
 const deleteObject = async (props) => {
     const branchId = await branchIdFromProps(props);
     const { bucket, rest } = splitBucketTarget(props.target);

package/commands/checkout.js

@@ -7,7 +7,7 @@ import { createBranch, pickBranchInteractively, } from '../utils/branch_picker.j
 import { fillSingleProject } from '../utils/enrichers.js';
 import { looksLikeBranchId } from '../utils/formats.js';
 import { autoPullEnvAfterPin } from './env.js';
-import { applyPolicyOnCreate } from './config.js';
+import { applyPolicyOnCreate, createBranchFromPolicyOnCheckout, } from './config.js';
 import { handler as linkHandler } from './link.js';
 // The positional is optional: omitting it in an interactive terminal opens a
 // branch picker. In non-interactive contexts a missing branch is an error.
@@ -52,27 +52,30 @@ export const handler = async (props) => {
     // (--project-id flag > .neon file > single-project auto-detect); when
     // nothing resolves, fall back to an interactive `neonctl link`.
     const projectId = await resolveProjectId(props);
-    const { branchId, created } = await resolveBranchId(props, projectId);
+    const { branchId, branchName, created, policyApplied } = await resolveBranchId(props, projectId);
     const orgId = await resolveOrgId(props, projectId);
-    // `checkout` is a thin helper over `set-context`. It fully "heals" the
-    // context file: it always (re)writes `projectId`, `branchId`, and `orgId`
-    // (when the project has one) so a `.neon` that drifted or was missing fields
-    // ends up complete and consistent after checkout.
+    // `checkout` is a thin helper over `link`. It fully "heals" the context file:
+    // it always (re)writes `projectId`, `branch`, and `orgId` (when the project
+    // has one) so a `.neon` that drifted or was missing fields ends up complete
+    // and consistent after checkout. The branch is stored as its name when known
+    // (see `link`'s `branch` field), matching what `link` writes.
     applyContext(props.contextFile, {
         projectId,
         ...(orgId ? { orgId } : {}),
-        branchId,
+        branch: branchName,
     });
     log.info('Checked out branch %s on project %s%s. Updated %s.', branchId, projectId, orgId ? ` (org ${orgId})` : '', props.contextFile);
-    // Only when checkout just *created* the branch do we apply the local neon.ts policy,
-    // so a new branch comes up with the declared settings/infra immediately. Checking out an
-    // existing branch never reconciles it — that's an explicit `neonctl deploy` / `config
-    // apply`. No neon.ts on disk → nothing to apply.
-    if (created) {
+    // When checkout *created* the branch and a neon.ts exists, the branch was created straight
+    // from the policy (evaluated as a new branch) so its settings/infra are already applied —
+    // see `policyApplied`. The fallback below covers the case where the branch was created bare
+    // (e.g. a policy-driven create wasn't possible); `applyPolicyOnCreate` is a no-op when there
+    // is no neon.ts on disk. Checking out an existing branch never reconciles it.
+    if (created && !policyApplied) {
         await applyPolicyOnCreate({
             projectId,
             branchId,
             ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+            ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         });
     }
     // Bundle `env pull` so the branch-first loop is just link + checkout: the branch you
@@ -94,26 +97,39 @@ const resolveBranchId = async (props, projectId) => {
                 'or run interactively to pick one from a list.',
         });
         if (picked.kind === 'existing') {
-            return { branchId: picked.branchId, created: false };
+            const existing = branches.find((b) => b.id === picked.branchId);
+            return {
+                branchId: picked.branchId,
+                branchName: existing?.name ?? picked.branchId,
+                created: false,
+                policyApplied: false,
+            };
         }
         // The user chose "create a new branch" from the picker.
-        return {
-            branchId: await createBranch(props.apiClient, projectId, picked.name, branches),
-            created: true,
-        };
+        return createCheckoutBranch(props, projectId, picked.name, branches);
     }
     const ref = props.id;
     // A `br-…` value is an id; match strictly by id and never offer to create.
     if (looksLikeBranchId(ref)) {
         const byId = branches.find((b) => b.id === ref);
         if (byId) {
-            return { branchId: byId.id, created: false };
+            return {
+                branchId: byId.id,
+                branchName: byId.name ?? byId.id,
+                created: false,
+                policyApplied: false,
+            };
         }
         throw new Error(notFoundMessage(ref, branches));
     }
     const byName = branches.find((b) => b.name === ref);
     if (byName) {
-        return { branchId: byName.id, created: false };
+        return {
+            branchId: byName.id,
+            branchName: byName.name ?? byName.id,
+            created: false,
+            policyApplied: false,
+        };
     }
     // Name not found: offer to create it interactively, mirroring `branch create`.
     if (isCi() || !process.stdout.isTTY) {
@@ -129,9 +145,35 @@ const resolveBranchId = async (props, projectId) => {
     if (!create) {
         throw new Error(`Aborted: branch "${ref}" was not found and not created.`);
     }
+    return createCheckoutBranch(props, projectId, ref, branches);
+};
+/**
+ * Create the branch to check out. When a `neon.ts` exists, route through the policy-driven
+ * create so the new branch comes up branched from the policy's `parent` and configured with
+ * its declared TTL / compute / services (evaluated as a *new* branch). Otherwise fall back to
+ * a bare branch off the default — the handler then applies the policy (a no-op with no
+ * `neon.ts`).
+ */
+const createCheckoutBranch = async (props, projectId, name, branches) => {
+    const fromPolicy = await createBranchFromPolicyOnCheckout({
+        projectId,
+        branchName: name,
+        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
+    });
+    if (fromPolicy) {
+        return {
+            branchId: fromPolicy.branchId,
+            branchName: name,
+            created: true,
+            policyApplied: true,
+        };
+    }
     return {
-        branchId: await createBranch(props.apiClient, projectId, ref, branches),
+        branchId: await createBranch(props.apiClient, projectId, name, branches),
+        branchName: name,
         created: true,
+        policyApplied: false,
     };
 };
 const notFoundMessage = (ref, branches) => `Branch ${ref} not found.\nAvailable branches: ${branches
@@ -202,6 +244,8 @@ const resolveProjectId = async (props) => {
         ...props,
         agent: false,
         yes: false,
+        clear: false,
+        checks: true,
     });
     const linked = readContextFile(props.contextFile);
     if (!linked.projectId) {

package/commands/config.js

@@ -1,5 +1,5 @@
 import { resolveConfig } from '@neondatabase/config';
-import { apply, inspect, loadConfigFromFile, plan, } from '@neondatabase/config-runtime';
+import { apply, createBranch as createBranchFromPolicy, inspect, loadConfigFromFile, plan, } from '@neondatabase/config-runtime';
 import { toNeonConfigView } from '../config_format.js';
 import { log } from '../log.js';
 import { loadEnvFileIntoProcess } from '../env_file.js';
@@ -7,6 +7,7 @@ import { branchIdFromProps, fillSingleProject } from '../utils/enrichers.js';
 import { bundleEntry } from '../utils/esbuild.js';
 import { zipBundle } from '../utils/zip.js';
 import { writer } from '../writer.js';
+import { autoPullEnvAfterPin } from './env.js';
 /**
  * Bundle a function with neonctl's OWN bundler (the shared esbuild helper) so the
  * config-runtime never has to import esbuild itself. Injecting this keeps esbuild
@@ -16,6 +17,7 @@ import { writer } from '../writer.js';
 const neonctlBundler = async (fn) => zipBundle(await bundleEntry(fn.source));
 const INSPECT_FIELDS = ['project', 'branch', 'config'];
 const APPLIED_FIELDS = ['action', 'kind', 'identifier', 'details'];
+const FUNCTION_FIELDS = ['slug', 'invocation_url'];
 const CONFLICT_FIELDS = [
     'identifier',
     'field',
@@ -47,6 +49,20 @@ export const applyFlags = {
         default: false,
     },
 };
+/**
+ * `--env-pull` for `config apply` / `deploy` (shared so both expose the identical surface).
+ * After a successful apply, the branch's Neon env vars are written to a local `.env` — the
+ * same bundled convenience as `link` / `checkout`. On by default; `--no-env-pull` opts out.
+ */
+export const envPullFlag = {
+    'env-pull': {
+        describe: "Pull the branch's Neon env vars (DATABASE_URL, …) into a local .env after a " +
+            'successful apply. On by default; use --no-env-pull to skip (e.g. when injecting ' +
+            'env at runtime with `neon-env run` / `neon dev`).',
+        type: 'boolean',
+        default: true,
+    },
+};
 export const command = 'config';
 export const describe = 'Manage a branch with a neon.ts policy';
 export const builder = (argv) => argv
@@ -85,6 +101,7 @@ export const builder = (argv) => argv
     },
     ...envFlag,
     ...applyFlags,
+    ...envPullFlag,
 }), (args) => applyCmd(args));
 export const handler = (args) => {
     return args;
@@ -107,6 +124,7 @@ export const status = async (props) => {
         projectId: props.projectId,
         branchId,
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
     });
     // The pulled `config` carries the branch's tuning inside a closure that JSON can't
@@ -141,9 +159,10 @@ export const planCmd = async (props) => {
         projectId: props.projectId,
         branchId,
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
     });
-    reportPushResult(props, result, 'plan');
+    reportPushResult(props, result, 'plan', utilizedServices(config));
 };
 export const applyCmd = async (props) => {
     const config = await loadConfig(props);
@@ -152,21 +171,68 @@ export const applyCmd = async (props) => {
         projectId: props.projectId,
         branchId,
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
         ...(props.updateExisting ? { updateExisting: true } : {}),
         ...(props.allowProtected ? { allowProtectedBranch: true } : {}),
         bundleFunction: neonctlBundler,
     });
-    reportPushResult(props, result, 'apply');
+    reportPushResult(props, result, 'apply', utilizedServices(config));
+    // After a successful apply/deploy, write the branch's Neon env vars to a local .env —
+    // the same bundled convenience as `link` / `checkout`, so the branch is immediately
+    // usable for local dev. `--no-env-pull` opts out; a pull failure degrades to a warning
+    // (the apply already succeeded). See autoPullEnvAfterPin.
+    await autoPullEnvAfterPin({ ...props, envPull: props.envPull !== false });
 };
 /**
- * Render a {@link PushResult}. JSON/YAML output emits the raw result verbatim so it
- * can be piped; the human-readable path renders the actual changes (dropping noops)
- * and any blocking conflicts as tables, or a "nothing to do" line when both are empty.
+ * A static service toggle (`auth` / `dataApi` / `preview.aiGateway`) is "on" unless
+ * explicitly disabled: `true` / `{}` / `{ enabled: true }` enable it; `false` /
+ * `{ enabled: false }` / absent leave it off. Mirrors the runtime's `isServiceEnabled`
+ * (which isn't exported), kept tiny and pure so it can be read straight off the policy.
  */
-const reportPushResult = (props, result, mode) => {
+const isToggleEnabled = (toggle) => {
+    if (toggle === undefined)
+        return false;
+    if (typeof toggle === 'boolean')
+        return toggle;
+    return toggle.enabled !== false;
+};
+/**
+ * Human-readable list of the services a `neon.ts` policy utilizes on the branch, shown under
+ * the plan/apply table. Postgres is always present (every branch has it); the rest are listed
+ * only when the policy declares them. This deliberately surfaces services that produce **no**
+ * plan step — notably the AI Gateway, which is always available and only needs a scoped branch
+ * credential (not a provisioning step) — so adding `preview.aiGateway` to a neon.ts isn't
+ * mistaken for being silently dropped. Service enablement is static top-level config (it never
+ * lives in the per-branch closure), so reading it straight off `config` is accurate.
+ */
+const utilizedServices = (config) => {
+    const services = ['Postgres'];
+    if (isToggleEnabled(config.auth))
+        services.push('Neon Auth');
+    if (isToggleEnabled(config.dataApi))
+        services.push('Data API');
+    if (Object.keys(config.preview?.buckets ?? {}).length > 0) {
+        services.push('Object Storage');
+    }
+    if (Object.keys(config.preview?.functions ?? {}).length > 0) {
+        services.push('Functions');
+    }
+    if (isToggleEnabled(config.preview?.aiGateway))
+        services.push('AI Gateway');
+    return services;
+};
+/**
+ * Render a {@link PushResult}. JSON/YAML output emits the raw result (plus a `services`
+ * summary) verbatim so it can be piped; the human-readable path renders the actual changes
+ * (dropping noops) and any blocking conflicts as tables, or a "nothing to do" line when both
+ * are empty — and always closes with the list of services the policy utilizes so a service
+ * that produces no plan step (Postgres, or the credential-gated AI Gateway) isn't mistaken
+ * for being missing from the plan above.
+ */
+const reportPushResult = (props, result, mode, services) => {
     if (props.output === 'json' || props.output === 'yaml') {
-        writer(props).end(result, { fields: [] });
+        writer(props).end({ ...result, services }, { fields: [] });
         return;
     }
     const changes = result.applied
@@ -184,21 +250,46 @@ const reportPushResult = (props, result, mode) => {
         desired: stringify(conflict.desired),
         reason: conflict.reason,
     }));
-    if (changes.length === 0 && conflicts.length === 0) {
-        log.info(`No changes — branch ${result.branchName} already matches the policy.`);
-        return;
+    // Deployed functions carry their invocation URL in the change details — pull them into a
+    // dedicated table so users can see where to call each function without digging through the
+    // raw details blob. Keyed by slug so a function never shows twice.
+    const functionUrlBySlug = new Map();
+    for (const change of result.applied) {
+        if (change.action === 'noop')
+            continue;
+        const slug = change.details?.slug;
+        const invocationUrl = change.details?.invocationUrl;
+        if (typeof slug === 'string' && typeof invocationUrl === 'string') {
+            functionUrlBySlug.set(slug, invocationUrl);
+        }
     }
+    const functions = [...functionUrlBySlug].map(([slug, invocation_url]) => ({
+        slug,
+        invocation_url,
+    }));
     const out = writer(props);
+    const noChanges = changes.length === 0 && conflicts.length === 0;
     if (changes.length > 0) {
         out.write(changes, {
             fields: APPLIED_FIELDS,
             title: mode === 'plan' ? 'Planned changes' : 'Applied changes',
         });
     }
+    if (functions.length > 0) {
+        out.write(functions, {
+            fields: FUNCTION_FIELDS,
+            title: mode === 'plan' ? 'Function URLs (after apply)' : 'Function URLs',
+        });
+    }
     if (conflicts.length > 0) {
         out.write(conflicts, { fields: CONFLICT_FIELDS, title: 'Conflicts' });
     }
+    // Flush any tables, then append the summary so it reads directly below them.
     out.end();
+    if (noChanges) {
+        log.info(`No changes — branch ${result.branchName} already matches the policy.`);
+    }
+    out.text(`\nUtilized services: ${services.join(', ')}\n`);
     if (conflicts.length > 0) {
         log.info('Resolve the conflicts above, or re-run with --update-existing to override the current remote settings.');
     }
@@ -235,11 +326,16 @@ export const applyPolicyOnCreate = async (props) => {
         projectId: props.projectId,
         branchId: props.branchId,
         ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
         ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
         updateExisting: true,
         allowProtectedBranch: true,
         bundleFunction: neonctlBundler,
     });
+    logPolicyResult(result);
+};
+/** Log a one-line summary of what applying a `neon.ts` policy changed (or that nothing did). */
+const logPolicyResult = (result) => {
     const changes = result.applied.filter((c) => c.action !== 'noop');
     if (changes.length === 0) {
         log.info('neon.ts applied — no changes were needed.');
@@ -247,3 +343,40 @@ export const applyPolicyOnCreate = async (props) => {
     }
     log.info('neon.ts applied — %d change%s: %s', changes.length, changes.length === 1 ? '' : 's', changes.map((c) => `${c.action} ${c.identifier}`).join(', '));
 };
+/**
+ * Create a branch **from** the local `neon.ts` policy. Returns `null` when there is no
+ * `neon.ts` on the path from cwd up to the repo root, so `neonctl checkout` can fall back to a
+ * bare branch create.
+ *
+ * Unlike a bare create followed by {@link applyPolicyOnCreate}, this evaluates the policy for
+ * the **new** branch (`exists: false`): the runtime branches from the policy's `parent` and
+ * brings the branch up with its declared TTL / compute settings / services. That's what makes
+ * a policy keyed on `!branch.exists` (the common "only configure new branches" shape) take
+ * effect on the very first `checkout` — a bare create + `apply` always saw `exists: true` and
+ * skipped that block.
+ */
+export const createBranchFromPolicyOnCheckout = async (props) => {
+    let config;
+    try {
+        ({ config } = await loadConfigFromFile({
+            ...(props.cwd ? { cwd: props.cwd } : {}),
+        }));
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (/Could not find a Neon config file/i.test(message))
+            return null;
+        throw err;
+    }
+    const { branchId, branchName, result } = await createBranchFromPolicy(config, {
+        projectId: props.projectId,
+        branchName: props.branchName,
+        ...(props.apiKey ? { apiKey: props.apiKey } : {}),
+        ...(props.apiHost ? { apiHost: props.apiHost } : {}),
+        ...(props.runtimeApi ? { api: props.runtimeApi } : {}),
+        bundleFunction: neonctlBundler,
+    });
+    log.info('Created branch %s (%s) from neon.ts policy.', branchName, branchId);
+    logPolicyResult(result);
+    return { branchId };
+};

package/commands/deploy.js

@@ -1,5 +1,5 @@
 import { fillSingleProject } from '../utils/enrichers.js';
-import { applyCmd, applyFlags, envFlag } from './config.js';
+import { applyCmd, applyFlags, envFlag, envPullFlag, } from './config.js';
 export const command = 'deploy';
 export const describe = 'Apply a neon.ts policy to a branch (alias for `config apply`)';
 export const builder = (argv) => argv
@@ -19,6 +19,7 @@ export const builder = (argv) => argv
     },
     ...envFlag,
     ...applyFlags,
+    ...envPullFlag,
 })
     .middleware(fillSingleProject)
     .strict();