neon 8.3.6 → 8.4.1

package/dist/commands/realtime.js

@@ -0,0 +1,50 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { retryOnLock } from "../api.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+import { defineConfig } from "@neon/config";
+//#region src/commands/realtime.ts
+var realtime_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	disable: () => disable,
+	enable: () => enable,
+	handler: () => handler
+});
+/** Request Realtime provisioning or an allowed-origin update for a branch. */
+const enable = async (props) => {
+	const realtime = props.allowedOrigins === void 0 ? true : { allowedOrigins: props.allowedOrigins };
+	defineConfig({ preview: { realtime } });
+	const branchId = await branchIdFromProps(props);
+	await retryOnLock(() => props.apiClient.enableProjectBranchRealtime(props.projectId, branchId, props.allowedOrigins === void 0 ? {} : { allowed_origins: [...props.allowedOrigins] }));
+	log.info("Realtime enable requested for branch %s.", branchId);
+};
+/** Request Realtime deprovisioning for a branch. */
+const disable = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await retryOnLock(() => props.apiClient.disableProjectBranchRealtime(props.projectId, branchId));
+	log.info("Realtime disable requested for branch %s.", branchId);
+};
+const command = "realtime";
+const describe = "Manage Neon Realtime for a branch";
+const builder = (argv) => argv.usage("$0 realtime <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("enable", "Enable Realtime on a branch", (yargs) => yargs.strict().option("allowed-origin", {
+	describe: "Allowed browser origin (repeatable). \"*\" allows every origin",
+	type: "array",
+	string: true
+}), (args) => enable({
+	...args,
+	...args.allowedOrigin !== void 0 ? { allowedOrigins: args.allowedOrigin } : {}
+})).command("disable", "Disable Realtime on a branch", (yargs) => yargs.strict(), (args) => disable(args));
+const handler = (_args) => {};
+//#endregion
+export { builder, command, describe, disable, enable, handler, realtime_exports as t };

package/dist/commands/subscribe.js

@@ -0,0 +1,247 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { writer } from "../writer.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+import { o as resolveNeonEnvVars } from "../_chunks/env-4WGRW2nw.js";
+import YAML from "yaml";
+//#region src/commands/subscribe.ts
+var subscribe_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler,
+	subscribe: () => subscribe
+});
+const command = "subscribe <query>";
+const describe = "Subscribe to a live SQL query with Neon Realtime";
+const builder = (argv) => argv.usage("$0 subscribe \"<query>\" [options]").positional("query", {
+	describe: "SELECT query to subscribe to",
+	type: "string"
+}).options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	},
+	changes: {
+		describe: "Show raw resets and transaction batches instead of full query results",
+		type: "boolean",
+		default: false
+	}
+}).example("$0 subscribe \"SELECT * FROM items\"", "Print the full result whenever it changes").example("$0 subscribe --changes \"SELECT * FROM items\"", "Print raw reset and delta events").epilogue("The subscription runs until interrupted. JSON output is newline-delimited; YAML output uses one document per event.").middleware(fillSingleProject).strict();
+const handler = async (props) => {
+	const controller = new AbortController();
+	const stop = (exitCode) => {
+		controller.abort();
+		setImmediate(() => process.exit(exitCode));
+	};
+	const onSigint = () => stop(130);
+	const onSigterm = () => stop(143);
+	process.once("SIGINT", onSigint);
+	process.once("SIGTERM", onSigterm);
+	try {
+		await subscribe({
+			...props,
+			signal: controller.signal
+		});
+	} finally {
+		process.removeListener("SIGINT", onSigint);
+		process.removeListener("SIGTERM", onSigterm);
+	}
+};
+/** Resolve Realtime credentials and stream one live SQL query until interrupted. */
+const subscribe = async (props, dependencies = {}) => {
+	const resolveBranchId = dependencies.resolveBranchId ?? branchIdFromProps;
+	const resolveEnv = dependencies.resolveEnv ?? resolveNeonEnvVars;
+	const connect = dependencies.connect ?? connectRealtime;
+	const branchId = await resolveBranchId(props);
+	const { vars } = await resolveEnv({
+		cwd: props.cwd ?? process.cwd(),
+		contextFile: props.contextFile,
+		projectId: props.projectId,
+		branchId,
+		apiKey: props.apiKey,
+		apiHost: props.apiHost,
+		services: ["postgres", "realtime"],
+		...props.runtimeApi ? { api: props.runtimeApi } : {}
+	});
+	const realtime = await connect({
+		url: requiredEnv(vars, "NEON_REALTIME_URL"),
+		secret: requiredEnv(vars, "NEON_REALTIME_SECRET"),
+		database: await databaseName(requiredEnv(vars, "DATABASE_URL"))
+	});
+	const render = createRenderer(props);
+	let subscription;
+	try {
+		if (props.changes) {
+			subscription = await realtime.subscribeChanges(props.query);
+			await consumeChanges(subscription, render, props.signal);
+		} else {
+			const materialized = await realtime.subscribeMaterialized(props.query);
+			subscription = materialized;
+			await consumeSnapshots(materialized, render, props.signal);
+		}
+	} finally {
+		subscription?.unsubscribe();
+		realtime.close();
+	}
+};
+const connectRealtime = async (options) => {
+	await ensureWebSocket();
+	const { createRealtime, rawSql } = await import("@neon/realtime");
+	const realtime = createRealtime({
+		url: options.url,
+		secret: options.secret,
+		db: options.database
+	});
+	return {
+		subscribeMaterialized: (query) => realtime.subscribe(rawSql(query)),
+		subscribeChanges: (query) => realtime.subscribe(rawSql(query), { materialize: false }),
+		close: () => realtime.close()
+	};
+};
+/** Node 20 does not expose WebSocket without an experimental flag. */
+const ensureWebSocket = async () => {
+	if (typeof globalThis.WebSocket !== "undefined") return;
+	const { WebSocket } = await import("undici");
+	Object.defineProperty(globalThis, "WebSocket", {
+		configurable: true,
+		writable: true,
+		value: WebSocket
+	});
+};
+const requiredEnv = (vars, key) => {
+	const value = vars[key];
+	if (value) return value;
+	throw new Error(`Could not resolve ${key} for the selected branch.`);
+};
+const databaseName = async (connectionString) => {
+	const { parse } = await import("pg-connection-string");
+	const database = parse(connectionString, { useLibpqCompat: true }).database;
+	if (database) return database;
+	throw new Error("DATABASE_URL must include a database name.");
+};
+const createRenderer = (props) => {
+	const out = props.out ?? process.stdout;
+	let renderedTableFrame = false;
+	return (event) => {
+		if (props.output === "json") {
+			out.write(`${JSON.stringify(event)}\n`);
+			return;
+		}
+		if (props.output === "yaml") {
+			out.write(`---\n${YAML.stringify(event)}`);
+			return;
+		}
+		if (renderedTableFrame) out.write("\n");
+		renderedTableFrame = true;
+		renderTableEvent(out, event);
+	};
+};
+const renderTableEvent = (out, event) => {
+	if (event.type === "snapshot") {
+		const fields = rowFields(event.rows);
+		writer({
+			output: "table",
+			out
+		}).end(event.rows, {
+			fields,
+			humanTitle: "Query result",
+			emptyMessage: "Query returned no rows."
+		});
+		return;
+	}
+	if (event.type === "reset") {
+		const rows = event.rows.map(({ rowId, row }) => ({
+			row_id: rowId,
+			row
+		}));
+		writer({
+			output: "table",
+			out
+		}).end(rows, {
+			fields: ["row_id", "row"],
+			humanTitle: "Reset",
+			emptyMessage: "Reset contains no rows."
+		});
+		return;
+	}
+	const rows = event.changes.map((change) => ({
+		type: change.type,
+		row_id: change.rowId,
+		row: change.type === "upsert" ? change.row : void 0
+	}));
+	writer({
+		output: "table",
+		out
+	}).end(rows, {
+		fields: [
+			"type",
+			"row_id",
+			"row"
+		],
+		humanTitle: `Batch (txids: ${event.txids.join(", ") || "none"})`,
+		emptyMessage: "Batch contains no row changes."
+	});
+};
+const rowFields = (rows) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of rows) for (const key of Object.keys(row)) seen.add(key);
+	return [...seen];
+};
+const consumeSnapshots = async (subscription, render, signal) => consumeSubscription(subscription, (fail) => [subscription.onReset(() => attempt(fail, () => {
+	const rows = subscription.getSnapshot().data;
+	if (rows !== void 0) render({
+		type: "snapshot",
+		rows
+	});
+})), subscription.onBatch(() => attempt(fail, () => {
+	const rows = subscription.getSnapshot().data;
+	if (rows !== void 0) render({
+		type: "snapshot",
+		rows
+	});
+}))], signal);
+const consumeChanges = async (subscription, render, signal) => consumeSubscription(subscription, (fail) => [subscription.onReset((rows) => attempt(fail, () => render({
+	type: "reset",
+	rows
+}))), subscription.onBatch((changes, batch) => attempt(fail, () => render({
+	type: "batch",
+	txids: batch.txids,
+	changes
+})))], signal);
+const consumeSubscription = (subscription, listenForData, signal) => new Promise((resolve, reject) => {
+	let settled = false;
+	let detachData = [];
+	let detachState = () => void 0;
+	const onAbort = () => finish(resolve);
+	const finish = (settle, error) => {
+		if (settled) return;
+		settled = true;
+		for (const detach of detachData) detach();
+		detachState();
+		signal?.removeEventListener("abort", onAbort);
+		settle(error);
+	};
+	const fail = (error) => finish(reject, error);
+	const onState = (state) => {
+		if (state.status === "error") fail(state.error);
+		else if (state.status === "closed") finish(resolve);
+	};
+	detachData = listenForData(fail);
+	detachState = subscription.onStateChange(onState);
+	signal?.addEventListener("abort", onAbort, { once: true });
+	onState(subscription.getState());
+	if (signal?.aborted) onAbort();
+});
+const attempt = (fail, action) => {
+	try {
+		action();
+	} catch (error) {
+		fail(error);
+	}
+};
+//#endregion
+export { builder, command, describe, handler, subscribe, subscribe_exports as t };

package/dist/config_edit.js

@@ -161,6 +161,52 @@ const setToggle = (parsed, key) => {
 		change: `set ${toggle.path}: false → true`
 	};
 };
+const realtimeValue = (edit) => edit.enabled && edit.allowedOrigins !== void 0 ? `{ allowedOrigins: ${JSON.stringify(edit.allowedOrigins)} }` : String(edit.enabled);
+/** Set the complete Realtime desired state while preserving an existing settings object. */
+const setRealtime = (parsed, edit) => {
+	const desired = realtimeValue(edit);
+	const declaration = `realtime: ${desired},`;
+	const snippet = [
+		"preview: {",
+		`${parsed.unit}${declaration}`,
+		"},"
+	];
+	const previewEntry = findEntry(parsed.root, "preview");
+	if (!previewEntry) return {
+		source: insertEntry(parsed, parsed.root, snippet, snippet, entryAfter(parsed, "preview")),
+		change: `added preview.realtime: ${desired}`
+	};
+	const preview = objectOf(parsed, previewEntry);
+	if (!preview) return unsupported("preview is set to an expression, not an object literal.", snippet);
+	const entry = findEntry(preview, "realtime");
+	if (!entry) return {
+		source: insertEntry(parsed, preview, [declaration], snippet),
+		change: `added preview.realtime: ${desired}`
+	};
+	const current = parsed.source.slice(entry.valueStart, entry.valueEnd);
+	if (entry.keyed && current === desired) return { source: parsed.source };
+	const object = objectOf(parsed, entry);
+	if (edit.enabled && edit.allowedOrigins === void 0 && object) return { source: parsed.source };
+	if (edit.enabled && edit.allowedOrigins !== void 0 && object) {
+		const origins = JSON.stringify(edit.allowedOrigins);
+		const allowedOrigins = findEntry(object, "allowedOrigins");
+		if (!allowedOrigins) return {
+			source: insertEntry(parsed, object, [`allowedOrigins: ${origins},`], snippet),
+			change: `added preview.realtime.allowedOrigins: ${origins}`
+		};
+		if (!allowedOrigins.keyed) return unsupported("preview.realtime.allowedOrigins is a computed property.", snippet);
+		if (parsed.source.slice(allowedOrigins.valueStart, allowedOrigins.valueEnd) === origins) return { source: parsed.source };
+		return {
+			source: parsed.source.slice(0, allowedOrigins.valueStart) + origins + parsed.source.slice(allowedOrigins.valueEnd),
+			change: `set preview.realtime.allowedOrigins to ${origins}`
+		};
+	}
+	if (!entry.keyed || current !== "true" && current !== "false" && !object) return unsupported("preview.realtime is set to an expression, not a boolean or object literal.", snippet);
+	return {
+		source: parsed.source.slice(0, entry.valueStart) + desired + parsed.source.slice(entry.valueEnd),
+		change: `set preview.realtime to ${desired}`
+	};
+};
 /**
 * Whether `dataApi` verifies a third-party IdP, in which case it does not need Neon Auth. An
 * `authProvider` that is neither literal is refused rather than assumed to be Neon's.
@@ -205,6 +251,9 @@ const apply = (source, edit) => {
 		steps.push(step);
 	};
 	switch (edit.kind) {
+		case "realtime":
+			run((parsed) => setRealtime(parsed, edit));
+			break;
 		case "service":
 			if (edit.service === "auth") run((parsed) => setToggle(parsed, "auth"));
 			else if (edit.service === "ai-gateway") run((parsed) => setToggle(parsed, "aiGateway"));

package/dist/config_services.js

@@ -1,5 +1,6 @@
 import { authoredAiGateway, authoredBuckets, authoredFunctions } from "@neon/config";
 //#region src/config_services.ts
+const isClaimableService = (service) => service !== "realtime";
 const isToggleEnabled = (toggle) => {
 	if (toggle === void 0) return false;
 	if (typeof toggle === "boolean") return toggle;
@@ -13,8 +14,10 @@ const declaredNeonServices = (config) => {
 	if (Object.keys(authoredBuckets(config) ?? {}).length > 0) services.push("object-storage");
 	if (Object.keys(authoredFunctions(config) ?? {}).length > 0) services.push("functions");
 	if (isToggleEnabled(authoredAiGateway(config))) services.push("ai-gateway");
+	if (config.preview?.realtime !== void 0 && config.preview.realtime !== false) services.push("realtime");
 	return services;
 };
+const declaredClaimableNeonServices = (config) => declaredNeonServices(config).filter(isClaimableService);
 const dataApiSettingsToSnake = (settings) => {
 	const out = {};
 	if (settings.dbAggregatesEnabled !== void 0) out.db_aggregates_enabled = settings.dbAggregatesEnabled;
@@ -51,4 +54,4 @@ const claimableDataApiCreateBody = (config) => {
 	return withSettings({ auth_provider: "neon_auth" });
 };
 //#endregion
-export { claimableDataApiCreateBody, declaredNeonServices };
+export { claimableDataApiCreateBody, declaredClaimableNeonServices, declaredNeonServices, isClaimableService };

package/dist/config_template.js

@@ -76,11 +76,12 @@ const renderGaServices = (services) => {
 const renderNeonConfig = (services) => {
 	const auth = services.includes("auth") || services.includes("data-api");
 	const dataApi = services.includes("data-api") ? "  dataApi: true,\n" : "";
+	const realtimeDeclaration = services.includes("realtime") ? "  preview: {\n    realtime: true,\n  },\n" : "";
 	return `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
 
 export default defineConfig({
   // Declare your Neon services here
-  auth: ${auth},
+${realtimeDeclaration}  auth: ${auth},
 ${dataApi}${renderGaServices(services)}  // Branch policy: per-branch tuning
   branch: (branch) => {
     if (branch.isDefault) {

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-L2DPzDAK.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-4WGRW2nw.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES } from "./neon_services.js";
-import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-XsUZj_Ay.js";
+import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-BpP3Dqpe.js";
 //#region src/env_services.ts
 const ENV_PULL_SERVICES = NEON_SERVICES;
 const ENV_PULL_KEYS = [
@@ -7,6 +7,7 @@ const ENV_PULL_KEYS = [
 	NEON_ENV_VAR_KEYS.branch.name,
 	...Object.values(NEON_ENV_VAR_KEYS.auth),
 	...Object.values(NEON_ENV_VAR_KEYS.dataApi),
+	...Object.values(NEON_ENV_VAR_KEYS.realtime),
 	...Object.values(NEON_ENV_VAR_KEYS.storage),
 	...Object.values(NEON_ENV_VAR_KEYS.aiGateway)
 ];
@@ -16,6 +17,7 @@ const SERVICE_ENV_KEYS = {
 	postgres: Object.values(NEON_ENV_VAR_KEYS.postgres),
 	auth: Object.values(NEON_ENV_VAR_KEYS.auth),
 	"data-api": Object.values(NEON_ENV_VAR_KEYS.dataApi),
+	realtime: Object.values(NEON_ENV_VAR_KEYS.realtime),
 	"object-storage": Object.values(NEON_ENV_VAR_KEYS.storage),
 	"ai-gateway": Object.values(NEON_ENV_VAR_KEYS.aiGateway),
 	functions: []
@@ -44,6 +46,8 @@ const ENV_KEY_SERVICE = {
 	NEON_AUTH_BASE_URL: "auth",
 	NEON_AUTH_JWKS_URL: "auth",
 	NEON_DATA_API_URL: "data-api",
+	NEON_REALTIME_URL: "realtime",
+	NEON_REALTIME_SECRET: "realtime",
 	AWS_ACCESS_KEY_ID: "object-storage",
 	AWS_SECRET_ACCESS_KEY: "object-storage",
 	AWS_ENDPOINT_URL_S3: "object-storage",

package/dist/index.js

@@ -12,11 +12,13 @@ import { getCliName } from "./utils/cli_name.js";
 import { ensureAuth } from "./commands/auth.js";
 import { recoverFrom401 } from "./auth_recovery.js";
 import { UsageError, failOnUsageError, isBareParentCommand, showHelp, showUsageErrorHelp } from "./help.js";
+import { stagingFeaturesEnabledForArgv } from "./utils/staging.js";
 import { lazyCommands, preloadCommand } from "./commands/manifest.js";
 import { rewriteUnknownAgentArg } from "./init/plan.js";
 import { recoverFromSSO } from "./sso_recovery.js";
 import { notifyIfUpdateAvailable } from "./update_notifier.js";
 import { fillInArgs, resolveApiKeyFromEnv } from "./utils/middlewares.js";
+import { collapseRepeatedFlags, declaredOptions } from "./utils/repeated_flags.js";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 //#region src/index.ts
@@ -28,6 +30,7 @@ const NO_SUBCOMMANDS_VERBS = [
 	"cs",
 	"connection-string",
 	"psql",
+	"subscribe",
 	"set-context",
 	"checkout",
 	"link",
@@ -47,7 +50,10 @@ const NO_SUBCOMMANDS_VERBS = [
 	"status"
 ];
 let builder = yargs(hideBin(process.argv));
-builder = builder.scriptName(pkg_default.name).locale("en").usage("$0 <command> [options]").parserConfiguration({ "populate--": true }).help().option("output", {
+builder = builder.scriptName(pkg_default.name).locale("en").usage("$0 <command> [options]").parserConfiguration({
+	"populate--": true,
+	"parse-positional-numbers": false
+}).help().option("output", {
 	alias: "o",
 	group: "Global options:",
 	describe: "Set output format",
@@ -120,6 +126,8 @@ builder = builder.scriptName(pkg_default.name).locale("en").usage("$0 <command>
 		default: true
 	}
 }).middleware((args) => {
+	collapseRepeatedFlags(args, declaredOptions(builder));
+}, true).middleware((args) => {
 	fillInArgs(args);
 }, true).middleware(resolveApiKeyFromEnv, true).middleware(initAnalyticsClientMiddleware, true).help(false).group("help", "Global options:").option("help", {
 	describe: "Show help",
@@ -129,7 +137,7 @@ builder = builder.scriptName(pkg_default.name).locale("en").usage("$0 <command>
 	if (args.help) await showHelp(builder);
 }, true).middleware(async (args) => {
 	if (args._.length === 1 && !NO_SUBCOMMANDS_VERBS.includes(args._[0]) || args._.length > 1 && isBareParentCommand(builder, args._)) await showHelp(builder);
-}).middleware(ensureAuth).middleware(enrichFromContext).middleware(analyticsMiddleware).command(lazyCommands).strictCommands().version(pkg_default.version).group("version", "Global options:").alias("version", "v").completion().scriptName(getCliName()).epilog("For more information, visit https://neon.com/docs/reference/neon-cli").wrap(null).fail(failOnUsageError);
+}).middleware(ensureAuth).middleware(enrichFromContext).middleware(analyticsMiddleware).command(lazyCommands({ staging: stagingFeaturesEnabledForArgv(hideBin(process.argv)) })).strictCommands().version(pkg_default.version).group("version", "Global options:").alias("version", "v").completion().scriptName(getCliName()).epilog("For more information, visit https://neon.com/docs/reference/neon-cli").wrap(null).fail(failOnUsageError);
 async function handleError(msg, err, canRetry) {
 	if (process.argv.some((arg) => arg === "--help" || arg === "-h")) {
 		await showHelp(builder);

package/dist/init/run.js

@@ -9,6 +9,7 @@ import { getCliName } from "../utils/cli_name.js";
 import { servicesFlagValue } from "../neon_services.js";
 import { CONFIG_INIT_SERVICES, parseConfigInitServices } from "../config_template.js";
 import { hasNeonConfigFile, neonConfigFilename } from "../project.js";
+import { assertRealtimeAvailable } from "../utils/staging.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
 import { mcpInstallableAgents } from "../mcp/targets.js";
 import { missingPluginsCommands, pluginsInstallableAgents } from "../plugins/targets.js";
@@ -183,7 +184,7 @@ const runInit = async (props) => {
 	};
 	const servicesFlag = servicesFlagValue(props.services);
 	if (props.config === false && servicesFlag !== void 0) throw new Error(INIT_CONFIG_SERVICES_CONFLICT);
-	if (servicesFlag !== void 0) parseConfigInitServices(servicesFlag);
+	if (servicesFlag !== void 0 && parseConfigInitServices(servicesFlag).includes("realtime")) assertRealtimeAvailable(props.apiHost);
 	const linkInputs = {
 		...props.orgId ? { orgId: props.orgId } : {},
 		...props.projectId ? { projectId: props.projectId } : {},

package/dist/neon_services.js

@@ -23,7 +23,8 @@ const NEON_SERVICES = [
 	"data-api",
 	"functions",
 	"object-storage",
-	"ai-gateway"
+	"ai-gateway",
+	"realtime"
 ];
 /** How output names each service. */
 const NEON_SERVICE_LABELS = {
@@ -32,7 +33,8 @@ const NEON_SERVICE_LABELS = {
 	"data-api": "Data API",
 	"object-storage": "Object Storage",
 	functions: "Functions",
-	"ai-gateway": "AI Gateway"
+	"ai-gateway": "AI Gateway",
+	realtime: "Realtime"
 };
 /**
 * Spellings that used to be canonical, and the service they now mean. Accepted so a scripted
@@ -73,7 +75,7 @@ const parseServices = (raw, options) => {
 	const unsupported = resolved.filter((name) => !allowed.some((service) => service === name));
 	if (unsupported.length > 0) throw new Error(`${unsupportedMessage(unsupported, flag)} ${supported}`);
 	for (const [used, canonical] of deprecated) onDeprecated?.(used, canonical);
-	return NEON_SERVICES.filter((service) => allowed.includes(service) && resolved.includes(service));
+	return allowed.filter((service) => resolved.includes(service));
 };
 /**
 * The sentences explaining why a selection was refused. A real Neon service this command

package/dist/parameters.gen.js

@@ -95,6 +95,11 @@ const projectCreateRequest = {
 		description: "The project name. If not specified, the name will be identical to the generated project ID",
 		demandOption: false
 	},
+	"project.realtime.allowed_origins": {
+		type: "array",
+		description: "The browser origins allowed to connect, each `http` or `https` with a host and optional port\nand no path. An empty list, or `*` alone, allows any origin. Omitted keeps the current or\ninherited value.\n",
+		demandOption: false
+	},
 	"project.branch.name": {
 		type: "string",
 		description: "The default branch name. If not specified, the default branch name, `main`, will be used.\n",
@@ -284,6 +289,11 @@ const branchCreateRequest = {
 		description: "Whether the branch is protected. Protected branches (and their computes) cannot be deleted, archived, or reset, and block deletion of the project. Can be gated by `protected_branches_only` in the IP allowlist. Paid plans only.\n",
 		demandOption: false
 	},
+	"branch.realtime.allowed_origins": {
+		type: "array",
+		description: "The browser origins allowed to connect, each `http` or `https` with a host and optional port\nand no path. An empty list, or `*` alone, allows any origin. Omitted keeps the current or\ninherited value.\n",
+		demandOption: false
+	},
 	"branch.archived": {
 		type: "boolean",
 		description: "Whether to create the branch in the archived state. When omitted, the branch is created as a normal (non-archived) branch.\n",

package/dist/test_utils/fixtures.js

@@ -23,6 +23,26 @@ const reserveClosedPort = () => new Promise((resolve, reject) => {
 		});
 	});
 });
+/** Tokens yargs would turn into numbers. `1.50` and `1e3` do not survive the round trip. */
+const NUMERIC_PSQL_ARGS = [
+	"-c",
+	"1",
+	"-p",
+	"5432",
+	"-v",
+	"1.50",
+	"1e3"
+];
+/** The arguments `mocks/bin/psql` received after the connection URI. */
+const forwardedPsqlArgs = (stdout) => {
+	const match = /\{"psql-cli-args":(\[.*?\])\}/.exec(stdout);
+	if (!match) throw new Error(`mocks/bin/psql did not run. stdout: ${stdout}`);
+	const args = JSON.parse(match[1]);
+	if (!Array.isArray(args)) throw new Error(`psql-cli-args is not an array: ${match[1]}`);
+	return args.slice(1);
+};
+/** The CLI rejects `--output` given twice with different values, so a test's own wins. */
+const passesOutput = (args) => args.some((arg) => arg === "-o" || arg === "--output" || arg.startsWith("--output="));
 const test = test$1.extend({
 	runMockServer: async ({}, use) => {
 		let startedServer;
@@ -62,8 +82,7 @@ const test = test$1.extend({
 			const cp = fork(join(process.cwd(), "./dist/index.js"), [
 				"--api-host",
 				apiHost,
-				"--output",
-				options.output ?? (options.outputTable ? "table" : "yaml"),
+				...passesOutput(args) ? [] : ["--output", options.output ?? (options.outputTable ? "table" : "yaml")],
 				"--no-analytics",
 				...options.apiKey === false ? [] : ["--api-key", options.apiKey ?? "test-key"],
 				...args
@@ -110,4 +129,4 @@ const test = test$1.extend({
 	}
 });
 //#endregion
-export { test };
+export { NUMERIC_PSQL_ARGS, forwardedPsqlArgs, passesOutput, test };

package/dist/utils/config_diff.js

@@ -78,6 +78,7 @@ const renderBranchGroups = (byBranch, paint) => {
 const serviceLabel = (identifier, details) => {
 	if (identifier === "auth") return "Neon Auth";
 	if (identifier === "dataApi") return "Data API";
+	if (identifier === "realtime") return "Realtime";
 	if (identifier.startsWith("bucket:")) return `bucket ${identifier.slice(7)}`;
 	if (identifier.startsWith("function:")) return `function ${identifier.slice(9)}`;
 	if (identifier.startsWith("domain:")) {

package/dist/utils/hooks.js

@@ -1,6 +1,7 @@
 import { log } from "../log.js";
 import { loadProjectConfig } from "../project.js";
-import { s as fetchEnvKeys } from "../_chunks/env-XsUZj_Ay.js";
+import { s as fetchEnvKeys } from "../_chunks/env-BpP3Dqpe.js";
+import { assertPolicyAvailable } from "./staging.js";
 import { runHook } from "@neon/config-runtime";
 //#region src/utils/hooks.ts
 /**
@@ -149,6 +150,7 @@ const runAfter = async (label, run) => {
 * postgres only, since nothing else is declared enabled).
 */
 const resolveHookEnv = async (config, options) => {
+	assertPolicyAvailable(config, options.apiHost);
 	try {
 		const resolved = await fetchEnvKeys(config, options, null);
 		return shapeHookEnv(resolved);