neon 8.4.5 → 8.6.0

package/README.md

@@ -316,23 +316,23 @@ neon realtime subscribe "SELECT id, title, completed FROM realtime_todos ORDER B
 
 The default terminal output is append-only. It identifies the selected project,
 branch, and database; prints the initial result once; reports connection-state
-changes; and then prints each published batch with its transaction IDs, a compact
+changes; and then prints each published change set with its transaction IDs, a compact
 `+insert ~update -delete` summary, and the affected rows. It does not take over the
-terminal or require keyboard navigation. Pass `--changes` to display the raw reset
-and batch events instead of the materialized view.
+terminal or require keyboard navigation. Pass `--changes` to display the raw `rows`
+and `changes` events instead of the materialized view.
 
 For scripts and agents, JSON output is a JSON Lines stream with one complete event
 per line. YAML output uses one document per event:
 
 ```bash
 neon realtime subscribe --changes --output json "SELECT * FROM realtime_todos" |
-  jq --unbuffered 'select(.type == "batch")'
+  jq --unbuffered 'select(.type == "changes")'
 
 neon realtime subscribe --output yaml "SELECT * FROM realtime_todos"
 ```
 
 Machine-readable output retains the event stream: without `--changes`, each event is
-a complete `snapshot`; with `--changes`, events are raw `reset` and `batch` objects.
+a complete `snapshot`; with `--changes`, events are raw `rows` and `changes` objects.
 Lifecycle labels and the target header are terminal-only.
 
 ## Configure autocompletion
@@ -623,7 +623,16 @@ Console), or drop auth from --service.
 
 If you'd rather not keep env vars on disk, inject them at runtime instead with `neon-env run -- <your dev command>` (from `@neon/env`) or `neon dev`, and pass `--no-env-pull` to `link` / `checkout`.
 
-**`neon dev` resolves the same set, by the same rules** — including the AI Gateway on a branch with no `neon.ts`. A function running locally gets the same Postgres / Auth / Data API / storage / AI Gateway vars a deploy would inject. Each `NEON_FUNCTION_<SLUG>_BASE_URL` this process is serving is rewritten to `http://localhost:<port>`: every neon.ts function, or the matching slug when `--source` names one. `neon env pull` and `neon-env run` write the production URL (`https://<branchId>-<slug>.compute.…`). `dev` writes nothing, but it does *read* your `.env` / `.env.local` to reuse the branch credential behind the AI Gateway and object storage. Without a file to read from it issues one on every start and leaves the last one live — it has nowhere to keep it, and so cannot name it to revoke it. It says so when it happens; run `env pull` (or just `link` / `checkout`) once and restarts reuse the credential instead.
+**`neon dev` resolves the same set, by the same rules** — including the AI Gateway on a branch with no `neon.ts`. A function running locally gets the same Postgres / Auth / Data API / storage / AI Gateway vars a deploy would inject. Each `NEON_FUNCTION_<SLUG>_BASE_URL` this process is serving is rewritten to `http://localhost:<port>`: every neon.ts function, or the matching slug when `--source` names one. `neon env pull` and `neon-env run` write the production URL (`https://<branchId>-<slug>.compute.…`).
+
+Before `neon.ts` is evaluated, `dev` loads the project directory's `.env`, then `.env.local`, which overrides it, into the environment, so Function env values written as `process.env.X!` resolve the same way they do for `neon deploy --env`. A variable already set in the shell wins over both. Local Functions inherit every loaded variable, including keys `neon.ts` doesn't declare; the deployed runtime gets only declared and Neon-injected env. `--env <file>` loads only that file, resolved from the current directory, matching `neon deploy --env`:
+
+```bash
+neon dev                       # loads .env, then .env.local (overrides .env)
+neon dev --env .env.staging    # loads only .env.staging
+```
+
+`dev` writes nothing. To reuse the branch credential behind the AI Gateway and object storage, it reads only the file `env pull` writes (`.env` when it exists, otherwise `.env.local`), so an override in the other file cannot pair one credential's key ID with another's secret. Without a file to read from it issues one on every start and leaves the last one live — it has nowhere to keep it, and so cannot name it to revoke it. It says so when it happens; run `env pull` (or just `link` / `checkout`) once and restarts reuse the credential instead.
 
 **Where `.neon` lives**: `link` writes `.neon` into the **current working directory** by default. If an existing `.neon` is found in any parent directory, that file is reused — so commands run from a sub-directory of a linked project still pick up the project's context. To pin the location explicitly, pass `--context-file <path>`. `neon init` always writes `.neon` into the current directory.
 
@@ -890,7 +899,7 @@ Without a TTY, pass `-y` or enough flags to answer every question. `-y` alone is
 
 `--project-id`, `--org-id`, `--project-name`, `--region-id`, and `--branch` are forwarded to `link`. They select linking. A linked directory is not relinked unless you pass one of those flags.
 
-After a new default `neon.ts` on a pinned branch, init runs `env pull` unless link already pulled env or the file declares extra services (those still need `neon config plan` / `neon deploy`).
+Init pulls the branch's env vars once, after the `neon.ts` step, so the pull includes what `neon.ts` declares. The AI Gateway and Functions need no deploy and are pulled immediately. When `neon.ts` declares Auth, the Data API, Object Storage, or Realtime, init pulls Postgres, plus the AI Gateway and the scaffolded function's URL when declared. `neon deploy` provisions the rest and pulls their env vars. An existing `neon.ts` is pulled by `link` as usual.
 
 A failed step stops the rest. `--profile` and `--config-dir` are forwarded to each child. `--output json` and `--output yaml` are refused; the commands init runs print their own output.
 
@@ -967,7 +976,7 @@ On a TTY the command asks which agents and which skills, then installs. Detected
 
 `-y` skips those questions and installs the default skills into detected agents: project-folder markers such as `.cursor`, else the agent driving the CLI. `--agent` / `-a` names coding agents and skips the agent picker. `--skill` / `-s` names specific skills and skips the skill picker; it does not select agents. `--global -y` uses installed apps, else the host CLI agent. Without a TTY, pass `-y`, or `--skill <name>` (add `--agent <name>` to name agents). If `-y` finds no agent, it exits: pass `--agent <name>`, run from a supported agent, or omit `-y` in a terminal to pick.
 
-`--skill` names by source repo: `neondatabase/agent-skills` (`neon`, `neon-ai-gateway`, `neon-auth`, `neon-functions`, `neon-object-storage`, `neon-postgres`, `neon-postgres-branches`, `neon-postgres-egress-optimizer`); `neondatabase/neon-for-agent-platforms` (`neon-postgres-agent-platforms`).
+`--skill` names by source repo: `neondatabase/agent-skills` (`neon`, `neon-ai-gateway`, `neon-auth`, `neon-functions`, `neon-object-storage`, `neon-postgres`, `neon-postgres-branches`, `neon-postgres-egress-optimizer`, `neon-realtime`); `neondatabase/neon-for-agent-platforms` (`neon-postgres-agent-platforms`).
 
 Supported agents match `neon mcp`, minus agents that cannot install skills: `antigravity`, `cline`, `cline-cli`, `claude-code`, `claude-desktop`, `codex`, `cursor`, `gemini-cli`, `goose`, `github-copilot-cli`, `grok-build`, `opencode`, `vscode`, `windsurf`, `zed`. `mcporter` is a known MCP name that is then skipped. `neon skills --help` lists the same skill and agent values, and that `-y` leaves out `neon-postgres-agent-platforms`.
 
@@ -1019,7 +1028,7 @@ Default scope is `project`. `--global` is `user`. On macOS and Linux, Cursor and
 
 Supported agents with a plugins mapping: `claude-code`, `claude-desktop`, `codex`, `cursor`, `github-copilot-cli`, `grok-build`, `vscode`. `claude-desktop` installs as Claude Code; detecting both produces one install and lists both names in the table. `mcporter` is a known MCP name that is then skipped.
 
-The plugins CLI installs every plugin it finds in the Neon plugin package. Today that is `neon-postgres` from `neondatabase/agent-skills`. It includes the Neon MCP server (`https://mcp.neon.tech/mcp`) and these skills: `neon`, `neon-ai-gateway`, `neon-auth`, `neon-functions`, `neon-object-storage`, `neon-postgres`, `neon-postgres-branches`, `neon-postgres-egress-optimizer`. It does not include `neon-postgres-agent-platforms`.
+The plugins CLI installs every plugin it finds in the Neon plugin package. Today that is `neon-postgres` from `neondatabase/agent-skills`. It includes the Neon MCP server (`https://mcp.neon.tech/mcp`) and these skills: `neon`, `neon-ai-gateway`, `neon-auth`, `neon-functions`, `neon-object-storage`, `neon-postgres`, `neon-postgres-branches`, `neon-postgres-egress-optimizer`, `neon-realtime`. It does not include `neon-postgres-agent-platforms`.
 
 `neon plugins --help` lists the plugin, those contents, and the supported agent names.
 

package/dist/_chunks/{env-4WGRW2nw.js → env-BNm69Qh8.js}

@@ -4,8 +4,8 @@ import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig } from "../project.js";
 import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-BpP3Dqpe.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
-import { StagingOnlyError, assertPolicyAvailable, assertRealtimeAvailable, stagingFeaturesEnabled } from "../utils/staging.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
+import { StagingOnlyError } from "../utils/staging.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, isPlatformError } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";
 import { plan, pullConfig } from "@neon/config-runtime";
@@ -414,8 +414,7 @@ const resolveNeonEnvVars = async (ctx) => {
 		const pulled = await pullConfig({
 			projectId: ctx.projectId,
 			branchId: ctx.branchId,
-			...apiOptions(ctx),
-			realtime: stagingFeaturesEnabled(ctx.apiHost)
+			...apiOptions(ctx)
 		});
 		const resolvedBranch = {
 			id: pulled.branch.id,
@@ -513,7 +512,6 @@ const resolveSelectedServices = async (ctx, directServices, envKeys) => {
 	const impliedServices = servicesForEnvKeys(envKeys);
 	const services = ENV_PULL_SERVICES.filter((service) => directServices.includes(service) || impliedServices.includes(service));
 	const selectedKeys = envKeysForSelection(directServices, envKeys);
-	if (services.includes("realtime")) assertRealtimeAvailable(ctx.apiHost);
 	const api = apiFor(ctx);
 	const has = (service) => services.includes(service);
 	const checkAiGateway = has("ai-gateway") && !selectedKeys.includes(NEON_ENV_VAR_KEYS.aiGateway.apiKey);
@@ -758,7 +756,6 @@ const loadNeonConfig = async (ctx) => {
 			...ctx.config ? { path: ctx.config } : {},
 			...ctx.omitUnsetFunctionEnv ? { unsetFunctionEnv: "omit" } : {}
 		});
-		assertPolicyAvailable(config, ctx.apiHost);
 		return config;
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);

package/dist/commands/config.js

@@ -11,7 +11,6 @@ import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig, neonConfigFilename, projectConfigPath, projectDir } from "../project.js";
 import { loadEnvFileIntoProcess } from "../env_file.js";
-import { assertPolicyAvailable, assertRealtimeAvailable, listedServices, stagingFeaturesEnabled, stagingFeaturesEnabledForArgv } from "../utils/staging.js";
 import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { writer } from "../writer.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
@@ -159,11 +158,7 @@ const missingDependencies = (cwd) => {
 * starter policy, which is what `config init` has always written.
 */
 const resolveServices = async (props) => {
-	if (props.services !== void 0) {
-		const services = parseConfigInitServices(props.services, (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical)));
-		if (services.includes("realtime")) assertRealtimeAvailable(props.apiHost);
-		return services;
-	}
+	if (props.services !== void 0) return parseConfigInitServices(props.services, (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical)));
 	if (props.pickServices) return props.pickServices();
 	if (isCi() || !process.stdout.isTTY) return [];
 	return pickServicesInteractively();
@@ -456,22 +451,14 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 }))).command("ai-gateway", "Enable the AI Gateway (aiGateway: true)", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "ai-gateway"
-}))).command({
-	command: "realtime",
-	describe: stagingFeaturesEnabledForArgv() ? "Enable Realtime (preview.realtime: true)" : false,
-	builder: (yargs) => addSharedOptions(yargs).option("allowed-origin", {
-		describe: "Allowed browser origin (repeatable). \"*\" allows every origin",
-		type: "array",
-		string: true
-	}),
-	handler: (args) => {
-		assertRealtimeAvailable();
-		return addCmd(addProps(args, {
-			kind: "realtime",
-			...args.allowedOrigin !== void 0 ? { allowedOrigins: args.allowedOrigin } : {}
-		}));
-	}
-}).command("function <slug>", "Declare a Neon Function and create its handler file", (yargs) => addSharedOptions(yargs).example("$0 config add function sendemail", "Creates functions/sendemail.ts and declares it").example("$0 config add function sendemail --source src/send.ts", "Declares an existing handler").positional("slug", {
+}))).command("realtime", "Enable Realtime (preview.realtime: true)", (yargs) => addSharedOptions(yargs).option("allowed-origin", {
+	describe: "Allowed browser origin (repeatable). \"*\" allows every origin",
+	type: "array",
+	string: true
+}), (args) => addCmd(addProps(args, {
+	kind: "realtime",
+	...args.allowedOrigin !== void 0 ? { allowedOrigins: args.allowedOrigin } : {}
+}))).command("function <slug>", "Declare a Neon Function and create its handler file", (yargs) => addSharedOptions(yargs).example("$0 config add function sendemail", "Creates functions/sendemail.ts and declares it").example("$0 config add function sendemail --source src/send.ts", "Declares an existing handler").positional("slug", {
 	describe: "Function slug: 1-20 lowercase letters and digits",
 	type: "string",
 	demandOption: true
@@ -510,7 +497,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 	},
 	services: servicesOption({
 		key: "services",
-		allowed: listedServices(NEON_SERVICES),
+		allowed: NEON_SERVICES,
 		describe: "Services the scaffolded neon.ts declares",
 		also: "postgres alone writes the starter policy; every branch has Postgres. Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
 	}),
@@ -541,8 +528,7 @@ const liveConfigView = async (opts) => {
 		branchId: opts.branchId,
 		...opts.apiKey ? { apiKey: opts.apiKey } : {},
 		...opts.apiHost ? { apiHost: opts.apiHost } : {},
-		...opts.runtimeApi ? { api: opts.runtimeApi } : {},
-		realtime: stagingFeaturesEnabled(opts.apiHost)
+		...opts.runtimeApi ? { api: opts.runtimeApi } : {}
 	});
 	const resolved = resolveConfig(live.config, {
 		name: live.branch.name,
@@ -569,7 +555,6 @@ const loadConfig = async (props) => {
 		contextFile: props.contextFile,
 		...props.config ? { path: props.config } : {}
 	});
-	assertPolicyAvailable(config, props.apiHost);
 	return config;
 };
 const status = async (props) => {
@@ -994,7 +979,6 @@ const applyPolicyOnCreate = async (props) => {
 		if (/Could not find a Neon config file/i.test(message)) return;
 		throw err;
 	}
-	assertPolicyAvailable(config, props.apiHost);
 	try {
 		warnDeprecatedPreview(config, await warningTargetForExistingBranch({
 			projectId: props.projectId,
@@ -1079,7 +1063,6 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 		if (/Could not find a Neon config file/i.test(message)) return null;
 		throw err;
 	}
-	assertPolicyAvailable(config, props.apiHost);
 	await assertAiGatewayProvisionableFromCreds({
 		projectId: props.projectId,
 		...props.apiKey ? { apiKey: props.apiKey } : {},

package/dist/commands/dev.js

@@ -2,13 +2,14 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
-import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
+import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-4WGRW2nw.js";
+import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { envFlag } from "./config.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -20,13 +21,16 @@ import { createServer } from "node:net";
 //#region src/commands/dev.ts
 var dev_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
+	captureShellEnv: () => captureShellEnv,
 	command: () => "dev",
 	describe: () => describe,
 	devBundleDir: () => devBundleDir,
 	devEnvContext: () => devEnvContext,
 	diffUnits: () => diffUnits,
+	formatEnvFiles: () => formatEnvFiles,
 	formatEnvSummary: () => formatEnvSummary,
 	handler: () => handler,
+	loadDevEnvFiles: () => loadDevEnvFiles,
 	localFunctionUrlEnv: () => localFunctionUrlEnv,
 	planFunctionsToUnits: () => planFunctionsToUnits,
 	reportDevCredential: () => reportDevCredential,
@@ -42,7 +46,8 @@ const builder = (argv) => argv.usage("$0 dev [--source <path>] [options]").examp
 	port: {
 		describe: "Port to listen on (single-function mode only, with --source). Fails if taken. Without it (and without a PORT env var) a free port is chosen automatically.",
 		type: "number"
-	}
+	},
+	...envFlag
 }).epilogue([
 	"",
 	"Functions run with the linked branch's Neon env injected, the same set the",
@@ -55,9 +60,14 @@ const builder = (argv) => argv.usage("$0 dev [--source <path>] [options]").examp
 	"this process is serving (every neon.ts function, or the matching slug when",
 	"`--source` names one).",
 	"",
-	"`dev` reads your .env / .env.local to reuse the branch credential behind the",
-	"AI Gateway and object storage, and never writes to them. With no such file it",
-	"issues a credential on every start, so run `env pull` once if you restart often."
+	"Before neon.ts is evaluated, `dev` loads the project's .env, then .env.local,",
+	"which overrides it, into the environment, so Function env values that read",
+	"process.env resolve. A variable already set in the shell wins. `--env <file>`",
+	"loads only that file instead. Functions inherit every loaded variable.",
+	"",
+	"`dev` reuses the branch credential behind the AI Gateway and object storage from",
+	"the file `env pull` writes, and never writes to it. With no such file it issues a",
+	"credential on every start, so run `env pull` once if you restart often."
 ].join("\n")).strict();
 /**
 * The resolver context for a `neon dev` run.
@@ -74,7 +84,7 @@ const builder = (argv) => argv.usage("$0 dev [--source <path>] [options]").examp
 *   last one live — one orphan per restart. `neon-env run` already reads the file for this
 *   reason; `dev` was the one that didn't.
 */
-const devEnvContext = (props, branchId, cwd) => {
+const devEnvContext = (props, branchId, cwd, baseEnv = process.env) => {
 	const location = {
 		cwd,
 		...props.contextFile ? { contextFile: props.contextFile } : {}
@@ -84,7 +94,7 @@ const devEnvContext = (props, branchId, cwd) => {
 		...location,
 		implyAiGateway: true,
 		env: {
-			...process.env,
+			...baseEnv,
 			...existsSync(envFile) ? readEnvFile(envFile) : {}
 		},
 		...props.projectId ? { projectId: props.projectId } : {},
@@ -114,22 +124,70 @@ const reportDevCredential = (credential) => {
 	log.warning(`Resolved credential secrets for this run (%s) without writing them to a file. Run \`${getCliName()} env pull\` once so restarts reuse them instead of revealing or minting again.`, credential.keys.join(", "));
 };
 const handler = async (props) => {
+	const shellEnv = captureShellEnv();
+	const envFiles = formatEnvFiles(loadDevEnvFiles(props, process.cwd()), process.cwd());
 	if (props.source !== void 0) {
-		await runSingleSource(props);
+		await runSingleSource(props, shellEnv, envFiles);
 		return;
 	}
 	if (props.port !== void 0) throw new Error("--port can only be used with --source. To set ports for the functions in neon.ts, give each one a `dev.port` in its config.");
-	await runFromConfig(props);
+	await runFromConfig(props, shellEnv, envFiles);
+};
+/**
+* Copy of the shell env before any dotenv file loads. PORT is read through `process.env`,
+* which is case-insensitive on Windows, so a shell `Port` still sets the port. Exported for
+* unit testing.
+*/
+const captureShellEnv = () => ({
+	...process.env,
+	PORT: process.env.PORT
+});
+/**
+* Load dotenv files into process.env before neon.ts is evaluated: `--env <file>` alone
+* (relative to cwd), else the project's {@link defaultDevEnvFiles}. A later file overrides
+* an earlier one; a key set before loading (the shell) is never overridden.
+*/
+const loadDevEnvFiles = (props, cwd) => {
+	const files = props.env ? [resolve(cwd, props.env)] : defaultDevEnvFiles({
+		cwd,
+		...props.contextFile ? { contextFile: props.contextFile } : {}
+	});
+	const name = (key) => process.platform === "win32" ? key.toUpperCase() : key;
+	const preset = new Set(Object.keys(process.env).filter((key) => process.env[key] !== void 0).map(name));
+	return files.map((path) => {
+		const applied = [];
+		for (const [key, value] of Object.entries(readEnvFile(path))) {
+			if (preset.has(name(key))) continue;
+			process.env[key] = value;
+			applied.push(key);
+		}
+		return {
+			path,
+			applied
+		};
+	});
+};
+/**
+* The banner's account of the dotenv files, in load order, e.g.
+* `.env.local (4 vars) → .env (2 vars)`. Counts are the keys each file set. Exported for
+* unit testing.
+*/
+const formatEnvFiles = (files, cwd) => {
+	if (files.length === 0) return "none (no .env.local or .env)";
+	return files.map(({ path, applied }) => {
+		const count = `${applied.length} var${applied.length === 1 ? "" : "s"}`;
+		return `${relative(cwd, path) || path} (${count})`;
+	}).join(" → ");
 };
 /** Single-function mode: serve exactly the `--source` path (legacy behavior). */
-const runSingleSource = async (props) => {
+const runSingleSource = async (props, shellEnv, envFiles) => {
 	const source = resolve(process.cwd(), props.source);
 	if (!existsSync(source)) throw new Error(`Source file not found: ${source}`);
 	const branchId = await resolveBranchId(props);
-	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
+	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd(), shellEnv));
 	reportDevCredential(credential);
 	const match = await findConfigFunctionBySource(process.cwd(), source, props.contextFile);
-	const { overlay, port } = await sourceFunctionUrlOverlay(match, props.port);
+	const { overlay, port } = await sourceFunctionUrlOverlay(match, props.port, shellEnv);
 	const unit = {
 		slug: null,
 		source,
@@ -144,19 +202,22 @@ const runSingleSource = async (props) => {
 			fn: []
 		}
 	};
-	await runSupervisor([unit], { ...skipped ? { envNote: skipped.reason } : {} });
+	await runSupervisor([unit], {
+		envFiles,
+		...skipped ? { envNote: skipped.reason } : {}
+	});
 };
 /**
 * Multi-function mode: serve every function declared in neon.ts. Requires a neon.ts
 * (there is no single source to fall back on), one dev server per function.
 */
-const runFromConfig = async (props) => {
+const runFromConfig = async (props, shellEnv, envFiles) => {
 	const branchId = await resolveBranchId(props);
 	const resolved = await resolveFunctionsFromConfig(process.cwd(), void 0, props.contextFile);
 	if (resolved === null) throw new Error("No --source given and no neon.ts found. Pass --source <path> to run a single function, or add a neon.ts that declares functions under `functions`.");
 	const { configPath, functions } = resolved;
 	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `functions`, or pass --source <path>.");
-	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
+	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd(), shellEnv));
 	reportDevCredential(credential);
 	const units = await planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);
 	const replan = async (searchBase, keepPorts) => {
@@ -169,6 +230,7 @@ const runFromConfig = async (props) => {
 			configPath,
 			replan
 		},
+		envFiles,
 		...skipped ? { envNote: skipped.reason } : {}
 	});
 };
@@ -231,8 +293,8 @@ const localFunctionUrlEnv = (functions) => {
 * `--source` serves one file. If that file is a neon.ts function, rewrite only that
 * slug to localhost — this process is not listening for the others.
 */
-const sourceFunctionUrlOverlay = async (match, cliPort) => {
-	const portSpec = portFromProps(cliPort);
+const sourceFunctionUrlOverlay = async (match, cliPort, shellEnv = process.env) => {
+	const portSpec = portFromProps(cliPort, shellEnv);
 	if (match === void 0) return {
 		overlay: {},
 		port: portSpec
@@ -298,14 +360,14 @@ const resolveBranchId = async (props) => {
 	}
 };
 const DEFAULT_PORT_BASE = 8787;
-const portFromProps = (port) => {
+const portFromProps = (port, shellEnv) => {
 	if (port !== void 0) return {
 		mode: "explicit",
 		port
 	};
-	if (process.env.PORT !== void 0 && process.env.PORT !== "") return {
+	if (shellEnv.PORT !== void 0 && shellEnv.PORT !== "") return {
 		mode: "explicit",
-		port: Number(process.env.PORT)
+		port: Number(shellEnv.PORT)
 	};
 	return {
 		mode: "search",
@@ -387,7 +449,7 @@ const READY_PATTERN = /neon-dev:ready (\d+)/;
 * in place; siblings are untouched.
 */
 const runSupervisor = async (units, options = {}) => {
-	const { reload, envNote } = options;
+	const { reload, envNote, envFiles } = options;
 	const runtimePath = resolveRuntimePath();
 	let shuttingDown = false;
 	const running = units.map(makeRunningUnit);
@@ -456,7 +518,7 @@ const runSupervisor = async (units, options = {}) => {
 		await Promise.all(running.map((r) => stopUnit(r)));
 		throw new Error("No function started. See the output above for details.");
 	}
-	printBanner(running, envNote);
+	printBanner(running, envNote, envFiles);
 	let configWatcher = null;
 	if (reload) {
 		const ops = {
@@ -709,10 +771,14 @@ const pipeChildOutput = (child, label) => {
 	forward("stdout");
 	forward("stderr");
 };
-const printBanner = (running, envNote) => {
+const printBanner = (running, envNote, envFiles) => {
 	log.info("");
 	log.info(chalk.green.bold("  Neon Functions dev server"));
 	log.info("");
+	if (envFiles) {
+		log.info(`  ${chalk.dim("env files".padEnd(20))} ${chalk.dim(envFiles)}`);
+		log.info("");
+	}
 	for (const r of running) {
 		const name = r.unit.label ?? "function";
 		const url = urlFor(r.boundPort);
@@ -876,4 +942,4 @@ const resolveRuntimePath = () => {
 	return candidate;
 };
 //#endregion
-export { builder, command, describe, devBundleDir, devEnvContext, diffUnits, formatEnvSummary, handler, localFunctionUrlEnv, planFunctionsToUnits, reportDevCredential, sourceFunctionUrlOverlay, dev_exports as t };
+export { builder, captureShellEnv, command, describe, devBundleDir, devEnvContext, diffUnits, formatEnvFiles, formatEnvSummary, handler, loadDevEnvFiles, localFunctionUrlEnv, planFunctionsToUnits, reportDevCredential, sourceFunctionUrlOverlay, dev_exports as t };

package/dist/commands/env.js

@@ -7,10 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { listedServices } from "../utils/staging.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-4WGRW2nw.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
@@ -48,7 +47,7 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	},
 	service: servicesOption({
 		key: "service",
-		allowed: listedServices(ENV_PULL_SERVICES),
+		allowed: ENV_PULL_SERVICES,
 		describe: "Pull only these services' variables",
 		also: "Overrides neon.ts, and prunes only within the services you name. Combines with --env as a union."
 	}),

package/dist/commands/init.js

@@ -2,7 +2,6 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { NEON_SERVICES, servicesOption } from "../neon_services.js";
-import { listedServices } from "../utils/staging.js";
 import { coerceAgentFlag } from "../utils/agent_flag.js";
 import { initPluginAgents, initSkillsMcpAgents } from "../init/plan.js";
 import { listSkillIds } from "../skills/catalog.js";
@@ -52,7 +51,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	describe: "Create neon.ts after linking. Use --no-config to skip. Omitted in Custom: you will be asked"
 }).option("services", servicesOption({
 	key: "services",
-	allowed: listedServices(NEON_SERVICES),
+	allowed: NEON_SERVICES,
 	describe: "Services to declare in neon.ts",
 	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
 })).option("org-id", {

package/dist/commands/link.js

@@ -864,7 +864,7 @@ const printSummary = (props, summary) => {
 */
 const finalizeLink = async (props, summary) => {
 	printSummary(props, summary);
-	if (!summary.branch || !summary.projectId || summary.noChecks) return;
+	if (!summary.branch || !summary.projectId || summary.noChecks || props.deferEnvPull === true) return;
 	const { config: _offerConfig, ...rest } = props;
 	await autoPullEnvAfterPin({
 		...rest,

package/dist/commands/manifest.js

@@ -1,5 +1,4 @@
 import { getCliName } from "../utils/cli_name.js";
-import { REALTIME_COMING_SOON } from "../utils/staging.js";
 import { Parser } from "yargs/helpers";
 //#region src/commands/manifest.ts
 /**
@@ -190,8 +189,7 @@ const commandManifest = [
 	{
 		command: "realtime",
 		describe: "Manage Neon Realtime for a branch",
-		load: () => import("./realtime.js"),
-		stagingOnly: REALTIME_COMING_SOON
+		load: () => import("./realtime.js")
 	},
 	{
 		command: "functions",

package/dist/commands/subscribe.js

@@ -1,16 +1,16 @@
 import { writer } from "../writer.js";
+import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { branchIdFromProps } from "../utils/enrichers.js";
-import { o as resolveNeonEnvVars } from "../_chunks/env-4WGRW2nw.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {
 	describe: "SELECT query to subscribe to",
 	type: "string"
 }).options({ changes: {
-	describe: "Show raw resets and transaction batches",
+	describe: "Show raw rows and changes events",
 	type: "boolean",
 	default: false
-} }).example("$0 realtime subscribe \"SELECT * FROM items\"", "Print the initial result followed by a readable transaction log").example("$0 realtime subscribe --changes \"SELECT * FROM items\"", "Print raw reset and delta events").epilogue("The subscription runs until interrupted. Terminal output is an append-only snapshot and transaction log; JSON output is newline-delimited; YAML output uses one document per event.").strict();
+} }).example("$0 realtime subscribe \"SELECT * FROM items\"", "Print the initial result followed by a readable transaction log").example("$0 realtime subscribe --changes \"SELECT * FROM items\"", "Print raw rows and changes events").epilogue("The subscription runs until interrupted. Terminal output is an append-only snapshot and transaction log; JSON output is newline-delimited; YAML output uses one document per event.").strict();
 const handler = async (args) => {
 	const props = args;
 	const controller = new AbortController();
@@ -140,16 +140,16 @@ const createRenderer = (props, context, now) => {
 			return;
 		}
 		out.write("\n");
-		if (event.type === "reset" && !props.changes) {
-			const label = hasBaseline ? "Reset" : "Initial snapshot";
+		if (event.type === "rows" && !props.changes) {
+			const label = hasBaseline ? "Rows" : "Initial snapshot";
 			hasBaseline = true;
 			rowsById.clear();
 			for (const { rowId, row } of event.rows) rowsById.set(rowId, row);
 			renderMaterializedRows(out, event.rows.map(({ row }) => row), `${timestamp(now)} ${label}`);
 			return;
 		}
-		if (event.type === "batch" && !props.changes) {
-			renderHumanBatch(out, event, rowsById, now);
+		if (event.type === "changes" && !props.changes) {
+			renderHumanChanges(out, event, rowsById, now);
 			return;
 		}
 		renderTableEvent(out, event, now);
@@ -160,12 +160,12 @@ const renderTableEvent = (out, event, now) => {
 		renderMaterializedRows(out, event.rows, `${timestamp(now)} Snapshot`);
 		return;
 	}
-	if (event.type === "reset") {
+	if (event.type === "rows") {
 		const rows = event.rows.map(({ rowId, row }) => ({
 			row_id: rowId,
 			row
 		}));
-		renderRows(out, rows, ["row_id", "row"], `${timestamp(now)} Reset · ${rowCount(rows.length)}`, "Reset contains no rows.");
+		renderRows(out, rows, ["row_id", "row"], `${timestamp(now)} Rows · ${rowCount(rows.length)}`, "Rows event contains no rows.");
 		return;
 	}
 	const rows = event.changes.map((change) => ({
@@ -177,7 +177,7 @@ const renderTableEvent = (out, event, now) => {
 		"type",
 		"row_id",
 		"row"
-	], `${timestamp(now)} ${transactionLabel(event.txids)} · ${rawChangeSummary(event.changes)}`, "Batch contains no row changes.");
+	], `${timestamp(now)} ${transactionLabel(event.txids)} · ${rawChangeSummary(event.changes)}`, "Changes event contains no row changes.");
 };
 const renderHumanHeader = (out, context, rawChanges) => {
 	const target = {
@@ -205,18 +205,18 @@ const renderMaterializedRows = (out, rows, title) => {
 	const humanTitle = `${title} · ${rowCount(rows.length)}`;
 	renderRows(out, rows, rowFields(rows), humanTitle, "Query returned no rows.");
 };
-const renderHumanBatch = (out, event, rowsById, now) => {
+const renderHumanChanges = (out, event, rowsById, now) => {
 	const changes = classifyChanges(event.changes, rowsById);
 	const inserted = changes.filter((change) => change.operation === "+ insert");
 	const updated = changes.filter((change) => change.operation === "~ update");
 	const deleted = changes.filter((change) => change.operation === "- delete");
-	const rowFieldsInBatch = rowFields(changes.flatMap((change) => change.row ? [change.row] : []));
-	const operationField = uniqueOperationField(rowFieldsInBatch);
+	const rowFieldsInChanges = rowFields(changes.flatMap((change) => change.row ? [change.row] : []));
+	const operationField = uniqueOperationField(rowFieldsInChanges);
 	const rows = changes.map((change) => ({
 		...change.row ?? {},
 		[operationField]: change.operation
 	}));
-	renderRows(out, rows, [operationField, ...rowFieldsInBatch], `${timestamp(now)} ${transactionLabel(event.txids)} · +${inserted.length} ~${updated.length} -${deleted.length}`, "Transaction contains no row changes.");
+	renderRows(out, rows, [operationField, ...rowFieldsInChanges], `${timestamp(now)} ${transactionLabel(event.txids)} · +${inserted.length} ~${updated.length} -${deleted.length}`, "Transaction contains no row changes.");
 };
 const renderRows = (out, rows, fields, title, emptyMessage) => {
 	writer({
@@ -292,11 +292,11 @@ const consumeSnapshots = async (subscription, render, signal) => consumeSubscrip
 }))], render, signal);
 const consumeChanges = async (subscription, render, signal) => consumeSubscription(subscription, (fail) => [subscription.onUpdate((update) => {
 	if (update.type === "rows") attempt(fail, () => render({
-		type: "reset",
+		type: "rows",
 		rows: update.rows
 	}));
 	else attempt(fail, () => render({
-		type: "batch",
+		type: "changes",
 		txids: update.batch.txids,
 		changes: update.changes
 	}));

package/dist/credential_io.js

@@ -1,2 +1 @@
-import { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
-export { storeFor };
+export { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";