neon 8.6.0 → 8.7.0

package/dist/api.js

@@ -669,6 +669,13 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				database_name: databaseName
 			}
 		})),
+		getProjectBranchRealtime: (projectId, branchId) => call(() => raw.getProjectBranchRealtime({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
 		enableProjectBranchRealtime: (projectId, branchId, data) => call(() => raw.enableProjectBranchRealtime({
 			client,
 			path: {
@@ -684,6 +691,13 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				branch_id: branchId
 			}
 		})),
+		rotateProjectBranchRealtimeSecret: (projectId, branchId) => call(() => raw.rotateProjectBranchRealtimeSecret({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
 		listProjectVpcEndpoints: (projectId) => call(() => raw.listProjectVpcEndpoints({
 			client,
 			path: { project_id: projectId }

package/dist/commands/dev.js

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
-import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
-import { resolveWatchInputs } from "../dev/inputs.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
+import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
 import { envFlag } from "./config.js";
+import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
+import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/env.js

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/realtime.js

@@ -1,6 +1,7 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
+import { getCliName } from "../utils/cli_name.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import { builder as builder$1, handler as handler$1 } from "./subscribe.js";
 import { defineConfig } from "@neon/config";
@@ -11,8 +12,11 @@ var realtime_exports = /* @__PURE__ */ __exportAll({
 	describe: () => describe,
 	disable: () => disable,
 	enable: () => enable,
-	handler: () => handler
+	handler: () => handler,
+	rotateSecret: () => rotateSecret
 });
+const ROTATION_POLL_INTERVAL_MS = Number(process.env.NEON_REALTIME_POLL_INTERVAL_MS) || 1e3;
+const ROTATION_POLL_TIMEOUT_MS = Number(process.env.NEON_REALTIME_POLL_TIMEOUT_MS) || 6e4;
 /** Request Realtime provisioning or an allowed-origin update for a branch. */
 const enable = async (props) => {
 	const realtime = props.allowedOrigins === void 0 ? true : { allowedOrigins: props.allowedOrigins };
@@ -27,6 +31,26 @@ const disable = async (props) => {
 	await retryOnLock(() => props.apiClient.disableProjectBranchRealtime(props.projectId, branchId));
 	log.info("Realtime disable requested for branch %s.", branchId);
 };
+/** Request replacement of a branch's Realtime shared secret. */
+const rotateSecret = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await retryOnLock(() => props.apiClient.rotateProjectBranchRealtimeSecret(props.projectId, branchId));
+	log.info("Realtime secret rotation requested for branch %s.", branchId);
+	if (!props.wait) return;
+	const deadline = Date.now() + ROTATION_POLL_TIMEOUT_MS;
+	do {
+		const { data } = await props.apiClient.getProjectBranchRealtime(props.projectId, branchId);
+		if (!data.pending) {
+			log.info("Realtime secret rotation completed for branch %s.", branchId);
+			log.info("Run %s env pull --service realtime to update NEON_REALTIME_SECRET.", getCliName());
+			return;
+		}
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) break;
+		await new Promise((resolve) => setTimeout(resolve, Math.min(ROTATION_POLL_INTERVAL_MS, remainingMs)));
+	} while (Date.now() < deadline);
+	throw new Error(`Timed out waiting for Realtime secret rotation on branch ${branchId}. It may still be in progress.`);
+};
 const command = "realtime";
 const describe = "Manage Neon Realtime for a branch";
 const builder = (argv) => argv.usage("$0 realtime <sub-command> [options]").options({
@@ -45,7 +69,11 @@ const builder = (argv) => argv.usage("$0 realtime <sub-command> [options]").opti
 }), (args) => enable({
 	...args,
 	...args.allowedOrigin !== void 0 ? { allowedOrigins: args.allowedOrigin } : {}
-})).command("disable", "Disable Realtime on a branch", (yargs) => yargs.strict(), (args) => disable(args)).command("subscribe <query>", "Subscribe to a live SQL query with Neon Realtime", builder$1, handler$1);
+})).command("disable", "Disable Realtime on a branch", (yargs) => yargs.strict(), (args) => disable(args)).command("rotate-secret", "Replace a branch's Realtime shared secret", (yargs) => yargs.strict().option("wait", {
+	describe: "Wait for the Realtime secret rotation to finish",
+	type: "boolean",
+	default: true
+}), (args) => rotateSecret(args)).command("subscribe <query>", "Subscribe to a live SQL query with Neon Realtime", builder$1, handler$1);
 const handler = (_args) => {};
 //#endregion
-export { builder, command, describe, disable, enable, handler, realtime_exports as t };
+export { builder, command, describe, disable, enable, handler, rotateSecret, realtime_exports as t };

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { branchIdFromProps } from "../utils/enrichers.js";
+import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/init/copy.js

@@ -99,11 +99,11 @@ const offlinePinNext = (input) => [
 	...input.envPull !== void 0 ? ["Then pull the branch's environment variables:", input.envPull] : []
 ];
 const skippedLinkNext = () => ["To connect this directory to a Neon project:", `${getCliName()} link`];
-const extraServicesNext = (input) => [
+const newConfigNext = (input) => [
 	"Preview the changes:",
 	`${getCliName()} config plan`,
 	"",
-	"Deploy when the changes and target are correct. Deploy also pulls the branch's environment variables:",
+	"Deploy to your Neon project:",
 	`${getCliName()} deploy`,
 	"",
 	"Optional, once deployed:",
@@ -116,6 +116,7 @@ const extraServicesNext = (input) => [
 	`${getCliName()} checkout dev --create`,
 	...input.skills ? ["", "Set up the services declared in neon.ts with your coding agent. The Neon agent skills cover best practices for each one."] : []
 ];
+const configInitNext = () => ["Declare this project's Neon services as code in neon.ts:", `${getCliName()} config init`];
 const existingConfigNext = () => ["The existing Neon config was preserved. Refresh environment variables when its declared services are available:", `${getCliName()} env pull`];
 const claimableNext = (expiresAt) => [
 	`This project expires at ${expiresAt}.`,
@@ -128,7 +129,7 @@ const claimableThenServicesNext = (expiresAt) => [
 	"After claiming the project, review neon.ts and preview the changes:",
 	`${getCliName()} config plan`,
 	"",
-	"Deploy when the changes and target are correct:",
+	"Deploy to your Neon project:",
 	`${getCliName()} deploy`,
 	"",
 	"Refresh local environment variables:",
@@ -173,4 +174,4 @@ const headingForOutcome = (outcome) => {
 	}
 };
 //#endregion
-export { AGENT_DETECTED_DESCRIPTION, AGENT_MCP_PICKER_MESSAGE, AGENT_MCP_SKIP_MESSAGE, AGENT_OTHER_DESCRIPTION, AGENT_PICKER_MESSAGE, AGENT_PLUGIN_SKIP_MESSAGE, AGENT_SETUP_MESSAGE, AGENT_SETUP_PLUGIN_DESCRIPTION, AGENT_SETUP_PLUGIN_TITLE, AGENT_SETUP_SKILLS_DESCRIPTION, AGENT_SETUP_SKILLS_TITLE, AGENT_SETUP_SKIP_DESCRIPTION, AGENT_SETUP_SKIP_TITLE, AGENT_SKILLS_PICKER_MESSAGE, AGENT_SKILLS_SKIP_MESSAGE, CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, CONFIG_CONFIRM_HINT, CONFIG_CONFIRM_MESSAGE, HEADING_CANCELLED, HEADING_COMPLETE, HEADING_FAILED, HEADING_PENDING, INIT_NEEDS_YES, INIT_SUBTITLE, MCP_API_KEY_NEEDS_AUTH, MCP_AUTH_API_KEY_DESCRIPTION, MCP_AUTH_API_KEY_TITLE, MCP_AUTH_MESSAGE, MCP_AUTH_OAUTH_DESCRIPTION, MCP_AUTH_OAUTH_TITLE, MCP_OAUTH_FALLBACK, MCP_SCOPED_NEEDS_PROJECT, MCP_SCOPE_GLOBAL_DESCRIPTION, MCP_SCOPE_GLOBAL_TITLE, MCP_SCOPE_MESSAGE, MCP_SCOPE_PROJECT_DESCRIPTION, MCP_SCOPE_PROJECT_TITLE, MODE_CUSTOM_DESCRIPTION, MODE_CUSTOM_TITLE, MODE_MESSAGE, MODE_RECOMMENDED_DESCRIPTION, MODE_RECOMMENDED_TITLE, NON_TTY_AGENT_SETUP, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, NO_AGENT_SETUP_CONFLICT, PACKAGE_MANAGER_MESSAGE, PROGRESS, PROJECT_PINNED_OFFLINE, PROJECT_SETUP_CLAIMABLE_DESCRIPTION, PROJECT_SETUP_CLAIMABLE_TITLE, PROJECT_SETUP_LINK_DESCRIPTION, PROJECT_SETUP_LINK_TITLE, PROJECT_SETUP_MESSAGE, SERVICES_HINT, SERVICES_MESSAGE, SKILLS_PICKER_MESSAGE, agentMissingCommandDescription, claimableNext, claimableThenServicesNext, envPullFailedNext, existingConfigNext, extraServicesNext, headingForOutcome, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, offlinePinNext, skippedLinkNext, unattendedUnauthedNext };
+export { AGENT_DETECTED_DESCRIPTION, AGENT_MCP_PICKER_MESSAGE, AGENT_MCP_SKIP_MESSAGE, AGENT_OTHER_DESCRIPTION, AGENT_PICKER_MESSAGE, AGENT_PLUGIN_SKIP_MESSAGE, AGENT_SETUP_MESSAGE, AGENT_SETUP_PLUGIN_DESCRIPTION, AGENT_SETUP_PLUGIN_TITLE, AGENT_SETUP_SKILLS_DESCRIPTION, AGENT_SETUP_SKILLS_TITLE, AGENT_SETUP_SKIP_DESCRIPTION, AGENT_SETUP_SKIP_TITLE, AGENT_SKILLS_PICKER_MESSAGE, AGENT_SKILLS_SKIP_MESSAGE, CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, CONFIG_CONFIRM_HINT, CONFIG_CONFIRM_MESSAGE, HEADING_CANCELLED, HEADING_COMPLETE, HEADING_FAILED, HEADING_PENDING, INIT_NEEDS_YES, INIT_SUBTITLE, MCP_API_KEY_NEEDS_AUTH, MCP_AUTH_API_KEY_DESCRIPTION, MCP_AUTH_API_KEY_TITLE, MCP_AUTH_MESSAGE, MCP_AUTH_OAUTH_DESCRIPTION, MCP_AUTH_OAUTH_TITLE, MCP_OAUTH_FALLBACK, MCP_SCOPED_NEEDS_PROJECT, MCP_SCOPE_GLOBAL_DESCRIPTION, MCP_SCOPE_GLOBAL_TITLE, MCP_SCOPE_MESSAGE, MCP_SCOPE_PROJECT_DESCRIPTION, MCP_SCOPE_PROJECT_TITLE, MODE_CUSTOM_DESCRIPTION, MODE_CUSTOM_TITLE, MODE_MESSAGE, MODE_RECOMMENDED_DESCRIPTION, MODE_RECOMMENDED_TITLE, NON_TTY_AGENT_SETUP, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, NO_AGENT_SETUP_CONFLICT, PACKAGE_MANAGER_MESSAGE, PROGRESS, PROJECT_PINNED_OFFLINE, PROJECT_SETUP_CLAIMABLE_DESCRIPTION, PROJECT_SETUP_CLAIMABLE_TITLE, PROJECT_SETUP_LINK_DESCRIPTION, PROJECT_SETUP_LINK_TITLE, PROJECT_SETUP_MESSAGE, SERVICES_HINT, SERVICES_MESSAGE, SKILLS_PICKER_MESSAGE, agentMissingCommandDescription, claimableNext, claimableThenServicesNext, configInitNext, envPullFailedNext, existingConfigNext, headingForOutcome, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, newConfigNext, offlinePinNext, skippedLinkNext, unattendedUnauthedNext };

package/dist/init/run.js

@@ -15,7 +15,7 @@ import { missingPluginsCommands, pluginsInstallableAgents } from "../plugins/tar
 import { skillsInstallableAgents } from "../skills/targets.js";
 import { FALLBACK_SKILLS_AGENTS, assertNamedAgentTooling, funnelAgentSetup, planInitToolingSteps, recommendedTooling, resolveNamedAgents, splitInitTooling } from "./plan.js";
 import { inferPackageManager, resolvePackageManager } from "../utils/package_manager.js";
-import { CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_API_KEY_NEEDS_AUTH, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, PROJECT_PINNED_OFFLINE, claimableNext, claimableThenServicesNext, envPullFailedNext, existingConfigNext, extraServicesNext, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, offlinePinNext, skippedLinkNext, unattendedUnauthedNext } from "./copy.js";
+import { CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_API_KEY_NEEDS_AUTH, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, PROJECT_PINNED_OFFLINE, claimableNext, claimableThenServicesNext, configInitNext, envPullFailedNext, existingConfigNext, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, newConfigNext, offlinePinNext, skippedLinkNext, unattendedUnauthedNext } from "./copy.js";
 import { agentsRowValue, configRowValue, formatInitDone, headingForKind, printInitBanner, printInitDone, printInitProgress, projectRowValue, shouldPrintInitBanner } from "./chrome.js";
 import { ConfigInstallFailed, initCmd } from "../commands/config.js";
 import { quoteFlagValue, runLink } from "../commands/link.js";
@@ -620,9 +620,9 @@ const runInit = async (props) => {
 		} else if (pendingClaimable && claimExpiresAt !== void 0) {
 			if (next.length > 0) next.push("");
 			next.push(...claimableNext(claimExpiresAt));
-		} else if (pendingServices) {
+		} else if (wroteNewFile && linked) {
 			if (next.length > 0) next.push("");
-			next.push(...extraServicesNext({
+			next.push(...newConfigNext({
 				skills: installsSkills(reportedTooling()),
 				functions: declared.includes("functions")
 			}));
@@ -630,6 +630,10 @@ const runInit = async (props) => {
 			if (next.length > 0) next.push("");
 			next.push(...existingConfigNext());
 		}
+		if (funnel.config === "skipped" && !existingConfig) {
+			if (next.length > 0) next.push("");
+			next.push(...configInitNext());
+		}
 		outcome = pending && !pendingUnauthed && noLink ? "success" : pending ? "pending" : "success";
 		if (pendingUnauthed) outcome = "pending";
 		if (noLink && !pendingUnauthed && !pendingServices && !pendingExisting) outcome = "success";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.6.0",
+  "version": "8.7.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -71,9 +71,9 @@
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
     "@neon/config": "1.9.1",
-    "@neon/config-runtime": "1.10.0",
     "@neon/realtime": "0.1.0",
-    "@neon/sdk": "7.2.0"
+    "@neon/sdk": "7.2.0",
+    "@neon/config-runtime": "1.10.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",