neon 8.6.1 → 8.7.0

package/dist/api.js

@@ -669,6 +669,13 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				database_name: databaseName
 			}
 		})),
+		getProjectBranchRealtime: (projectId, branchId) => call(() => raw.getProjectBranchRealtime({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
 		enableProjectBranchRealtime: (projectId, branchId, data) => call(() => raw.enableProjectBranchRealtime({
 			client,
 			path: {
@@ -684,6 +691,13 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 				branch_id: branchId
 			}
 		})),
+		rotateProjectBranchRealtimeSecret: (projectId, branchId) => call(() => raw.rotateProjectBranchRealtimeSecret({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
 		listProjectVpcEndpoints: (projectId) => call(() => raw.listProjectVpcEndpoints({
 			client,
 			path: { project_id: projectId }

package/dist/commands/realtime.js

@@ -1,6 +1,7 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
+import { getCliName } from "../utils/cli_name.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import { builder as builder$1, handler as handler$1 } from "./subscribe.js";
 import { defineConfig } from "@neon/config";
@@ -11,8 +12,11 @@ var realtime_exports = /* @__PURE__ */ __exportAll({
 	describe: () => describe,
 	disable: () => disable,
 	enable: () => enable,
-	handler: () => handler
+	handler: () => handler,
+	rotateSecret: () => rotateSecret
 });
+const ROTATION_POLL_INTERVAL_MS = Number(process.env.NEON_REALTIME_POLL_INTERVAL_MS) || 1e3;
+const ROTATION_POLL_TIMEOUT_MS = Number(process.env.NEON_REALTIME_POLL_TIMEOUT_MS) || 6e4;
 /** Request Realtime provisioning or an allowed-origin update for a branch. */
 const enable = async (props) => {
 	const realtime = props.allowedOrigins === void 0 ? true : { allowedOrigins: props.allowedOrigins };
@@ -27,6 +31,26 @@ const disable = async (props) => {
 	await retryOnLock(() => props.apiClient.disableProjectBranchRealtime(props.projectId, branchId));
 	log.info("Realtime disable requested for branch %s.", branchId);
 };
+/** Request replacement of a branch's Realtime shared secret. */
+const rotateSecret = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await retryOnLock(() => props.apiClient.rotateProjectBranchRealtimeSecret(props.projectId, branchId));
+	log.info("Realtime secret rotation requested for branch %s.", branchId);
+	if (!props.wait) return;
+	const deadline = Date.now() + ROTATION_POLL_TIMEOUT_MS;
+	do {
+		const { data } = await props.apiClient.getProjectBranchRealtime(props.projectId, branchId);
+		if (!data.pending) {
+			log.info("Realtime secret rotation completed for branch %s.", branchId);
+			log.info("Run %s env pull --service realtime to update NEON_REALTIME_SECRET.", getCliName());
+			return;
+		}
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) break;
+		await new Promise((resolve) => setTimeout(resolve, Math.min(ROTATION_POLL_INTERVAL_MS, remainingMs)));
+	} while (Date.now() < deadline);
+	throw new Error(`Timed out waiting for Realtime secret rotation on branch ${branchId}. It may still be in progress.`);
+};
 const command = "realtime";
 const describe = "Manage Neon Realtime for a branch";
 const builder = (argv) => argv.usage("$0 realtime <sub-command> [options]").options({
@@ -45,7 +69,11 @@ const builder = (argv) => argv.usage("$0 realtime <sub-command> [options]").opti
 }), (args) => enable({
 	...args,
 	...args.allowedOrigin !== void 0 ? { allowedOrigins: args.allowedOrigin } : {}
-})).command("disable", "Disable Realtime on a branch", (yargs) => yargs.strict(), (args) => disable(args)).command("subscribe <query>", "Subscribe to a live SQL query with Neon Realtime", builder$1, handler$1);
+})).command("disable", "Disable Realtime on a branch", (yargs) => yargs.strict(), (args) => disable(args)).command("rotate-secret", "Replace a branch's Realtime shared secret", (yargs) => yargs.strict().option("wait", {
+	describe: "Wait for the Realtime secret rotation to finish",
+	type: "boolean",
+	default: true
+}), (args) => rotateSecret(args)).command("subscribe <query>", "Subscribe to a live SQL query with Neon Realtime", builder$1, handler$1);
 const handler = (_args) => {};
 //#endregion
-export { builder, command, describe, disable, enable, handler, realtime_exports as t };
+export { builder, command, describe, disable, enable, handler, rotateSecret, realtime_exports as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.6.1",
+  "version": "8.7.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -71,9 +71,9 @@
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
     "@neon/config": "1.9.1",
-    "@neon/config-runtime": "1.10.0",
     "@neon/realtime": "0.1.0",
-    "@neon/sdk": "7.2.0"
+    "@neon/sdk": "7.2.0",
+    "@neon/config-runtime": "1.10.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",