neon 8.7.2 → 8.9.0

package/README.md

@@ -89,6 +89,9 @@ neon claim create
 
 # Request Managed Better Auth and the Data API too
 neon claim create --service auth --service data-api
+
+# Create the project in another region (default: aws-us-east-2)
+neon claim create --region-id aws-eu-central-1
 ```
 
 When the current directory has a `neon.ts`, `claim create` also requests every service
@@ -895,7 +898,7 @@ $ neon init -y --agent cursor --project-id <project-id> \
     --mcp-auth oauth --mcp-config-location project --mcp-project-scoped
 ```
 
-Without a TTY, pass `-y` or enough flags to answer every question. `-y` alone is Recommended. `-y` with `--skill`, MCP flags, `--no-agent-setup`, or `--claimable` is Custom: those flags, Recommended defaults for the rest. `--skill` selects skills (not the plugin). MCP flags select skills and MCP. `--agent` skips agent selection and, without `-y`, selects Custom. `--no-link` skips project linking without asking. `--no-config` skips `neon.ts`. `--services` implies creating `neon.ts`. `--org-id`, `--project-id`, `--project-name`, `--region-id`, and `--branch` select linking.
+Without a TTY, pass `-y` or enough flags to answer every question. `-y` alone is Recommended. `-y` with `--skill`, MCP flags, `--no-agent-setup`, or `--claimable` is Custom: those flags, Recommended defaults for the rest. `--skill` selects skills (not the plugin). MCP flags select skills and MCP. `--agent` skips agent selection and, without `-y`, selects Custom. `--no-link` skips project linking without asking. `--no-config` skips `neon.ts`. `--services` implies creating `neon.ts`. `--org-id`, `--project-id`, `--project-name`, `--region-id`, and `--branch` select linking. With `--claimable`, `--region-id` picks the claimable project's region.
 
 `--project-id`, `--org-id`, `--project-name`, `--region-id`, and `--branch` are forwarded to `link`. They select linking. A linked directory is not relinked unless you pass one of those flags.
 

package/dist/analytics.js

@@ -1,6 +1,7 @@
 import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
+import { getOrCreateAnonymousId } from "./anonymous_id.js";
 import pkg_default from "./pkg.js";
 import { UnreadableResponseError, getApiClient, isNeonApiError } from "./api.js";
 import { getAuthContext } from "./auth_context.js";
@@ -19,16 +20,17 @@ const WRITE_KEY = "3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV";
 const hasCurrentBranchArgv = () => process.argv.includes("--current-branch");
 const ANONYMOUS = "anonymous";
 /**
-* Who to attribute an event to, given whatever identified this invocation.
-*
-* Nothing is guaranteed to have identified it: a command can run with no credentials at all,
-* leaving the id empty. Segment accepts an empty `userId` and forwards it as-is rather than
-* rejecting it, so the substitution has to happen here. `""` is falsy but not nullish, which
-* is why the fallback has to be `||`.
+* The identity to send an event under. A run nothing identified (an empty `userId`, which
+* Segment would forward as-is) is the shared `"anonymous"` user, as it always was, so existing
+* queries on it keep working. The stored anonymous id goes with every event, signed in or not,
+* so the signed-out events of an installation can be joined to its account once a user is known.
 *
 * Exported for tests.
 */
-const analyticsUserId = (userId) => userId || ANONYMOUS;
+const analyticsIdentity = (userId, anonymousId) => ({
+	userId: userId || ANONYMOUS,
+	...anonymousId ? { anonymousId } : {}
+});
 /**
 * The account an invocation that presented no API key may claim, which is nothing at all
 * unless stored credentials named a user.
@@ -77,10 +79,13 @@ const telemetryCredential = (authContext, apiKey, defaultCredentialsPath) => {
 let client;
 let clientInitialized = false;
 let errorEventContext;
+/** Set with the client, so it exists only when analytics is on. */
+let anonymousId;
 /** Lets tests send to a local collector; the CLI itself always uses track.neon.tech. */
-const useAnalyticsClientForTests = (analytics) => {
+const useAnalyticsClientForTests = (analytics, testAnonymousId) => {
 	client = analytics;
 	clientInitialized = true;
+	anonymousId = testAnonymousId;
 };
 /**
 * Phase 1: Run before validation so the Segment client exists if any
@@ -97,7 +102,8 @@ const initAnalyticsClientMiddleware = (args) => {
 		host: "https://track.neon.tech"
 	});
 	log.debug("Initialized CLI analytics client");
-	client.identify({ userId: ANONYMOUS });
+	anonymousId = args.configDir ? getOrCreateAnonymousId(args.configDir) : void 0;
+	client.identify(analyticsIdentity(void 0, anonymousId));
 };
 /**
 * The attribution of the current attempt. A 401 retry runs the middleware again and starts a
@@ -179,9 +185,9 @@ const analyticsMiddleware = (args) => {
 	})();
 	queue = queue.then(() => lookup);
 	enqueue((analytics, { userId }) => {
-		analytics.identify({ userId: analyticsUserId(userId) });
+		analytics.identify(analyticsIdentity(userId, anonymousId));
 		analytics.track({
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			event: "CLI Started",
 			properties: startedProperties,
 			context: { direct: true }
@@ -266,7 +272,7 @@ const sendError = (err, errCode) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event: "CLI Error",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -284,7 +290,7 @@ const trackEvent = (event, properties) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event,
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -300,7 +306,7 @@ const trackCommandSuccess = (args) => {
 	enqueue((analytics, { userId, accountId, authMethod, authData }) => {
 		analytics.track({
 			event: "cli_command_success",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties: {
 				...properties,
 				accountId,
@@ -348,4 +354,4 @@ const getAnalyticsEventProperties = (args) => ({
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 //#endregion
-export { analyticsMiddleware, analyticsUserId, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };
+export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };

package/dist/anonymous_id.js

@@ -0,0 +1,59 @@
+import { t as writeSecretFile } from "./_chunks/secure_file-BucZj4yQ.js";
+import { isCi } from "./env.js";
+import { log } from "./log.js";
+import { isEexist } from "./refresh_lock.js";
+import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+//#region src/anonymous_id.ts
+const ANONYMOUS_ID_FILE = "anonymous_id";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const readStored = (path) => {
+	try {
+		const stored = readFileSync(path, "utf8").trim();
+		return UUID.test(stored) ? stored : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Names this installation in analytics before sign-in. Commands that know the user send it
+* alongside `userId`, so earlier events can be linked to the account.
+*
+* Not stored in CI, where the config directory doesn't outlive the run and every run would
+* mint a new installation. Call only once analytics is known to be enabled.
+*/
+const getOrCreateAnonymousId = (configDir) => {
+	if (isCi()) return;
+	const path = join(configDir, ANONYMOUS_ID_FILE);
+	try {
+		const stored = readStored(path);
+		if (stored) return stored;
+		mkdirSync(configDir, { recursive: true });
+		const id = randomUUID();
+		const temporary = `${path}.${id}.tmp`;
+		writeFileSync(temporary, `${id}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+		try {
+			linkSync(temporary, path);
+			return id;
+		} catch (err) {
+			if (!isEexist(err)) throw err;
+			const winner = readStored(path);
+			if (winner) return winner;
+			writeSecretFile(path, `${id}\n`);
+			return id;
+		} finally {
+			try {
+				unlinkSync(temporary);
+			} catch {}
+		}
+	} catch (err) {
+		log.debug("Could not store the anonymous analytics id: %s", err);
+		return;
+	}
+};
+//#endregion
+export { ANONYMOUS_ID_FILE, getOrCreateAnonymousId };

package/dist/claimable/api.js

@@ -72,6 +72,7 @@ const parseRegistrationResponse = (value) => {
 		project: {
 			id: stringField(project, "id", action),
 			branchId: stringField(project, "branch_id", action),
+			regionId: stringField(project, "region_id", action),
 			expiresAt: stringField(project, "expires_at", action)
 		},
 		capabilities: capabilities.map((item) => parseCapabilityDecision(item, action))
@@ -180,6 +181,7 @@ var ClaimableClient = class {
 				type: "anonymous",
 				capabilities: input.capabilities,
 				source: input.source,
+				...input.regionId !== void 0 ? { region_id: input.regionId } : {},
 				...input.dataApi !== void 0 ? { data_api: input.dataApi } : {}
 			}
 		}));

package/dist/commands/auth.js

@@ -2,6 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { withExclusiveLock } from "../refresh_lock.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
@@ -12,7 +13,6 @@ import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "..
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
-import { withExclusiveLock } from "../refresh_lock.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpEpilogue, helpWidth, wrapHelpText } from "../utils/help_text.js";

package/dist/commands/claim.js

@@ -90,6 +90,7 @@ const CLAIM_LIST_FIELDS = [
 const CLAIM_CREATE_FIELDS = [
 	"project_id",
 	"branch_id",
+	"region_id",
 	"state",
 	"project_expires_at",
 	"granted_capabilities",
@@ -110,7 +111,10 @@ const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option(
 	allowed: CLAIMABLE_SERVICES,
 	describe: "Services to request for the claimable project",
 	also: "Postgres is always included. Services unavailable before claim are recorded and reported."
-})).option("file", {
+})).option("region-id", {
+	describe: "Region ID for the new project (e.g. aws-eu-central-1). Defaults to aws-us-east-2",
+	type: "string"
+}).option("file", {
 	describe: "Target dotenv file. Defaults to an existing .env, otherwise .env.local",
 	type: "string"
 }).option("config", {
@@ -206,6 +210,7 @@ const create = async (props) => {
 	const registration = await client.register({
 		capabilities: claimableCapabilities(props.services ?? []),
 		source: "neon_cli",
+		...props.regionId !== void 0 ? { regionId: props.regionId } : {},
 		...props.dataApi ? { dataApi: props.dataApi } : {}
 	});
 	const stored = {
@@ -263,6 +268,7 @@ const create = async (props) => {
 		writer(props).end({
 			project_id: registration.project.id,
 			branch_id: registration.project.branchId,
+			region_id: registration.project.regionId,
 			state: "unclaimed",
 			project_expires_at: registration.project.expiresAt,
 			granted_capabilities: granted,

package/dist/commands/dev.js

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
-import { envFlag } from "./config.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { envFlag } from "./config.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/env.js

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/init.js

@@ -64,7 +64,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	describe: "Forwarded to link: name for a new project",
 	type: "string"
 }).option("region-id", {
-	describe: "Forwarded to link: region for a new project",
+	describe: "Region for a new project, forwarded to link or to the claimable project",
 	type: "string"
 }).option("branch", {
 	alias: "branch-id",

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { branchIdFromProps } from "../utils/enrichers.js";
 import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
+import { branchIdFromProps } from "../utils/enrichers.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/init/copy.js

@@ -35,7 +35,7 @@ const MCP_AUTH_API_KEY_TITLE = "Use a Neon API key";
 const MCP_AUTH_API_KEY_DESCRIPTION = "Reuse an existing MCP key or create a key after CLI authentication.";
 const CLAIMABLE_MCP_API_KEY = "Claimable project setup cannot create an account API key for MCP. Use --mcp-auth oauth.";
 const CLAIMABLE_NO_LINK = "--claimable cannot be combined with --no-link.";
-const CLAIMABLE_ACCOUNT_FLAGS = "--claimable cannot be combined with --org-id, --project-id, --project-name, --region-id, or --branch.";
+const CLAIMABLE_ACCOUNT_FLAGS = "--claimable cannot be combined with --org-id, --project-id, --project-name, or --branch.";
 const CLAIMABLE_ALREADY_LINKED = "--claimable cannot run in a directory that is already linked. Omit --claimable, or unlink first.";
 const PROJECT_SETUP_MESSAGE = "How would you like to get a Neon project?";
 const PROJECT_SETUP_LINK_TITLE = "Sign in to Neon";

package/dist/init/run.js

@@ -149,7 +149,8 @@ const defaultCreateClaimable = async (input) => {
 		apiKey: input.apiKey,
 		envPull: false,
 		cwd: input.cwd,
-		...input.profile !== void 0 ? { profile: input.profile } : {}
+		...input.profile !== void 0 ? { profile: input.profile } : {},
+		...input.regionId !== void 0 ? { regionId: input.regionId } : {}
 	});
 };
 const runInit = async (props) => {
@@ -191,7 +192,8 @@ const runInit = async (props) => {
 		...props.regionId ? { regionId: props.regionId } : {},
 		...props.branch ? { branch: props.branch } : {}
 	};
-	const hasExplicitLinkInputs = props.orgId !== void 0 || props.projectId !== void 0 || props.projectName !== void 0 || props.regionId !== void 0 || props.branch !== void 0;
+	const hasAccountLinkInputs = props.orgId !== void 0 || props.projectId !== void 0 || props.projectName !== void 0 || props.branch !== void 0;
+	const hasExplicitLinkInputs = hasAccountLinkInputs || props.regionId !== void 0;
 	const funnel = createInitFunnel();
 	let outcome = "error";
 	let printed = false;
@@ -241,7 +243,7 @@ const runInit = async (props) => {
 		const claimableExisting = alreadyLinked && readLinkedClaimableCredentials(configDir, readContextFile(contextFile)) !== null;
 		if (props.claimable === true) {
 			if (props.link === false) throw new Error(CLAIMABLE_NO_LINK);
-			if (hasExplicitLinkInputs) throw new Error(CLAIMABLE_ACCOUNT_FLAGS);
+			if (hasAccountLinkInputs) throw new Error(CLAIMABLE_ACCOUNT_FLAGS);
 			if (alreadyLinked) throw new Error(CLAIMABLE_ALREADY_LINKED);
 		}
 		const recommended = mode === "recommended";
@@ -424,7 +426,8 @@ const runInit = async (props) => {
 				contextFile,
 				output: props.output,
 				apiKey: props.apiKey,
-				...props.profile !== void 0 ? { profile: props.profile } : {}
+				...props.profile !== void 0 ? { profile: props.profile } : {},
+				...props.regionId !== void 0 ? { regionId: props.regionId } : {}
 			});
 			funnel.link = "claimable";
 			claimExpiresAt = readLinkedClaimableCredentials(configDir, readContextFile(contextFile))?.expiresAt;

package/dist/psql/io/history.js

@@ -1,7 +1,7 @@
 import { promises } from "node:fs";
 import * as path from "node:path";
-import * as os from "node:os";
 import { randomUUID } from "node:crypto";
+import * as os from "node:os";
 //#region src/psql/io/history.ts
 /**
 * psql history file I/O.

package/dist/refresh_lock.js

@@ -41,4 +41,4 @@ const withExclusiveLock = async (lockPath, fn) => {
 	}
 };
 //#endregion
-export { withExclusiveLock };
+export { isEexist, withExclusiveLock };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.7.2",
+  "version": "8.9.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -70,10 +70,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.2",
-    "@neon/config-runtime": "1.10.1",
-    "@neon/realtime": "0.1.0",
-    "@neon/sdk": "7.3.0"
+    "@neon/config": "1.9.3",
+    "@neon/config-runtime": "1.10.2",
+    "@neon/realtime": "0.1.2",
+    "@neon/sdk": "7.4.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -110,10 +110,10 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.33",
-    "@neon/env": "1.6.3",
-    "@neon/functions": "0.11.0",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon-internals/env-core": "0.0.34",
+    "@neon/e2e-harness": "0.0.0",
+    "@neon/env": "1.6.4",
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",