@neon/config-runtime 0.12.5 → 1.0.1

package/dist/lib/native-packages.js

@@ -0,0 +1,424 @@
+import { installedPackageVersion, readPackageManifest } from "./resolve-package.js";
+import { ErrorCode, PlatformError, externalPackageRoot } from "@neon/config";
+import { join, resolve, sep } from "node:path";
+import { lstatSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+//#region src/lib/native-packages.ts
+/**
+* The architecture, OS and libc a Neon Function runs on. Native packages are installed for
+* this triple rather than for the machine running the deploy, which is usually a macOS or
+* linux-x64 laptop.
+*/
+const RUNTIME_TARGET = {
+	cpu: "arm64",
+	os: "linux",
+	libc: "glibc"
+};
+/** Human-readable form of {@link RUNTIME_TARGET}, for error messages. */
+const RUNTIME_TARGET_LABEL = `${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} (${RUNTIME_TARGET.libc})`;
+/**
+* `e_machine` for AArch64 in an ELF header, and the offsets needed to read it. Used to
+* verify that a binary about to be shipped really is built for the runtime, so a wrong-arch
+* file fails the deploy instead of failing `dlopen` at invoke.
+*/
+const ELF = {
+	magic: "ELF",
+	machineOffset: 18,
+	headerBytes: 20,
+	aarch64: 183
+};
+/** Extensions treated as compiled artifacts, whose architecture is worth verifying. */
+const BINARY_PATTERN = /\.(node|so)(\.\d+)*$/;
+/**
+* The WebAssembly fallback cannot be identified from its manifest: `@img/sharp-wasm32`
+* declares no `os`, `cpu`, or `libc` at all — wasm genuinely runs anywhere — so npm installs
+* it whatever target is asked for and only the name distinguishes it.
+*
+* Matched as a whole dash-delimited token rather than a substring, and only when a real
+* native build for the runtime is also being shipped. That condition is the actual semantic:
+* the fallback is dropped *because the real thing is there*, and sharp's loader would
+* otherwise fall through to it silently, turning a broken native path into a working but far
+* slower one. A project where the wasm build is the only implementation keeps it.
+*
+* Two narrower rules were tried and both failed. Scoping to a staged package's
+* `optionalDependencies` looked more principled and is wrong: `sharp` declares
+* `@img/sharp-freebsd-wasm32` and `@img/sharp-webcontainers-wasm32` but not
+* `@img/sharp-wasm32`, which arrives transitively — CI caught the fallback shipping. Matching
+* `@img/sharp-wasm32` by name would work only for sharp.
+*/
+const WASM_VARIANT_TOKEN = "wasm32";
+/**
+* Whether a package cannot load on the runtime at all, read from its own manifest the way npm
+* decides what to install — `@img/sharp-linuxmusl-arm64` declares `libc: ["musl"]`, which a
+* glibc runtime cannot load.
+*
+* A fact about the package rather than a guess from its name, so a package called
+* `musl-helper` is untouched. The WebAssembly fallback is the one case this cannot see, since
+* wasm genuinely runs anywhere; {@link WASM_VARIANT_TOKEN} covers it.
+*/
+function isIncompatibleWithRuntime(packageDir) {
+	const manifest = readPackageManifest(packageDir);
+	return manifest !== void 0 && !manifestRunsOnRuntime(manifest);
+}
+/** Whether a package name reads as a WebAssembly build. */
+function isWasmVariantName(packageName) {
+	return packageName.split(/[-/]/).includes(WASM_VARIANT_TOKEN);
+}
+/**
+* The library a platform-variant package belongs to, taken as the name up to its first
+* platform token: `@img/sharp` from both `@img/sharp-wasm32` and `@img/sharp-linux-arm64`.
+*
+* This is what lets "a real build is present" be asked per library rather than over the whole
+* tree. A package with no platform token is its own family, so it can never be mistaken for
+* a sibling of something else.
+*/
+function platformFamily(packageName) {
+	const [scope, rest] = packageName.startsWith("@") ? [`${packageName.split("/")[0]}/`, packageName.split("/")[1] ?? ""] : ["", packageName];
+	const parts = rest.split("-");
+	const cut = parts.findIndex((part) => PLATFORM_TOKENS.has(part));
+	return `${scope}${(cut === -1 ? parts : parts.slice(0, cut)).join("-")}`;
+}
+/**
+* The tokens npm's platform-variant packages are named with. Only used to find where a name
+* stops being the library and starts being the target, so an unrecognised token simply leaves
+* the package in a family of its own — which keeps its files.
+*/
+const PLATFORM_TOKENS = /* @__PURE__ */ new Set([
+	"wasm32",
+	"linux",
+	"linuxmusl",
+	"darwin",
+	"win32",
+	"freebsd",
+	"android",
+	"webcontainers"
+]);
+/** nft reports an unresolvable import as `Failed to resolve dependency "<specifier>"`. */
+const UNRESOLVED_PATTERN = /Failed to resolve dependency "([^"]+)"/;
+/**
+* The unresolved specifiers worth reporting: a file that will be missing from the archive.
+*
+* Only **relative** ones. A relative specifier names a path inside a package that is already
+* staged, so failing to resolve it means the file is absent from the trace and nothing
+* downstream notices.
+*
+* A bare specifier is the opposite — on a platform-gated package it is how the loader probes.
+* `sharp` names every platform's binary in turn, so tracing a correctly staged `sharp`
+* produces about a dozen unresolved bare specifiers, one per platform that was correctly not
+* installed, plus several built by string concatenation (`@img/sharp-libvips-/package`) that
+* no tracer can follow. Measured: twelve of them, none indicating a missing file.
+*
+* **Reported, never fatal.** Relative does not mean required: a package may do
+* `try { require("./optional.node") } catch {}` and fall back to JavaScript, which is correct
+* code that this would otherwise refuse to deploy. Telling the two apart needs control flow
+* the tracer does not expose — the same reason the undeclared-native report is advisory.
+*/
+function concreteUnresolved(unresolved) {
+	return [...new Set(unresolved.filter((specifier) => specifier.startsWith("./") || specifier.startsWith("../")))];
+}
+/** Whether a manifest's `os`/`cpu`/`libc` permit {@link RUNTIME_TARGET}. */
+function manifestRunsOnRuntime(manifest) {
+	const permits = (raw, value) => {
+		const field = typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw.filter((entry) => typeof entry === "string") : void 0;
+		if (field === void 0 || field.length === 0) return true;
+		if (field.includes(`!${value}`)) return false;
+		const positives = field.filter((entry) => !entry.startsWith("!"));
+		return positives.length === 0 || positives.includes(value);
+	};
+	return permits(manifest.os, RUNTIME_TARGET.os) && permits(manifest.cpu, RUNTIME_TARGET.cpu) && permits(manifest.libc, RUNTIME_TARGET.libc);
+}
+/**
+* The package a `node_modules/...` archive path belongs to, and where its manifest sits
+* inside the staging tree.
+*
+* Anchored on the **last** `node_modules` segment. Anchoring on the first attributes
+* `node_modules/parent/node_modules/child-musl/...` to `parent`, so the nested package is
+* classified by its parent's manifest and an incompatible build survives into the archive —
+* where an AArch64 musl binary passes the architecture check and then fails to load on glibc.
+*/
+function packageOfArchivePath(path) {
+	const segments = path.split("/");
+	const last = segments.lastIndexOf("node_modules");
+	if (last === -1) return void 0;
+	const first = segments[last + 1];
+	if (first === void 0) return void 0;
+	const scoped = first.startsWith("@");
+	const parts = scoped ? segments.slice(last + 1, last + 3) : [first];
+	if (scoped && parts.length < 2) return void 0;
+	return {
+		name: parts.join("/"),
+		dir: segments.slice(0, last + 1 + parts.length).join("/")
+	};
+}
+/** How long the staging install may take before the deploy gives up on it. */
+const INSTALL_TIMEOUT_MS = 12e4;
+const DEFAULT_ARCHIVE_LIMITS = {
+	maxZipBytes: 10485760,
+	maxTotalBytes: 67108864,
+	maxEntries: 4096
+};
+const bytes = (n) => `${(n / 1048576).toFixed(1)} MiB`;
+const invalid = (message, cause) => new PlatformError(ErrorCode.InvalidConfig, message, cause === void 0 ? void 0 : { cause });
+/**
+* Collect the files the declared native packages need, ready to be merged into the archive.
+*
+* Three steps, in this order for reasons that are not interchangeable:
+*
+* 1. **Install for the runtime target into a throwaway directory.** The user's own
+*    `node_modules` is never read for these files. Its binaries are built for their machine,
+*    and a cross-platform install is not sticky — a later plain `npm install` re-resolves
+*    optional dependencies for the host and replaces the target's packages with the host's.
+*    Only the resolved *version* of the declared package is taken from the user's tree. That
+*    is not the same as honouring their lockfile: transitive pins, overrides, patches, and
+*    aliases are not carried across, so the staged graph can differ below the root.
+* 2. **Trace the installed tree.** The file set cannot be discovered by asking Node:
+*    `@img/sharp-linux-arm64` exports only `./sharp.node` and `./package`, with no `.` and no
+*    wildcard, so its directory is unreachable through the resolver. A tracer that follows
+*    `createRequire` is required — which is also why esbuild cannot see these files, and why
+*    `sharp` bundles cleanly today and then fails at invoke.
+* 3. **Copy the traced files, preserving the `node_modules` layout.** A `.node` addon locates
+*    its sibling shared libraries by a path relative to its own directory, so flattening the
+*    tree breaks loading even though every file is present.
+*/
+async function traceNativePackages(options) {
+	const { slug, packages, projectDir } = options;
+	const limits = options.limits ?? DEFAULT_ARCHIVE_LIMITS;
+	const deps = {
+		...defaultDeps,
+		...options.deps
+	};
+	const roots = [...new Set(packages.map(externalPackageRoot))];
+	const warnings = [];
+	const specs = roots.map((pkg) => {
+		const version = deps.installedVersion(projectDir, pkg);
+		if (version === void 0) throw invalid(`Function "${slug}" stages "${pkg}", but no installed copy of it could be found in this project, so the deploy cannot tell which version you tested against. Install "${pkg}" as a dependency, or exclude it if the function never reaches it:\n    externalPackages: [{ name: "${pkg}", includeFiles: false }]`);
+		return `${pkg}@${version}`;
+	});
+	const staging = mkdtempSync(join(tmpdir(), "neon-fn-native-"));
+	try {
+		writeFileSync(join(staging, "package.json"), `${JSON.stringify({
+			name: "neon-fn-native-staging",
+			private: true
+		}, null, 2)}\n`);
+		await deps.install(staging, specs);
+		verifyInstalled(slug, roots, staging);
+		writeFileSync(join(staging, "trace-entry.mjs"), packages.map((pkg) => `import ${JSON.stringify(pkg)};`).join("\n"));
+		const traced = await deps.trace(staging, "trace-entry.mjs");
+		for (const specifier of concreteUnresolved(traced.unresolved ?? [])) warnings.push(`Function "${slug}" stages a package that imports "${specifier}", which is not in the tree the deploy installed. The import is relative to a package that *was* installed, so it will not appear in the archive and nothing else will notice. If the package reaches it, the function fails at invoke with "Cannot find module". If the import is wrapped in a try/catch — a native accelerator behind a JavaScript fallback — the deploy is already correct.`);
+		const entries = readArchiveFiles(slug, staging, selectArchiveFiles(slug, traced.files, staging));
+		enforceLimits(slug, entries, limits);
+		return {
+			entries,
+			warnings
+		};
+	} finally {
+		rmSync(staging, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/**
+* Fail when a declared package produced no build for the runtime target. npm omits a
+* platform-specific optional dependency silently when none matches, so "installed" does not
+* imply "usable here" — without this check the archive would ship a package whose binary is
+* simply absent, and the failure would surface at invoke.
+*/
+function verifyInstalled(slug, packages, staging) {
+	for (const pkg of packages) {
+		const manifest = join(staging, "node_modules", pkg, "package.json");
+		if (lstatSync(manifest, { throwIfNoEntry: false }) === void 0) throw invalid(`Function "${slug}" declares "${pkg}" in externalPackages, but it did not install for the Functions runtime (${RUNTIME_TARGET_LABEL}). Either the package does not publish a build for that platform, or it compiles from source at install time, which the deploy cannot do. Check that it lists a ${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} build among its optional dependencies. If this function never reaches "${pkg}", exclude it instead:\n    externalPackages: [{ name: "${pkg}", includeFiles: false }]`);
+	}
+}
+/**
+* Reduce a trace to the files worth archiving: everything under `node_modules`, minus the
+* sibling builds that cannot run on the runtime (see {@link isIncompatibleWithRuntime}) and
+* the WebAssembly fallback when a real build is shipping (see {@link WASM_VARIANT_TOKEN}).
+* The trace entry itself is dropped — the real entry is the esbuild bundle.
+*/
+function selectArchiveFiles(slug, traced, staging) {
+	const inTree = traced.filter((path) => path.startsWith(`node_modules${sep}`) || path.startsWith("node_modules/")).map((path) => path.split(sep).join("/"));
+	const incompatible = /* @__PURE__ */ new Map();
+	const isIncompatible = (dir) => {
+		const known = incompatible.get(dir);
+		if (known !== void 0) return known;
+		const decision = isIncompatibleWithRuntime(join(staging, ...dir.split("/")));
+		incompatible.set(dir, decision);
+		return decision;
+	};
+	const compatible = inTree.filter((path) => {
+		const pkg = packageOfArchivePath(path);
+		return pkg !== void 0 && !isIncompatible(pkg.dir);
+	});
+	/**
+	* A wasm build is only redundant next to the real build of the *same library at the same
+	* version*. Keying on the family alone conflates versions: a tree holding
+	* `foo-linux-arm64@1` and a nested `foo-wasm32@2` would delete v2 — whose consumer has no
+	* other implementation — because v1 shipped a binary.
+	*/
+	const variantKey = (name, dir) => {
+		const version = readPackageManifest(join(staging, ...dir.split("/")))?.version;
+		return `${platformFamily(name)}@${typeof version === "string" ? version : "?"}`;
+	};
+	const nativeBuilds = new Set(compatible.filter((path) => BINARY_PATTERN.test(path)).flatMap((path) => {
+		const pkg = packageOfArchivePath(path);
+		return pkg === void 0 ? [] : [variantKey(pkg.name, pkg.dir)];
+	}));
+	const files = compatible.filter((path) => {
+		const pkg = packageOfArchivePath(path);
+		if (pkg === void 0) return true;
+		return !(isWasmVariantName(pkg.name) && nativeBuilds.has(variantKey(pkg.name, pkg.dir)));
+	}).sort();
+	if (files.length === 0) throw invalid(`Function "${slug}" stages external packages, but tracing the installed packages found no files to ship. This is a bug in the deploy — please report it at https://github.com/neondatabase/neon-pkgs/issues.`);
+	return files;
+}
+/**
+* Read the traced files, checking each one is shippable as it goes.
+*
+* Two rejections here, both cheaper to hit now than after upload. A symlink cannot be
+* represented in the archive at all, and a compiled binary built for the wrong architecture
+* would deploy fine and then fail to load — which is the exact failure this whole option
+* exists to prevent, so it must not be reintroduced by a stale or hand-patched tree.
+*/
+function readArchiveFiles(slug, staging, files) {
+	const entries = {};
+	for (const relative of files) {
+		const absolute = resolve(staging, relative);
+		if (!absolute.startsWith(`${resolve(staging)}${sep}`)) throw invalid(`Function "${slug}": traced file "${relative}" resolves outside the staging directory. This is a bug in the deploy — please report it.`);
+		const stat = lstatSync(absolute, { throwIfNoEntry: false });
+		if (stat === void 0) throw invalid(`Function "${slug}": traced file "${relative}" disappeared before it could be read. This is a bug in the deploy — please report it at https://github.com/neondatabase/neon-pkgs/issues.`);
+		if (stat.isSymbolicLink()) throw invalid(`Function "${slug}" would ship a symbolic link, which the build does not support: ${relative}. This is a bug in the deploy — please report it at https://github.com/neondatabase/neon-pkgs/issues.`);
+		if (!stat.isFile()) continue;
+		const contents = readFileSync(absolute);
+		if (BINARY_PATTERN.test(relative)) verifyArchitecture(slug, relative, contents);
+		entries[relative] = new Uint8Array(contents);
+	}
+	return entries;
+}
+/**
+* Reject a compiled artifact that is not built for the runtime. Only ELF AArch64 can load
+* there, so anything else — a Mach-O from the user's laptop, an x64 ELF from a stale
+* install — is a deploy-time error rather than an invoke-time one.
+*/
+function verifyArchitecture(slug, relative, contents) {
+	if (contents.length < ELF.headerBytes) throw invalid(`Function "${slug}" would ship "${relative}", which is ${contents.length} bytes — too short to be a valid binary. The package may have been installed incompletely; reinstall it and try again.`);
+	if (!(contents.subarray(0, 4).toString("binary") === ELF.magic)) throw invalid(`Function "${slug}" would ship "${relative}", which is not a Linux binary. The Functions runtime is ${RUNTIME_TARGET_LABEL}, so a binary built for another platform cannot load there. A package that compiles from source at install time produces a binary for the machine that installed it and cannot be cross-installed by the deploy.`);
+	const machine = contents.readUInt16LE(ELF.machineOffset);
+	if (machine !== ELF.aarch64) throw invalid(`Function "${slug}" would ship "${relative}", which is built for a different architecture (ELF machine 0x${machine.toString(16)}). The Functions runtime is ${RUNTIME_TARGET_LABEL}.`);
+}
+/**
+* Check the archive against the build service's limits, naming the largest contributors. The
+* compressed size is not known until the archive is zipped, so only the counts and
+* uncompressed total are checked here; {@link assertZipWithinLimits} covers the rest.
+*
+* Exported so the caller can re-check the **final** archive: these entries are the staged
+* files alone, and the bundle is merged in afterwards.
+*/
+function enforceLimits(slug, entries, limits = DEFAULT_ARCHIVE_LIMITS) {
+	const names = Object.keys(entries);
+	const count = names.length;
+	if (count > limits.maxEntries) throw invalid(`Function "${slug}" archive has ${count} files; the limit is ${limits.maxEntries}. Native packages bring their whole file tree — ship fewer of them, or split the work across functions.`);
+	const total = names.reduce((sum, name) => sum + entries[name].length, 0);
+	if (total > limits.maxTotalBytes) throw invalid(`Function "${slug}" archive is ${bytes(total)} uncompressed; the limit is ${bytes(limits.maxTotalBytes)}.\n\n${describeLargest(entries)}`);
+}
+/**
+* Check the compressed archive, which is only measurable once it exists. Separate from
+* {@link enforceLimits} for that reason, and exported so the bundler can call it on the
+* finished ZIP.
+*/
+function assertZipWithinLimits(slug, zip, entries, limits = DEFAULT_ARCHIVE_LIMITS) {
+	if (zip.length <= limits.maxZipBytes) return;
+	throw invalid(`Function "${slug}" archive is ${bytes(zip.length)} compressed; the limit is ${bytes(limits.maxZipBytes)}.\n\n${describeLargest(entries)}`);
+}
+/** The handful of files worth naming when an archive is too big. */
+function describeLargest(entries) {
+	return `Largest contributors:\n${Object.entries(entries).sort(([, a], [, b]) => b.length - a.length).slice(0, 4).map(([name, data]) => `  ${bytes(data.length).padStart(9)}  ${name}`).join("\n")}\n\nNative binaries are large. Ship fewer of them, or split the work across functions.`;
+}
+const defaultDeps = {
+	install: (cwd, specs) => runNpmInstall(cwd, specs),
+	trace: async (base, entry) => {
+		const { nodeFileTrace } = await loadNft();
+		const result = await nodeFileTrace([join(base, entry)], { base });
+		return {
+			files: [...result.fileList],
+			unresolved: [...result.warnings].flatMap((warning) => {
+				const specifier = UNRESOLVED_PATTERN.exec(warning.message)?.[1];
+				return specifier === void 0 ? [] : [specifier];
+			})
+		};
+	},
+	installedVersion: (projectDir, pkg) => installedPackageVersion(projectDir, pkg)
+};
+/**
+* Install into the staging directory by shelling out to whatever `npm` is on `PATH`, rather
+* than importing it. The CLI also ships as a standalone binary with no npm and no
+* `node_modules` inside it, so a `require()` would be unresolvable there; a subprocess works
+* in both forms.
+*
+* `--cpu/--os/--libc` are what select the runtime's builds instead of the host's.
+* `--ignore-scripts` matters for more than speed: an install script would compile for the
+* host architecture and overwrite the prebuilt binary we are here to collect.
+*/
+async function runNpmInstall(cwd, specs) {
+	const args = [
+		"install",
+		...specs,
+		`--cpu=${RUNTIME_TARGET.cpu}`,
+		`--os=${RUNTIME_TARGET.os}`,
+		`--libc=${RUNTIME_TARGET.libc}`,
+		"--ignore-scripts",
+		"--no-audit",
+		"--no-fund",
+		"--no-package-lock",
+		"--loglevel=error"
+	];
+	const { code, stderr, spawnError } = await new Promise((resolveRun) => {
+		const child = spawn("npm", args, {
+			cwd,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			],
+			timeout: INSTALL_TIMEOUT_MS
+		});
+		let stderr = "";
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		child.on("error", (spawnError) => resolveRun({
+			code: null,
+			stderr,
+			spawnError
+		}));
+		child.on("close", (code) => resolveRun({
+			code,
+			stderr
+		}));
+	});
+	if (spawnError !== void 0) {
+		const missing = spawnError.code === "ENOENT";
+		throw invalid(missing ? `Shipping a function's externalPackages requires "npm" on PATH, to install them for the Functions runtime (${RUNTIME_TARGET_LABEL}). It could not be found. Install Node.js with npm, or set includeFiles: false on every entry so nothing needs staging.` : `Failed to install externalPackages for the Functions runtime: ${spawnError.message}`, spawnError);
+	}
+	if (code !== 0) {
+		if (stderr.includes("EBADPLATFORM")) throw invalid(`One of ${specs.map((s) => `"${s}"`).join(", ")} has no build for the Functions runtime (${RUNTIME_TARGET_LABEL}), so its files cannot be staged. Use a package that publishes a ${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} build (sharp does). If this function never reaches it, exclude it instead:\n    externalPackages: [{ name: "<package>", includeFiles: false }]\n\nnpm reported:\n${stderr.trim()}`);
+		throw invalid(`Failed to install externalPackages for the Functions runtime (${RUNTIME_TARGET_LABEL}). npm exited with code ${code}.\n${stderr.trim()}`);
+	}
+}
+/**
+* Loaded with a dynamic `import()` for the same reason as esbuild and fflate: nothing in this
+* package's static graph should name the tracer, so a `neon.ts` that only reads config never
+* pulls it in. A deploy that declares no native packages never reaches this.
+*/
+async function loadNft() {
+	try {
+		return await import("@vercel/nft");
+	} catch (cause) {
+		throw invalid("Staging a function's external packages requires `@vercel/nft`, which could not be loaded. Installed from npm it is a dependency of @neon/config-runtime, so reinstalling your dependencies fixes it. If you are running the standalone `neon` binary, this is a packaging bug — please report it at https://github.com/neondatabase/neon-pkgs/issues.", cause);
+	}
+}
+//#endregion
+export { DEFAULT_ARCHIVE_LIMITS, RUNTIME_TARGET, RUNTIME_TARGET_LABEL, assertZipWithinLimits, enforceLimits, traceNativePackages };
+
+//# sourceMappingURL=native-packages.js.map

package/dist/lib/native-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-packages.js","names":[],"sources":["../../src/lib/native-packages.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport {\n\tlstatSync,\n\tmkdtempSync,\n\treadFileSync,\n\trmSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join, resolve, sep } from \"node:path\";\nimport { ErrorCode, externalPackageRoot, PlatformError } from \"@neon/config\";\nimport {\n\tinstalledPackageVersion,\n\treadPackageManifest,\n} from \"./resolve-package.js\";\n\n/**\n * The architecture, OS and libc a Neon Function runs on. Native packages are installed for\n * this triple rather than for the machine running the deploy, which is usually a macOS or\n * linux-x64 laptop.\n */\nexport const RUNTIME_TARGET = {\n\tcpu: \"arm64\",\n\tos: \"linux\",\n\tlibc: \"glibc\",\n} as const;\n\n/** Human-readable form of {@link RUNTIME_TARGET}, for error messages. */\nexport const RUNTIME_TARGET_LABEL = `${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} (${RUNTIME_TARGET.libc})`;\n\n/**\n * `e_machine` for AArch64 in an ELF header, and the offsets needed to read it. Used to\n * verify that a binary about to be shipped really is built for the runtime, so a wrong-arch\n * file fails the deploy instead of failing `dlopen` at invoke.\n */\nconst ELF = {\n\tmagic: \"\\x7fELF\",\n\tmachineOffset: 18,\n\theaderBytes: 20,\n\taarch64: 0xb7,\n} as const;\n\n/** Extensions treated as compiled artifacts, whose architecture is worth verifying. */\nconst BINARY_PATTERN = /\\.(node|so)(\\.\\d+)*$/;\n\n/**\n * The WebAssembly fallback cannot be identified from its manifest: `@img/sharp-wasm32`\n * declares no `os`, `cpu`, or `libc` at all — wasm genuinely runs anywhere — so npm installs\n * it whatever target is asked for and only the name distinguishes it.\n *\n * Matched as a whole dash-delimited token rather than a substring, and only when a real\n * native build for the runtime is also being shipped. That condition is the actual semantic:\n * the fallback is dropped *because the real thing is there*, and sharp's loader would\n * otherwise fall through to it silently, turning a broken native path into a working but far\n * slower one. A project where the wasm build is the only implementation keeps it.\n *\n * Two narrower rules were tried and both failed. Scoping to a staged package's\n * `optionalDependencies` looked more principled and is wrong: `sharp` declares\n * `@img/sharp-freebsd-wasm32` and `@img/sharp-webcontainers-wasm32` but not\n * `@img/sharp-wasm32`, which arrives transitively — CI caught the fallback shipping. Matching\n * `@img/sharp-wasm32` by name would work only for sharp.\n */\nconst WASM_VARIANT_TOKEN = \"wasm32\";\n\n/**\n * Whether a package cannot load on the runtime at all, read from its own manifest the way npm\n * decides what to install — `@img/sharp-linuxmusl-arm64` declares `libc: [\"musl\"]`, which a\n * glibc runtime cannot load.\n *\n * A fact about the package rather than a guess from its name, so a package called\n * `musl-helper` is untouched. The WebAssembly fallback is the one case this cannot see, since\n * wasm genuinely runs anywhere; {@link WASM_VARIANT_TOKEN} covers it.\n */\nfunction isIncompatibleWithRuntime(packageDir: string): boolean {\n\tconst manifest = readPackageManifest(packageDir);\n\treturn manifest !== undefined && !manifestRunsOnRuntime(manifest);\n}\n\n/** Whether a package name reads as a WebAssembly build. */\nfunction isWasmVariantName(packageName: string): boolean {\n\treturn packageName.split(/[-/]/).includes(WASM_VARIANT_TOKEN);\n}\n\n/**\n * The library a platform-variant package belongs to, taken as the name up to its first\n * platform token: `@img/sharp` from both `@img/sharp-wasm32` and `@img/sharp-linux-arm64`.\n *\n * This is what lets \"a real build is present\" be asked per library rather than over the whole\n * tree. A package with no platform token is its own family, so it can never be mistaken for\n * a sibling of something else.\n */\nfunction platformFamily(packageName: string): string {\n\tconst [scope, rest] = packageName.startsWith(\"@\")\n\t\t? [`${packageName.split(\"/\")[0]}/`, packageName.split(\"/\")[1] ?? \"\"]\n\t\t: [\"\", packageName];\n\tconst parts = rest.split(\"-\");\n\tconst cut = parts.findIndex((part) => PLATFORM_TOKENS.has(part));\n\treturn `${scope}${(cut === -1 ? parts : parts.slice(0, cut)).join(\"-\")}`;\n}\n\n/**\n * The tokens npm's platform-variant packages are named with. Only used to find where a name\n * stops being the library and starts being the target, so an unrecognised token simply leaves\n * the package in a family of its own — which keeps its files.\n */\nconst PLATFORM_TOKENS = new Set([\n\t\"wasm32\",\n\t\"linux\",\n\t\"linuxmusl\",\n\t\"darwin\",\n\t\"win32\",\n\t\"freebsd\",\n\t\"android\",\n\t\"webcontainers\",\n]);\n\n/** nft reports an unresolvable import as `Failed to resolve dependency \"<specifier>\"`. */\nconst UNRESOLVED_PATTERN = /Failed to resolve dependency \"([^\"]+)\"/;\n\n/**\n * The unresolved specifiers worth reporting: a file that will be missing from the archive.\n *\n * Only **relative** ones. A relative specifier names a path inside a package that is already\n * staged, so failing to resolve it means the file is absent from the trace and nothing\n * downstream notices.\n *\n * A bare specifier is the opposite — on a platform-gated package it is how the loader probes.\n * `sharp` names every platform's binary in turn, so tracing a correctly staged `sharp`\n * produces about a dozen unresolved bare specifiers, one per platform that was correctly not\n * installed, plus several built by string concatenation (`@img/sharp-libvips-/package`) that\n * no tracer can follow. Measured: twelve of them, none indicating a missing file.\n *\n * **Reported, never fatal.** Relative does not mean required: a package may do\n * `try { require(\"./optional.node\") } catch {}` and fall back to JavaScript, which is correct\n * code that this would otherwise refuse to deploy. Telling the two apart needs control flow\n * the tracer does not expose — the same reason the undeclared-native report is advisory.\n */\nfunction concreteUnresolved(unresolved: readonly string[]): string[] {\n\treturn [\n\t\t...new Set(\n\t\t\tunresolved.filter(\n\t\t\t\t(specifier) =>\n\t\t\t\t\tspecifier.startsWith(\"./\") || specifier.startsWith(\"../\"),\n\t\t\t),\n\t\t),\n\t];\n}\n\n/** Whether a manifest's `os`/`cpu`/`libc` permit {@link RUNTIME_TARGET}. */\nfunction manifestRunsOnRuntime(manifest: Record<string, unknown>): boolean {\n\tconst permits = (raw: unknown, value: string): boolean => {\n\t\tconst field =\n\t\t\ttypeof raw === \"string\"\n\t\t\t\t? [raw]\n\t\t\t\t: Array.isArray(raw)\n\t\t\t\t\t? raw.filter(\n\t\t\t\t\t\t\t(entry): entry is string =>\n\t\t\t\t\t\t\t\ttypeof entry === \"string\",\n\t\t\t\t\t\t)\n\t\t\t\t\t: undefined;\n\t\tif (field === undefined || field.length === 0) return true;\n\t\tif (field.includes(`!${value}`)) return false;\n\t\tconst positives = field.filter((entry) => !entry.startsWith(\"!\"));\n\t\treturn positives.length === 0 || positives.includes(value);\n\t};\n\treturn (\n\t\tpermits(manifest.os, RUNTIME_TARGET.os) &&\n\t\tpermits(manifest.cpu, RUNTIME_TARGET.cpu) &&\n\t\tpermits(manifest.libc, RUNTIME_TARGET.libc)\n\t);\n}\n\n/**\n * The package a `node_modules/...` archive path belongs to, and where its manifest sits\n * inside the staging tree.\n *\n * Anchored on the **last** `node_modules` segment. Anchoring on the first attributes\n * `node_modules/parent/node_modules/child-musl/...` to `parent`, so the nested package is\n * classified by its parent's manifest and an incompatible build survives into the archive —\n * where an AArch64 musl binary passes the architecture check and then fails to load on glibc.\n */\nfunction packageOfArchivePath(\n\tpath: string,\n): { name: string; dir: string } | undefined {\n\tconst segments = path.split(\"/\");\n\tconst last = segments.lastIndexOf(\"node_modules\");\n\tif (last === -1) return undefined;\n\n\tconst first = segments[last + 1];\n\tif (first === undefined) return undefined;\n\tconst scoped = first.startsWith(\"@\");\n\tconst parts = scoped ? segments.slice(last + 1, last + 3) : [first];\n\tif (scoped && parts.length < 2) return undefined;\n\n\treturn {\n\t\tname: parts.join(\"/\"),\n\t\t// Everything up to and including the package's own segments.\n\t\tdir: segments.slice(0, last + 1 + parts.length).join(\"/\"),\n\t};\n}\n\n/** How long the staging install may take before the deploy gives up on it. */\nconst INSTALL_TIMEOUT_MS = 120_000;\n\n/**\n * Size ceilings the deploy must respect. The build service rejects an archive over these,\n * with an error that surfaces long after the CLI has exited, so they are checked here where\n * the message can name the files responsible.\n *\n * These mirror the service's limits rather than defining them. Passing them in lets a caller\n * track a change on the service side without editing this module.\n */\nexport type ArchiveLimits = {\n\t/** Compressed archive bytes — the ZIP that is uploaded. */\n\tmaxZipBytes: number;\n\t/** Total uncompressed bytes across every archive entry. */\n\tmaxTotalBytes: number;\n\t/** Number of archive entries. */\n\tmaxEntries: number;\n};\n\nexport const DEFAULT_ARCHIVE_LIMITS: ArchiveLimits = {\n\tmaxZipBytes: 10 * 1024 * 1024,\n\tmaxTotalBytes: 64 * 1024 * 1024,\n\tmaxEntries: 4096,\n};\n\n/** Injectable side effects, so the tracing logic is testable without a registry or npm. */\nexport type NativeTraceDeps = {\n\t/** Install `specs` for the runtime target into `cwd`. Resolves on success. */\n\tinstall: (cwd: string, specs: string[]) => Promise<void>;\n\t/** Trace `entry` within `base`, returning archive-relative file paths. */\n\t/**\n\t * Trace `entry` within `base`.\n\t *\n\t * `files` are archive-relative paths. `unresolved` are the specifiers the tracer could\n\t * not follow, which are classified rather than reported wholesale — see\n\t * {@link concreteUnresolved}.\n\t */\n\ttrace: (\n\t\tbase: string,\n\t\tentry: string,\n\t) => Promise<{ files: string[]; unresolved?: string[] }>;\n\t/** Version of `pkg` as resolved in the user's project, or undefined if not installed. */\n\tinstalledVersion: (projectDir: string, pkg: string) => string | undefined;\n};\n\n/** Files to place in the archive under `node_modules/`, keyed by archive-relative path. */\nexport type NativeTraceResult = {\n\tentries: Record<string, Uint8Array>;\n\t/**\n\t * Advisory findings from the staging run — currently a relative import the tracer could\n\t * not resolve, meaning that file will not be in the archive.\n\t *\n\t * The caller must surface these. They are advisory rather than fatal because the tracer\n\t * cannot tell a required import from one wrapped in a try/catch, but an unreported one is\n\t * a function that deploys clean and fails at invoke.\n\t */\n\twarnings: string[];\n};\n\nconst bytes = (n: number): string => `${(n / (1024 * 1024)).toFixed(1)} MiB`;\n\nconst invalid = (message: string, cause?: unknown): PlatformError =>\n\tnew PlatformError(\n\t\tErrorCode.InvalidConfig,\n\t\tmessage,\n\t\tcause === undefined ? undefined : { cause },\n\t);\n\n/**\n * Collect the files the declared native packages need, ready to be merged into the archive.\n *\n * Three steps, in this order for reasons that are not interchangeable:\n *\n * 1. **Install for the runtime target into a throwaway directory.** The user's own\n *    `node_modules` is never read for these files. Its binaries are built for their machine,\n *    and a cross-platform install is not sticky — a later plain `npm install` re-resolves\n *    optional dependencies for the host and replaces the target's packages with the host's.\n *    Only the resolved *version* of the declared package is taken from the user's tree. That\n *    is not the same as honouring their lockfile: transitive pins, overrides, patches, and\n *    aliases are not carried across, so the staged graph can differ below the root.\n * 2. **Trace the installed tree.** The file set cannot be discovered by asking Node:\n *    `@img/sharp-linux-arm64` exports only `./sharp.node` and `./package`, with no `.` and no\n *    wildcard, so its directory is unreachable through the resolver. A tracer that follows\n *    `createRequire` is required — which is also why esbuild cannot see these files, and why\n *    `sharp` bundles cleanly today and then fails at invoke.\n * 3. **Copy the traced files, preserving the `node_modules` layout.** A `.node` addon locates\n *    its sibling shared libraries by a path relative to its own directory, so flattening the\n *    tree breaks loading even though every file is present.\n */\nexport async function traceNativePackages(options: {\n\tslug: string;\n\tpackages: readonly string[];\n\tprojectDir: string;\n\tlimits?: ArchiveLimits;\n\tdeps?: Partial<NativeTraceDeps>;\n}): Promise<NativeTraceResult> {\n\tconst { slug, packages, projectDir } = options;\n\tconst limits = options.limits ?? DEFAULT_ARCHIVE_LIMITS;\n\tconst deps: NativeTraceDeps = { ...defaultDeps, ...options.deps };\n\n\t// `packages` are the specifiers as authored, which is what the trace entry must import.\n\t// Installing and verifying work on whole packages, so those use the roots.\n\tconst roots = [...new Set(packages.map(externalPackageRoot))];\n\n\tconst warnings: string[] = [];\n\tconst specs = roots.map((pkg) => {\n\t\tconst version = deps.installedVersion(projectDir, pkg);\n\t\t// Pinned to the user's own resolution, and refused outright when it cannot be read.\n\t\t// The alternative is installing whatever the registry calls latest, which ships code\n\t\t// the user has never run — a difference that surfaces as an unreproducible production\n\t\t// bug rather than as a deploy error. Guaranteeing the declared root is pinned is what\n\t\t// makes the remaining gap (transitive pins, overrides, patches) a bounded one.\n\t\tif (version === undefined) {\n\t\t\tthrow invalid(\n\t\t\t\t`Function \"${slug}\" stages \"${pkg}\", but no installed copy of it could be found ` +\n\t\t\t\t\t`in this project, so the deploy cannot tell which version you tested ` +\n\t\t\t\t\t`against. Install \"${pkg}\" as a dependency, or exclude it if the function ` +\n\t\t\t\t\t`never reaches it:\\n` +\n\t\t\t\t\t`    externalPackages: [{ name: \"${pkg}\", includeFiles: false }]`,\n\t\t\t);\n\t\t}\n\t\treturn `${pkg}@${version}`;\n\t});\n\n\tconst staging = mkdtempSync(join(tmpdir(), \"neon-fn-native-\"));\n\ttry {\n\t\t// A manifest whose name matches no dependency, and no lockfile, so npm treats the\n\t\t// directory as a fresh project and resolves the declared specs on their own.\n\t\twriteFileSync(\n\t\t\tjoin(staging, \"package.json\"),\n\t\t\t`${JSON.stringify({ name: \"neon-fn-native-staging\", private: true }, null, 2)}\\n`,\n\t\t);\n\t\tawait deps.install(staging, specs);\n\t\tverifyInstalled(slug, roots, staging);\n\n\t\t// One entry importing every declared specifier, so a single trace covers them all.\n\t\t// The authored specifier rather than the root: a package whose `exports` map lists\n\t\t// only a subpath cannot be imported by its root at all.\n\t\twriteFileSync(\n\t\t\tjoin(staging, \"trace-entry.mjs\"),\n\t\t\tpackages.map((pkg) => `import ${JSON.stringify(pkg)};`).join(\"\\n\"),\n\t\t);\n\n\t\tconst traced = await deps.trace(staging, \"trace-entry.mjs\");\n\t\tfor (const specifier of concreteUnresolved(traced.unresolved ?? [])) {\n\t\t\twarnings.push(\n\t\t\t\t`Function \"${slug}\" stages a package that imports \"${specifier}\", which is not ` +\n\t\t\t\t\t`in the tree the deploy installed. The import is relative to a package that ` +\n\t\t\t\t\t`*was* installed, so it will not appear in the archive and nothing else will ` +\n\t\t\t\t\t`notice. If the package reaches it, the function fails at invoke with ` +\n\t\t\t\t\t`\"Cannot find module\". If the import is wrapped in a try/catch — a native ` +\n\t\t\t\t\t`accelerator behind a JavaScript fallback — the deploy is already correct.`,\n\t\t\t);\n\t\t}\n\t\tconst files = selectArchiveFiles(slug, traced.files, staging);\n\t\tconst entries = readArchiveFiles(slug, staging, files);\n\t\tenforceLimits(slug, entries, limits);\n\t\treturn { entries, warnings };\n\t} finally {\n\t\trmSync(staging, { recursive: true, force: true });\n\t}\n}\n\n/**\n * Fail when a declared package produced no build for the runtime target. npm omits a\n * platform-specific optional dependency silently when none matches, so \"installed\" does not\n * imply \"usable here\" — without this check the archive would ship a package whose binary is\n * simply absent, and the failure would surface at invoke.\n */\nfunction verifyInstalled(\n\tslug: string,\n\tpackages: readonly string[],\n\tstaging: string,\n): void {\n\tfor (const pkg of packages) {\n\t\tconst manifest = join(staging, \"node_modules\", pkg, \"package.json\");\n\t\tif (lstatSync(manifest, { throwIfNoEntry: false }) === undefined) {\n\t\t\tthrow invalid(\n\t\t\t\t`Function \"${slug}\" declares \"${pkg}\" in externalPackages, but it did not ` +\n\t\t\t\t\t`install for the Functions runtime (${RUNTIME_TARGET_LABEL}). Either the ` +\n\t\t\t\t\t`package does not publish a build for that platform, or it compiles from ` +\n\t\t\t\t\t`source at install time, which the deploy cannot do. Check that it lists a ` +\n\t\t\t\t\t`${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} build among its optional ` +\n\t\t\t\t\t`dependencies. If this function never reaches \"${pkg}\", exclude it instead:` +\n\t\t\t\t\t`\\n    externalPackages: [{ name: \"${pkg}\", includeFiles: false }]`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/**\n * Reduce a trace to the files worth archiving: everything under `node_modules`, minus the\n * sibling builds that cannot run on the runtime (see {@link isIncompatibleWithRuntime}) and\n * the WebAssembly fallback when a real build is shipping (see {@link WASM_VARIANT_TOKEN}).\n * The trace entry itself is dropped — the real entry is the esbuild bundle.\n */\nfunction selectArchiveFiles(\n\tslug: string,\n\ttraced: readonly string[],\n\tstaging: string,\n): string[] {\n\tconst inTree = traced\n\t\t.filter(\n\t\t\t(path) =>\n\t\t\t\tpath.startsWith(`node_modules${sep}`) ||\n\t\t\t\tpath.startsWith(\"node_modules/\"),\n\t\t)\n\t\t.map((path) => path.split(sep).join(\"/\"));\n\n\t// Resolved once per package directory: the decision is a property of the package, and its\n\t// manifest would otherwise be re-read for every file it contributes.\n\tconst incompatible = new Map<string, boolean>();\n\tconst isIncompatible = (dir: string): boolean => {\n\t\tconst known = incompatible.get(dir);\n\t\tif (known !== undefined) return known;\n\t\tconst decision = isIncompatibleWithRuntime(\n\t\t\tjoin(staging, ...dir.split(\"/\")),\n\t\t);\n\t\tincompatible.set(dir, decision);\n\t\treturn decision;\n\t};\n\n\tconst compatible = inTree.filter((path) => {\n\t\tconst pkg = packageOfArchivePath(path);\n\t\treturn pkg !== undefined && !isIncompatible(pkg.dir);\n\t});\n\n\t/**\n\t * A wasm build is only redundant next to the real build of the *same library at the same\n\t * version*. Keying on the family alone conflates versions: a tree holding\n\t * `foo-linux-arm64@1` and a nested `foo-wasm32@2` would delete v2 — whose consumer has no\n\t * other implementation — because v1 shipped a binary.\n\t */\n\tconst variantKey = (name: string, dir: string): string => {\n\t\tconst version = readPackageManifest(\n\t\t\tjoin(staging, ...dir.split(\"/\")),\n\t\t)?.version;\n\t\treturn `${platformFamily(name)}@${typeof version === \"string\" ? version : \"?\"}`;\n\t};\n\n\t// The library versions that ship a compiled binary able to load on the runtime. Scoped\n\t// rather than a single flag over the whole tree: a function may stage two unrelated\n\t// packages, one with a real native build and one where wasm is the only implementation,\n\t// and a global \"some binary exists\" test would delete the second.\n\tconst nativeBuilds = new Set(\n\t\tcompatible\n\t\t\t.filter((path) => BINARY_PATTERN.test(path))\n\t\t\t.flatMap((path) => {\n\t\t\t\tconst pkg = packageOfArchivePath(path);\n\t\t\t\treturn pkg === undefined ? [] : [variantKey(pkg.name, pkg.dir)];\n\t\t\t}),\n\t);\n\n\tconst files = compatible\n\t\t.filter((path) => {\n\t\t\tconst pkg = packageOfArchivePath(path);\n\t\t\tif (pkg === undefined) return true;\n\t\t\treturn !(\n\t\t\t\tisWasmVariantName(pkg.name) &&\n\t\t\t\tnativeBuilds.has(variantKey(pkg.name, pkg.dir))\n\t\t\t);\n\t\t})\n\t\t.sort();\n\n\tif (files.length === 0) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" stages external packages, but tracing the installed packages ` +\n\t\t\t\t`found no files to ship. This is a bug in the deploy — please report it at ` +\n\t\t\t\t`https://github.com/neondatabase/neon-pkgs/issues.`,\n\t\t);\n\t}\n\treturn files;\n}\n\n/**\n * Read the traced files, checking each one is shippable as it goes.\n *\n * Two rejections here, both cheaper to hit now than after upload. A symlink cannot be\n * represented in the archive at all, and a compiled binary built for the wrong architecture\n * would deploy fine and then fail to load — which is the exact failure this whole option\n * exists to prevent, so it must not be reintroduced by a stale or hand-patched tree.\n */\nfunction readArchiveFiles(\n\tslug: string,\n\tstaging: string,\n\tfiles: readonly string[],\n): Record<string, Uint8Array> {\n\tconst entries: Record<string, Uint8Array> = {};\n\tfor (const relative of files) {\n\t\tconst absolute = resolve(staging, relative);\n\t\t// Defence in depth: a traced path must stay inside the staging tree.\n\t\tif (!absolute.startsWith(`${resolve(staging)}${sep}`)) {\n\t\t\tthrow invalid(\n\t\t\t\t`Function \"${slug}\": traced file \"${relative}\" resolves outside the staging ` +\n\t\t\t\t\t`directory. This is a bug in the deploy — please report it.`,\n\t\t\t);\n\t\t}\n\t\t// lstat, not stat: stat follows the link and would report the target's type, so a\n\t\t// symlink would pass this check silently.\n\t\tconst stat = lstatSync(absolute, { throwIfNoEntry: false });\n\t\t// The tracer said this file is needed and it is not there. Skipping it would ship an\n\t\t// archive that is quietly missing something and fail at invoke, which is the failure\n\t\t// this whole path exists to prevent.\n\t\tif (stat === undefined) {\n\t\t\tthrow invalid(\n\t\t\t\t`Function \"${slug}\": traced file \"${relative}\" disappeared before it could be ` +\n\t\t\t\t\t`read. This is a bug in the deploy — please report it at ` +\n\t\t\t\t\t`https://github.com/neondatabase/neon-pkgs/issues.`,\n\t\t\t);\n\t\t}\n\t\tif (stat.isSymbolicLink()) {\n\t\t\tthrow invalid(\n\t\t\t\t`Function \"${slug}\" would ship a symbolic link, which the build does not ` +\n\t\t\t\t\t`support: ${relative}. This is a bug in the deploy — please report it at ` +\n\t\t\t\t\t`https://github.com/neondatabase/neon-pkgs/issues.`,\n\t\t\t);\n\t\t}\n\t\tif (!stat.isFile()) continue;\n\n\t\tconst contents = readFileSync(absolute);\n\t\tif (BINARY_PATTERN.test(relative))\n\t\t\tverifyArchitecture(slug, relative, contents);\n\t\tentries[relative] = new Uint8Array(contents);\n\t}\n\treturn entries;\n}\n\n/**\n * Reject a compiled artifact that is not built for the runtime. Only ELF AArch64 can load\n * there, so anything else — a Mach-O from the user's laptop, an x64 ELF from a stale\n * install — is a deploy-time error rather than an invoke-time one.\n */\nfunction verifyArchitecture(\n\tslug: string,\n\trelative: string,\n\tcontents: Buffer,\n): void {\n\t// Too short to carry an ELF header at all. Returning here would let a truncated or\n\t// placeholder binary through the one check that exists to stop a wrong-architecture file\n\t// reaching the runtime.\n\tif (contents.length < ELF.headerBytes) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" would ship \"${relative}\", which is ${contents.length} bytes — ` +\n\t\t\t\t`too short to be a valid binary. The package may have been installed ` +\n\t\t\t\t`incompletely; reinstall it and try again.`,\n\t\t);\n\t}\n\tconst isElf = contents.subarray(0, 4).toString(\"binary\") === ELF.magic;\n\tif (!isElf) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" would ship \"${relative}\", which is not a Linux binary. ` +\n\t\t\t\t`The Functions runtime is ${RUNTIME_TARGET_LABEL}, so a binary built for ` +\n\t\t\t\t`another platform cannot load there. A package that compiles from source at ` +\n\t\t\t\t`install time produces a binary for the machine that installed it and cannot ` +\n\t\t\t\t`be cross-installed by the deploy.`,\n\t\t);\n\t}\n\tconst machine = contents.readUInt16LE(ELF.machineOffset);\n\tif (machine !== ELF.aarch64) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" would ship \"${relative}\", which is built for a different ` +\n\t\t\t\t`architecture (ELF machine 0x${machine.toString(16)}). The Functions runtime is ` +\n\t\t\t\t`${RUNTIME_TARGET_LABEL}.`,\n\t\t);\n\t}\n}\n\n/**\n * Check the archive against the build service's limits, naming the largest contributors. The\n * compressed size is not known until the archive is zipped, so only the counts and\n * uncompressed total are checked here; {@link assertZipWithinLimits} covers the rest.\n *\n * Exported so the caller can re-check the **final** archive: these entries are the staged\n * files alone, and the bundle is merged in afterwards.\n */\nexport function enforceLimits(\n\tslug: string,\n\tentries: Record<string, Uint8Array>,\n\tlimits: ArchiveLimits = DEFAULT_ARCHIVE_LIMITS,\n): void {\n\tconst names = Object.keys(entries);\n\tconst count = names.length;\n\tif (count > limits.maxEntries) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" archive has ${count} files; the limit is ${limits.maxEntries}. ` +\n\t\t\t\t`Native packages bring their whole file tree — ship fewer of them, or split the ` +\n\t\t\t\t`work across functions.`,\n\t\t);\n\t}\n\tconst total = names.reduce((sum, name) => sum + entries[name].length, 0);\n\tif (total > limits.maxTotalBytes) {\n\t\tthrow invalid(\n\t\t\t`Function \"${slug}\" archive is ${bytes(total)} uncompressed; the limit is ` +\n\t\t\t\t`${bytes(limits.maxTotalBytes)}.\\n\\n${describeLargest(entries)}`,\n\t\t);\n\t}\n}\n\n/**\n * Check the compressed archive, which is only measurable once it exists. Separate from\n * {@link enforceLimits} for that reason, and exported so the bundler can call it on the\n * finished ZIP.\n */\nexport function assertZipWithinLimits(\n\tslug: string,\n\tzip: Uint8Array,\n\tentries: Record<string, Uint8Array>,\n\tlimits: ArchiveLimits = DEFAULT_ARCHIVE_LIMITS,\n): void {\n\tif (zip.length <= limits.maxZipBytes) return;\n\tthrow invalid(\n\t\t`Function \"${slug}\" archive is ${bytes(zip.length)} compressed; the limit is ` +\n\t\t\t`${bytes(limits.maxZipBytes)}.\\n\\n${describeLargest(entries)}`,\n\t);\n}\n\n/** The handful of files worth naming when an archive is too big. */\nfunction describeLargest(entries: Record<string, Uint8Array>): string {\n\tconst largest = Object.entries(entries)\n\t\t.sort(([, a], [, b]) => b.length - a.length)\n\t\t.slice(0, 4)\n\t\t.map(([name, data]) => `  ${bytes(data.length).padStart(9)}  ${name}`);\n\treturn `Largest contributors:\\n${largest.join(\"\\n\")}\\n\\nNative binaries are large. Ship fewer of them, or split the work across functions.`;\n}\n\nconst defaultDeps: NativeTraceDeps = {\n\tinstall: (cwd, specs) => runNpmInstall(cwd, specs),\n\ttrace: async (base, entry) => {\n\t\tconst { nodeFileTrace } = await loadNft();\n\t\t// The entry is passed absolute: nft resolves a relative one against the process cwd,\n\t\t// not against `base`. `fileList` still comes back relative to `base`, which is what\n\t\t// the archive keys need.\n\t\tconst result = await nodeFileTrace([join(base, entry)], { base });\n\t\treturn {\n\t\t\tfiles: [...result.fileList],\n\t\t\tunresolved: [...result.warnings].flatMap((warning) => {\n\t\t\t\tconst specifier = UNRESOLVED_PATTERN.exec(warning.message)?.[1];\n\t\t\t\treturn specifier === undefined ? [] : [specifier];\n\t\t\t}),\n\t\t};\n\t},\n\tinstalledVersion: (projectDir, pkg) =>\n\t\tinstalledPackageVersion(projectDir, pkg),\n};\n\n/**\n * Install into the staging directory by shelling out to whatever `npm` is on `PATH`, rather\n * than importing it. The CLI also ships as a standalone binary with no npm and no\n * `node_modules` inside it, so a `require()` would be unresolvable there; a subprocess works\n * in both forms.\n *\n * `--cpu/--os/--libc` are what select the runtime's builds instead of the host's.\n * `--ignore-scripts` matters for more than speed: an install script would compile for the\n * host architecture and overwrite the prebuilt binary we are here to collect.\n */\nasync function runNpmInstall(cwd: string, specs: string[]): Promise<void> {\n\tconst args = [\n\t\t\"install\",\n\t\t...specs,\n\t\t`--cpu=${RUNTIME_TARGET.cpu}`,\n\t\t`--os=${RUNTIME_TARGET.os}`,\n\t\t`--libc=${RUNTIME_TARGET.libc}`,\n\t\t\"--ignore-scripts\",\n\t\t\"--no-audit\",\n\t\t\"--no-fund\",\n\t\t\"--no-package-lock\",\n\t\t\"--loglevel=error\",\n\t];\n\n\tconst { code, stderr, spawnError } = await new Promise<{\n\t\tcode: number | null;\n\t\tstderr: string;\n\t\tspawnError?: Error;\n\t}>((resolveRun) => {\n\t\tconst child = spawn(\"npm\", args, {\n\t\t\tcwd,\n\t\t\tstdio: [\"ignore\", \"ignore\", \"pipe\"],\n\t\t\ttimeout: INSTALL_TIMEOUT_MS,\n\t\t});\n\t\tlet stderr = \"\";\n\t\tchild.stderr.on(\"data\", (chunk: Buffer) => {\n\t\t\tstderr += chunk.toString();\n\t\t});\n\t\tchild.on(\"error\", (spawnError) =>\n\t\t\tresolveRun({ code: null, stderr, spawnError }),\n\t\t);\n\t\tchild.on(\"close\", (code) => resolveRun({ code, stderr }));\n\t});\n\n\tif (spawnError !== undefined) {\n\t\tconst missing = (spawnError as NodeJS.ErrnoException).code === \"ENOENT\";\n\t\tthrow invalid(\n\t\t\tmissing\n\t\t\t\t? `Shipping a function's externalPackages requires \"npm\" on PATH, to install ` +\n\t\t\t\t\t\t`them for the Functions runtime (${RUNTIME_TARGET_LABEL}). It could not ` +\n\t\t\t\t\t\t`be found. Install Node.js with npm, or set includeFiles: false on every ` +\n\t\t\t\t\t\t`entry so nothing needs staging.`\n\t\t\t\t: `Failed to install externalPackages for the Functions runtime: ${spawnError.message}`,\n\t\t\tspawnError,\n\t\t);\n\t}\n\tif (code !== 0) {\n\t\t// npm reports a package that declares no build for the target as EBADPLATFORM, whose\n\t\t// own message compares against the *host* platform and so reads as though the wrong\n\t\t// thing was asked for. Say what actually happened instead.\n\t\tif (stderr.includes(\"EBADPLATFORM\")) {\n\t\t\tthrow invalid(\n\t\t\t\t`One of ${specs.map((s) => `\"${s}\"`).join(\", \")} has no build for the ` +\n\t\t\t\t\t`Functions runtime (${RUNTIME_TARGET_LABEL}), so its files cannot be ` +\n\t\t\t\t\t`staged. Use a package that publishes a ` +\n\t\t\t\t\t`${RUNTIME_TARGET.os}-${RUNTIME_TARGET.cpu} build (sharp does). If this ` +\n\t\t\t\t\t`function never reaches it, exclude it instead:\\n` +\n\t\t\t\t\t`    externalPackages: [{ name: \"<package>\", includeFiles: false }]` +\n\t\t\t\t\t`\\n\\nnpm reported:\\n${stderr.trim()}`,\n\t\t\t);\n\t\t}\n\t\tthrow invalid(\n\t\t\t`Failed to install externalPackages for the Functions runtime ` +\n\t\t\t\t`(${RUNTIME_TARGET_LABEL}). npm exited with code ${code}.\\n${stderr.trim()}`,\n\t\t);\n\t}\n}\n\n/**\n * Loaded with a dynamic `import()` for the same reason as esbuild and fflate: nothing in this\n * package's static graph should name the tracer, so a `neon.ts` that only reads config never\n * pulls it in. A deploy that declares no native packages never reaches this.\n */\nasync function loadNft(): Promise<typeof import(\"@vercel/nft\")> {\n\ttry {\n\t\treturn await import(\"@vercel/nft\");\n\t} catch (cause) {\n\t\tthrow invalid(\n\t\t\t\"Staging a function's external packages requires `@vercel/nft`, which could not \" +\n\t\t\t\t\"be loaded. Installed from npm it is a dependency of @neon/config-runtime, so \" +\n\t\t\t\t\"reinstalling your dependencies fixes it. If you are running the standalone \" +\n\t\t\t\t\"`neon` binary, this is a packaging bug — please report it at \" +\n\t\t\t\t\"https://github.com/neondatabase/neon-pkgs/issues.\",\n\t\t\tcause,\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AAqBA,MAAa,iBAAiB;CAC7B,KAAK;CACL,IAAI;CACJ,MAAM;AACP;;AAGA,MAAa,uBAAuB,GAAG,eAAe,GAAG,GAAG,eAAe,IAAI,IAAI,eAAe,KAAK;;;;;;AAOvG,MAAM,MAAM;CACX,OAAO;CACP,eAAe;CACf,aAAa;CACb,SAAS;AACV;;AAGA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;AAmBvB,MAAM,qBAAqB;;;;;;;;;;AAW3B,SAAS,0BAA0B,YAA6B;CAC/D,MAAM,WAAW,oBAAoB,UAAU;CAC/C,OAAO,aAAa,KAAA,KAAa,CAAC,sBAAsB,QAAQ;AACjE;;AAGA,SAAS,kBAAkB,aAA8B;CACxD,OAAO,YAAY,MAAM,MAAM,CAAC,CAAC,SAAS,kBAAkB;AAC7D;;;;;;;;;AAUA,SAAS,eAAe,aAA6B;CACpD,MAAM,CAAC,OAAO,QAAQ,YAAY,WAAW,GAAG,IAC7C,CAAC,GAAG,YAAY,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IACjE,CAAC,IAAI,WAAW;CACnB,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,MAAM,MAAM,WAAW,SAAS,gBAAgB,IAAI,IAAI,CAAC;CAC/D,OAAO,GAAG,SAAS,QAAQ,KAAK,QAAQ,MAAM,MAAM,GAAG,GAAG,EAAA,CAAG,KAAK,GAAG;AACtE;;;;;;AAOA,MAAM,kCAAkB,IAAI,IAAI;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACD,CAAC;;AAGD,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;AAoB3B,SAAS,mBAAmB,YAAyC;CACpE,OAAO,CACN,GAAG,IAAI,IACN,WAAW,QACT,cACA,UAAU,WAAW,IAAI,KAAK,UAAU,WAAW,KAAK,CAC1D,CACD,CACD;AACD;;AAGA,SAAS,sBAAsB,UAA4C;CAC1E,MAAM,WAAW,KAAc,UAA2B;EACzD,MAAM,QACL,OAAO,QAAQ,WACZ,CAAC,GAAG,IACJ,MAAM,QAAQ,GAAG,IAChB,IAAI,QACH,UACA,OAAO,UAAU,QACnB,IACC,KAAA;EACL,IAAI,UAAU,KAAA,KAAa,MAAM,WAAW,GAAG,OAAO;EACtD,IAAI,MAAM,SAAS,IAAI,OAAO,GAAG,OAAO;EACxC,MAAM,YAAY,MAAM,QAAQ,UAAU,CAAC,MAAM,WAAW,GAAG,CAAC;EAChE,OAAO,UAAU,WAAW,KAAK,UAAU,SAAS,KAAK;CAC1D;CACA,OACC,QAAQ,SAAS,IAAI,eAAe,EAAE,KACtC,QAAQ,SAAS,KAAK,eAAe,GAAG,KACxC,QAAQ,SAAS,MAAM,eAAe,IAAI;AAE5C;;;;;;;;;;AAWA,SAAS,qBACR,MAC4C;CAC5C,MAAM,WAAW,KAAK,MAAM,GAAG;CAC/B,MAAM,OAAO,SAAS,YAAY,cAAc;CAChD,IAAI,SAAS,IAAI,OAAO,KAAA;CAExB,MAAM,QAAQ,SAAS,OAAO;CAC9B,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,SAAS,MAAM,WAAW,GAAG;CACnC,MAAM,QAAQ,SAAS,SAAS,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK;CAClE,IAAI,UAAU,MAAM,SAAS,GAAG,OAAO,KAAA;CAEvC,OAAO;EACN,MAAM,MAAM,KAAK,GAAG;EAEpB,KAAK,SAAS,MAAM,GAAG,OAAO,IAAI,MAAM,MAAM,CAAC,CAAC,KAAK,GAAG;CACzD;AACD;;AAGA,MAAM,qBAAqB;AAmB3B,MAAa,yBAAwC;CACpD,aAAa;CACb,eAAe;CACf,YAAY;AACb;AAoCA,MAAM,SAAS,MAAsB,IAAI,IAAK,QAAA,CAAc,QAAQ,CAAC,EAAE;AAEvE,MAAM,WAAW,SAAiB,UACjC,IAAI,cACH,UAAU,eACV,SACA,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC3C;;;;;;;;;;;;;;;;;;;;;;AAuBD,eAAsB,oBAAoB,SAMX;CAC9B,MAAM,EAAE,MAAM,UAAU,eAAe;CACvC,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,OAAwB;EAAE,GAAG;EAAa,GAAG,QAAQ;CAAK;CAIhE,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,mBAAmB,CAAC,CAAC;CAE5D,MAAM,WAAqB,CAAC;CAC5B,MAAM,QAAQ,MAAM,KAAK,QAAQ;EAChC,MAAM,UAAU,KAAK,iBAAiB,YAAY,GAAG;EAMrD,IAAI,YAAY,KAAA,GACf,MAAM,QACL,aAAa,KAAK,YAAY,IAAI,sIAEZ,IAAI,sGAEU,IAAI,0BACzC;EAED,OAAO,GAAG,IAAI,GAAG;CAClB,CAAC;CAED,MAAM,UAAU,YAAY,KAAK,OAAO,GAAG,iBAAiB,CAAC;CAC7D,IAAI;EAGH,cACC,KAAK,SAAS,cAAc,GAC5B,GAAG,KAAK,UAAU;GAAE,MAAM;GAA0B,SAAS;EAAK,GAAG,MAAM,CAAC,EAAE,GAC/E;EACA,MAAM,KAAK,QAAQ,SAAS,KAAK;EACjC,gBAAgB,MAAM,OAAO,OAAO;EAKpC,cACC,KAAK,SAAS,iBAAiB,GAC/B,SAAS,KAAK,QAAQ,UAAU,KAAK,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAClE;EAEA,MAAM,SAAS,MAAM,KAAK,MAAM,SAAS,iBAAiB;EAC1D,KAAK,MAAM,aAAa,mBAAmB,OAAO,cAAc,CAAC,CAAC,GACjE,SAAS,KACR,aAAa,KAAK,mCAAmC,UAAU,+XAMhE;EAGD,MAAM,UAAU,iBAAiB,MAAM,SADzB,mBAAmB,MAAM,OAAO,OAAO,OACD,CAAC;EACrD,cAAc,MAAM,SAAS,MAAM;EACnC,OAAO;GAAE;GAAS;EAAS;CAC5B,UAAU;EACT,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;AACD;;;;;;;AAQA,SAAS,gBACR,MACA,UACA,SACO;CACP,KAAK,MAAM,OAAO,UAAU;EAC3B,MAAM,WAAW,KAAK,SAAS,gBAAgB,KAAK,cAAc;EAClE,IAAI,UAAU,UAAU,EAAE,gBAAgB,MAAM,CAAC,MAAM,KAAA,GACtD,MAAM,QACL,aAAa,KAAK,cAAc,IAAI,2EACG,qBAAqB,kKAGxD,eAAe,GAAG,GAAG,eAAe,IAAI,0EACM,IAAI,0DAChB,IAAI,0BAC3C;CAEF;AACD;;;;;;;AAQA,SAAS,mBACR,MACA,QACA,SACW;CACX,MAAM,SAAS,OACb,QACC,SACA,KAAK,WAAW,eAAe,KAAK,KACpC,KAAK,WAAW,eAAe,CACjC,CAAC,CACA,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;CAIzC,MAAM,+BAAe,IAAI,IAAqB;CAC9C,MAAM,kBAAkB,QAAyB;EAChD,MAAM,QAAQ,aAAa,IAAI,GAAG;EAClC,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,MAAM,WAAW,0BAChB,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,CAAC,CAChC;EACA,aAAa,IAAI,KAAK,QAAQ;EAC9B,OAAO;CACR;CAEA,MAAM,aAAa,OAAO,QAAQ,SAAS;EAC1C,MAAM,MAAM,qBAAqB,IAAI;EACrC,OAAO,QAAQ,KAAA,KAAa,CAAC,eAAe,IAAI,GAAG;CACpD,CAAC;;;;;;;CAQD,MAAM,cAAc,MAAc,QAAwB;EACzD,MAAM,UAAU,oBACf,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,CAAC,CAChC,CAAC,EAAE;EACH,OAAO,GAAG,eAAe,IAAI,EAAE,GAAG,OAAO,YAAY,WAAW,UAAU;CAC3E;CAMA,MAAM,eAAe,IAAI,IACxB,WACE,QAAQ,SAAS,eAAe,KAAK,IAAI,CAAC,CAAC,CAC3C,SAAS,SAAS;EAClB,MAAM,MAAM,qBAAqB,IAAI;EACrC,OAAO,QAAQ,KAAA,IAAY,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC;CAC/D,CAAC,CACH;CAEA,MAAM,QAAQ,WACZ,QAAQ,SAAS;EACjB,MAAM,MAAM,qBAAqB,IAAI;EACrC,IAAI,QAAQ,KAAA,GAAW,OAAO;EAC9B,OAAO,EACN,kBAAkB,IAAI,IAAI,KAC1B,aAAa,IAAI,WAAW,IAAI,MAAM,IAAI,GAAG,CAAC;CAEhD,CAAC,CAAC,CACD,KAAK;CAEP,IAAI,MAAM,WAAW,GACpB,MAAM,QACL,aAAa,KAAK,2LAGnB;CAED,OAAO;AACR;;;;;;;;;AAUA,SAAS,iBACR,MACA,SACA,OAC6B;CAC7B,MAAM,UAAsC,CAAC;CAC7C,KAAK,MAAM,YAAY,OAAO;EAC7B,MAAM,WAAW,QAAQ,SAAS,QAAQ;EAE1C,IAAI,CAAC,SAAS,WAAW,GAAG,QAAQ,OAAO,IAAI,KAAK,GACnD,MAAM,QACL,aAAa,KAAK,kBAAkB,SAAS,0FAE9C;EAID,MAAM,OAAO,UAAU,UAAU,EAAE,gBAAgB,MAAM,CAAC;EAI1D,IAAI,SAAS,KAAA,GACZ,MAAM,QACL,aAAa,KAAK,kBAAkB,SAAS,2IAG9C;EAED,IAAI,KAAK,eAAe,GACvB,MAAM,QACL,aAAa,KAAK,kEACL,SAAS,sGAEvB;EAED,IAAI,CAAC,KAAK,OAAO,GAAG;EAEpB,MAAM,WAAW,aAAa,QAAQ;EACtC,IAAI,eAAe,KAAK,QAAQ,GAC/B,mBAAmB,MAAM,UAAU,QAAQ;EAC5C,QAAQ,YAAY,IAAI,WAAW,QAAQ;CAC5C;CACA,OAAO;AACR;;;;;;AAOA,SAAS,mBACR,MACA,UACA,UACO;CAIP,IAAI,SAAS,SAAS,IAAI,aACzB,MAAM,QACL,aAAa,KAAK,gBAAgB,SAAS,cAAc,SAAS,OAAO,uHAG1E;CAGD,IAAI,EADU,SAAS,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,QAAQ,MAAM,IAAI,QAEhE,MAAM,QACL,aAAa,KAAK,gBAAgB,SAAS,2DACd,qBAAqB,iNAInD;CAED,MAAM,UAAU,SAAS,aAAa,IAAI,aAAa;CACvD,IAAI,YAAY,IAAI,SACnB,MAAM,QACL,aAAa,KAAK,gBAAgB,SAAS,gEACX,QAAQ,SAAS,EAAE,EAAE,8BACjD,qBAAqB,EAC1B;AAEF;;;;;;;;;AAUA,SAAgB,cACf,MACA,SACA,SAAwB,wBACjB;CACP,MAAM,QAAQ,OAAO,KAAK,OAAO;CACjC,MAAM,QAAQ,MAAM;CACpB,IAAI,QAAQ,OAAO,YAClB,MAAM,QACL,aAAa,KAAK,gBAAgB,MAAM,uBAAuB,OAAO,WAAW,wGAGlF;CAED,MAAM,QAAQ,MAAM,QAAQ,KAAK,SAAS,MAAM,QAAQ,KAAK,CAAC,QAAQ,CAAC;CACvE,IAAI,QAAQ,OAAO,eAClB,MAAM,QACL,aAAa,KAAK,eAAe,MAAM,KAAK,EAAE,8BAC1C,MAAM,OAAO,aAAa,EAAE,OAAO,gBAAgB,OAAO,GAC/D;AAEF;;;;;;AAOA,SAAgB,sBACf,MACA,KACA,SACA,SAAwB,wBACjB;CACP,IAAI,IAAI,UAAU,OAAO,aAAa;CACtC,MAAM,QACL,aAAa,KAAK,eAAe,MAAM,IAAI,MAAM,EAAE,4BAC/C,MAAM,OAAO,WAAW,EAAE,OAAO,gBAAgB,OAAO,GAC7D;AACD;;AAGA,SAAS,gBAAgB,SAA6C;CAKrE,OAAO,0BAJS,OAAO,QAAQ,OAAO,CAAC,CACrC,MAAM,GAAG,IAAI,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAC3C,MAAM,GAAG,CAAC,CAAC,CACX,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,MACzB,CAAC,CAAC,KAAK,IAAI,EAAE;AACrD;AAEA,MAAM,cAA+B;CACpC,UAAU,KAAK,UAAU,cAAc,KAAK,KAAK;CACjD,OAAO,OAAO,MAAM,UAAU;EAC7B,MAAM,EAAE,kBAAkB,MAAM,QAAQ;EAIxC,MAAM,SAAS,MAAM,cAAc,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;EAChE,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,YAAY,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC,SAAS,YAAY;IACrD,MAAM,YAAY,mBAAmB,KAAK,QAAQ,OAAO,CAAC,GAAG;IAC7D,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,CAAC,SAAS;GACjD,CAAC;EACF;CACD;CACA,mBAAmB,YAAY,QAC9B,wBAAwB,YAAY,GAAG;AACzC;;;;;;;;;;;AAYA,eAAe,cAAc,KAAa,OAAgC;CACzE,MAAM,OAAO;EACZ;EACA,GAAG;EACH,SAAS,eAAe;EACxB,QAAQ,eAAe;EACvB,UAAU,eAAe;EACzB;EACA;EACA;EACA;EACA;CACD;CAEA,MAAM,EAAE,MAAM,QAAQ,eAAe,MAAM,IAAI,SAI3C,eAAe;EAClB,MAAM,QAAQ,MAAM,OAAO,MAAM;GAChC;GACA,OAAO;IAAC;IAAU;IAAU;GAAM;GAClC,SAAS;EACV,CAAC;EACD,IAAI,SAAS;EACb,MAAM,OAAO,GAAG,SAAS,UAAkB;GAC1C,UAAU,MAAM,SAAS;EAC1B,CAAC;EACD,MAAM,GAAG,UAAU,eAClB,WAAW;GAAE,MAAM;GAAM;GAAQ;EAAW,CAAC,CAC9C;EACA,MAAM,GAAG,UAAU,SAAS,WAAW;GAAE;GAAM;EAAO,CAAC,CAAC;CACzD,CAAC;CAED,IAAI,eAAe,KAAA,GAAW;EAC7B,MAAM,UAAW,WAAqC,SAAS;EAC/D,MAAM,QACL,UACG,6GACmC,qBAAqB,2HAGxD,iEAAiE,WAAW,WAC/E,UACD;CACD;CACA,IAAI,SAAS,GAAG;EAIf,IAAI,OAAO,SAAS,cAAc,GACjC,MAAM,QACL,UAAU,MAAM,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,2CACzB,qBAAqB,mEAExC,eAAe,GAAG,GAAG,eAAe,IAAI,oKAGrB,OAAO,KAAK,GACpC;EAED,MAAM,QACL,iEACK,qBAAqB,0BAA0B,KAAK,KAAK,OAAO,KAAK,GAC3E;CACD;AACD;;;;;;AAOA,eAAe,UAAiD;CAC/D,IAAI;EACH,OAAO,MAAM,OAAO;CACrB,SAAS,OAAO;EACf,MAAM,QACL,yVAKA,KACD;CACD;AACD"}

package/dist/lib/push-config.js

@@ -7,9 +7,9 @@ import { ErrorCode, PlatformError, PushAbortedError, PushConflictError, createNe
 * injects its own bundler never triggers this import, so esbuild can be dropped
 * from their build entirely.
 */
-const defaultBundleFunction = async (fn) => {
+const makeDefaultBundleFunction = (onWarning) => async (fn) => {
 	const { buildFunctionBundle } = await import("./function-bundle.js");
-	return buildFunctionBundle(fn);
+	return buildFunctionBundle(fn, { onWarning });
 };
 /**
 * Push a Neon branch policy to a specific project + branch.
@@ -23,6 +23,7 @@ const defaultBundleFunction = async (fn) => {
 async function pushConfig(config, options) {
 	const api = options.api ?? createApiFromOptions(options);
 	const projectId = options.projectId;
+	const warnings = [];
 	const dryRun = options.dryRun === true;
 	const updateExisting = options.updateExisting === true;
 	const allowProtectedBranch = options.allowProtectedBranch === true;
@@ -91,7 +92,9 @@ async function pushConfig(config, options) {
 			remoteProjectId: remoteProject.id,
 			branchById,
 			branchByName,
-			bundleFunction: options.bundleFunction ?? defaultBundleFunction
+			bundleFunction: options.bundleFunction ?? makeDefaultBundleFunction((message) => {
+				warnings.push(message);
+			})
 		});
 		applied.push(change);
 	}
@@ -110,7 +113,8 @@ async function pushConfig(config, options) {
 		branchName: branch.name,
 		dryRun,
 		applied,
-		conflicts: diff.conflicts
+		conflicts: diff.conflicts,
+		warnings
 	};
 	if (remoteProject.orgId) result.orgId = remoteProject.orgId;
 	return result;