@neon/config-runtime 1.7.6 → 1.8.0

package/dist/lib/function-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"function-bundle.d.ts","names":[],"sources":["../../src/lib/function-bundle.ts"],"mappings":";;;;;KAmBY,eAAA,QACP,2BACA,QAAQ;AAFb;AAA2B;AACtB;AACQ;AAAR;AAAO;AASZ;AAGK,cAHQ,sBAAA,GAGa,mOAAA;AAAA,KAArB,qBAAA,GAAqB;EACJ,UAAA,CAAA,EAAR,OAAQ,CAAA,eAAA,CAAA;EAAR;EAAO,SAAA,CAAA,EAAA,CAAA,OAAA,EAAA,MAAA,EAAA,GAAA,IAAA;AASrB,CAAA;AAAyC;AACpC;AACK;AACC;AAAR,iBAHmB,mBAAA,CAGnB,EAAA,EAFE,sBAEF,EAAA,OAAA,CAAA,EADO,qBACP,CAAA,EAAA,OAAA,CAAQ,UAAR,CAAA"}
+{"version":3,"file":"function-bundle.d.ts","names":["ResolvedFunctionConfig","NativeTraceDeps","FunctionBundler","Uint8Array","Promise","ESM_CJS_INTEROP_BANNER","FunctionBundleOptions","Partial","buildFunctionBundle","NativeTraceDeps","ResolvedFunctionConfig","FunctionBundler","fn","Promise","Uint8Array","ESM_CJS_INTEROP_BANNER","FunctionBundleOptions","nativeDeps","Partial","onWarning","message","buildFunctionBundle","options"],"sources":["../../src/lib/function-bundle.ts"],"mappings":";;;;;KAmBYE,eAAAA,QACPF,2BACAI,QAAQD;AAFb;AAA2B;AACtBH;AACQG;AAARC;AAAO;AASZ;AAGKE,cAHQD,sBAAAA,GAGa,mOAAA;AAAA,KAArBC,qBAAAA,GAAqB;EACJL,UAAAA,CAAAA,EAARM,OAAQN,CAAAA,eAAAA,CAAAA;EAARM;EAAOY,SAAA,CAAA,EAAA,CAAAC,OAAA,EAAA,MAAA,EAAA,GAAA,IAAA;AASrB,CAAA;AAAyC;AACpCpB;AACKM;AACCH;AAARC,iBAHmBI,mBAAAA,CAGnBJ,EAAAA,EAFEJ,sBAEFI,EAAAA,OAAAA,CAAAA,EADOE,qBACPF,CAAAA,EAAAA,OAAAA,CAAQD,UAARC,CAAAA"}

package/dist/lib/function-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"function-source.d.ts","names":[],"sources":["../../src/lib/function-source.ts"],"mappings":";;;KAaY,YAAA;;AAAA,iBAGU,mBAAA,CAHE,MAAA,EAAA,MAAA,CAAA,EAGmC,OAHnC,CAAA,MAAA,CAAA;AAGxB;AAyCA;AAAgC;AAC3B;AACa,iBAFI,UAAA,CAEJ,EAAA,EADb,sBACa,EAAA,OACf,CADe,EAAA;EACP,GAAA,CAAA,EADO,YACP;AAAR,CAAA,CAAA,EAAA,OAAA,CAAQ,cAAR,CAAA"}
+{"version":3,"file":"function-source.d.ts","names":["FunctionBundle","ResolvedFunctionConfig","UnbundledVia","resolveEsbuildEntry","Promise","bundleAsIs","FunctionBundle","ResolvedFunctionConfig","UnbundledVia","resolveEsbuildEntry","source","Promise","bundleAsIs","fn","options","via"],"sources":["../../src/lib/function-source.ts"],"mappings":";;;KAaYE,YAAAA;;AAAAA,iBAGUC,mBAAAA,CAHEO,MAAA,EAAA,MAAA,CAAA,EAGmCN,OAHnC,CAAA,MAAA,CAAA;AAGxB;AAyCA;AAAgC;AAC3BH;AACaC,iBAFIG,UAAAA,CAEJH,EAAAA,EADbD,sBACaC,EAAAA,OACfE,CADeF,EAAAA;EACPF,GAAAA,CAAAA,EADOE,YACPF;AAARI,CAAAA,CAAAA,EAAAA,OAAAA,CAAQJ,cAARI,CAAAA"}

package/dist/lib/function-zip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"function-zip.d.ts","names":[],"sources":["../../src/lib/function-zip.ts"],"mappings":";;AAIsB,iBAAA,UAAA,CAAU,OAAA,EACtB,MADsB,CAAA,MAAA,EACP,UADO,CAAA,CAAA,EAE7B,OAF6B,CAErB,UAFqB,CAAA;AAAA,iBAOV,iBAAA,CAPU,IAAA,EAAA,MAAA,EAAA,OAAA,EAStB,MATsB,CAAA,MAAA,EASP,UATO,CAAA,CAAA,EAU7B,OAV6B,CAUrB,UAVqB,CAAA"}
+{"version":3,"file":"function-zip.d.ts","names":["zipEntries","Uint8Array","Record","Promise","zipFunctionBundle","zipEntries","entries","Record","Uint8Array","Promise","zipFunctionBundle","slug"],"sources":["../../src/lib/function-zip.ts"],"mappings":";;AAIsBA,iBAAAA,UAAAA,CAAUM,OAAA,EACtBJ,MADsB,CAAA,MAAA,EACPD,UADO,CAAA,CAAA,EAE7BE,OAF6B,CAErBF,UAFqB,CAAA;AAAA,iBAOVG,iBAAAA,CAPUO,IAAA,EAAA,MAAA,EAAAL,OAAA,EAStBJ,MATsB,CAAA,MAAA,EASPD,UATO,CAAA,CAAA,EAU7BE,OAV6B,CAUrBF,UAVqB,CAAA"}

package/dist/lib/native-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-detect.d.ts","names":[],"sources":["../../src/lib/native-detect.ts"],"mappings":";;AAUA;AAMA;AAwCA;AAA4C,KA9ChC,cAAA,GA8CgC;EACtB,IAAA,EAAA,QAAA;EAKlB,IAAA,EAAA,MAAA;AAAa,CAAA,GAAA;EA2ED,IAAA,EAAA,oBAAoB;EAyIpB,UAAA,EAAA,MAAA;;;;;;;;KAlQJ,aAAA;;;YAGD;;;;;;;;;;;;;;;;iBAqCK,4BAAA;;aACM;;;;;;IAKlB;;;;;;;;;;iBA2EY,oBAAA;;;;;iBAyIA,qBAAA,wBAEN"}
+{"version":3,"file":"native-detect.d.ts","names":["NativeEvidence","NativeFinding","findUndeclaredNativePackages","Record","packageNameFromInput","describeNativeFinding","NativeEvidence","kind","file","dependency","script","NativeFinding","name","evidence","findUndeclaredNativePackages","options","metafile","inputs","Record","declared","projectDir","cwd","packageNameFromInput","input","describeNativeFinding","slug","finding"],"sources":["../../src/lib/native-detect.ts"],"mappings":";;AAUA;AAMA;AAwCA;AAA4C,KA9ChCA,cAAAA,GA8CgC;EACtBG,IAAAA,EAAAA,QAAAA;EAKlBF,IAAAA,EAAAA,MAAAA;AAAa,CAAA,GAAA;EA2EDG,IAAAA,EAAAA,oBAAoB;EAyIpBC,UAAAA,EAAAA,MAAAA;;;;;;;;KAlQJJ,aAAAA;;;YAGDD;;;;;;;;;;;;;;;;iBAqCKE,4BAAAA;;aACMC;;;;;;IAKlBF;;;;;;;;;;iBA2EYG,oBAAAA;;;;;iBAyIAC,qBAAAA,wBAENJ"}

package/dist/lib/native-packages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-packages.d.ts","names":[],"sources":["../../src/lib/native-packages.ts"],"mappings":";;AAqBA;AAOA;AAwLA;AASA;AAOY,cA/MC,cA+Mc,EAAA;EAAA,SAAA,GAAA,EAAA,OAAA;EAEiB,SAAA,EAAA,EAAA,OAAA;EAYtC,SAAA,IAAA,EAAA,OAAA;AAAO,CAAA;AAMb;AAA6B,cA5NhB,oBA4NgB,EAAA,MAAA;AACJ;AAAf;AAAM;AA0ChB;AAAyC;AAI/B;AACM;AAAR;AACI,KArFA,aAAA,GAqFA;EAAR;EAAO,WAAA,EAAA,MAAA;EAwRK;EAAa,aAAA,EAAA,MAAA;EAEJ;EAAf,UAAA,EAAA,MAAA;AACD,CAAA;AAAsC,cAvWlC,sBAuWkC,EAvWV,aAuWU;AAyB/C;AAAqC,KAzXzB,eAAA,GAyXyB;EAE/B;EACmB,OAAA,EAAA,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,EAAA,EAAA,GA1XmB,OA0XnB,CAAA,IAAA,CAAA;EAAf;EACD;AAAsC;;;;;;0CA/WzC;;;;;;;;KAMM,iBAAA;WACF,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CH,mBAAA;;;;WAIZ;SACF,QAAQ;IACZ,QAAQ;;;;;;;;;iBAwRI,aAAA,wBAEN,eAAe,sBAChB;;;;;;iBAyBO,qBAAA,oBAEV,qBACI,eAAe,sBAChB"}
+{"version":3,"file":"native-packages.d.ts","names":["RUNTIME_TARGET","RUNTIME_TARGET_LABEL","ArchiveLimits","DEFAULT_ARCHIVE_LIMITS","NativeTraceDeps","Promise","NativeTraceResult","Uint8Array","Record","traceNativePackages","Partial","enforceLimits","assertZipWithinLimits","RUNTIME_TARGET","cpu","os","libc","RUNTIME_TARGET_LABEL","ArchiveLimits","maxZipBytes","maxTotalBytes","maxEntries","DEFAULT_ARCHIVE_LIMITS","NativeTraceDeps","install","cwd","specs","Promise","trace","base","entry","files","unresolved","installedVersion","projectDir","pkg","NativeTraceResult","entries","Record","Uint8Array","warnings","traceNativePackages","options","slug","packages","limits","deps","Partial","enforceLimits","assertZipWithinLimits","zip"],"sources":["../../src/lib/native-packages.ts"],"mappings":";;AAqBA;AAOA;AAwLA;AASA;AAOYI,cA/MCJ,cA+Mc,EAAA;EAAA,SAAAc,GAAA,EAAA,OAAA;EAEiBT,SAAAA,EAAAA,EAAAA,OAAAA;EAYtCA,SAAAA,IAAAA,EAAAA,OAAAA;AAAO,CAAA;AAMb;AAA6B,cA5NhBJ,oBA4NgB,EAAA,MAAA;AACJM;AAAfC;AAAM;AA0ChB;AAAyC;AAI/BN;AACME;AAARM;AACIJ,KArFAJ,aAAAA,GAqFAI;EAARD;EAAOc,WAAA,EAAA,MAAA;EAwRKR;EAAaS,aAAA,EAAA,MAAA;EAEJb;EAAfC,UAAAA,EAAAA,MAAAA;AACDN,CAAAA;AAAsC,cAvWlCC,sBAuWkC,EAvWVD,aAuWU;AAyB/C;AAAqC,KAzXzBE,eAAAA,GAyXyB;EAE/BG;EACmBA,OAAAA,EAAAA,CAAAA,GAAAA,EAAAA,MAAAA,EAAAA,KAAAA,EAAAA,MAAAA,EAAAA,EAAAA,GA1XmBF,OA0XnBE,CAAAA,IAAAA,CAAAA;EAAfC;EACDN;AAAsC;;;;;;0CA/WzCG;;;;;;;;KAMMC,iBAAAA;WACFE,eAAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CHE,mBAAAA;;;;WAIZP;SACFQ,QAAQN;IACZC,QAAQC;;;;;;;;;iBAwRIK,aAAAA,wBAENH,eAAeD,sBAChBL;;;;;;iBAyBOU,qBAAAA,oBAEVL,qBACIC,eAAeD,sBAChBL"}

package/dist/lib/operations.d.ts

@@ -39,6 +39,10 @@ interface ApplyOptions extends ConfigOperationOptions {
   updateExisting?: boolean;
   /** Auto-confirm applying to a branch marked `protected` on Neon. */
   allowProtectedBranch?: boolean;
+  /** Asked before a protected-branch push or an override. See {@link PushConfigOptions.confirm}. */
+  confirm?: PushConfigOptions["confirm"];
+  /** Runs after confirmation, before any change. See {@link PushConfigOptions.beforeMutations}. */
+  beforeMutations?: PushConfigOptions["beforeMutations"];
   /** Inject to deploy without this package loading esbuild. */
   bundleFunction?: FunctionBundler;
 }

package/dist/lib/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","names":[],"sources":["../../src/lib/operations.ts"],"mappings":";;;;;;;;;AAsBA;AAsBA;AAA8B;AASZ,UA/BD,sBAAA,CA+BC;EAToB;AAAsB;AAkB5D;AAA6B;EACnB,SAAA,EAAA,MAAA;EACC;AAAR;AAAO;AAkBV;EAA0B,QAAA,EAAA,MAAA;EACjB;EACC,MAAA,CAAA,EAAA,MAAA;EACC;EAAR,OAAA,CAAA,EAAA,MAAA;EAAO;EAwBY,GAAA,CAAA,EAvEf,iBAuEoB,CAAA,KAAA,CAAA;AAAA;AAClB;AACC;AACC;AAAR,UApEc,YAAA,SAAqB,sBAoEnC,CAAA;EAAO;AAmBV;AAAoC;AAQ7B;EAEW,cAAA,CAAA,EAAA,OAAA;EAAe;EAOhB,oBAAA,CAAkB,EAAA,OAAA;EAmCb;EAAY,cAAA,CAAA,EAlIhB,eAkIgB;AACzB;AACC;AACC;AAAR;AAAO;;;iBA5HY,OAAA,UACZ,yBACP,QAAQ;;;;;;;;;iBAkBW,IAAA,SACb,iBACC,yBACP,QAAQ;;;;;;;;;;;;iBAwBW,KAAA,SACb,iBACC,eACP,QAAQ;;;;;UAmBM,mBAAA;;;;;;;;QAQV;;mBAEW;;;;;;UAOD,kBAAA;;;;UAIR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+Ba,YAAA,SACb,iBACC,sBACP,QAAQ"}
+{"version":3,"file":"operations.d.ts","names":["Config","NeonApi","PushResult","FunctionBundler","PulledBranchConfig","PushConfigOptions","ConfigOperationOptions","ApplyOptions","inspect","Promise","plan","apply","CreateBranchOptions","CreateBranchResult","createBranch","FunctionBundler","PulledBranchConfig","PushConfigOptions","Config","NeonApi","PushResult","ConfigOperationOptions","projectId","branchId","apiKey","apiHost","api","ApplyOptions","updateExisting","allowProtectedBranch","confirm","beforeMutations","bundleFunction","inspect","options","Promise","plan","config","apply","CreateBranchOptions","branchName","CreateBranchResult","result","createBranch"],"sources":["../../src/lib/operations.ts"],"mappings":";;;;;;;;;AAsBA;AAsBA;AAA8B;AASnBK,UA/BMC,sBAAAA,CA+BND;EAEQA;AAEDF;AAboBG;AAAsB;EAsBtCE,SAAAA,EAAO,MAAA;EAAA;AACnBF;AACCF;AAARK;EAAOc,QAAA,EAAA,MAAA;EAkBYb;EAAIc,MAAA,CAAA,EAAA,MAAA;EACjBxB;EACCM,OAAAA,CAAAA,EAAAA,MAAAA;EACCJ;EAARO,GAAAA,CAAAA,EAnDIJ,iBAmDJI,CAAAA,KAAAA,CAAAA;AAAO;AAwBV;AAA2B;AAClBT;AACCO,UAvEOA,YAAAA,SAAqBD,sBAuE5BC,CAAAA;EACCL;AAARO;AAAO;AAuBV;EAAoCmB,cAAA,CAAA,EAAA,OAAA;EAQ7B3B;EAEWE,oBAAAA,CAAAA,EAAAA,OAAAA;EAAe;EAOhBU,OAAAA,CAAAA,EAvGNR,iBAuGwB,CAAA,SAI1BH,CAAAA;EA+BaY;EAAYiB,eAAA,CAAA,EAxIf1B,iBAwIe,CAAA,iBAAA,CAAA;EACzBL;EACCY,cAAAA,CAAAA,EAxIQT,eAwIRS;AACCC;AAARJ;AAAO;;;;;iBAhIYD,OAAAA,UACZF,yBACPG,QAAQL;;;;;;;;;iBAkBWM,IAAAA,SACbV,iBACCM,yBACPG,QAAQP;;;;;;;;;;;;iBAwBWS,KAAAA,SACbX,iBACCO,eACPE,QAAQP;;;;;UAuBMU,mBAAAA;;;;;;;;QAQVX;;mBAEWE;;;;;;UAODU,kBAAAA;;;;UAIRX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+BaY,YAAAA,SACbd,iBACCY,sBACPH,QAAQI"}

package/dist/lib/operations.js

@@ -56,6 +56,8 @@ async function apply(config, options) {
 		...options.apiHost ? { apiHost: options.apiHost } : {},
 		...options.updateExisting ? { updateExisting: true } : {},
 		...options.allowProtectedBranch ? { allowProtectedBranch: true } : {},
+		...options.confirm ? { confirm: options.confirm } : {},
+		...options.beforeMutations ? { beforeMutations: options.beforeMutations } : {},
 		...options.bundleFunction ? { bundleFunction: options.bundleFunction } : {}
 	});
 }

package/dist/lib/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","names":[],"sources":["../../src/lib/operations.ts"],"sourcesContent":["import {\n\ttype AppliedChange,\n\ttype ComputeSettings,\n\ttype Config,\n\tcreateNeonApiFromOptions,\n\tErrorCode,\n\ttype NeonApi,\n\ttype NeonBranchSnapshot,\n\tPartialBranchCreateError,\n\tPlatformError,\n\ttype PushResult,\n\tresolveConfig,\n} from \"@neon/config\";\nimport type { FunctionBundler } from \"./function-bundle.js\";\nimport { type PulledBranchConfig, pullConfig } from \"./pull-config.js\";\nimport { type PushConfigOptions, pushConfig } from \"./push-config.js\";\n\n/**\n * Where to run the operation and how to authenticate. Filesystem- and env-agnostic: the\n * `projectId` and `branchId` are always passed explicitly by the caller (e.g. neonctl\n * resolves them from `.neon` / `NEON_*` and forwards them here).\n */\nexport interface ConfigOperationOptions {\n\t/**\n\t * Neon project id. **Required** — the management API addresses branches through their\n\t * project, so operations cannot run without it.\n\t */\n\tprojectId: string;\n\t/**\n\t * Neon branch id (`br-…`). **Required.** Must already exist on the project; resolve\n\t * branch names to ids before calling.\n\t */\n\tbranchId: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. */\n\tapiKey?: string;\n\t/** Neon API base URL. Falls back to `NEON_API_HOST`, then production. */\n\tapiHost?: string;\n\t/** Inject a custom NeonApi adapter (primarily for tests). */\n\tapi?: PushConfigOptions[\"api\"];\n}\n\n/**\n * Options accepted by {@link apply} on top of {@link ConfigOperationOptions}.\n */\nexport interface ApplyOptions extends ConfigOperationOptions {\n\t/**\n\t * Auto-confirm overriding existing remote settings (TTL, `protected`, compute\n\t * settings) on the selected branch. Without it, drift is reported as a conflict.\n\t */\n\tupdateExisting?: boolean;\n\t/** Auto-confirm applying to a branch marked `protected` on Neon. */\n\tallowProtectedBranch?: boolean;\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n}\n\n/**\n * Read a branch's live Neon state as a plain object (project + branch metadata and the\n * reverse-engineered `BranchConfig`). Network read only — never mutates.\n *\n * `projectId` and `branchId` are **required** (both in `options`).\n */\nexport async function inspect(\n\toptions: ConfigOperationOptions,\n): Promise<PulledBranchConfig> {\n\treturn pullConfig({\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\n/**\n * Compute what {@link apply} would do for the given branch without mutating anything\n * (dry-run plan). Returns the full {@link PushResult} with the planned changes in\n * `applied` and any blocking drift in `conflicts` — the Neon equivalent of\n * `terraform plan`.\n *\n * `projectId` and `branchId` are **required** (both in `options`).\n */\nexport async function plan(\n\tconfig: Config,\n\toptions: ConfigOperationOptions,\n): Promise<PushResult> {\n\treturn pushConfig(config, {\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\tdryRun: true,\n\t\t// Surface the full would-apply list as plan steps without mutating anything.\n\t\tupdateExisting: true,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\n/**\n * Apply a `neon.ts` policy to the given Neon branch and return the {@link PushResult}\n * describing what changed — the Neon equivalent of `terraform apply`.\n *\n * `projectId` and `branchId` are **required** (both in `options`). Pass `updateExisting`\n * to auto-confirm overriding existing remote settings and `allowProtectedBranch` to\n * auto-confirm applying to a protected branch; otherwise drift is reported as a\n * `PushConflictError`.\n *\n * Never creates projects or branches — both must already exist.\n */\nexport async function apply(\n\tconfig: Config,\n\toptions: ApplyOptions,\n): Promise<PushResult> {\n\treturn pushConfig(config, {\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t\t...(options.updateExisting ? { updateExisting: true } : {}),\n\t\t...(options.allowProtectedBranch ? { allowProtectedBranch: true } : {}),\n\t\t...(options.bundleFunction\n\t\t\t? { bundleFunction: options.bundleFunction }\n\t\t\t: {}),\n\t});\n}\n\n/**\n * Options accepted by {@link createBranch}. Unlike {@link ConfigOperationOptions} this takes a\n * branch **name** (the branch does not exist yet) rather than an id.\n */\nexport interface CreateBranchOptions {\n\t/** Neon project id to create the branch in. **Required.** */\n\tprojectId: string;\n\t/** Name of the branch to create. **Required.** Must not already exist on the project. */\n\tbranchName: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. Ignored when `api` is set. */\n\tapiKey?: string;\n\t/** Inject a custom NeonApi adapter (primarily for tests). */\n\tapi?: NeonApi;\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n}\n\n/**\n * Result of {@link createBranch}: the created branch's id/name plus the {@link PushResult}\n * describing the policy that was applied to it.\n */\nexport interface CreateBranchResult {\n\tbranchId: string;\n\tbranchName: string;\n\t/** What applying the policy to the freshly created branch changed. */\n\tresult: PushResult;\n}\n\n/**\n * Create a Neon branch **from a `neon.ts` policy** and bring it up with its declared\n * settings/infra in one step — the operation `neonctl checkout <new-name>` needs.\n *\n * The flow is the one a creation actually wants:\n *  1. Evaluate the policy for the new branch with `exists: false` (so creation-time tuning —\n *     `parent`, `ttl`, compute settings, `protected` — resolves instead of the\n *     \"existing branch, leave as-is\" path most policies guard with `if (branch.exists)`).\n *  2. Create the branch **with** that tuning: `parent`, `expires_at`, `protected`, and the\n *     compute settings all ride along on the single create call, which Neon validates as a\n *     whole. A setting it rejects therefore fails the creation outright, leaving nothing\n *     behind, rather than producing a branch that doesn't match the policy.\n *  3. {@link pushConfig} the rest onto it with `branchExists: false` — the services (Neon\n *     Auth, Data API, buckets, functions), which have no create-time equivalent because they\n *     are provisioned against an existing branch id.\n *\n * This is why `apply` alone couldn't do it: `apply` operates on an *existing* branch\n * (`exists: true`), so a policy keyed on `!branch.exists` never returns the creation tuning.\n *\n * `result.applied` covers both steps — the settings the create call carried are reported\n * exactly like the ones a push applies (see {@link settingsAppliedAtCreate}), so folding them\n * into the creation doesn't make them vanish from the summary.\n *\n * Throws {@link PlatformError} (`Conflict`) if a branch with `branchName` already exists, or\n * (`BranchNotFound`) if the policy names a `parent` that isn't on the project — both before\n * anything is created, as is a setting Neon rejects in step 2. Only step 3 can fail with a\n * branch already created; that throws {@link PartialBranchCreateError} carrying its id/name.\n */\nexport async function createBranch(\n\tconfig: Config,\n\toptions: CreateBranchOptions,\n): Promise<CreateBranchResult> {\n\tconst api =\n\t\toptions.api ??\n\t\tcreateNeonApiFromOptions(\n\t\t\t\"createBranch\",\n\t\t\toptions.apiKey ? { apiKey: options.apiKey } : {},\n\t\t);\n\tconst { projectId, branchName } = options;\n\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.some((b) => b.name === branchName)) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.Conflict,\n\t\t\t`createBranch: a branch named \"${branchName}\" already exists on project ${projectId}. Pick a different name or check it out instead of creating it.`,\n\t\t\t{ details: { projectId, branchName } },\n\t\t);\n\t}\n\n\t// Evaluate the policy as a creation so `parent` (only settable at create time) resolves.\n\tconst resolved = resolveConfig(config, {\n\t\tname: branchName,\n\t\texists: false,\n\t});\n\tconst parentId = resolveParentBranchId(\n\t\tresolved.parent,\n\t\tbranches,\n\t\tbranchName,\n\t);\n\n\t// Everything the policy can express *in the create call itself* goes into it. Neon\n\t// validates the whole request, so a value it rejects (a plan-gated suspend timeout, an\n\t// out-of-range autoscaling limit) fails with **no branch created** instead of leaving one\n\t// behind that silently diverges from the policy. Only the services below genuinely need an\n\t// existing branch id, which is what keeps them a second step.\n\tconst expiresAt =\n\t\tresolved.ttlSeconds !== undefined\n\t\t\t? new Date(Date.now() + resolved.ttlSeconds * 1000).toISOString()\n\t\t\t: undefined;\n\tconst computeSettings = resolved.postgres?.computeSettings;\n\n\tconst { branch } = await api.createBranch(projectId, {\n\t\tname: branchName,\n\t\t...(parentId ? { parentId } : {}),\n\t\t...(expiresAt ? { expiresAt } : {}),\n\t\t...(resolved.protected !== undefined\n\t\t\t? { protected: resolved.protected }\n\t\t\t: {}),\n\t\t...(computeSettings ? { computeSettings } : {}),\n\t});\n\n\tconst appliedAtCreate = settingsAppliedAtCreate({\n\t\tbranchName: branch.name,\n\t\t...(resolved.parent !== undefined\n\t\t\t? { parentName: resolved.parent }\n\t\t\t: {}),\n\t\t...(expiresAt !== undefined ? { expiresAt } : {}),\n\t\t...(resolved.protected !== undefined\n\t\t\t? { isProtected: resolved.protected }\n\t\t\t: {}),\n\t\t...(computeSettings ? { computeSettings } : {}),\n\t});\n\n\t// Reconcile what the create call could not express as a new branch (`branchExists: false`):\n\t// the services/functions the policy declares. The settings above are already in place, so\n\t// push sees them satisfied and applies nothing for them.\n\t// `updateExisting`/`allowProtectedBranch` are safe here — there is no pre-existing state a\n\t// user would be surprised to see overridden.\n\t//\n\t// The branch is already created at this point, so a failure here (a service that can't be\n\t// provisioned, a function that fails to deploy, a transient API error) cannot be undone by\n\t// throwing: the branch would linger without its declared services, invisible to the caller.\n\t// Re-throw as PartialBranchCreateError so the id/name survive and the caller can keep the\n\t// branch usable while reporting that it diverges from the policy.\n\tlet result: PushResult;\n\ttry {\n\t\tresult = await pushConfig(config, {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tapi,\n\t\t\tbranchExists: false,\n\t\t\tupdateExisting: true,\n\t\t\tallowProtectedBranch: true,\n\t\t\t...(options.bundleFunction\n\t\t\t\t? { bundleFunction: options.bundleFunction }\n\t\t\t\t: {}),\n\t\t});\n\t} catch (cause) {\n\t\tthrow new PartialBranchCreateError(branch.id, branch.name, cause);\n\t}\n\n\treturn {\n\t\tbranchId: branch.id,\n\t\tbranchName: branch.name,\n\t\tresult: {\n\t\t\t...result,\n\t\t\tapplied: mergeCreateSettings(appliedAtCreate, result.applied),\n\t\t},\n\t};\n}\n\n/**\n * Describe the policy settings the create call itself carried as {@link AppliedChange}s, keyed\n * by field.\n *\n * Applying a setting *at creation* rather than in a follow-up call must not make it disappear\n * from the report, so these are shaped exactly like the changes `pushConfig` returns for the\n * same fields — same `kind`/`identifier`/`details`, so every renderer already knows how to\n * print them and no caller needs to special-case a creation.\n */\nconst settingsAppliedAtCreate = (args: {\n\tbranchName: string;\n\t/** The parent the *policy* named, omitted when the branch fell back to the project default. */\n\tparentName?: string;\n\texpiresAt?: string;\n\tisProtected?: boolean;\n\tcomputeSettings?: ComputeSettings;\n}): Map<string, AppliedChange> => {\n\tconst changes = new Map<string, AppliedChange>();\n\tconst add = (field: string, details: Record<string, unknown>): void => {\n\t\tchanges.set(field, {\n\t\t\tkind: \"branch\",\n\t\t\taction: \"create\",\n\t\t\tidentifier: args.branchName,\n\t\t\tdetails: { field, ...details },\n\t\t});\n\t};\n\tif (args.parentName !== undefined) {\n\t\tadd(\"parent\", { parent: args.parentName });\n\t}\n\tif (args.expiresAt !== undefined) add(\"ttl\", { expiresAt: args.expiresAt });\n\tif (args.isProtected !== undefined) {\n\t\tadd(\"protected\", { protected: args.isProtected });\n\t}\n\tif (args.computeSettings) {\n\t\tadd(\"computeSettings\", { settings: args.computeSettings });\n\t}\n\treturn changes;\n};\n\n/**\n * Fold the create-time settings into what the push applied, reporting each field once.\n *\n * A field the create call already satisfied is a noop for the push, so the two normally don't\n * overlap. They do when the create didn't take (an API that ignores a create-time field, or\n * drift in the moments between the two calls) and the push applied it for real — the push\n * change is the one that describes what actually happened, so it wins.\n */\nconst mergeCreateSettings = (\n\tatCreate: Map<string, AppliedChange>,\n\tpushed: AppliedChange[],\n): AppliedChange[] => {\n\tconst pushedFields = new Set(\n\t\tpushed\n\t\t\t.filter((c) => c.kind === \"branch\" && c.action !== \"noop\")\n\t\t\t.map((c) => c.details?.field)\n\t\t\t.filter((field): field is string => typeof field === \"string\"),\n\t);\n\tconst fromCreate = [...atCreate]\n\t\t.filter(([field]) => !pushedFields.has(field))\n\t\t.map(([, change]) => change);\n\treturn [...fromCreate, ...pushed];\n};\n\n/**\n * Resolve the parent branch id for a new branch. A policy-declared `parent` (a branch name) is\n * looked up by name; an unknown name is a hard error. With no `parent`, fall back to the\n * project's default branch, or `undefined` (let the API pick the project default) when none is\n * marked default.\n */\nfunction resolveParentBranchId(\n\tparentName: string | undefined,\n\tbranches: NeonBranchSnapshot[],\n\tbranchName: string,\n): string | undefined {\n\tif (parentName !== undefined) {\n\t\tconst match = branches.find((b) => b.name === parentName);\n\t\tif (!match) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.BranchNotFound,\n\t\t\t\t`createBranch: the policy for \"${branchName}\" sets parent \"${parentName}\", but no branch with that name exists. Existing branches: ${\n\t\t\t\t\tbranches.map((b) => b.name).join(\", \") || \"(none)\"\n\t\t\t\t}.`,\n\t\t\t\t{\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tbranchName,\n\t\t\t\t\t\tparent: parentName,\n\t\t\t\t\t\tavailable: branches.map((b) => b.name),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn match.id;\n\t}\n\treturn branches.find((b) => b.isDefault)?.id;\n}\n"],"mappings":";;;;;;;;;;AA8DA,eAAsB,QACrB,SAC8B;CAC9B,OAAO,WAAW;EACjB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;;;;;;;;AAUA,eAAsB,KACrB,QACA,SACsB;CACtB,OAAO,WAAW,QAAQ;EACzB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,QAAQ;EAER,gBAAgB;EAChB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;;;;;;;;;;;AAaA,eAAsB,MACrB,QACA,SACsB;CACtB,OAAO,WAAW,QAAQ;EACzB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACtD,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;EACzD,GAAI,QAAQ,uBAAuB,EAAE,sBAAsB,KAAK,IAAI,CAAC;EACrE,GAAI,QAAQ,iBACT,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;CACL,CAAC;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,eAAsB,aACrB,QACA,SAC8B;CAC9B,MAAM,MACL,QAAQ,OACR,yBACC,gBACA,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAChD;CACD,MAAM,EAAE,WAAW,eAAe;CAElC,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,MAAM,MAAM,EAAE,SAAS,UAAU,GAC7C,MAAM,IAAI,cACT,UAAU,UACV,iCAAiC,WAAW,8BAA8B,UAAU,kEACpF,EAAE,SAAS;EAAE;EAAW;CAAW,EAAE,CACtC;CAID,MAAM,WAAW,cAAc,QAAQ;EACtC,MAAM;EACN,QAAQ;CACT,CAAC;CACD,MAAM,WAAW,sBAChB,SAAS,QACT,UACA,UACD;CAOA,MAAM,YACL,SAAS,eAAe,KAAA,IACrB,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,aAAa,GAAI,CAAC,CAAC,YAAY,IAC9D,KAAA;CACJ,MAAM,kBAAkB,SAAS,UAAU;CAE3C,MAAM,EAAE,WAAW,MAAM,IAAI,aAAa,WAAW;EACpD,MAAM;EACN,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACjC,GAAI,SAAS,cAAc,KAAA,IACxB,EAAE,WAAW,SAAS,UAAU,IAChC,CAAC;EACJ,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;CAC9C,CAAC;CAED,MAAM,kBAAkB,wBAAwB;EAC/C,YAAY,OAAO;EACnB,GAAI,SAAS,WAAW,KAAA,IACrB,EAAE,YAAY,SAAS,OAAO,IAC9B,CAAC;EACJ,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;EAC/C,GAAI,SAAS,cAAc,KAAA,IACxB,EAAE,aAAa,SAAS,UAAU,IAClC,CAAC;EACJ,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;CAC9C,CAAC;CAaD,IAAI;CACJ,IAAI;EACH,SAAS,MAAM,WAAW,QAAQ;GACjC;GACA,UAAU,OAAO;GACjB;GACA,cAAc;GACd,gBAAgB;GAChB,sBAAsB;GACtB,GAAI,QAAQ,iBACT,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;EACL,CAAC;CACF,SAAS,OAAO;EACf,MAAM,IAAI,yBAAyB,OAAO,IAAI,OAAO,MAAM,KAAK;CACjE;CAEA,OAAO;EACN,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB,QAAQ;GACP,GAAG;GACH,SAAS,oBAAoB,iBAAiB,OAAO,OAAO;EAC7D;CACD;AACD;;;;;;;;;;AAWA,MAAM,2BAA2B,SAOC;CACjC,MAAM,0BAAU,IAAI,IAA2B;CAC/C,MAAM,OAAO,OAAe,YAA2C;EACtE,QAAQ,IAAI,OAAO;GAClB,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE;IAAO,GAAG;GAAQ;EAC9B,CAAC;CACF;CACA,IAAI,KAAK,eAAe,KAAA,GACvB,IAAI,UAAU,EAAE,QAAQ,KAAK,WAAW,CAAC;CAE1C,IAAI,KAAK,cAAc,KAAA,GAAW,IAAI,OAAO,EAAE,WAAW,KAAK,UAAU,CAAC;CAC1E,IAAI,KAAK,gBAAgB,KAAA,GACxB,IAAI,aAAa,EAAE,WAAW,KAAK,YAAY,CAAC;CAEjD,IAAI,KAAK,iBACR,IAAI,mBAAmB,EAAE,UAAU,KAAK,gBAAgB,CAAC;CAE1D,OAAO;AACR;;;;;;;;;AAUA,MAAM,uBACL,UACA,WACqB;CACrB,MAAM,eAAe,IAAI,IACxB,OACE,QAAQ,MAAM,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM,CAAC,CACzD,KAAK,MAAM,EAAE,SAAS,KAAK,CAAC,CAC5B,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAC/D;CAIA,OAAO,CAAC,GAHW,CAAC,GAAG,QAAQ,CAAC,CAC9B,QAAQ,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,CAC7C,KAAK,GAAG,YAAY,MACF,GAAG,GAAG,MAAM;AACjC;;;;;;;AAQA,SAAS,sBACR,YACA,UACA,YACqB;CACrB,IAAI,eAAe,KAAA,GAAW;EAC7B,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,SAAS,UAAU;EACxD,IAAI,CAAC,OACJ,MAAM,IAAI,cACT,UAAU,gBACV,iCAAiC,WAAW,iBAAiB,WAAW,6DACvE,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAC1C,IACD,EACC,SAAS;GACR;GACA,QAAQ;GACR,WAAW,SAAS,KAAK,MAAM,EAAE,IAAI;EACtC,EACD,CACD;EAED,OAAO,MAAM;CACd;CACA,OAAO,SAAS,MAAM,MAAM,EAAE,SAAS,CAAC,EAAE;AAC3C"}
+{"version":3,"file":"operations.js","names":[],"sources":["../../src/lib/operations.ts"],"sourcesContent":["import {\n\ttype AppliedChange,\n\ttype ComputeSettings,\n\ttype Config,\n\tcreateNeonApiFromOptions,\n\tErrorCode,\n\ttype NeonApi,\n\ttype NeonBranchSnapshot,\n\tPartialBranchCreateError,\n\tPlatformError,\n\ttype PushResult,\n\tresolveConfig,\n} from \"@neon/config\";\nimport type { FunctionBundler } from \"./function-bundle.js\";\nimport { type PulledBranchConfig, pullConfig } from \"./pull-config.js\";\nimport { type PushConfigOptions, pushConfig } from \"./push-config.js\";\n\n/**\n * Where to run the operation and how to authenticate. Filesystem- and env-agnostic: the\n * `projectId` and `branchId` are always passed explicitly by the caller (e.g. neonctl\n * resolves them from `.neon` / `NEON_*` and forwards them here).\n */\nexport interface ConfigOperationOptions {\n\t/**\n\t * Neon project id. **Required** — the management API addresses branches through their\n\t * project, so operations cannot run without it.\n\t */\n\tprojectId: string;\n\t/**\n\t * Neon branch id (`br-…`). **Required.** Must already exist on the project; resolve\n\t * branch names to ids before calling.\n\t */\n\tbranchId: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. */\n\tapiKey?: string;\n\t/** Neon API base URL. Falls back to `NEON_API_HOST`, then production. */\n\tapiHost?: string;\n\t/** Inject a custom NeonApi adapter (primarily for tests). */\n\tapi?: PushConfigOptions[\"api\"];\n}\n\n/**\n * Options accepted by {@link apply} on top of {@link ConfigOperationOptions}.\n */\nexport interface ApplyOptions extends ConfigOperationOptions {\n\t/**\n\t * Auto-confirm overriding existing remote settings (TTL, `protected`, compute\n\t * settings) on the selected branch. Without it, drift is reported as a conflict.\n\t */\n\tupdateExisting?: boolean;\n\t/** Auto-confirm applying to a branch marked `protected` on Neon. */\n\tallowProtectedBranch?: boolean;\n\t/** Asked before a protected-branch push or an override. See {@link PushConfigOptions.confirm}. */\n\tconfirm?: PushConfigOptions[\"confirm\"];\n\t/** Runs after confirmation, before any change. See {@link PushConfigOptions.beforeMutations}. */\n\tbeforeMutations?: PushConfigOptions[\"beforeMutations\"];\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n}\n\n/**\n * Read a branch's live Neon state as a plain object (project + branch metadata and the\n * reverse-engineered `BranchConfig`). Network read only — never mutates.\n *\n * `projectId` and `branchId` are **required** (both in `options`).\n */\nexport async function inspect(\n\toptions: ConfigOperationOptions,\n): Promise<PulledBranchConfig> {\n\treturn pullConfig({\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\n/**\n * Compute what {@link apply} would do for the given branch without mutating anything\n * (dry-run plan). Returns the full {@link PushResult} with the planned changes in\n * `applied` and any blocking drift in `conflicts` — the Neon equivalent of\n * `terraform plan`.\n *\n * `projectId` and `branchId` are **required** (both in `options`).\n */\nexport async function plan(\n\tconfig: Config,\n\toptions: ConfigOperationOptions,\n): Promise<PushResult> {\n\treturn pushConfig(config, {\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\tdryRun: true,\n\t\t// Surface the full would-apply list as plan steps without mutating anything.\n\t\tupdateExisting: true,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\n/**\n * Apply a `neon.ts` policy to the given Neon branch and return the {@link PushResult}\n * describing what changed — the Neon equivalent of `terraform apply`.\n *\n * `projectId` and `branchId` are **required** (both in `options`). Pass `updateExisting`\n * to auto-confirm overriding existing remote settings and `allowProtectedBranch` to\n * auto-confirm applying to a protected branch; otherwise drift is reported as a\n * `PushConflictError`.\n *\n * Never creates projects or branches — both must already exist.\n */\nexport async function apply(\n\tconfig: Config,\n\toptions: ApplyOptions,\n): Promise<PushResult> {\n\treturn pushConfig(config, {\n\t\tprojectId: options.projectId,\n\t\tbranchId: options.branchId,\n\t\t...(options.api ? { api: options.api } : {}),\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t\t...(options.updateExisting ? { updateExisting: true } : {}),\n\t\t...(options.allowProtectedBranch ? { allowProtectedBranch: true } : {}),\n\t\t...(options.confirm ? { confirm: options.confirm } : {}),\n\t\t...(options.beforeMutations\n\t\t\t? { beforeMutations: options.beforeMutations }\n\t\t\t: {}),\n\t\t...(options.bundleFunction\n\t\t\t? { bundleFunction: options.bundleFunction }\n\t\t\t: {}),\n\t});\n}\n\n/**\n * Options accepted by {@link createBranch}. Unlike {@link ConfigOperationOptions} this takes a\n * branch **name** (the branch does not exist yet) rather than an id.\n */\nexport interface CreateBranchOptions {\n\t/** Neon project id to create the branch in. **Required.** */\n\tprojectId: string;\n\t/** Name of the branch to create. **Required.** Must not already exist on the project. */\n\tbranchName: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. Ignored when `api` is set. */\n\tapiKey?: string;\n\t/** Inject a custom NeonApi adapter (primarily for tests). */\n\tapi?: NeonApi;\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n}\n\n/**\n * Result of {@link createBranch}: the created branch's id/name plus the {@link PushResult}\n * describing the policy that was applied to it.\n */\nexport interface CreateBranchResult {\n\tbranchId: string;\n\tbranchName: string;\n\t/** What applying the policy to the freshly created branch changed. */\n\tresult: PushResult;\n}\n\n/**\n * Create a Neon branch **from a `neon.ts` policy** and bring it up with its declared\n * settings/infra in one step — the operation `neonctl checkout <new-name>` needs.\n *\n * The flow is the one a creation actually wants:\n *  1. Evaluate the policy for the new branch with `exists: false` (so creation-time tuning —\n *     `parent`, `ttl`, compute settings, `protected` — resolves instead of the\n *     \"existing branch, leave as-is\" path most policies guard with `if (branch.exists)`).\n *  2. Create the branch **with** that tuning: `parent`, `expires_at`, `protected`, and the\n *     compute settings all ride along on the single create call, which Neon validates as a\n *     whole. A setting it rejects therefore fails the creation outright, leaving nothing\n *     behind, rather than producing a branch that doesn't match the policy.\n *  3. {@link pushConfig} the rest onto it with `branchExists: false` — the services (Neon\n *     Auth, Data API, buckets, functions), which have no create-time equivalent because they\n *     are provisioned against an existing branch id.\n *\n * This is why `apply` alone couldn't do it: `apply` operates on an *existing* branch\n * (`exists: true`), so a policy keyed on `!branch.exists` never returns the creation tuning.\n *\n * `result.applied` covers both steps — the settings the create call carried are reported\n * exactly like the ones a push applies (see {@link settingsAppliedAtCreate}), so folding them\n * into the creation doesn't make them vanish from the summary.\n *\n * Throws {@link PlatformError} (`Conflict`) if a branch with `branchName` already exists, or\n * (`BranchNotFound`) if the policy names a `parent` that isn't on the project — both before\n * anything is created, as is a setting Neon rejects in step 2. Only step 3 can fail with a\n * branch already created; that throws {@link PartialBranchCreateError} carrying its id/name.\n */\nexport async function createBranch(\n\tconfig: Config,\n\toptions: CreateBranchOptions,\n): Promise<CreateBranchResult> {\n\tconst api =\n\t\toptions.api ??\n\t\tcreateNeonApiFromOptions(\n\t\t\t\"createBranch\",\n\t\t\toptions.apiKey ? { apiKey: options.apiKey } : {},\n\t\t);\n\tconst { projectId, branchName } = options;\n\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.some((b) => b.name === branchName)) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.Conflict,\n\t\t\t`createBranch: a branch named \"${branchName}\" already exists on project ${projectId}. Pick a different name or check it out instead of creating it.`,\n\t\t\t{ details: { projectId, branchName } },\n\t\t);\n\t}\n\n\t// Evaluate the policy as a creation so `parent` (only settable at create time) resolves.\n\tconst resolved = resolveConfig(config, {\n\t\tname: branchName,\n\t\texists: false,\n\t});\n\tconst parentId = resolveParentBranchId(\n\t\tresolved.parent,\n\t\tbranches,\n\t\tbranchName,\n\t);\n\n\t// Everything the policy can express *in the create call itself* goes into it. Neon\n\t// validates the whole request, so a value it rejects (a plan-gated suspend timeout, an\n\t// out-of-range autoscaling limit) fails with **no branch created** instead of leaving one\n\t// behind that silently diverges from the policy. Only the services below genuinely need an\n\t// existing branch id, which is what keeps them a second step.\n\tconst expiresAt =\n\t\tresolved.ttlSeconds !== undefined\n\t\t\t? new Date(Date.now() + resolved.ttlSeconds * 1000).toISOString()\n\t\t\t: undefined;\n\tconst computeSettings = resolved.postgres?.computeSettings;\n\n\tconst { branch } = await api.createBranch(projectId, {\n\t\tname: branchName,\n\t\t...(parentId ? { parentId } : {}),\n\t\t...(expiresAt ? { expiresAt } : {}),\n\t\t...(resolved.protected !== undefined\n\t\t\t? { protected: resolved.protected }\n\t\t\t: {}),\n\t\t...(computeSettings ? { computeSettings } : {}),\n\t});\n\n\tconst appliedAtCreate = settingsAppliedAtCreate({\n\t\tbranchName: branch.name,\n\t\t...(resolved.parent !== undefined\n\t\t\t? { parentName: resolved.parent }\n\t\t\t: {}),\n\t\t...(expiresAt !== undefined ? { expiresAt } : {}),\n\t\t...(resolved.protected !== undefined\n\t\t\t? { isProtected: resolved.protected }\n\t\t\t: {}),\n\t\t...(computeSettings ? { computeSettings } : {}),\n\t});\n\n\t// Reconcile what the create call could not express as a new branch (`branchExists: false`):\n\t// the services/functions the policy declares. The settings above are already in place, so\n\t// push sees them satisfied and applies nothing for them.\n\t// `updateExisting`/`allowProtectedBranch` are safe here — there is no pre-existing state a\n\t// user would be surprised to see overridden.\n\t//\n\t// The branch is already created at this point, so a failure here (a service that can't be\n\t// provisioned, a function that fails to deploy, a transient API error) cannot be undone by\n\t// throwing: the branch would linger without its declared services, invisible to the caller.\n\t// Re-throw as PartialBranchCreateError so the id/name survive and the caller can keep the\n\t// branch usable while reporting that it diverges from the policy.\n\tlet result: PushResult;\n\ttry {\n\t\tresult = await pushConfig(config, {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tapi,\n\t\t\tbranchExists: false,\n\t\t\tupdateExisting: true,\n\t\t\tallowProtectedBranch: true,\n\t\t\t...(options.bundleFunction\n\t\t\t\t? { bundleFunction: options.bundleFunction }\n\t\t\t\t: {}),\n\t\t});\n\t} catch (cause) {\n\t\tthrow new PartialBranchCreateError(branch.id, branch.name, cause);\n\t}\n\n\treturn {\n\t\tbranchId: branch.id,\n\t\tbranchName: branch.name,\n\t\tresult: {\n\t\t\t...result,\n\t\t\tapplied: mergeCreateSettings(appliedAtCreate, result.applied),\n\t\t},\n\t};\n}\n\n/**\n * Describe the policy settings the create call itself carried as {@link AppliedChange}s, keyed\n * by field.\n *\n * Applying a setting *at creation* rather than in a follow-up call must not make it disappear\n * from the report, so these are shaped exactly like the changes `pushConfig` returns for the\n * same fields — same `kind`/`identifier`/`details`, so every renderer already knows how to\n * print them and no caller needs to special-case a creation.\n */\nconst settingsAppliedAtCreate = (args: {\n\tbranchName: string;\n\t/** The parent the *policy* named, omitted when the branch fell back to the project default. */\n\tparentName?: string;\n\texpiresAt?: string;\n\tisProtected?: boolean;\n\tcomputeSettings?: ComputeSettings;\n}): Map<string, AppliedChange> => {\n\tconst changes = new Map<string, AppliedChange>();\n\tconst add = (field: string, details: Record<string, unknown>): void => {\n\t\tchanges.set(field, {\n\t\t\tkind: \"branch\",\n\t\t\taction: \"create\",\n\t\t\tidentifier: args.branchName,\n\t\t\tdetails: { field, ...details },\n\t\t});\n\t};\n\tif (args.parentName !== undefined) {\n\t\tadd(\"parent\", { parent: args.parentName });\n\t}\n\tif (args.expiresAt !== undefined) add(\"ttl\", { expiresAt: args.expiresAt });\n\tif (args.isProtected !== undefined) {\n\t\tadd(\"protected\", { protected: args.isProtected });\n\t}\n\tif (args.computeSettings) {\n\t\tadd(\"computeSettings\", { settings: args.computeSettings });\n\t}\n\treturn changes;\n};\n\n/**\n * Fold the create-time settings into what the push applied, reporting each field once.\n *\n * A field the create call already satisfied is a noop for the push, so the two normally don't\n * overlap. They do when the create didn't take (an API that ignores a create-time field, or\n * drift in the moments between the two calls) and the push applied it for real — the push\n * change is the one that describes what actually happened, so it wins.\n */\nconst mergeCreateSettings = (\n\tatCreate: Map<string, AppliedChange>,\n\tpushed: AppliedChange[],\n): AppliedChange[] => {\n\tconst pushedFields = new Set(\n\t\tpushed\n\t\t\t.filter((c) => c.kind === \"branch\" && c.action !== \"noop\")\n\t\t\t.map((c) => c.details?.field)\n\t\t\t.filter((field): field is string => typeof field === \"string\"),\n\t);\n\tconst fromCreate = [...atCreate]\n\t\t.filter(([field]) => !pushedFields.has(field))\n\t\t.map(([, change]) => change);\n\treturn [...fromCreate, ...pushed];\n};\n\n/**\n * Resolve the parent branch id for a new branch. A policy-declared `parent` (a branch name) is\n * looked up by name; an unknown name is a hard error. With no `parent`, fall back to the\n * project's default branch, or `undefined` (let the API pick the project default) when none is\n * marked default.\n */\nfunction resolveParentBranchId(\n\tparentName: string | undefined,\n\tbranches: NeonBranchSnapshot[],\n\tbranchName: string,\n): string | undefined {\n\tif (parentName !== undefined) {\n\t\tconst match = branches.find((b) => b.name === parentName);\n\t\tif (!match) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.BranchNotFound,\n\t\t\t\t`createBranch: the policy for \"${branchName}\" sets parent \"${parentName}\", but no branch with that name exists. Existing branches: ${\n\t\t\t\t\tbranches.map((b) => b.name).join(\", \") || \"(none)\"\n\t\t\t\t}.`,\n\t\t\t\t{\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tbranchName,\n\t\t\t\t\t\tparent: parentName,\n\t\t\t\t\t\tavailable: branches.map((b) => b.name),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn match.id;\n\t}\n\treturn branches.find((b) => b.isDefault)?.id;\n}\n"],"mappings":";;;;;;;;;;AAkEA,eAAsB,QACrB,SAC8B;CAC9B,OAAO,WAAW;EACjB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;;;;;;;;AAUA,eAAsB,KACrB,QACA,SACsB;CACtB,OAAO,WAAW,QAAQ;EACzB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,QAAQ;EAER,gBAAgB;EAChB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;;;;;;;;;;;AAaA,eAAsB,MACrB,QACA,SACsB;CACtB,OAAO,WAAW,QAAQ;EACzB,WAAW,QAAQ;EACnB,UAAU,QAAQ;EAClB,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAC1C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACtD,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;EACzD,GAAI,QAAQ,uBAAuB,EAAE,sBAAsB,KAAK,IAAI,CAAC;EACrE,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;EACtD,GAAI,QAAQ,kBACT,EAAE,iBAAiB,QAAQ,gBAAgB,IAC3C,CAAC;EACJ,GAAI,QAAQ,iBACT,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;CACL,CAAC;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0DA,eAAsB,aACrB,QACA,SAC8B;CAC9B,MAAM,MACL,QAAQ,OACR,yBACC,gBACA,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAChD;CACD,MAAM,EAAE,WAAW,eAAe;CAElC,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,MAAM,MAAM,EAAE,SAAS,UAAU,GAC7C,MAAM,IAAI,cACT,UAAU,UACV,iCAAiC,WAAW,8BAA8B,UAAU,kEACpF,EAAE,SAAS;EAAE;EAAW;CAAW,EAAE,CACtC;CAID,MAAM,WAAW,cAAc,QAAQ;EACtC,MAAM;EACN,QAAQ;CACT,CAAC;CACD,MAAM,WAAW,sBAChB,SAAS,QACT,UACA,UACD;CAOA,MAAM,YACL,SAAS,eAAe,KAAA,IACrB,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,aAAa,GAAI,CAAC,CAAC,YAAY,IAC9D,KAAA;CACJ,MAAM,kBAAkB,SAAS,UAAU;CAE3C,MAAM,EAAE,WAAW,MAAM,IAAI,aAAa,WAAW;EACpD,MAAM;EACN,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;EACjC,GAAI,SAAS,cAAc,KAAA,IACxB,EAAE,WAAW,SAAS,UAAU,IAChC,CAAC;EACJ,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;CAC9C,CAAC;CAED,MAAM,kBAAkB,wBAAwB;EAC/C,YAAY,OAAO;EACnB,GAAI,SAAS,WAAW,KAAA,IACrB,EAAE,YAAY,SAAS,OAAO,IAC9B,CAAC;EACJ,GAAI,cAAc,KAAA,IAAY,EAAE,UAAU,IAAI,CAAC;EAC/C,GAAI,SAAS,cAAc,KAAA,IACxB,EAAE,aAAa,SAAS,UAAU,IAClC,CAAC;EACJ,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;CAC9C,CAAC;CAaD,IAAI;CACJ,IAAI;EACH,SAAS,MAAM,WAAW,QAAQ;GACjC;GACA,UAAU,OAAO;GACjB;GACA,cAAc;GACd,gBAAgB;GAChB,sBAAsB;GACtB,GAAI,QAAQ,iBACT,EAAE,gBAAgB,QAAQ,eAAe,IACzC,CAAC;EACL,CAAC;CACF,SAAS,OAAO;EACf,MAAM,IAAI,yBAAyB,OAAO,IAAI,OAAO,MAAM,KAAK;CACjE;CAEA,OAAO;EACN,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB,QAAQ;GACP,GAAG;GACH,SAAS,oBAAoB,iBAAiB,OAAO,OAAO;EAC7D;CACD;AACD;;;;;;;;;;AAWA,MAAM,2BAA2B,SAOC;CACjC,MAAM,0BAAU,IAAI,IAA2B;CAC/C,MAAM,OAAO,OAAe,YAA2C;EACtE,QAAQ,IAAI,OAAO;GAClB,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE;IAAO,GAAG;GAAQ;EAC9B,CAAC;CACF;CACA,IAAI,KAAK,eAAe,KAAA,GACvB,IAAI,UAAU,EAAE,QAAQ,KAAK,WAAW,CAAC;CAE1C,IAAI,KAAK,cAAc,KAAA,GAAW,IAAI,OAAO,EAAE,WAAW,KAAK,UAAU,CAAC;CAC1E,IAAI,KAAK,gBAAgB,KAAA,GACxB,IAAI,aAAa,EAAE,WAAW,KAAK,YAAY,CAAC;CAEjD,IAAI,KAAK,iBACR,IAAI,mBAAmB,EAAE,UAAU,KAAK,gBAAgB,CAAC;CAE1D,OAAO;AACR;;;;;;;;;AAUA,MAAM,uBACL,UACA,WACqB;CACrB,MAAM,eAAe,IAAI,IACxB,OACE,QAAQ,MAAM,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM,CAAC,CACzD,KAAK,MAAM,EAAE,SAAS,KAAK,CAAC,CAC5B,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAC/D;CAIA,OAAO,CAAC,GAHW,CAAC,GAAG,QAAQ,CAAC,CAC9B,QAAQ,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,CAC7C,KAAK,GAAG,YAAY,MACF,GAAG,GAAG,MAAM;AACjC;;;;;;;AAQA,SAAS,sBACR,YACA,UACA,YACqB;CACrB,IAAI,eAAe,KAAA,GAAW;EAC7B,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,SAAS,UAAU;EACxD,IAAI,CAAC,OACJ,MAAM,IAAI,cACT,UAAU,gBACV,iCAAiC,WAAW,iBAAiB,WAAW,6DACvE,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAC1C,IACD,EACC,SAAS;GACR;GACA,QAAQ;GACR,WAAW,SAAS,KAAK,MAAM,EAAE,IAAI;EACtC,EACD,CACD;EAED,OAAO,MAAM;CACd;CACA,OAAO,SAAS,MAAM,MAAM,EAAE,SAAS,CAAC,EAAE;AAC3C"}

package/dist/lib/pull-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull-config.d.ts","names":[],"sources":["../../src/lib/pull-config.ts"],"mappings":";;;UAkBiB,iBAAA;;EAAA,SAAA,EAAA,MAAA;EAmBA;EAAa,QAAA,EAAA,MAAA;EACU;EAA9B,MAAA,CAAA,EAAA,MAAA;EACE;EAOE,OAAA,CAAA,EAAA,MAAA;EAAkB;EAGf,GAAA,CAAA,EArBV,OAqBU;AAAkB;AA6B1B;AAME;AAAa;AAGxB;AAAgC;AACtB;AACC,UApDM,aAAA,CAoDN;EAAR,OAAA,EAnDO,KAmDP,CAAA;IAAO,IAAA,EAAA,MAAA;IAoIM,MAAA,EAvLwB,iBAuLD;EAAA,CAAA,CAAA;EAC7B,SAAA,EAvLE,KAuLF,CAAA;IACD,IAAA,EAAA,MAAA;IACE,IAAA,EAAA,MAAA;EACA,CAAA,CAAA;EAEA;AACE;AACG;AAMb;AAAkB;;eA7LP;;UAGG,kBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BR;;;;;;YAME;;iBAGW,UAAA,UACZ,oBACP,QAAQ;iBAoIK,uBAAA,UACN,6BACD,8BACE,gCACA;WAEA;aACE;gBACG;;;;;IAMb"}
+{"version":3,"file":"pull-config.d.ts","names":["BucketAccessLevel","Config","NeonApi","NeonBranchSnapshot","NeonBucketSnapshot","NeonCredentialMeta","NeonEndpointSnapshot","NeonFunctionSnapshot","NeonProjectSnapshot","PullConfigOptions","PulledPreview","Array","PulledBranchConfig","pullConfig","Promise","buildPulledBranchConfig","BucketAccessLevel","Config","NeonApi","NeonBranchSnapshot","NeonBucketSnapshot","NeonCredentialMeta","NeonEndpointSnapshot","NeonFunctionSnapshot","NeonProjectSnapshot","PullConfigOptions","projectId","branchId","apiKey","apiHost","api","PulledPreview","buckets","Array","name","access","functions","slug","credentials","PulledBranchConfig","project","id","region","pgVersion","orgId","branch","parent","isDefault","protected","expiresAt","config","preview","pullConfig","options","Promise","buildPulledBranchConfig","branches","endpoint","previewState","authEnabled","dataApiEnabled"],"sources":["../../src/lib/pull-config.ts"],"mappings":";;;UAkBiBS,iBAAAA;;EAAAA,SAAAA,EAAAA,MAAAA;EAmBAC;EAAaiB,QAAA,EAAA,MAAA;EACU3B;EAA9BW,MAAAA,CAAAA,EAAAA,MAAAA;EACEA;EAOEN,OAAAA,CAAAA,EAAAA,MAAAA;EAAkB;EAGfO,GAAAA,CAAAA,EArBVV,OAqBUU;AAAkB;AA6B1BX;AAMES;AAAa;AAGxB;AAAgC;AACtBD;AACCG,UApDMF,aAAAA,CAoDNE;EAARE,OAAAA,EAnDOH,KAmDPG,CAAAA;IAAOoB,IAAA,EAAA,MAAA;IAoIMnB,MAAAA,EAvLwBf,iBAuLD;EAAA,CAAA,CAAA;EAC7BQ,SAAAA,EAvLEG,KAuLFH,CAAAA;IACDL,IAAAA,EAAAA,MAAAA;IACEA,IAAAA,EAAAA,MAAAA;EACAG,CAAAA,CAAAA;EAEAF;AACEG;AACGF;AAMbO;AAAkB;;eA7LPP;;UAGGO,kBAAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BRX;;;;;;YAMES;;iBAGWG,UAAAA,UACZJ,oBACPK,QAAQF;iBAoIKG,uBAAAA,UACNP,6BACDL,8BACEA,gCACAG;WAEAF;aACEG;gBACGF;;;;;IAMbO"}

package/dist/lib/push-config.d.ts

@@ -1,5 +1,5 @@
 import { FunctionBundler } from "./function-bundle.js";
-import { Config, NeonApi, PushResult } from "@neon/config";
+import { Config, ConflictReport, NeonApi, PushResult } from "@neon/config";
 
 //#region src/lib/push-config.d.ts
 interface PushConfigOptions {
@@ -69,6 +69,12 @@ interface PushConfigOptions {
    * Never invoked on `dryRun`.
    */
   confirm?: (context: PushConfirmContext) => boolean | Promise<boolean>;
+  /**
+   * Runs once after {@link confirm} approves (or was not needed) and before the first
+   * mutation or function bundle. A throw aborts the push with nothing changed by it.
+   * Never invoked on `dryRun`.
+   */
+  beforeMutations?: () => void | Promise<void>;
   /** Inject to deploy without this package loading esbuild. */
   bundleFunction?: FunctionBundler;
   /**
@@ -104,6 +110,11 @@ interface PushConfirmContext {
    * prompt.
    */
   overrideUpdates: boolean;
+  /**
+   * The settings that would be overridden, as current → desired, so the caller can show
+   * what it is asking about. Empty when only {@link protectedBranch} applies.
+   */
+  overrides: readonly ConflictReport[];
 }
 /**
  * Push a Neon branch policy to a specific project + branch.

package/dist/lib/push-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push-config.d.ts","names":[],"sources":["../../src/lib/push-config.ts"],"mappings":";;;;UAkCiB,iBAAA;;AAAjB;AAAkC;AAoB3B;AA8Cc;EAAiC,SAAA,EAAA,MAAA;EAEpC;AAAe;AAmBjC;AA2BA;EAAgC,QAAA,EAAA,MAAA;EACvB;EACC,MAAA,CAAA,EAAA,MAAA;EACC;EAAR,OAAA,CAAA,EAAA,MAAA;EAAO;;;;QAjGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA8Cc,iCAAiC;;mBAEpC;;;;;;;;;;;;;;;;;;UAmBD,kBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BK,UAAA,SACb,iBACC,oBACP,QAAQ"}
+{"version":3,"file":"push-config.d.ts","names":["Config","ConflictReport","NeonApi","PushResult","FunctionBundler","PushConfigOptions","PushConfirmContext","Promise","pushConfig","FunctionBundler","Config","ConflictReport","NeonApi","PushResult","PushConfigOptions","projectId","branchId","apiKey","apiHost","api","branchExists","updateExisting","allowProtectedBranch","confirm","context","PushConfirmContext","Promise","beforeMutations","bundleFunction","dryRun","branchName","protectedBranch","overrideUpdates","overrides","pushConfig","config","options"],"sources":["../../src/lib/push-config.ts"],"mappings":";;;;UAmCiBK,iBAAAA;;AAAjB;AAAkC;AAoB3BH;AA8CcI;EAAiCC,SAAAA,EAAAA,MAAAA;EAMtBA;AAEdH;AAAe;AAmBjC;EAgCsBI,QAAAA,EAAAA,MAAU;EAAA;EACvBR,MAAAA,CAAAA,EAAAA,MAAAA;EACCK;EACCF,OAAAA,CAAAA,EAAAA,MAAAA;EAARI;AAAO;;;QA5GHL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA8CcI,iCAAiCC;;;;;;iCAMtBA;;mBAEdH;;;;;;;;;;;;;;;;;;UAmBDE,kBAAAA;;;;;;;;;;;;;;;;;;;;sBAoBIL;;;;;;;;;;;iBAYCO,UAAAA,SACbR,iBACCK,oBACPE,QAAQJ"}

package/dist/lib/push-config.js

@@ -66,7 +66,8 @@ async function pushConfig(config, options) {
 			if (!await options.confirm({
 				branchName: branch.name,
 				protectedBranch: needsProtectedConfirm,
-				overrideUpdates: needsOverrideConfirm
+				overrideUpdates: needsOverrideConfirm,
+				overrides: needsOverrideConfirm ? diffConfig(resolved, remote, { updateExisting: false }).conflicts : []
 			})) {
 				const reasons = [];
 				if (needsProtectedConfirm) reasons.push("protected-branch");
@@ -78,6 +79,7 @@ async function pushConfig(config, options) {
 			throw new PushConflictError(legacy.conflicts);
 		}
 	}
+	if (!dryRun) await options.beforeMutations?.();
 	const applied = [{
 		kind: "branch",
 		action: "noop",

package/dist/lib/push-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"push-config.js","names":[],"sources":["../../src/lib/push-config.ts"],"sourcesContent":["import {\n\ttype AppliedChange,\n\ttype Config,\n\ttype CreateTriggerInput,\n\tcreateNeonApiFromOptions,\n\tdiffConfig,\n\tErrorCode,\n\ttype NeonApi,\n\ttype NeonBranchSnapshot,\n\ttype NeonCustomDomainSnapshot,\n\ttype PlanStep,\n\tPlatformError,\n\tPushAbortedError,\n\tPushConflictError,\n\ttype PushResult,\n\ttype RemotePreviewState,\n\ttype RemoteServiceState,\n\ttype RemoteState,\n\ttype ResolvedFunctionConfig,\n\ttype ResolvedFunctionTrigger,\n\ttype ResolvedPreviewConfig,\n\tresolveConfig,\n\ttype UpdateTriggerInput,\n} from \"@neon/config\";\nimport type { FunctionBundler } from \"./function-bundle.js\";\n\n// Eager loading would evaluate esbuild for callers that provide their own bundler.\nconst makeDefaultBundleFunction =\n\t(onWarning: (message: string) => void): FunctionBundler =>\n\tasync (fn: ResolvedFunctionConfig): Promise<Uint8Array> => {\n\t\tconst { buildFunctionBundle } = await import(\"./function-bundle.js\");\n\t\treturn buildFunctionBundle(fn, { onWarning });\n\t};\n\nexport interface PushConfigOptions {\n\t/**\n\t * Neon project id. **Required** — the management API addresses every branch through\n\t * its project, so there is no way to push without it. `pushConfig` never creates a\n\t * project; resolve the id yourself (e.g. via neonctl) and pass it in.\n\t */\n\tprojectId: string;\n\t/**\n\t * Neon branch id (`br-…`). **Required.** `pushConfig` never creates a branch — it must\n\t * already exist on the project. Resolve names to ids before calling.\n\t */\n\tbranchId: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. Ignored when `api` is supplied. */\n\tapiKey?: string;\n\t/** Neon API base URL. Falls back to `NEON_API_HOST`, then production. */\n\tapiHost?: string;\n\t/**\n\t * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n\t * on the default real adapter built from `apiKey`.\n\t */\n\tapi?: NeonApi;\n\t/**\n\t * Whether to evaluate the policy as if the target branch **already exists** (the value of\n\t * `branch.exists` passed to the `defineConfig({ branch: (branch) => … })` closure). Defaults to `true`.\n\t *\n\t * Set to `false` to evaluate the policy as a **branch creation** — used by\n\t * {@link createBranch} right after it provisions a new branch, so creation-time tuning\n\t * gated on `!branch.exists` (TTL, compute settings, `parent`) actually resolves instead of\n\t * hitting the \"existing branch, leave as-is\" path. Only affects policy evaluation; the\n\t * branch must still physically exist on Neon (`pushConfig` never creates one).\n\t */\n\tbranchExists?: boolean;\n\t/**\n\t * Auto-confirm overriding existing remote settings.\n\t *\n\t * When `true`, mutable drift on the selected branch (TTL, `protected` flag, compute\n\t * settings) is applied as actual mutations and the override-confirm prompt is\n\t * skipped. When `false` (default) the behaviour depends on whether `confirm` is\n\t * supplied:\n\t *   - With `confirm`: the callback is asked whether to apply the override.\n\t *   - Without `confirm`: drift is reported as a `PushConflictError` (legacy\n\t *     non-interactive default — preserved so programmatic SDK callers don't\n\t *     silently start mutating remote state).\n\t */\n\tupdateExisting?: boolean;\n\t/**\n\t * Auto-confirm pushing to a protected branch.\n\t *\n\t * When `true`, no protected-branch confirmation is asked. When `false` (default):\n\t *   - With `confirm`: the callback is asked.\n\t *   - Without `confirm`: the push proceeds (legacy SDK default).\n\t */\n\tallowProtectedBranch?: boolean;\n\t/**\n\t * Optional confirmation callback. Invoked once with a single context object before\n\t * any mutations run when the push needs confirmation: pushing to a protected\n\t * branch (unless `allowProtectedBranch` is `true`) and/or applying mutable drift\n\t * (unless `updateExisting` is `true`).\n\t *\n\t * Both prompts collapse into a single callback invocation when both apply, so the\n\t * CLI can render one combined \"are you sure?\" prompt.\n\t *\n\t * Resolves to `true` to proceed, `false` to abort with {@link PushAbortedError}.\n\t *\n\t * Never invoked on `dryRun`.\n\t */\n\tconfirm?: (context: PushConfirmContext) => boolean | Promise<boolean>;\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n\t/**\n\t * When `true`, compute the full plan against the live remote state but **do not\n\t * execute any mutations**. The resulting `PushResult.applied` array records every\n\t * change that *would* run on a real push (with the same action / identifier / details\n\t * shape, so the existing CLI summary formatter just works), and conflicts are\n\t * reported instead of thrown.\n\t *\n\t * Used by `plan(config, branchId)` and any caller that wants a \"would this push do\n\t * something dangerous?\" check before invoking `pushConfig` for real.\n\t */\n\tdryRun?: boolean;\n}\n\n/**\n * Context handed to a {@link PushConfigOptions.confirm} callback. Both flags can be\n * `true` simultaneously when the push targets a protected branch *and* would override\n * existing settings — render a single combined prompt covering both reasons.\n */\nexport interface PushConfirmContext {\n\t/** Name of the target branch on Neon. */\n\tbranchName: string;\n\t/**\n\t * `true` when the target branch has the `protected` flag on Neon and the caller\n\t * did not pass `allowProtectedBranch: true`.\n\t */\n\tprotectedBranch: boolean;\n\t/**\n\t * `true` when the plan would override existing remote settings (TTL, `protected`\n\t * flag, compute settings on an existing endpoint) and the caller did not pass\n\t * `updateExisting: true`. Additive operations (enabling Neon Auth / Data API for\n\t * the first time) are **not** counted here — those are unambiguous and never\n\t * prompt.\n\t */\n\toverrideUpdates: boolean;\n}\n\n/**\n * Push a Neon branch policy to a specific project + branch.\n *\n * Filesystem- and env-agnostic: the caller supplies an already-validated `Config` object\n * (from `defineConfig` / `loadConfigFromFile`) and explicit `projectId` + `branch` in\n * `options`. `pushConfig` performs no `.neon` lookups and reads no `NEON_*` env vars except the API credential/host resolution documented on `apiKey`/`apiHost`.\n *\n * It will **not** create a project or branch — both must already exist on Neon.\n */\nexport async function pushConfig(\n\tconfig: Config,\n\toptions: PushConfigOptions,\n): Promise<PushResult> {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\n\t// Collected from the built-in bundler and returned on the result. A caller that injects\n\t// its own `bundleFunction` reports for itself, so this stays empty for them.\n\tconst warnings: string[] = [];\n\n\tconst dryRun = options.dryRun === true;\n\tconst updateExisting = options.updateExisting === true;\n\tconst allowProtectedBranch = options.allowProtectedBranch === true;\n\n\t// Same scheduling as `pullConfig`: independent reads start together and are awaited in\n\t// the order they used to run, so the first error reported is unchanged.\n\tconst projectRead = started(() => api.getProject(projectId));\n\tconst listsRead = started(() =>\n\t\tPromise.all([\n\t\t\thandled(api.listBranches(projectId)),\n\t\t\thandled(api.listEndpoints(projectId)),\n\t\t]),\n\t);\n\tconst remoteProject = await projectRead;\n\tconst [branches, endpoints] = await listsRead;\n\tconst branch = resolveRemoteBranch(options.branchId, branches);\n\tconst resolved = resolveConfig(config, {\n\t\tname: branch.name,\n\t\tid: branch.id,\n\t\texists: options.branchExists !== false,\n\t\t...(branch.parentId ? { parentId: branch.parentId } : {}),\n\t\tisDefault: branch.isDefault,\n\t\tisProtected: branch.protected,\n\t\t...(branch.expiresAt ? { expiresAt: branch.expiresAt } : {}),\n\t});\n\tconst servicesRead = started(() =>\n\t\tresolveServiceState({\n\t\t\tapi,\n\t\t\tprojectId: remoteProject.id,\n\t\t\tbranch,\n\t\t\twantsAuth: resolved.authEnabled,\n\t\t\twantsDataApi:\n\t\t\t\tresolved.dataApiEnabled ||\n\t\t\t\tresolved.dataApiPolicy === \"disabled\",\n\t\t}),\n\t);\n\t// Only fetch Preview state when the policy actually uses it — and within that, only the\n\t// specific features the policy declares. So a policy that uses functions never probes\n\t// the AI Gateway, and `apply`/`plan` only fail on a Preview feature being unavailable\n\t// (404/503) when the policy actually asks for it.\n\tconst desiredPreview = resolved.preview;\n\tconst previewRead = desiredPreview\n\t\t? started(() =>\n\t\t\t\tresolvePreviewState({\n\t\t\t\t\tapi,\n\t\t\t\t\tprojectId: remoteProject.id,\n\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\tdesired: desiredPreview,\n\t\t\t\t\twantsTriggers: (resolved.triggers?.length ?? 0) > 0,\n\t\t\t\t}),\n\t\t\t)\n\t\t: undefined;\n\tconst services = await servicesRead;\n\tconst remote: RemoteState = {\n\t\tprojectId: remoteProject.id,\n\t\tbranch,\n\t\tendpoint: endpoints.find(\n\t\t\t(ep) => ep.type === \"read_write\" && ep.branchId === branch.id,\n\t\t),\n\t\tservices,\n\t};\n\tif (previewRead) {\n\t\tremote.preview = await previewRead;\n\t}\n\n\t// Always compute the plan with `updateExisting: true` so we can see what *would* be\n\t// overridden. The decision of whether to apply / prompt / fail is gated below using\n\t// the recorded steps.\n\tconst diff = diffConfig(resolved, remote, { updateExisting: true });\n\tconst overrideSteps = diff.plan.filter(isOverrideStep);\n\tconst needsOverrideConfirm = overrideSteps.length > 0 && !updateExisting;\n\tconst needsProtectedConfirm = branch.protected && !allowProtectedBranch;\n\n\tif (!dryRun && diff.conflicts.length > 0) {\n\t\tthrow new PushConflictError(diff.conflicts);\n\t}\n\n\tif (!dryRun && (needsOverrideConfirm || needsProtectedConfirm)) {\n\t\tif (options.confirm) {\n\t\t\tconst ok = await options.confirm({\n\t\t\t\tbranchName: branch.name,\n\t\t\t\tprotectedBranch: needsProtectedConfirm,\n\t\t\t\toverrideUpdates: needsOverrideConfirm,\n\t\t\t});\n\t\t\tif (!ok) {\n\t\t\t\tconst reasons: (\"protected-branch\" | \"override-updates\")[] = [];\n\t\t\t\tif (needsProtectedConfirm) reasons.push(\"protected-branch\");\n\t\t\t\tif (needsOverrideConfirm) reasons.push(\"override-updates\");\n\t\t\t\tthrow new PushAbortedError(branch.name, reasons);\n\t\t\t}\n\t\t} else if (needsOverrideConfirm) {\n\t\t\t// Legacy non-interactive fallback: surface the would-be drift as a\n\t\t\t// `PushConflictError` so programmatic callers that skipped both\n\t\t\t// `updateExisting` and `confirm` see the previous fail-fast behavior.\n\t\t\tconst legacy = diffConfig(resolved, remote, {\n\t\t\t\tupdateExisting: false,\n\t\t\t});\n\t\t\tthrow new PushConflictError(legacy.conflicts);\n\t\t}\n\t\t// Protected branch + no confirm callback: legacy default proceeds without\n\t\t// any extra check (no programmatic regression).\n\t}\n\n\tconst applied: AppliedChange[] = [\n\t\t{ kind: \"branch\", action: \"noop\", identifier: branch.name },\n\t];\n\n\tconst branchById = new Map(branches.map((b) => [b.id, b] as const));\n\tconst branchByName = new Map(branches.map((b) => [b.name, b] as const));\n\tconst ctx: ApplyContext = {\n\t\tapi,\n\t\tremoteProjectId: remoteProject.id,\n\t\tbranchById,\n\t\tbranchByName,\n\t\tbundleFunction:\n\t\t\toptions.bundleFunction ??\n\t\t\tmakeDefaultBundleFunction((message) => {\n\t\t\t\twarnings.push(message);\n\t\t\t}),\n\t\tdeploymentIdBySlug: new Map(),\n\t};\n\n\tfor (const step of diff.plan) {\n\t\tconst change = dryRun\n\t\t\t? synthesizeAppliedChange(step)\n\t\t\t: await applyStep(step, ctx);\n\t\tapplied.push(change);\n\t}\n\n\t// Surface each deployed function's invocation URL on its applied change so callers\n\t// (e.g. neonctl) can show users where to call it right after a push.\n\tawait enrichFunctionInvocationUrls({\n\t\tapi,\n\t\tprojectId: remoteProject.id,\n\t\tbranchId: branch.id,\n\t\tplan: diff.plan,\n\t\tapplied,\n\t\tpreview: remote.preview,\n\t\tdryRun,\n\t});\n\n\tconst result: PushResult = {\n\t\tprojectId: remoteProject.id,\n\t\tbranchId: branch.id,\n\t\tbranchName: branch.name,\n\t\tdryRun,\n\t\tapplied,\n\t\tconflicts: diff.conflicts,\n\t\twarnings,\n\t};\n\tif (remoteProject.orgId) result.orgId = remoteProject.orgId;\n\tenrichDeclaredCustomDomains({\n\t\tresult,\n\t\tpreview: remote.preview,\n\t\tfunctions: resolved.preview?.functions ?? [],\n\t\tapplied,\n\t\twarnings,\n\t});\n\treturn result;\n}\n\nfunction isOverrideStep(step: PlanStep): boolean {\n\treturn (\n\t\tstep.kind === \"update-branch-ttl\" ||\n\t\tstep.kind === \"update-branch-protected\" ||\n\t\tstep.kind === \"update-endpoint\" ||\n\t\tstep.kind === \"update-data-api\" ||\n\t\tstep.kind === \"disable-data-api\" ||\n\t\tstep.kind === \"retarget-custom-domain\"\n\t);\n}\n\n/**\n * Build an {@link AppliedChange} from a {@link PlanStep} without calling the Neon API.\n * Used by dry-run mode so callers see the same record shape they would on a live push,\n * just with no side effects. Identifiers are the branch names from the plan; any\n * sub-resource ids (`branchId`, `endpointId`) flow through unchanged when known.\n */\nfunction synthesizeAppliedChange(step: PlanStep): AppliedChange {\n\tswitch (step.kind) {\n\t\tcase \"update-branch-ttl\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: { field: \"ttl\", expiresAt: step.expiresAt },\n\t\t\t};\n\t\tcase \"update-branch-protected\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: { field: \"protected\", protected: step.protected },\n\t\t\t};\n\t\tcase \"update-endpoint\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: {\n\t\t\t\t\tfield: \"computeSettings\",\n\t\t\t\t\tendpointId: step.endpointId,\n\t\t\t\t\tsettings: step.settings,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"enable-auth\":\n\t\t\t// Pure branch on/off toggle: the target branch is redundant (same on\n\t\t\t// every row) and the database is auto-derived, not policy-chosen — so\n\t\t\t// there is nothing meaningful to surface in the change summary.\n\t\t\treturn { kind: \"service\", action: \"create\", identifier: \"auth\" };\n\t\tcase \"enable-data-api\":\n\t\t\treturn { kind: \"service\", action: \"create\", identifier: \"dataApi\" };\n\t\tcase \"update-data-api\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t\tdetails: { field: \"settings\", settings: step.settings },\n\t\t\t};\n\t\tcase \"disable-data-api\":\n\t\t\treturn { kind: \"service\", action: \"delete\", identifier: \"dataApi\" };\n\t\tcase \"create-bucket\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `bucket:${step.bucketName}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tbucketName: step.bucketName,\n\t\t\t\t\taccessLevel: step.accessLevel,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"deploy-function\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\t// The first deployment creates the function; a later one updates it.\n\t\t\t\taction: step.functionExists ? \"update\" : \"create\",\n\t\t\t\tidentifier: `function:${step.fn.slug}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tslug: step.fn.slug,\n\t\t\t\t\tsource: step.fn.source,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"create-trigger\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\tcase \"update-trigger\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\tcase \"register-custom-domain\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: step.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"retarget-custom-domain\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: step.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tpreviousSlug: step.previousSlug,\n\t\t\t\t},\n\t\t\t};\n\t}\n}\n\nfunction createApiFromOptions(options: PushConfigOptions): NeonApi {\n\treturn createNeonApiFromOptions(\"pushConfig\", {\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\nfunction resolveRemoteBranch(\n\tbranchId: string,\n\tbranches: NeonBranchSnapshot[],\n): NeonBranchSnapshot {\n\tconst found = branches.find((b) => b.id === branchId);\n\tif (found) return found;\n\tthrow new PlatformError(\n\t\tErrorCode.BranchNotFound,\n\t\t[\n\t\t\t`pushConfig: branch id ${JSON.stringify(branchId)} does not exist on the project.`,\n\t\t\t`Available branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \") || \"(none)\"}.`,\n\t\t\t\"Pass an existing branch id, or create the branch first with the neonctl CLI.\",\n\t\t].join(\" \"),\n\t\t{ details: { branchId, available: branches.map((b) => b.id) } },\n\t);\n}\n\n/**\n * Starts a read now and keeps an unread rejection from crashing the process; the caller\n * awaits it (and sees the error) when its turn comes. The read is called synchronously and\n * its own promise returned, so errors surface in the same order as a direct call; a\n * synchronous throw becomes the returned rejection.\n */\nfunction started<T>(read: () => Promise<T>): Promise<T> {\n\tlet promise: Promise<T>;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => undefined);\n\treturn promise;\n}\n\n/**\n * Marks a `Promise.all` member's rejection as handled, so a later member's synchronous\n * throw cannot leave it unobserved. `Promise.all` still reports it.\n */\nfunction handled<T>(promise: Promise<T>): Promise<T> {\n\tpromise.catch(() => undefined);\n\treturn promise;\n}\n\n/**\n * Pre-fetch the current state of branch-scoped integrations on the selected branch.\n */\nasync function resolveServiceState(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranch: NeonBranchSnapshot;\n\twantsAuth: boolean;\n\twantsDataApi: boolean;\n}): Promise<RemoteServiceState> {\n\tconst { api, projectId, branch, wantsAuth, wantsDataApi } = args;\n\tif (!wantsAuth && !wantsDataApi) {\n\t\treturn {\n\t\t\tdatabaseName: \"neondb\",\n\t\t\tauthEnabled: false,\n\t\t\tdataApiEnabled: false,\n\t\t};\n\t}\n\n\tconst databaseName = await pickServiceDatabaseName(\n\t\tapi,\n\t\tprojectId,\n\t\tbranch.id,\n\t);\n\n\tconst [auth, dataApi] = await Promise.all([\n\t\twantsAuth\n\t\t\t? handled(api.getNeonAuth(projectId, branch.id))\n\t\t\t: Promise.resolve(null),\n\t\twantsDataApi\n\t\t\t? handled(api.getNeonDataApi(projectId, branch.id, databaseName))\n\t\t\t: Promise.resolve(null),\n\t]);\n\tconst result: RemoteServiceState = {\n\t\tdatabaseName,\n\t\tauthEnabled: auth !== null,\n\t\tdataApiEnabled: dataApi !== null,\n\t};\n\t// Carry the current Data API settings (when reported) so the diff can detect settings\n\t// drift and plan an update. `null` distinguishes \"enabled but not reported\" from \"absent\".\n\tif (dataApi) result.dataApiSettings = dataApi.settings ?? null;\n\treturn result;\n}\n\n/**\n * Pre-fetch the current state of branch-scoped Preview features (buckets, functions) so the\n * diff can be computed additively. Only called when the policy has a `preview` block.\n *\n * The AI Gateway is not probed: it is always available (credential-gated, not per-branch\n * provisioned), so `preview.aiGateway` produces no plan step — it only drives the branch\n * credential's `ai_gateway:invoke` scope and the gateway env vars (`@neon/env`).\n */\nasync function resolvePreviewState(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tdesired: ResolvedPreviewConfig;\n\twantsTriggers: boolean;\n}): Promise<RemotePreviewState> {\n\tconst { api, projectId, branchId, desired, wantsTriggers } = args;\n\t// Read only the Preview features the policy declares: undeclared features can never\n\t// produce a plan step (see diffConfig), so probing them is pure waste — and would make\n\t// `plan`/`apply` fail on a feature the user didn't ask for if it's unavailable in the\n\t// project/region. A declared-but-unavailable feature still throws (failing the push),\n\t// which is the intended signal to enable it first.\n\tconst wantsCustomDomains = desired.functions.some(\n\t\t(fn) => (fn.customDomains?.length ?? 0) > 0,\n\t);\n\tconst customDomainApi = wantsCustomDomains\n\t\t? requireCustomDomainApi(api)\n\t\t: undefined;\n\tconst [buckets, functions, triggers, customDomains] = await Promise.all([\n\t\tdesired.buckets.length > 0\n\t\t\t? handled(api.listBranchBuckets(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\tdesired.functions.length > 0\n\t\t\t? handled(api.listBranchFunctions(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\twantsTriggers\n\t\t\t? handled(api.listBranchTriggers(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\tcustomDomainApi\n\t\t\t? handled(\n\t\t\t\t\tcustomDomainApi.listBranchCustomDomains(\n\t\t\t\t\t\tprojectId,\n\t\t\t\t\t\tbranchId,\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t: Promise.resolve([]),\n\t]);\n\tconst preview: RemotePreviewState = { buckets, functions, triggers };\n\tif (wantsCustomDomains) preview.customDomains = customDomains;\n\treturn preview;\n}\n\n/**\n * Resolve the database name for a Data API integration. Auto-pick when the branch has\n * exactly one database; otherwise fall back to Neon's default (`neondb`) so the call\n * stays useful even on branches with multiple databases — push doesn't have a way to\n * surface a \"pick one\" prompt the way `fetchEnv` does.\n */\nasync function pickServiceDatabaseName(\n\tapi: NeonApi,\n\tprojectId: string,\n\tbranchId: string,\n): Promise<string> {\n\tconst databases = await api.listBranchDatabases(projectId, branchId);\n\tif (databases.length === 1) return databases[0].name;\n\tconst neondb = databases.find((d) => d.name === \"neondb\");\n\tif (neondb) return neondb.name;\n\treturn databases[0]?.name ?? \"neondb\";\n}\n\ninterface ApplyContext {\n\tapi: NeonApi;\n\tremoteProjectId: string;\n\tbranchById: Map<string, NeonBranchSnapshot>;\n\tbranchByName: Map<string, NeonBranchSnapshot>;\n\tbundleFunction: FunctionBundler;\n\tdeploymentIdBySlug: Map<string, number>;\n}\n\nasync function applyStep(\n\tstep: PlanStep,\n\tctx: ApplyContext,\n): Promise<AppliedChange> {\n\tswitch (step.kind) {\n\t\tcase \"update-branch-ttl\": {\n\t\t\tconst updated = await ctx.api.updateBranch(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{\n\t\t\t\t\texpiresAt: step.expiresAt ?? null,\n\t\t\t\t},\n\t\t\t);\n\t\t\tctx.branchById.set(updated.id, updated);\n\t\t\tctx.branchByName.set(updated.name, updated);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: updated.name,\n\t\t\t\tdetails: { field: \"ttl\", expiresAt: step.expiresAt },\n\t\t\t};\n\t\t}\n\t\tcase \"update-branch-protected\": {\n\t\t\tconst updated = await ctx.api.updateBranch(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{ protected: step.protected },\n\t\t\t);\n\t\t\tctx.branchById.set(updated.id, updated);\n\t\t\tctx.branchByName.set(updated.name, updated);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: updated.name,\n\t\t\t\tdetails: { field: \"protected\", protected: step.protected },\n\t\t\t};\n\t\t}\n\t\tcase \"update-endpoint\": {\n\t\t\tconst updated = await ctx.api.updateEndpoint(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.endpointId,\n\t\t\t\tstep.settings,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: {\n\t\t\t\t\tfield: \"computeSettings\",\n\t\t\t\t\tendpointId: updated.id,\n\t\t\t\t\tsettings: step.settings,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"enable-auth\": {\n\t\t\tawait ctx.api.enableNeonAuth(ctx.remoteProjectId, step.branchId, {\n\t\t\t\t...(step.databaseName\n\t\t\t\t\t? { databaseName: step.databaseName }\n\t\t\t\t\t: {}),\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: \"auth\",\n\t\t\t};\n\t\t}\n\t\tcase \"enable-data-api\": {\n\t\t\tawait ctx.api.enableProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t\tstep.input,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t};\n\t\t}\n\t\tcase \"update-data-api\": {\n\t\t\tawait ctx.api.updateProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t\tstep.settings,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t\tdetails: { field: \"settings\", settings: step.settings },\n\t\t\t};\n\t\t}\n\t\tcase \"disable-data-api\": {\n\t\t\tawait ctx.api.deleteProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"delete\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t};\n\t\t}\n\t\tcase \"create-bucket\": {\n\t\t\tawait ctx.api.createBranchBucket(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{ name: step.bucketName, accessLevel: step.accessLevel },\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `bucket:${step.bucketName}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tbucketName: step.bucketName,\n\t\t\t\t\taccessLevel: step.accessLevel,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"deploy-function\": {\n\t\t\tconst bundle = await ctx.bundleFunction(step.fn);\n\t\t\t// Neon creates the function on its first deployment — there is no separate\n\t\t\t// create call — so a single deploy both creates (when absent) and ships code.\n\t\t\tconst deployment = await ctx.api.deployBranchFunction(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.fn.slug,\n\t\t\t\t{\n\t\t\t\t\tbundle,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t\tenvironment: step.fn.env,\n\t\t\t\t},\n\t\t\t);\n\t\t\tctx.deploymentIdBySlug.set(step.fn.slug, deployment.id);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: step.functionExists ? \"update\" : \"create\",\n\t\t\t\tidentifier: `function:${step.fn.slug}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tslug: step.fn.slug,\n\t\t\t\t\tsource: step.fn.source,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t\tdeploymentId: deployment.id,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"create-trigger\": {\n\t\t\tawait ctx.api.createBranchTrigger(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tcreateTriggerInput(step.functionSlug, step.trigger),\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\t}\n\t\tcase \"update-trigger\": {\n\t\t\tawait ctx.api.updateBranchTrigger(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.triggerId,\n\t\t\t\tupdateTriggerInput(step.functionSlug, step.trigger),\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\t}\n\t\tcase \"register-custom-domain\": {\n\t\t\tconst methods = requireCustomDomainApi(ctx.api);\n\t\t\tlet snapshot: NeonCustomDomainSnapshot;\n\t\t\ttry {\n\t\t\t\tsnapshot = await methods.registerBranchCustomDomain(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t\t{ domain: step.domain, functionSlug: step.functionSlug },\n\t\t\t\t);\n\t\t\t} catch (err) {\n\t\t\t\tthrow rewriteCustomDomainConflict(err, step.domain);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: snapshot.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tcnameTarget: snapshot.cnameTarget,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"retarget-custom-domain\": {\n\t\t\tconst methods = requireCustomDomainApi(ctx.api);\n\t\t\tconst deploymentId = ctx.deploymentIdBySlug.get(step.functionSlug);\n\t\t\tif (deploymentId === undefined) {\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.ServerError,\n\t\t\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(step.functionSlug)}: this apply did not deploy that function.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait waitForCompletedFunctionDeployment({\n\t\t\t\tapi: ctx.api,\n\t\t\t\tprojectId: ctx.remoteProjectId,\n\t\t\t\tbranchId: step.branchId,\n\t\t\t\tslug: step.functionSlug,\n\t\t\t\tdeploymentId,\n\t\t\t});\n\t\t\tconst observed = (\n\t\t\t\tawait methods.listBranchCustomDomains(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t)\n\t\t\t).find((item) => item.domain === step.domain);\n\t\t\tif (\n\t\t\t\tobserved === undefined ||\n\t\t\t\tobserved.entityType !== \"function\" ||\n\t\t\t\tobserved.entityId !== step.previousSlug\n\t\t\t) {\n\t\t\t\tconst seen =\n\t\t\t\t\tobserved === undefined\n\t\t\t\t\t\t? \"no registration\"\n\t\t\t\t\t\t: `${observed.entityType} ${JSON.stringify(observed.entityId)}`;\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.Conflict,\n\t\t\t\t\t`Cannot retarget ${JSON.stringify(step.domain)}: planned owner was function ${JSON.stringify(step.previousSlug)}; observed ${seen}. DELETE was not attempted.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait methods.deleteBranchCustomDomain(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.domain,\n\t\t\t);\n\t\t\tlet snapshot: NeonCustomDomainSnapshot;\n\t\t\ttry {\n\t\t\t\tsnapshot = await methods.registerBranchCustomDomain(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t\t{ domain: step.domain, functionSlug: step.functionSlug },\n\t\t\t\t);\n\t\t\t} catch (err) {\n\t\t\t\tconst rewritten = rewriteCustomDomainConflict(err, step.domain);\n\t\t\t\tconst message =\n\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t? rewritten.message\n\t\t\t\t\t\t: rewritten instanceof Error\n\t\t\t\t\t\t\t? rewritten.message\n\t\t\t\t\t\t\t: String(rewritten);\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t? rewritten.code\n\t\t\t\t\t\t: ErrorCode.ServerError,\n\t\t\t\t\t`Deleted the previous registration of ${JSON.stringify(step.domain)} (function ${JSON.stringify(step.previousSlug)}) but failed to register it on ${JSON.stringify(step.functionSlug)}. Inspect current ownership with \\`neon function domains list\\` before recovering. ${message}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tcause: rewritten instanceof Error ? rewritten : err,\n\t\t\t\t\t\tdetails:\n\t\t\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t\t\t? { ...rewritten.details }\n\t\t\t\t\t\t\t\t: {},\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: snapshot.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tpreviousSlug: step.previousSlug,\n\t\t\t\t\tcnameTarget: snapshot.cnameTarget,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t}\n}\n\n/**\n * Add each deployed function's invocation URL to its applied-change `details` so callers\n * (e.g. neonctl) can show users where to call the function right after a push.\n *\n * The URL is read from the preview snapshot already fetched for the diff, which lists every\n * existing function with its `invocationUrl`. A function created by its *first* deployment in\n * this push is not in that snapshot, so when one is present we re-list the branch's functions\n * once to learn its freshly-minted URL. Skipped on dry-run (nothing was created) and\n * best-effort otherwise: a failed re-list omits the URL rather than failing a push that has\n * already applied.\n */\nasync function enrichFunctionInvocationUrls(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tplan: PlanStep[];\n\tapplied: AppliedChange[];\n\tpreview: RemotePreviewState | undefined;\n\tdryRun: boolean;\n}): Promise<void> {\n\tconst { api, projectId, branchId, plan, applied, preview, dryRun } = args;\n\tconst deployedSlugs = plan.flatMap((step) =>\n\t\tstep.kind === \"deploy-function\" ? [step.fn.slug] : [],\n\t);\n\tif (deployedSlugs.length === 0) return;\n\n\tconst urlBySlug = new Map<string, string>(\n\t\t(preview?.functions ?? []).map(\n\t\t\t(fn) => [fn.slug, fn.invocationUrl] as const,\n\t\t),\n\t);\n\n\t// A first-time deploy creates the function, so its URL isn't in the pre-fetch; re-list\n\t// once when any deployed slug is still missing a URL.\n\tconst hasMissingUrl = deployedSlugs.some((slug) => !urlBySlug.has(slug));\n\tif (hasMissingUrl && !dryRun) {\n\t\ttry {\n\t\t\tfor (const fn of await api.listBranchFunctions(\n\t\t\t\tprojectId,\n\t\t\t\tbranchId,\n\t\t\t)) {\n\t\t\t\turlBySlug.set(fn.slug, fn.invocationUrl);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Push already succeeded; surface what we can rather than failing here.\n\t\t}\n\t}\n\n\tfor (const change of applied) {\n\t\tconst slug = functionSlugFromIdentifier(change.identifier);\n\t\tif (slug === undefined) continue;\n\t\tconst invocationUrl = urlBySlug.get(slug);\n\t\tif (invocationUrl === undefined) continue;\n\t\tchange.details = { ...change.details, invocationUrl };\n\t}\n}\n\n/** Pull the function slug out of a `function:<slug>` applied-change identifier. */\nfunction functionSlugFromIdentifier(identifier: string): string | undefined {\n\tconst prefix = \"function:\";\n\treturn identifier.startsWith(prefix)\n\t\t? identifier.slice(prefix.length)\n\t\t: undefined;\n}\n\nasync function waitForCompletedFunctionDeployment(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tslug: string;\n\tdeploymentId: number;\n}): Promise<void> {\n\tconst get = args.api.getBranchFunction;\n\tif (!get) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.FeatureUnavailable,\n\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(args.slug)}: this NeonApi adapter does not implement getBranchFunction, so apply cannot confirm the function finished deploying.`,\n\t\t);\n\t}\n\tconst intervalMs =\n\t\tNumber(process.env.NEON_FUNCTIONS_POLL_INTERVAL_MS) || 2000;\n\tconst timeoutMs =\n\t\tNumber(process.env.NEON_FUNCTIONS_POLL_TIMEOUT_MS) || 600_000;\n\tconst deadline = Date.now() + timeoutMs;\n\tfor (;;) {\n\t\tconst fn = await get.call(\n\t\t\targs.api,\n\t\t\targs.projectId,\n\t\t\targs.branchId,\n\t\t\targs.slug,\n\t\t);\n\t\tconst dep = fn.currentDeployment;\n\t\t// GET can still report the previous deployment after this apply's POST returns.\n\t\tif (dep !== undefined && dep.id > args.deploymentId) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.ServerError,\n\t\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(args.slug)}: current deployment is ${dep.id}, this apply submitted ${args.deploymentId}; left the previous custom-domain registration in place.`,\n\t\t\t);\n\t\t}\n\t\tif (dep !== undefined && dep.id === args.deploymentId) {\n\t\t\tif (dep.status === \"completed\") return;\n\t\t\tif (dep.status === \"failed\") {\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.ServerError,\n\t\t\t\t\t`Deployment of function ${JSON.stringify(args.slug)} failed; left the previous custom-domain registration in place.`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tif (Date.now() >= deadline) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.ServerError,\n\t\t\t\t`Timed out waiting for function ${JSON.stringify(args.slug)} to finish deploying; left the previous custom-domain registration in place.`,\n\t\t\t);\n\t\t}\n\t\tawait new Promise((resolve) => setTimeout(resolve, intervalMs));\n\t}\n}\n\nfunction requireCustomDomainApi(api: NeonApi): {\n\tlistBranchCustomDomains: NonNullable<NeonApi[\"listBranchCustomDomains\"]>;\n\tregisterBranchCustomDomain: NonNullable<\n\t\tNeonApi[\"registerBranchCustomDomain\"]\n\t>;\n\tdeleteBranchCustomDomain: NonNullable<NeonApi[\"deleteBranchCustomDomain\"]>;\n} {\n\tconst list = api.listBranchCustomDomains;\n\tconst register = api.registerBranchCustomDomain;\n\tconst remove = api.deleteBranchCustomDomain;\n\tif (!list || !register || !remove) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.FeatureUnavailable,\n\t\t\t\"This NeonApi adapter does not implement custom domains. Implement listBranchCustomDomains, registerBranchCustomDomain, and deleteBranchCustomDomain, or remove customDomains from neon.ts.\",\n\t\t);\n\t}\n\treturn {\n\t\tlistBranchCustomDomains: list.bind(api),\n\t\tregisterBranchCustomDomain: register.bind(api),\n\t\tdeleteBranchCustomDomain: remove.bind(api),\n\t};\n}\n\nfunction rewriteCustomDomainConflict(err: unknown, domain: string): unknown {\n\tif (!(err instanceof PlatformError) || err.code !== ErrorCode.Conflict) {\n\t\treturn err;\n\t}\n\tconst neonMessage =\n\t\ttypeof err.details.neonMessage === \"string\"\n\t\t\t? err.details.neonMessage\n\t\t\t: undefined;\n\tconst requestId =\n\t\ttypeof err.details.requestId === \"string\"\n\t\t\t? err.details.requestId\n\t\t\t: undefined;\n\tconst status =\n\t\ttypeof err.details.status === \"number\" ? err.details.status : undefined;\n\tconst apiParts = [\n\t\tstatus !== undefined ? `HTTP ${status}` : undefined,\n\t\tneonMessage ? `Neon API said: \"${neonMessage}\"` : undefined,\n\t\trequestId ? `request id ${requestId}` : undefined,\n\t].filter((part): part is string => part !== undefined);\n\treturn new PlatformError(\n\t\tErrorCode.Conflict,\n\t\t[\n\t\t\t`Hostname ${JSON.stringify(domain)} is already registered to another resource.`,\n\t\t\tapiParts.length > 0 ? `(${apiParts.join(\"; \")})` : undefined,\n\t\t\t\"Declare it only on the branch that owns it (use the branch closure), or delete it there first with `neon function domains delete`.\",\n\t\t]\n\t\t\t.filter((part): part is string => part !== undefined)\n\t\t\t.join(\" \"),\n\t\t{ cause: err, details: { ...err.details } },\n\t);\n}\n\nfunction enrichDeclaredCustomDomains(args: {\n\tresult: PushResult;\n\tpreview: RemotePreviewState | undefined;\n\tfunctions: ResolvedFunctionConfig[];\n\tapplied: AppliedChange[];\n\twarnings: string[];\n}): void {\n\tconst declared: Array<{ domain: string; slug: string }> = [];\n\tfor (const fn of args.functions) {\n\t\tfor (const domain of fn.customDomains ?? []) {\n\t\t\tdeclared.push({ domain, slug: fn.slug });\n\t\t}\n\t}\n\tif (declared.length === 0) return;\n\n\tconst blockedDomains = new Set(\n\t\targs.result.conflicts.flatMap((conflict) => {\n\t\t\tif (conflict.field !== \"customDomain\") return [];\n\t\t\tconst match = /^custom domain \"([^\"]+)\"/.exec(conflict.reason);\n\t\t\treturn match?.[1] !== undefined ? [match[1]] : [];\n\t\t}),\n\t);\n\n\tconst cnameByDomain = new Map<string, string>();\n\tfor (const remote of args.preview?.customDomains ?? []) {\n\t\tif (blockedDomains.has(remote.domain)) continue;\n\t\tcnameByDomain.set(remote.domain, remote.cnameTarget);\n\t}\n\tfor (const change of args.applied) {\n\t\tconst domain =\n\t\t\ttypeof change.details?.domain === \"string\"\n\t\t\t\t? change.details.domain\n\t\t\t\t: undefined;\n\t\tconst cnameTarget = change.details?.cnameTarget;\n\t\tif (domain !== undefined && typeof cnameTarget === \"string\") {\n\t\t\tcnameByDomain.set(domain, cnameTarget);\n\t\t}\n\t}\n\n\targs.result.customDomains = declared.map(({ domain, slug }) => {\n\t\tconst entry: { domain: string; slug: string; cnameTarget?: string } = {\n\t\t\tdomain,\n\t\t\tslug,\n\t\t};\n\t\tconst cnameTarget = cnameByDomain.get(domain);\n\t\tif (cnameTarget !== undefined) entry.cnameTarget = cnameTarget;\n\t\tif (cnameTarget === \"\") {\n\t\t\targs.warnings.push(\n\t\t\t\t`No CNAME target for ${domain}; this region has no custom-domains front door.`,\n\t\t\t);\n\t\t}\n\t\treturn entry;\n\t});\n}\n\nfunction triggerChangeDetails(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): Record<string, unknown> {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\tfunctionSlug,\n\t\t\ttype: trigger.type,\n\t\t\tcron: trigger.cron,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\tfunctionSlug,\n\t\ttype: trigger.type,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tenabled: trigger.enabled,\n\t};\n}\n\nfunction createTriggerInput(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): CreateTriggerInput {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\ttype: \"schedule\",\n\t\t\tname: trigger.name,\n\t\t\tfunctionSlug,\n\t\t\tcron: trigger.cron,\n\t\t\tfunctionPath: trigger.functionPath,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\ttype: \"storage_object_created\",\n\t\tname: trigger.name,\n\t\tfunctionSlug,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tfunctionPath: trigger.functionPath,\n\t\tenabled: trigger.enabled,\n\t};\n}\n\nfunction updateTriggerInput(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): UpdateTriggerInput {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\ttype: \"schedule\",\n\t\t\tname: trigger.name,\n\t\t\tfunctionSlug,\n\t\t\tcron: trigger.cron,\n\t\t\tfunctionPath: trigger.functionPath,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\ttype: \"storage_object_created\",\n\t\tname: trigger.name,\n\t\tfunctionSlug,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tfunctionPath: trigger.functionPath,\n\t\tenabled: trigger.enabled,\n\t};\n}\n"],"mappings":";;AA2BA,MAAM,6BACJ,cACD,OAAO,OAAoD;CAC1D,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAC7C,OAAO,oBAAoB,IAAI,EAAE,UAAU,CAAC;AAC7C;;;;;;;;;;AAoHD,eAAsB,WACrB,QACA,SACsB;CACtB,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAI1B,MAAM,WAAqB,CAAC;CAE5B,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,iBAAiB,QAAQ,mBAAmB;CAClD,MAAM,uBAAuB,QAAQ,yBAAyB;CAI9D,MAAM,cAAc,cAAc,IAAI,WAAW,SAAS,CAAC;CAC3D,MAAM,YAAY,cACjB,QAAQ,IAAI,CACX,QAAQ,IAAI,aAAa,SAAS,CAAC,GACnC,QAAQ,IAAI,cAAc,SAAS,CAAC,CACrC,CAAC,CACF;CACA,MAAM,gBAAgB,MAAM;CAC5B,MAAM,CAAC,UAAU,aAAa,MAAM;CACpC,MAAM,SAAS,oBAAoB,QAAQ,UAAU,QAAQ;CAC7D,MAAM,WAAW,cAAc,QAAQ;EACtC,MAAM,OAAO;EACb,IAAI,OAAO;EACX,QAAQ,QAAQ,iBAAiB;EACjC,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;EACvD,WAAW,OAAO;EAClB,aAAa,OAAO;EACpB,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;CAC3D,CAAC;CACD,MAAM,eAAe,cACpB,oBAAoB;EACnB;EACA,WAAW,cAAc;EACzB;EACA,WAAW,SAAS;EACpB,cACC,SAAS,kBACT,SAAS,kBAAkB;CAC7B,CAAC,CACF;CAKA,MAAM,iBAAiB,SAAS;CAChC,MAAM,cAAc,iBACjB,cACA,oBAAoB;EACnB;EACA,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,SAAS;EACT,gBAAgB,SAAS,UAAU,UAAU,KAAK;CACnD,CAAC,CACF,IACC,KAAA;CACH,MAAM,WAAW,MAAM;CACvB,MAAM,SAAsB;EAC3B,WAAW,cAAc;EACzB;EACA,UAAU,UAAU,MAClB,OAAO,GAAG,SAAS,gBAAgB,GAAG,aAAa,OAAO,EAC5D;EACA;CACD;CACA,IAAI,aACH,OAAO,UAAU,MAAM;CAMxB,MAAM,OAAO,WAAW,UAAU,QAAQ,EAAE,gBAAgB,KAAK,CAAC;CAElE,MAAM,uBADgB,KAAK,KAAK,OAAO,cACE,CAAC,CAAC,SAAS,KAAK,CAAC;CAC1D,MAAM,wBAAwB,OAAO,aAAa,CAAC;CAEnD,IAAI,CAAC,UAAU,KAAK,UAAU,SAAS,GACtC,MAAM,IAAI,kBAAkB,KAAK,SAAS;CAG3C,IAAI,CAAC,WAAW,wBAAwB,wBAAwB;EAC/D,IAAI,QAAQ,SAMP;OAAA,CAAC,MALY,QAAQ,QAAQ;IAChC,YAAY,OAAO;IACnB,iBAAiB;IACjB,iBAAiB;GAClB,CAAC,GACQ;IACR,MAAM,UAAuD,CAAC;IAC9D,IAAI,uBAAuB,QAAQ,KAAK,kBAAkB;IAC1D,IAAI,sBAAsB,QAAQ,KAAK,kBAAkB;IACzD,MAAM,IAAI,iBAAiB,OAAO,MAAM,OAAO;GAChD;SACM,IAAI,sBAAsB;GAIhC,MAAM,SAAS,WAAW,UAAU,QAAQ,EAC3C,gBAAgB,MACjB,CAAC;GACD,MAAM,IAAI,kBAAkB,OAAO,SAAS;EAC7C;CAGD;CAEA,MAAM,UAA2B,CAChC;EAAE,MAAM;EAAU,QAAQ;EAAQ,YAAY,OAAO;CAAK,CAC3D;CAEA,MAAM,aAAa,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAU,CAAC;CAClE,MAAM,eAAe,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAU,CAAC;CACtE,MAAM,MAAoB;EACzB;EACA,iBAAiB,cAAc;EAC/B;EACA;EACA,gBACC,QAAQ,kBACR,2BAA2B,YAAY;GACtC,SAAS,KAAK,OAAO;EACtB,CAAC;EACF,oCAAoB,IAAI,IAAI;CAC7B;CAEA,KAAK,MAAM,QAAQ,KAAK,MAAM;EAC7B,MAAM,SAAS,SACZ,wBAAwB,IAAI,IAC5B,MAAM,UAAU,MAAM,GAAG;EAC5B,QAAQ,KAAK,MAAM;CACpB;CAIA,MAAM,6BAA6B;EAClC;EACA,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,MAAM,KAAK;EACX;EACA,SAAS,OAAO;EAChB;CACD,CAAC;CAED,MAAM,SAAqB;EAC1B,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB;EACA;EACA,WAAW,KAAK;EAChB;CACD;CACA,IAAI,cAAc,OAAO,OAAO,QAAQ,cAAc;CACtD,4BAA4B;EAC3B;EACA,SAAS,OAAO;EAChB,WAAW,SAAS,SAAS,aAAa,CAAC;EAC3C;EACA;CACD,CAAC;CACD,OAAO;AACR;AAEA,SAAS,eAAe,MAAyB;CAChD,OACC,KAAK,SAAS,uBACd,KAAK,SAAS,6BACd,KAAK,SAAS,qBACd,KAAK,SAAS,qBACd,KAAK,SAAS,sBACd,KAAK,SAAS;AAEhB;;;;;;;AAQA,SAAS,wBAAwB,MAA+B;CAC/D,QAAQ,KAAK,MAAb;EACC,KAAK,qBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,OAAO;IAAO,WAAW,KAAK;GAAU;EACpD;EACD,KAAK,2BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,OAAO;IAAa,WAAW,KAAK;GAAU;EAC1D;EACD,KAAK,mBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IACR,OAAO;IACP,YAAY,KAAK;IACjB,UAAU,KAAK;GAChB;EACD;EACD,KAAK,eAIJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAO;EAChE,KAAK,mBACJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAU;EACnE,KAAK,mBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY;GACZ,SAAS;IAAE,OAAO;IAAY,UAAU,KAAK;GAAS;EACvD;EACD,KAAK,oBACJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAU;EACnE,KAAK,iBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,YAAY,KAAK;IACjB,aAAa,KAAK;GACnB;EACD;EACD,KAAK,mBACJ,OAAO;GACN,MAAM;GAEN,QAAQ,KAAK,iBAAiB,WAAW;GACzC,YAAY,YAAY,KAAK,GAAG;GAChC,SAAS;IACR,MAAM,KAAK,GAAG;IACd,QAAQ,KAAK,GAAG;IAChB,SAAS,KAAK,GAAG;GAClB;EACD;EACD,KAAK,kBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;GACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;EAC9D;EACD,KAAK,kBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;GACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;EAC9D;EACD,KAAK,0BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,QAAQ,KAAK;IACb,MAAM,KAAK;GACZ;EACD;EACD,KAAK,0BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,QAAQ,KAAK;IACb,MAAM,KAAK;IACX,cAAc,KAAK;GACpB;EACD;CACF;AACD;AAEA,SAAS,qBAAqB,SAAqC;CAClE,OAAO,yBAAyB,cAAc;EAC7C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;AAEA,SAAS,oBACR,UACA,UACqB;CACrB,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,QAAQ;CACpD,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cACT,UAAU,gBACV;EACC,yBAAyB,KAAK,UAAU,QAAQ,EAAE;EAClD,uBAAuB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS;EACzF;CACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS;EAAE;EAAU,WAAW,SAAS,KAAK,MAAM,EAAE,EAAE;CAAE,EAAE,CAC/D;AACD;;;;;;;AAQA,SAAS,QAAW,MAAoC;CACvD,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAA,CAAS;CAC7B,OAAO;AACR;;;;;AAMA,SAAS,QAAW,SAAiC;CACpD,QAAQ,YAAY,KAAA,CAAS;CAC7B,OAAO;AACR;;;;AAKA,eAAe,oBAAoB,MAMH;CAC/B,MAAM,EAAE,KAAK,WAAW,QAAQ,WAAW,iBAAiB;CAC5D,IAAI,CAAC,aAAa,CAAC,cAClB,OAAO;EACN,cAAc;EACd,aAAa;EACb,gBAAgB;CACjB;CAGD,MAAM,eAAe,MAAM,wBAC1B,KACA,WACA,OAAO,EACR;CAEA,MAAM,CAAC,MAAM,WAAW,MAAM,QAAQ,IAAI,CACzC,YACG,QAAQ,IAAI,YAAY,WAAW,OAAO,EAAE,CAAC,IAC7C,QAAQ,QAAQ,IAAI,GACvB,eACG,QAAQ,IAAI,eAAe,WAAW,OAAO,IAAI,YAAY,CAAC,IAC9D,QAAQ,QAAQ,IAAI,CACxB,CAAC;CACD,MAAM,SAA6B;EAClC;EACA,aAAa,SAAS;EACtB,gBAAgB,YAAY;CAC7B;CAGA,IAAI,SAAS,OAAO,kBAAkB,QAAQ,YAAY;CAC1D,OAAO;AACR;;;;;;;;;AAUA,eAAe,oBAAoB,MAMH;CAC/B,MAAM,EAAE,KAAK,WAAW,UAAU,SAAS,kBAAkB;CAM7D,MAAM,qBAAqB,QAAQ,UAAU,MAC3C,QAAQ,GAAG,eAAe,UAAU,KAAK,CAC3C;CACA,MAAM,kBAAkB,qBACrB,uBAAuB,GAAG,IAC1B,KAAA;CACH,MAAM,CAAC,SAAS,WAAW,UAAU,iBAAiB,MAAM,QAAQ,IAAI;EACvE,QAAQ,QAAQ,SAAS,IACtB,QAAQ,IAAI,kBAAkB,WAAW,QAAQ,CAAC,IAClD,QAAQ,QAAQ,CAAC,CAAC;EACrB,QAAQ,UAAU,SAAS,IACxB,QAAQ,IAAI,oBAAoB,WAAW,QAAQ,CAAC,IACpD,QAAQ,QAAQ,CAAC,CAAC;EACrB,gBACG,QAAQ,IAAI,mBAAmB,WAAW,QAAQ,CAAC,IACnD,QAAQ,QAAQ,CAAC,CAAC;EACrB,kBACG,QACA,gBAAgB,wBACf,WACA,QACD,CACD,IACC,QAAQ,QAAQ,CAAC,CAAC;CACtB,CAAC;CACD,MAAM,UAA8B;EAAE;EAAS;EAAW;CAAS;CACnE,IAAI,oBAAoB,QAAQ,gBAAgB;CAChD,OAAO;AACR;;;;;;;AAQA,eAAe,wBACd,KACA,WACA,UACkB;CAClB,MAAM,YAAY,MAAM,IAAI,oBAAoB,WAAW,QAAQ;CACnE,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,QAAQ;CACxD,IAAI,QAAQ,OAAO,OAAO;CAC1B,OAAO,UAAU,EAAE,EAAE,QAAQ;AAC9B;AAWA,eAAe,UACd,MACA,KACyB;CACzB,QAAQ,KAAK,MAAb;EACC,KAAK,qBAAqB;GACzB,MAAM,UAAU,MAAM,IAAI,IAAI,aAC7B,IAAI,iBACJ,KAAK,UACL,EACC,WAAW,KAAK,aAAa,KAC9B,CACD;GACA,IAAI,WAAW,IAAI,QAAQ,IAAI,OAAO;GACtC,IAAI,aAAa,IAAI,QAAQ,MAAM,OAAO;GAC1C,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,QAAQ;IACpB,SAAS;KAAE,OAAO;KAAO,WAAW,KAAK;IAAU;GACpD;EACD;EACA,KAAK,2BAA2B;GAC/B,MAAM,UAAU,MAAM,IAAI,IAAI,aAC7B,IAAI,iBACJ,KAAK,UACL,EAAE,WAAW,KAAK,UAAU,CAC7B;GACA,IAAI,WAAW,IAAI,QAAQ,IAAI,OAAO;GACtC,IAAI,aAAa,IAAI,QAAQ,MAAM,OAAO;GAC1C,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,QAAQ;IACpB,SAAS;KAAE,OAAO;KAAa,WAAW,KAAK;IAAU;GAC1D;EACD;EACA,KAAK,mBAAmB;GACvB,MAAM,UAAU,MAAM,IAAI,IAAI,eAC7B,IAAI,iBACJ,KAAK,YACL,KAAK,QACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,KAAK;IACjB,SAAS;KACR,OAAO;KACP,YAAY,QAAQ;KACpB,UAAU,KAAK;IAChB;GACD;EACD;EACA,KAAK;GACJ,MAAM,IAAI,IAAI,eAAe,IAAI,iBAAiB,KAAK,UAAU,EAChE,GAAI,KAAK,eACN,EAAE,cAAc,KAAK,aAAa,IAClC,CAAC,EACL,CAAC;GACD,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,cACL,KAAK,KACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,cACL,KAAK,QACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,SAAS;KAAE,OAAO;KAAY,UAAU,KAAK;IAAS;GACvD;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,YACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,mBACb,IAAI,iBACJ,KAAK,UACL;IAAE,MAAM,KAAK;IAAY,aAAa,KAAK;GAAY,CACxD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,YAAY,KAAK;KACjB,aAAa,KAAK;IACnB;GACD;EAED,KAAK,mBAAmB;GACvB,MAAM,SAAS,MAAM,IAAI,eAAe,KAAK,EAAE;GAG/C,MAAM,aAAa,MAAM,IAAI,IAAI,qBAChC,IAAI,iBACJ,KAAK,UACL,KAAK,GAAG,MACR;IACC;IACA,SAAS,KAAK,GAAG;IACjB,aAAa,KAAK,GAAG;GACtB,CACD;GACA,IAAI,mBAAmB,IAAI,KAAK,GAAG,MAAM,WAAW,EAAE;GACtD,OAAO;IACN,MAAM;IACN,QAAQ,KAAK,iBAAiB,WAAW;IACzC,YAAY,YAAY,KAAK,GAAG;IAChC,SAAS;KACR,MAAM,KAAK,GAAG;KACd,QAAQ,KAAK,GAAG;KAChB,SAAS,KAAK,GAAG;KACjB,cAAc,WAAW;IAC1B;GACD;EACD;EACA,KAAK;GACJ,MAAM,IAAI,IAAI,oBACb,IAAI,iBACJ,KAAK,UACL,mBAAmB,KAAK,cAAc,KAAK,OAAO,CACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;IACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;GAC9D;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,oBACb,IAAI,iBACJ,KAAK,UACL,KAAK,WACL,mBAAmB,KAAK,cAAc,KAAK,OAAO,CACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;IACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;GAC9D;EAED,KAAK,0BAA0B;GAC9B,MAAM,UAAU,uBAAuB,IAAI,GAAG;GAC9C,IAAI;GACJ,IAAI;IACH,WAAW,MAAM,QAAQ,2BACxB,IAAI,iBACJ,KAAK,UACL;KAAE,QAAQ,KAAK;KAAQ,cAAc,KAAK;IAAa,CACxD;GACD,SAAS,KAAK;IACb,MAAM,4BAA4B,KAAK,KAAK,MAAM;GACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,QAAQ,SAAS;KACjB,MAAM,KAAK;KACX,aAAa,SAAS;IACvB;GACD;EACD;EACA,KAAK,0BAA0B;GAC9B,MAAM,UAAU,uBAAuB,IAAI,GAAG;GAC9C,MAAM,eAAe,IAAI,mBAAmB,IAAI,KAAK,YAAY;GACjE,IAAI,iBAAiB,KAAA,GACpB,MAAM,IAAI,cACT,UAAU,aACV,wCAAwC,KAAK,UAAU,KAAK,YAAY,EAAE,2CAC3E;GAED,MAAM,mCAAmC;IACxC,KAAK,IAAI;IACT,WAAW,IAAI;IACf,UAAU,KAAK;IACf,MAAM,KAAK;IACX;GACD,CAAC;GACD,MAAM,YACL,MAAM,QAAQ,wBACb,IAAI,iBACJ,KAAK,QACN,EAAA,CACC,MAAM,SAAS,KAAK,WAAW,KAAK,MAAM;GAC5C,IACC,aAAa,KAAA,KACb,SAAS,eAAe,cACxB,SAAS,aAAa,KAAK,cAC1B;IACD,MAAM,OACL,aAAa,KAAA,IACV,oBACA,GAAG,SAAS,WAAW,GAAG,KAAK,UAAU,SAAS,QAAQ;IAC9D,MAAM,IAAI,cACT,UAAU,UACV,mBAAmB,KAAK,UAAU,KAAK,MAAM,EAAE,+BAA+B,KAAK,UAAU,KAAK,YAAY,EAAE,aAAa,KAAK,4BACnI;GACD;GACA,MAAM,QAAQ,yBACb,IAAI,iBACJ,KAAK,UACL,KAAK,MACN;GACA,IAAI;GACJ,IAAI;IACH,WAAW,MAAM,QAAQ,2BACxB,IAAI,iBACJ,KAAK,UACL;KAAE,QAAQ,KAAK;KAAQ,cAAc,KAAK;IAAa,CACxD;GACD,SAAS,KAAK;IACb,MAAM,YAAY,4BAA4B,KAAK,KAAK,MAAM;IAC9D,MAAM,UACL,qBAAqB,gBAClB,UAAU,UACV,qBAAqB,QACpB,UAAU,UACV,OAAO,SAAS;IACrB,MAAM,IAAI,cACT,qBAAqB,gBAClB,UAAU,OACV,UAAU,aACb,wCAAwC,KAAK,UAAU,KAAK,MAAM,EAAE,aAAa,KAAK,UAAU,KAAK,YAAY,EAAE,iCAAiC,KAAK,UAAU,KAAK,YAAY,EAAE,qFAAqF,WAC3Q;KACC,OAAO,qBAAqB,QAAQ,YAAY;KAChD,SACC,qBAAqB,gBAClB,EAAE,GAAG,UAAU,QAAQ,IACvB,CAAC;IACN,CACD;GACD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,QAAQ,SAAS;KACjB,MAAM,KAAK;KACX,cAAc,KAAK;KACnB,aAAa,SAAS;IACvB;GACD;EACD;CACD;AACD;;;;;;;;;;;;AAaA,eAAe,6BAA6B,MAQ1B;CACjB,MAAM,EAAE,KAAK,WAAW,UAAU,MAAM,SAAS,SAAS,WAAW;CACrE,MAAM,gBAAgB,KAAK,SAAS,SACnC,KAAK,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CACrD;CACA,IAAI,cAAc,WAAW,GAAG;CAEhC,MAAM,YAAY,IAAI,KACpB,SAAS,aAAa,CAAC,EAAA,CAAG,KACzB,OAAO,CAAC,GAAG,MAAM,GAAG,aAAa,CACnC,CACD;CAKA,IADsB,cAAc,MAAM,SAAS,CAAC,UAAU,IAAI,IAAI,CACtD,KAAK,CAAC,QACrB,IAAI;EACH,KAAK,MAAM,MAAM,MAAM,IAAI,oBAC1B,WACA,QACD,GACC,UAAU,IAAI,GAAG,MAAM,GAAG,aAAa;CAEzC,QAAQ,CAER;CAGD,KAAK,MAAM,UAAU,SAAS;EAC7B,MAAM,OAAO,2BAA2B,OAAO,UAAU;EACzD,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,gBAAgB,UAAU,IAAI,IAAI;EACxC,IAAI,kBAAkB,KAAA,GAAW;EACjC,OAAO,UAAU;GAAE,GAAG,OAAO;GAAS;EAAc;CACrD;AACD;;AAGA,SAAS,2BAA2B,YAAwC;CAE3E,OAAO,WAAW,WAAW,WAAM,IAChC,WAAW,MAAM,CAAa,IAC9B,KAAA;AACJ;AAEA,eAAe,mCAAmC,MAMhC;CACjB,MAAM,MAAM,KAAK,IAAI;CACrB,IAAI,CAAC,KACJ,MAAM,IAAI,cACT,UAAU,oBACV,wCAAwC,KAAK,UAAU,KAAK,IAAI,EAAE,sHACnE;CAED,MAAM,aACL,OAAO,QAAQ,IAAI,+BAA+B,KAAK;CACxD,MAAM,YACL,OAAO,QAAQ,IAAI,8BAA8B,KAAK;CACvD,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,SAAS;EAOR,MAAM,OAAM,MANK,IAAI,KACpB,KAAK,KACL,KAAK,WACL,KAAK,UACL,KAAK,IACN,EAAA,CACe;EAEf,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,KAAK,cACtC,MAAM,IAAI,cACT,UAAU,aACV,wCAAwC,KAAK,UAAU,KAAK,IAAI,EAAE,0BAA0B,IAAI,GAAG,yBAAyB,KAAK,aAAa,yDAC/I;EAED,IAAI,QAAQ,KAAA,KAAa,IAAI,OAAO,KAAK,cAAc;GACtD,IAAI,IAAI,WAAW,aAAa;GAChC,IAAI,IAAI,WAAW,UAClB,MAAM,IAAI,cACT,UAAU,aACV,0BAA0B,KAAK,UAAU,KAAK,IAAI,EAAE,gEACrD;EAEF;EACA,IAAI,KAAK,IAAI,KAAK,UACjB,MAAM,IAAI,cACT,UAAU,aACV,kCAAkC,KAAK,UAAU,KAAK,IAAI,EAAE,6EAC7D;EAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,UAAU,CAAC;CAC/D;AACD;AAEA,SAAS,uBAAuB,KAM9B;CACD,MAAM,OAAO,IAAI;CACjB,MAAM,WAAW,IAAI;CACrB,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAC1B,MAAM,IAAI,cACT,UAAU,oBACV,4LACD;CAED,OAAO;EACN,yBAAyB,KAAK,KAAK,GAAG;EACtC,4BAA4B,SAAS,KAAK,GAAG;EAC7C,0BAA0B,OAAO,KAAK,GAAG;CAC1C;AACD;AAEA,SAAS,4BAA4B,KAAc,QAAyB;CAC3E,IAAI,EAAE,eAAe,kBAAkB,IAAI,SAAS,UAAU,UAC7D,OAAO;CAER,MAAM,cACL,OAAO,IAAI,QAAQ,gBAAgB,WAChC,IAAI,QAAQ,cACZ,KAAA;CACJ,MAAM,YACL,OAAO,IAAI,QAAQ,cAAc,WAC9B,IAAI,QAAQ,YACZ,KAAA;CACJ,MAAM,SACL,OAAO,IAAI,QAAQ,WAAW,WAAW,IAAI,QAAQ,SAAS,KAAA;CAC/D,MAAM,WAAW;EAChB,WAAW,KAAA,IAAY,QAAQ,WAAW,KAAA;EAC1C,cAAc,mBAAmB,YAAY,KAAK,KAAA;EAClD,YAAY,cAAc,cAAc,KAAA;CACzC,CAAC,CAAC,QAAQ,SAAyB,SAAS,KAAA,CAAS;CACrD,OAAO,IAAI,cACV,UAAU,UACV;EACC,YAAY,KAAK,UAAU,MAAM,EAAE;EACnC,SAAS,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,KAAK,KAAA;EACnD;CACD,CAAC,CACC,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CACpD,KAAK,GAAG,GACV;EAAE,OAAO;EAAK,SAAS,EAAE,GAAG,IAAI,QAAQ;CAAE,CAC3C;AACD;AAEA,SAAS,4BAA4B,MAM5B;CACR,MAAM,WAAoD,CAAC;CAC3D,KAAK,MAAM,MAAM,KAAK,WACrB,KAAK,MAAM,UAAU,GAAG,iBAAiB,CAAC,GACzC,SAAS,KAAK;EAAE;EAAQ,MAAM,GAAG;CAAK,CAAC;CAGzC,IAAI,SAAS,WAAW,GAAG;CAE3B,MAAM,iBAAiB,IAAI,IAC1B,KAAK,OAAO,UAAU,SAAS,aAAa;EAC3C,IAAI,SAAS,UAAU,gBAAgB,OAAO,CAAC;EAC/C,MAAM,QAAQ,2BAA2B,KAAK,SAAS,MAAM;EAC7D,OAAO,QAAQ,OAAO,KAAA,IAAY,CAAC,MAAM,EAAE,IAAI,CAAC;CACjD,CAAC,CACF;CAEA,MAAM,gCAAgB,IAAI,IAAoB;CAC9C,KAAK,MAAM,UAAU,KAAK,SAAS,iBAAiB,CAAC,GAAG;EACvD,IAAI,eAAe,IAAI,OAAO,MAAM,GAAG;EACvC,cAAc,IAAI,OAAO,QAAQ,OAAO,WAAW;CACpD;CACA,KAAK,MAAM,UAAU,KAAK,SAAS;EAClC,MAAM,SACL,OAAO,OAAO,SAAS,WAAW,WAC/B,OAAO,QAAQ,SACf,KAAA;EACJ,MAAM,cAAc,OAAO,SAAS;EACpC,IAAI,WAAW,KAAA,KAAa,OAAO,gBAAgB,UAClD,cAAc,IAAI,QAAQ,WAAW;CAEvC;CAEA,KAAK,OAAO,gBAAgB,SAAS,KAAK,EAAE,QAAQ,WAAW;EAC9D,MAAM,QAAgE;GACrE;GACA;EACD;EACA,MAAM,cAAc,cAAc,IAAI,MAAM;EAC5C,IAAI,gBAAgB,KAAA,GAAW,MAAM,cAAc;EACnD,IAAI,gBAAgB,IACnB,KAAK,SAAS,KACb,uBAAuB,OAAO,gDAC/B;EAED,OAAO;CACR,CAAC;AACF;AAEA,SAAS,qBACR,cACA,SAC0B;CAC1B,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN;EACA,MAAM,QAAQ;EACd,MAAM,QAAQ;EACd,SAAS,QAAQ;CAClB;CAED,OAAO;EACN;EACA,MAAM,QAAQ;EACd,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,SAAS,QAAQ;CAClB;AACD;AAEA,SAAS,mBACR,cACA,SACqB;CACrB,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;CAED,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;AACD;AAEA,SAAS,mBACR,cACA,SACqB;CACrB,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;CAED,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;AACD"}
+{"version":3,"file":"push-config.js","names":[],"sources":["../../src/lib/push-config.ts"],"sourcesContent":["import {\n\ttype AppliedChange,\n\ttype Config,\n\ttype ConflictReport,\n\ttype CreateTriggerInput,\n\tcreateNeonApiFromOptions,\n\tdiffConfig,\n\tErrorCode,\n\ttype NeonApi,\n\ttype NeonBranchSnapshot,\n\ttype NeonCustomDomainSnapshot,\n\ttype PlanStep,\n\tPlatformError,\n\tPushAbortedError,\n\tPushConflictError,\n\ttype PushResult,\n\ttype RemotePreviewState,\n\ttype RemoteServiceState,\n\ttype RemoteState,\n\ttype ResolvedFunctionConfig,\n\ttype ResolvedFunctionTrigger,\n\ttype ResolvedPreviewConfig,\n\tresolveConfig,\n\ttype UpdateTriggerInput,\n} from \"@neon/config\";\nimport type { FunctionBundler } from \"./function-bundle.js\";\n\n// Eager loading would evaluate esbuild for callers that provide their own bundler.\nconst makeDefaultBundleFunction =\n\t(onWarning: (message: string) => void): FunctionBundler =>\n\tasync (fn: ResolvedFunctionConfig): Promise<Uint8Array> => {\n\t\tconst { buildFunctionBundle } = await import(\"./function-bundle.js\");\n\t\treturn buildFunctionBundle(fn, { onWarning });\n\t};\n\nexport interface PushConfigOptions {\n\t/**\n\t * Neon project id. **Required** — the management API addresses every branch through\n\t * its project, so there is no way to push without it. `pushConfig` never creates a\n\t * project; resolve the id yourself (e.g. via neonctl) and pass it in.\n\t */\n\tprojectId: string;\n\t/**\n\t * Neon branch id (`br-…`). **Required.** `pushConfig` never creates a branch — it must\n\t * already exist on the project. Resolve names to ids before calling.\n\t */\n\tbranchId: string;\n\t/** Neon API key. Falls back to `NEON_API_KEY` / neonctl credentials. Ignored when `api` is supplied. */\n\tapiKey?: string;\n\t/** Neon API base URL. Falls back to `NEON_API_HOST`, then production. */\n\tapiHost?: string;\n\t/**\n\t * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n\t * on the default real adapter built from `apiKey`.\n\t */\n\tapi?: NeonApi;\n\t/**\n\t * Whether to evaluate the policy as if the target branch **already exists** (the value of\n\t * `branch.exists` passed to the `defineConfig({ branch: (branch) => … })` closure). Defaults to `true`.\n\t *\n\t * Set to `false` to evaluate the policy as a **branch creation** — used by\n\t * {@link createBranch} right after it provisions a new branch, so creation-time tuning\n\t * gated on `!branch.exists` (TTL, compute settings, `parent`) actually resolves instead of\n\t * hitting the \"existing branch, leave as-is\" path. Only affects policy evaluation; the\n\t * branch must still physically exist on Neon (`pushConfig` never creates one).\n\t */\n\tbranchExists?: boolean;\n\t/**\n\t * Auto-confirm overriding existing remote settings.\n\t *\n\t * When `true`, mutable drift on the selected branch (TTL, `protected` flag, compute\n\t * settings) is applied as actual mutations and the override-confirm prompt is\n\t * skipped. When `false` (default) the behaviour depends on whether `confirm` is\n\t * supplied:\n\t *   - With `confirm`: the callback is asked whether to apply the override.\n\t *   - Without `confirm`: drift is reported as a `PushConflictError` (legacy\n\t *     non-interactive default — preserved so programmatic SDK callers don't\n\t *     silently start mutating remote state).\n\t */\n\tupdateExisting?: boolean;\n\t/**\n\t * Auto-confirm pushing to a protected branch.\n\t *\n\t * When `true`, no protected-branch confirmation is asked. When `false` (default):\n\t *   - With `confirm`: the callback is asked.\n\t *   - Without `confirm`: the push proceeds (legacy SDK default).\n\t */\n\tallowProtectedBranch?: boolean;\n\t/**\n\t * Optional confirmation callback. Invoked once with a single context object before\n\t * any mutations run when the push needs confirmation: pushing to a protected\n\t * branch (unless `allowProtectedBranch` is `true`) and/or applying mutable drift\n\t * (unless `updateExisting` is `true`).\n\t *\n\t * Both prompts collapse into a single callback invocation when both apply, so the\n\t * CLI can render one combined \"are you sure?\" prompt.\n\t *\n\t * Resolves to `true` to proceed, `false` to abort with {@link PushAbortedError}.\n\t *\n\t * Never invoked on `dryRun`.\n\t */\n\tconfirm?: (context: PushConfirmContext) => boolean | Promise<boolean>;\n\t/**\n\t * Runs once after {@link confirm} approves (or was not needed) and before the first\n\t * mutation or function bundle. A throw aborts the push with nothing changed by it.\n\t * Never invoked on `dryRun`.\n\t */\n\tbeforeMutations?: () => void | Promise<void>;\n\t/** Inject to deploy without this package loading esbuild. */\n\tbundleFunction?: FunctionBundler;\n\t/**\n\t * When `true`, compute the full plan against the live remote state but **do not\n\t * execute any mutations**. The resulting `PushResult.applied` array records every\n\t * change that *would* run on a real push (with the same action / identifier / details\n\t * shape, so the existing CLI summary formatter just works), and conflicts are\n\t * reported instead of thrown.\n\t *\n\t * Used by `plan(config, branchId)` and any caller that wants a \"would this push do\n\t * something dangerous?\" check before invoking `pushConfig` for real.\n\t */\n\tdryRun?: boolean;\n}\n\n/**\n * Context handed to a {@link PushConfigOptions.confirm} callback. Both flags can be\n * `true` simultaneously when the push targets a protected branch *and* would override\n * existing settings — render a single combined prompt covering both reasons.\n */\nexport interface PushConfirmContext {\n\t/** Name of the target branch on Neon. */\n\tbranchName: string;\n\t/**\n\t * `true` when the target branch has the `protected` flag on Neon and the caller\n\t * did not pass `allowProtectedBranch: true`.\n\t */\n\tprotectedBranch: boolean;\n\t/**\n\t * `true` when the plan would override existing remote settings (TTL, `protected`\n\t * flag, compute settings on an existing endpoint) and the caller did not pass\n\t * `updateExisting: true`. Additive operations (enabling Neon Auth / Data API for\n\t * the first time) are **not** counted here — those are unambiguous and never\n\t * prompt.\n\t */\n\toverrideUpdates: boolean;\n\t/**\n\t * The settings that would be overridden, as current → desired, so the caller can show\n\t * what it is asking about. Empty when only {@link protectedBranch} applies.\n\t */\n\toverrides: readonly ConflictReport[];\n}\n\n/**\n * Push a Neon branch policy to a specific project + branch.\n *\n * Filesystem- and env-agnostic: the caller supplies an already-validated `Config` object\n * (from `defineConfig` / `loadConfigFromFile`) and explicit `projectId` + `branch` in\n * `options`. `pushConfig` performs no `.neon` lookups and reads no `NEON_*` env vars except the API credential/host resolution documented on `apiKey`/`apiHost`.\n *\n * It will **not** create a project or branch — both must already exist on Neon.\n */\nexport async function pushConfig(\n\tconfig: Config,\n\toptions: PushConfigOptions,\n): Promise<PushResult> {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\n\t// Collected from the built-in bundler and returned on the result. A caller that injects\n\t// its own `bundleFunction` reports for itself, so this stays empty for them.\n\tconst warnings: string[] = [];\n\n\tconst dryRun = options.dryRun === true;\n\tconst updateExisting = options.updateExisting === true;\n\tconst allowProtectedBranch = options.allowProtectedBranch === true;\n\n\t// Same scheduling as `pullConfig`: independent reads start together and are awaited in\n\t// the order they used to run, so the first error reported is unchanged.\n\tconst projectRead = started(() => api.getProject(projectId));\n\tconst listsRead = started(() =>\n\t\tPromise.all([\n\t\t\thandled(api.listBranches(projectId)),\n\t\t\thandled(api.listEndpoints(projectId)),\n\t\t]),\n\t);\n\tconst remoteProject = await projectRead;\n\tconst [branches, endpoints] = await listsRead;\n\tconst branch = resolveRemoteBranch(options.branchId, branches);\n\tconst resolved = resolveConfig(config, {\n\t\tname: branch.name,\n\t\tid: branch.id,\n\t\texists: options.branchExists !== false,\n\t\t...(branch.parentId ? { parentId: branch.parentId } : {}),\n\t\tisDefault: branch.isDefault,\n\t\tisProtected: branch.protected,\n\t\t...(branch.expiresAt ? { expiresAt: branch.expiresAt } : {}),\n\t});\n\tconst servicesRead = started(() =>\n\t\tresolveServiceState({\n\t\t\tapi,\n\t\t\tprojectId: remoteProject.id,\n\t\t\tbranch,\n\t\t\twantsAuth: resolved.authEnabled,\n\t\t\twantsDataApi:\n\t\t\t\tresolved.dataApiEnabled ||\n\t\t\t\tresolved.dataApiPolicy === \"disabled\",\n\t\t}),\n\t);\n\t// Only fetch Preview state when the policy actually uses it — and within that, only the\n\t// specific features the policy declares. So a policy that uses functions never probes\n\t// the AI Gateway, and `apply`/`plan` only fail on a Preview feature being unavailable\n\t// (404/503) when the policy actually asks for it.\n\tconst desiredPreview = resolved.preview;\n\tconst previewRead = desiredPreview\n\t\t? started(() =>\n\t\t\t\tresolvePreviewState({\n\t\t\t\t\tapi,\n\t\t\t\t\tprojectId: remoteProject.id,\n\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\tdesired: desiredPreview,\n\t\t\t\t\twantsTriggers: (resolved.triggers?.length ?? 0) > 0,\n\t\t\t\t}),\n\t\t\t)\n\t\t: undefined;\n\tconst services = await servicesRead;\n\tconst remote: RemoteState = {\n\t\tprojectId: remoteProject.id,\n\t\tbranch,\n\t\tendpoint: endpoints.find(\n\t\t\t(ep) => ep.type === \"read_write\" && ep.branchId === branch.id,\n\t\t),\n\t\tservices,\n\t};\n\tif (previewRead) {\n\t\tremote.preview = await previewRead;\n\t}\n\n\t// Always compute the plan with `updateExisting: true` so we can see what *would* be\n\t// overridden. The decision of whether to apply / prompt / fail is gated below using\n\t// the recorded steps.\n\tconst diff = diffConfig(resolved, remote, { updateExisting: true });\n\tconst overrideSteps = diff.plan.filter(isOverrideStep);\n\tconst needsOverrideConfirm = overrideSteps.length > 0 && !updateExisting;\n\tconst needsProtectedConfirm = branch.protected && !allowProtectedBranch;\n\n\tif (!dryRun && diff.conflicts.length > 0) {\n\t\tthrow new PushConflictError(diff.conflicts);\n\t}\n\n\tif (!dryRun && (needsOverrideConfirm || needsProtectedConfirm)) {\n\t\tif (options.confirm) {\n\t\t\tconst ok = await options.confirm({\n\t\t\t\tbranchName: branch.name,\n\t\t\t\tprotectedBranch: needsProtectedConfirm,\n\t\t\t\toverrideUpdates: needsOverrideConfirm,\n\t\t\t\t// The non-overriding diff reports exactly the drift as conflicts; the\n\t\t\t\t// override-able plan above has already ruled out every other conflict.\n\t\t\t\toverrides: needsOverrideConfirm\n\t\t\t\t\t? diffConfig(resolved, remote, { updateExisting: false })\n\t\t\t\t\t\t\t.conflicts\n\t\t\t\t\t: [],\n\t\t\t});\n\t\t\tif (!ok) {\n\t\t\t\tconst reasons: (\"protected-branch\" | \"override-updates\")[] = [];\n\t\t\t\tif (needsProtectedConfirm) reasons.push(\"protected-branch\");\n\t\t\t\tif (needsOverrideConfirm) reasons.push(\"override-updates\");\n\t\t\t\tthrow new PushAbortedError(branch.name, reasons);\n\t\t\t}\n\t\t} else if (needsOverrideConfirm) {\n\t\t\t// Legacy non-interactive fallback: surface the would-be drift as a\n\t\t\t// `PushConflictError` so programmatic callers that skipped both\n\t\t\t// `updateExisting` and `confirm` see the previous fail-fast behavior.\n\t\t\tconst legacy = diffConfig(resolved, remote, {\n\t\t\t\tupdateExisting: false,\n\t\t\t});\n\t\t\tthrow new PushConflictError(legacy.conflicts);\n\t\t}\n\t\t// Protected branch + no confirm callback: legacy default proceeds without\n\t\t// any extra check (no programmatic regression).\n\t}\n\n\tif (!dryRun) await options.beforeMutations?.();\n\n\tconst applied: AppliedChange[] = [\n\t\t{ kind: \"branch\", action: \"noop\", identifier: branch.name },\n\t];\n\n\tconst branchById = new Map(branches.map((b) => [b.id, b] as const));\n\tconst branchByName = new Map(branches.map((b) => [b.name, b] as const));\n\tconst ctx: ApplyContext = {\n\t\tapi,\n\t\tremoteProjectId: remoteProject.id,\n\t\tbranchById,\n\t\tbranchByName,\n\t\tbundleFunction:\n\t\t\toptions.bundleFunction ??\n\t\t\tmakeDefaultBundleFunction((message) => {\n\t\t\t\twarnings.push(message);\n\t\t\t}),\n\t\tdeploymentIdBySlug: new Map(),\n\t};\n\n\tfor (const step of diff.plan) {\n\t\tconst change = dryRun\n\t\t\t? synthesizeAppliedChange(step)\n\t\t\t: await applyStep(step, ctx);\n\t\tapplied.push(change);\n\t}\n\n\t// Surface each deployed function's invocation URL on its applied change so callers\n\t// (e.g. neonctl) can show users where to call it right after a push.\n\tawait enrichFunctionInvocationUrls({\n\t\tapi,\n\t\tprojectId: remoteProject.id,\n\t\tbranchId: branch.id,\n\t\tplan: diff.plan,\n\t\tapplied,\n\t\tpreview: remote.preview,\n\t\tdryRun,\n\t});\n\n\tconst result: PushResult = {\n\t\tprojectId: remoteProject.id,\n\t\tbranchId: branch.id,\n\t\tbranchName: branch.name,\n\t\tdryRun,\n\t\tapplied,\n\t\tconflicts: diff.conflicts,\n\t\twarnings,\n\t};\n\tif (remoteProject.orgId) result.orgId = remoteProject.orgId;\n\tenrichDeclaredCustomDomains({\n\t\tresult,\n\t\tpreview: remote.preview,\n\t\tfunctions: resolved.preview?.functions ?? [],\n\t\tapplied,\n\t\twarnings,\n\t});\n\treturn result;\n}\n\nfunction isOverrideStep(step: PlanStep): boolean {\n\treturn (\n\t\tstep.kind === \"update-branch-ttl\" ||\n\t\tstep.kind === \"update-branch-protected\" ||\n\t\tstep.kind === \"update-endpoint\" ||\n\t\tstep.kind === \"update-data-api\" ||\n\t\tstep.kind === \"disable-data-api\" ||\n\t\tstep.kind === \"retarget-custom-domain\"\n\t);\n}\n\n/**\n * Build an {@link AppliedChange} from a {@link PlanStep} without calling the Neon API.\n * Used by dry-run mode so callers see the same record shape they would on a live push,\n * just with no side effects. Identifiers are the branch names from the plan; any\n * sub-resource ids (`branchId`, `endpointId`) flow through unchanged when known.\n */\nfunction synthesizeAppliedChange(step: PlanStep): AppliedChange {\n\tswitch (step.kind) {\n\t\tcase \"update-branch-ttl\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: { field: \"ttl\", expiresAt: step.expiresAt },\n\t\t\t};\n\t\tcase \"update-branch-protected\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: { field: \"protected\", protected: step.protected },\n\t\t\t};\n\t\tcase \"update-endpoint\":\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: {\n\t\t\t\t\tfield: \"computeSettings\",\n\t\t\t\t\tendpointId: step.endpointId,\n\t\t\t\t\tsettings: step.settings,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"enable-auth\":\n\t\t\t// Pure branch on/off toggle: the target branch is redundant (same on\n\t\t\t// every row) and the database is auto-derived, not policy-chosen — so\n\t\t\t// there is nothing meaningful to surface in the change summary.\n\t\t\treturn { kind: \"service\", action: \"create\", identifier: \"auth\" };\n\t\tcase \"enable-data-api\":\n\t\t\treturn { kind: \"service\", action: \"create\", identifier: \"dataApi\" };\n\t\tcase \"update-data-api\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t\tdetails: { field: \"settings\", settings: step.settings },\n\t\t\t};\n\t\tcase \"disable-data-api\":\n\t\t\treturn { kind: \"service\", action: \"delete\", identifier: \"dataApi\" };\n\t\tcase \"create-bucket\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `bucket:${step.bucketName}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tbucketName: step.bucketName,\n\t\t\t\t\taccessLevel: step.accessLevel,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"deploy-function\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\t// The first deployment creates the function; a later one updates it.\n\t\t\t\taction: step.functionExists ? \"update\" : \"create\",\n\t\t\t\tidentifier: `function:${step.fn.slug}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tslug: step.fn.slug,\n\t\t\t\t\tsource: step.fn.source,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"create-trigger\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\tcase \"update-trigger\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\tcase \"register-custom-domain\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: step.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t},\n\t\t\t};\n\t\tcase \"retarget-custom-domain\":\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: step.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tpreviousSlug: step.previousSlug,\n\t\t\t\t},\n\t\t\t};\n\t}\n}\n\nfunction createApiFromOptions(options: PushConfigOptions): NeonApi {\n\treturn createNeonApiFromOptions(\"pushConfig\", {\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\nfunction resolveRemoteBranch(\n\tbranchId: string,\n\tbranches: NeonBranchSnapshot[],\n): NeonBranchSnapshot {\n\tconst found = branches.find((b) => b.id === branchId);\n\tif (found) return found;\n\tthrow new PlatformError(\n\t\tErrorCode.BranchNotFound,\n\t\t[\n\t\t\t`pushConfig: branch id ${JSON.stringify(branchId)} does not exist on the project.`,\n\t\t\t`Available branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \") || \"(none)\"}.`,\n\t\t\t\"Pass an existing branch id, or create the branch first with the neonctl CLI.\",\n\t\t].join(\" \"),\n\t\t{ details: { branchId, available: branches.map((b) => b.id) } },\n\t);\n}\n\n/**\n * Starts a read now and keeps an unread rejection from crashing the process; the caller\n * awaits it (and sees the error) when its turn comes. The read is called synchronously and\n * its own promise returned, so errors surface in the same order as a direct call; a\n * synchronous throw becomes the returned rejection.\n */\nfunction started<T>(read: () => Promise<T>): Promise<T> {\n\tlet promise: Promise<T>;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => undefined);\n\treturn promise;\n}\n\n/**\n * Marks a `Promise.all` member's rejection as handled, so a later member's synchronous\n * throw cannot leave it unobserved. `Promise.all` still reports it.\n */\nfunction handled<T>(promise: Promise<T>): Promise<T> {\n\tpromise.catch(() => undefined);\n\treturn promise;\n}\n\n/**\n * Pre-fetch the current state of branch-scoped integrations on the selected branch.\n */\nasync function resolveServiceState(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranch: NeonBranchSnapshot;\n\twantsAuth: boolean;\n\twantsDataApi: boolean;\n}): Promise<RemoteServiceState> {\n\tconst { api, projectId, branch, wantsAuth, wantsDataApi } = args;\n\tif (!wantsAuth && !wantsDataApi) {\n\t\treturn {\n\t\t\tdatabaseName: \"neondb\",\n\t\t\tauthEnabled: false,\n\t\t\tdataApiEnabled: false,\n\t\t};\n\t}\n\n\tconst databaseName = await pickServiceDatabaseName(\n\t\tapi,\n\t\tprojectId,\n\t\tbranch.id,\n\t);\n\n\tconst [auth, dataApi] = await Promise.all([\n\t\twantsAuth\n\t\t\t? handled(api.getNeonAuth(projectId, branch.id))\n\t\t\t: Promise.resolve(null),\n\t\twantsDataApi\n\t\t\t? handled(api.getNeonDataApi(projectId, branch.id, databaseName))\n\t\t\t: Promise.resolve(null),\n\t]);\n\tconst result: RemoteServiceState = {\n\t\tdatabaseName,\n\t\tauthEnabled: auth !== null,\n\t\tdataApiEnabled: dataApi !== null,\n\t};\n\t// Carry the current Data API settings (when reported) so the diff can detect settings\n\t// drift and plan an update. `null` distinguishes \"enabled but not reported\" from \"absent\".\n\tif (dataApi) result.dataApiSettings = dataApi.settings ?? null;\n\treturn result;\n}\n\n/**\n * Pre-fetch the current state of branch-scoped Preview features (buckets, functions) so the\n * diff can be computed additively. Only called when the policy has a `preview` block.\n *\n * The AI Gateway is not probed: it is always available (credential-gated, not per-branch\n * provisioned), so `preview.aiGateway` produces no plan step — it only drives the branch\n * credential's `ai_gateway:invoke` scope and the gateway env vars (`@neon/env`).\n */\nasync function resolvePreviewState(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tdesired: ResolvedPreviewConfig;\n\twantsTriggers: boolean;\n}): Promise<RemotePreviewState> {\n\tconst { api, projectId, branchId, desired, wantsTriggers } = args;\n\t// Read only the Preview features the policy declares: undeclared features can never\n\t// produce a plan step (see diffConfig), so probing them is pure waste — and would make\n\t// `plan`/`apply` fail on a feature the user didn't ask for if it's unavailable in the\n\t// project/region. A declared-but-unavailable feature still throws (failing the push),\n\t// which is the intended signal to enable it first.\n\tconst wantsCustomDomains = desired.functions.some(\n\t\t(fn) => (fn.customDomains?.length ?? 0) > 0,\n\t);\n\tconst customDomainApi = wantsCustomDomains\n\t\t? requireCustomDomainApi(api)\n\t\t: undefined;\n\tconst [buckets, functions, triggers, customDomains] = await Promise.all([\n\t\tdesired.buckets.length > 0\n\t\t\t? handled(api.listBranchBuckets(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\tdesired.functions.length > 0\n\t\t\t? handled(api.listBranchFunctions(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\twantsTriggers\n\t\t\t? handled(api.listBranchTriggers(projectId, branchId))\n\t\t\t: Promise.resolve([]),\n\t\tcustomDomainApi\n\t\t\t? handled(\n\t\t\t\t\tcustomDomainApi.listBranchCustomDomains(\n\t\t\t\t\t\tprojectId,\n\t\t\t\t\t\tbranchId,\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t: Promise.resolve([]),\n\t]);\n\tconst preview: RemotePreviewState = { buckets, functions, triggers };\n\tif (wantsCustomDomains) preview.customDomains = customDomains;\n\treturn preview;\n}\n\n/**\n * Resolve the database name for a Data API integration. Auto-pick when the branch has\n * exactly one database; otherwise fall back to Neon's default (`neondb`) so the call\n * stays useful even on branches with multiple databases — push doesn't have a way to\n * surface a \"pick one\" prompt the way `fetchEnv` does.\n */\nasync function pickServiceDatabaseName(\n\tapi: NeonApi,\n\tprojectId: string,\n\tbranchId: string,\n): Promise<string> {\n\tconst databases = await api.listBranchDatabases(projectId, branchId);\n\tif (databases.length === 1) return databases[0].name;\n\tconst neondb = databases.find((d) => d.name === \"neondb\");\n\tif (neondb) return neondb.name;\n\treturn databases[0]?.name ?? \"neondb\";\n}\n\ninterface ApplyContext {\n\tapi: NeonApi;\n\tremoteProjectId: string;\n\tbranchById: Map<string, NeonBranchSnapshot>;\n\tbranchByName: Map<string, NeonBranchSnapshot>;\n\tbundleFunction: FunctionBundler;\n\tdeploymentIdBySlug: Map<string, number>;\n}\n\nasync function applyStep(\n\tstep: PlanStep,\n\tctx: ApplyContext,\n): Promise<AppliedChange> {\n\tswitch (step.kind) {\n\t\tcase \"update-branch-ttl\": {\n\t\t\tconst updated = await ctx.api.updateBranch(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{\n\t\t\t\t\texpiresAt: step.expiresAt ?? null,\n\t\t\t\t},\n\t\t\t);\n\t\t\tctx.branchById.set(updated.id, updated);\n\t\t\tctx.branchByName.set(updated.name, updated);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: updated.name,\n\t\t\t\tdetails: { field: \"ttl\", expiresAt: step.expiresAt },\n\t\t\t};\n\t\t}\n\t\tcase \"update-branch-protected\": {\n\t\t\tconst updated = await ctx.api.updateBranch(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{ protected: step.protected },\n\t\t\t);\n\t\t\tctx.branchById.set(updated.id, updated);\n\t\t\tctx.branchByName.set(updated.name, updated);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: updated.name,\n\t\t\t\tdetails: { field: \"protected\", protected: step.protected },\n\t\t\t};\n\t\t}\n\t\tcase \"update-endpoint\": {\n\t\t\tconst updated = await ctx.api.updateEndpoint(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.endpointId,\n\t\t\t\tstep.settings,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"branch\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: step.branchName,\n\t\t\t\tdetails: {\n\t\t\t\t\tfield: \"computeSettings\",\n\t\t\t\t\tendpointId: updated.id,\n\t\t\t\t\tsettings: step.settings,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"enable-auth\": {\n\t\t\tawait ctx.api.enableNeonAuth(ctx.remoteProjectId, step.branchId, {\n\t\t\t\t...(step.databaseName\n\t\t\t\t\t? { databaseName: step.databaseName }\n\t\t\t\t\t: {}),\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: \"auth\",\n\t\t\t};\n\t\t}\n\t\tcase \"enable-data-api\": {\n\t\t\tawait ctx.api.enableProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t\tstep.input,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t};\n\t\t}\n\t\tcase \"update-data-api\": {\n\t\t\tawait ctx.api.updateProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t\tstep.settings,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t\tdetails: { field: \"settings\", settings: step.settings },\n\t\t\t};\n\t\t}\n\t\tcase \"disable-data-api\": {\n\t\t\tawait ctx.api.deleteProjectBranchDataApi(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.databaseName,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"delete\",\n\t\t\t\tidentifier: \"dataApi\",\n\t\t\t};\n\t\t}\n\t\tcase \"create-bucket\": {\n\t\t\tawait ctx.api.createBranchBucket(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\t{ name: step.bucketName, accessLevel: step.accessLevel },\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `bucket:${step.bucketName}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tbucketName: step.bucketName,\n\t\t\t\t\taccessLevel: step.accessLevel,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"deploy-function\": {\n\t\t\tconst bundle = await ctx.bundleFunction(step.fn);\n\t\t\t// Neon creates the function on its first deployment — there is no separate\n\t\t\t// create call — so a single deploy both creates (when absent) and ships code.\n\t\t\tconst deployment = await ctx.api.deployBranchFunction(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.fn.slug,\n\t\t\t\t{\n\t\t\t\t\tbundle,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t\tenvironment: step.fn.env,\n\t\t\t\t},\n\t\t\t);\n\t\t\tctx.deploymentIdBySlug.set(step.fn.slug, deployment.id);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: step.functionExists ? \"update\" : \"create\",\n\t\t\t\tidentifier: `function:${step.fn.slug}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tslug: step.fn.slug,\n\t\t\t\t\tsource: step.fn.source,\n\t\t\t\t\truntime: step.fn.runtime,\n\t\t\t\t\tdeploymentId: deployment.id,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"create-trigger\": {\n\t\t\tawait ctx.api.createBranchTrigger(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tcreateTriggerInput(step.functionSlug, step.trigger),\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\t}\n\t\tcase \"update-trigger\": {\n\t\t\tawait ctx.api.updateBranchTrigger(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.triggerId,\n\t\t\t\tupdateTriggerInput(step.functionSlug, step.trigger),\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `trigger:${step.functionSlug}:${step.trigger.name}`,\n\t\t\t\tdetails: triggerChangeDetails(step.functionSlug, step.trigger),\n\t\t\t};\n\t\t}\n\t\tcase \"register-custom-domain\": {\n\t\t\tconst methods = requireCustomDomainApi(ctx.api);\n\t\t\tlet snapshot: NeonCustomDomainSnapshot;\n\t\t\ttry {\n\t\t\t\tsnapshot = await methods.registerBranchCustomDomain(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t\t{ domain: step.domain, functionSlug: step.functionSlug },\n\t\t\t\t);\n\t\t\t} catch (err) {\n\t\t\t\tthrow rewriteCustomDomainConflict(err, step.domain);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"create\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: snapshot.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tcnameTarget: snapshot.cnameTarget,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t\tcase \"retarget-custom-domain\": {\n\t\t\tconst methods = requireCustomDomainApi(ctx.api);\n\t\t\tconst deploymentId = ctx.deploymentIdBySlug.get(step.functionSlug);\n\t\t\tif (deploymentId === undefined) {\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.ServerError,\n\t\t\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(step.functionSlug)}: this apply did not deploy that function.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait waitForCompletedFunctionDeployment({\n\t\t\t\tapi: ctx.api,\n\t\t\t\tprojectId: ctx.remoteProjectId,\n\t\t\t\tbranchId: step.branchId,\n\t\t\t\tslug: step.functionSlug,\n\t\t\t\tdeploymentId,\n\t\t\t});\n\t\t\tconst observed = (\n\t\t\t\tawait methods.listBranchCustomDomains(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t)\n\t\t\t).find((item) => item.domain === step.domain);\n\t\t\tif (\n\t\t\t\tobserved === undefined ||\n\t\t\t\tobserved.entityType !== \"function\" ||\n\t\t\t\tobserved.entityId !== step.previousSlug\n\t\t\t) {\n\t\t\t\tconst seen =\n\t\t\t\t\tobserved === undefined\n\t\t\t\t\t\t? \"no registration\"\n\t\t\t\t\t\t: `${observed.entityType} ${JSON.stringify(observed.entityId)}`;\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.Conflict,\n\t\t\t\t\t`Cannot retarget ${JSON.stringify(step.domain)}: planned owner was function ${JSON.stringify(step.previousSlug)}; observed ${seen}. DELETE was not attempted.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tawait methods.deleteBranchCustomDomain(\n\t\t\t\tctx.remoteProjectId,\n\t\t\t\tstep.branchId,\n\t\t\t\tstep.domain,\n\t\t\t);\n\t\t\tlet snapshot: NeonCustomDomainSnapshot;\n\t\t\ttry {\n\t\t\t\tsnapshot = await methods.registerBranchCustomDomain(\n\t\t\t\t\tctx.remoteProjectId,\n\t\t\t\t\tstep.branchId,\n\t\t\t\t\t{ domain: step.domain, functionSlug: step.functionSlug },\n\t\t\t\t);\n\t\t\t} catch (err) {\n\t\t\t\tconst rewritten = rewriteCustomDomainConflict(err, step.domain);\n\t\t\t\tconst message =\n\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t? rewritten.message\n\t\t\t\t\t\t: rewritten instanceof Error\n\t\t\t\t\t\t\t? rewritten.message\n\t\t\t\t\t\t\t: String(rewritten);\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t? rewritten.code\n\t\t\t\t\t\t: ErrorCode.ServerError,\n\t\t\t\t\t`Deleted the previous registration of ${JSON.stringify(step.domain)} (function ${JSON.stringify(step.previousSlug)}) but failed to register it on ${JSON.stringify(step.functionSlug)}. Inspect current ownership with \\`neon function domains list\\` before recovering. ${message}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tcause: rewritten instanceof Error ? rewritten : err,\n\t\t\t\t\t\tdetails:\n\t\t\t\t\t\t\trewritten instanceof PlatformError\n\t\t\t\t\t\t\t\t? { ...rewritten.details }\n\t\t\t\t\t\t\t\t: {},\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"service\",\n\t\t\t\taction: \"update\",\n\t\t\t\tidentifier: `domain:${step.domain}`,\n\t\t\t\tdetails: {\n\t\t\t\t\tdomain: snapshot.domain,\n\t\t\t\t\tslug: step.functionSlug,\n\t\t\t\t\tpreviousSlug: step.previousSlug,\n\t\t\t\t\tcnameTarget: snapshot.cnameTarget,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\t}\n}\n\n/**\n * Add each deployed function's invocation URL to its applied-change `details` so callers\n * (e.g. neonctl) can show users where to call the function right after a push.\n *\n * The URL is read from the preview snapshot already fetched for the diff, which lists every\n * existing function with its `invocationUrl`. A function created by its *first* deployment in\n * this push is not in that snapshot, so when one is present we re-list the branch's functions\n * once to learn its freshly-minted URL. Skipped on dry-run (nothing was created) and\n * best-effort otherwise: a failed re-list omits the URL rather than failing a push that has\n * already applied.\n */\nasync function enrichFunctionInvocationUrls(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tplan: PlanStep[];\n\tapplied: AppliedChange[];\n\tpreview: RemotePreviewState | undefined;\n\tdryRun: boolean;\n}): Promise<void> {\n\tconst { api, projectId, branchId, plan, applied, preview, dryRun } = args;\n\tconst deployedSlugs = plan.flatMap((step) =>\n\t\tstep.kind === \"deploy-function\" ? [step.fn.slug] : [],\n\t);\n\tif (deployedSlugs.length === 0) return;\n\n\tconst urlBySlug = new Map<string, string>(\n\t\t(preview?.functions ?? []).map(\n\t\t\t(fn) => [fn.slug, fn.invocationUrl] as const,\n\t\t),\n\t);\n\n\t// A first-time deploy creates the function, so its URL isn't in the pre-fetch; re-list\n\t// once when any deployed slug is still missing a URL.\n\tconst hasMissingUrl = deployedSlugs.some((slug) => !urlBySlug.has(slug));\n\tif (hasMissingUrl && !dryRun) {\n\t\ttry {\n\t\t\tfor (const fn of await api.listBranchFunctions(\n\t\t\t\tprojectId,\n\t\t\t\tbranchId,\n\t\t\t)) {\n\t\t\t\turlBySlug.set(fn.slug, fn.invocationUrl);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Push already succeeded; surface what we can rather than failing here.\n\t\t}\n\t}\n\n\tfor (const change of applied) {\n\t\tconst slug = functionSlugFromIdentifier(change.identifier);\n\t\tif (slug === undefined) continue;\n\t\tconst invocationUrl = urlBySlug.get(slug);\n\t\tif (invocationUrl === undefined) continue;\n\t\tchange.details = { ...change.details, invocationUrl };\n\t}\n}\n\n/** Pull the function slug out of a `function:<slug>` applied-change identifier. */\nfunction functionSlugFromIdentifier(identifier: string): string | undefined {\n\tconst prefix = \"function:\";\n\treturn identifier.startsWith(prefix)\n\t\t? identifier.slice(prefix.length)\n\t\t: undefined;\n}\n\nasync function waitForCompletedFunctionDeployment(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tslug: string;\n\tdeploymentId: number;\n}): Promise<void> {\n\tconst get = args.api.getBranchFunction;\n\tif (!get) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.FeatureUnavailable,\n\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(args.slug)}: this NeonApi adapter does not implement getBranchFunction, so apply cannot confirm the function finished deploying.`,\n\t\t);\n\t}\n\tconst intervalMs =\n\t\tNumber(process.env.NEON_FUNCTIONS_POLL_INTERVAL_MS) || 2000;\n\tconst timeoutMs =\n\t\tNumber(process.env.NEON_FUNCTIONS_POLL_TIMEOUT_MS) || 600_000;\n\tconst deadline = Date.now() + timeoutMs;\n\tfor (;;) {\n\t\tconst fn = await get.call(\n\t\t\targs.api,\n\t\t\targs.projectId,\n\t\t\targs.branchId,\n\t\t\targs.slug,\n\t\t);\n\t\tconst dep = fn.currentDeployment;\n\t\t// GET can still report the previous deployment after this apply's POST returns.\n\t\tif (dep !== undefined && dep.id > args.deploymentId) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.ServerError,\n\t\t\t\t`Cannot retarget a custom domain onto ${JSON.stringify(args.slug)}: current deployment is ${dep.id}, this apply submitted ${args.deploymentId}; left the previous custom-domain registration in place.`,\n\t\t\t);\n\t\t}\n\t\tif (dep !== undefined && dep.id === args.deploymentId) {\n\t\t\tif (dep.status === \"completed\") return;\n\t\t\tif (dep.status === \"failed\") {\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.ServerError,\n\t\t\t\t\t`Deployment of function ${JSON.stringify(args.slug)} failed; left the previous custom-domain registration in place.`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tif (Date.now() >= deadline) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.ServerError,\n\t\t\t\t`Timed out waiting for function ${JSON.stringify(args.slug)} to finish deploying; left the previous custom-domain registration in place.`,\n\t\t\t);\n\t\t}\n\t\tawait new Promise((resolve) => setTimeout(resolve, intervalMs));\n\t}\n}\n\nfunction requireCustomDomainApi(api: NeonApi): {\n\tlistBranchCustomDomains: NonNullable<NeonApi[\"listBranchCustomDomains\"]>;\n\tregisterBranchCustomDomain: NonNullable<\n\t\tNeonApi[\"registerBranchCustomDomain\"]\n\t>;\n\tdeleteBranchCustomDomain: NonNullable<NeonApi[\"deleteBranchCustomDomain\"]>;\n} {\n\tconst list = api.listBranchCustomDomains;\n\tconst register = api.registerBranchCustomDomain;\n\tconst remove = api.deleteBranchCustomDomain;\n\tif (!list || !register || !remove) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.FeatureUnavailable,\n\t\t\t\"This NeonApi adapter does not implement custom domains. Implement listBranchCustomDomains, registerBranchCustomDomain, and deleteBranchCustomDomain, or remove customDomains from neon.ts.\",\n\t\t);\n\t}\n\treturn {\n\t\tlistBranchCustomDomains: list.bind(api),\n\t\tregisterBranchCustomDomain: register.bind(api),\n\t\tdeleteBranchCustomDomain: remove.bind(api),\n\t};\n}\n\nfunction rewriteCustomDomainConflict(err: unknown, domain: string): unknown {\n\tif (!(err instanceof PlatformError) || err.code !== ErrorCode.Conflict) {\n\t\treturn err;\n\t}\n\tconst neonMessage =\n\t\ttypeof err.details.neonMessage === \"string\"\n\t\t\t? err.details.neonMessage\n\t\t\t: undefined;\n\tconst requestId =\n\t\ttypeof err.details.requestId === \"string\"\n\t\t\t? err.details.requestId\n\t\t\t: undefined;\n\tconst status =\n\t\ttypeof err.details.status === \"number\" ? err.details.status : undefined;\n\tconst apiParts = [\n\t\tstatus !== undefined ? `HTTP ${status}` : undefined,\n\t\tneonMessage ? `Neon API said: \"${neonMessage}\"` : undefined,\n\t\trequestId ? `request id ${requestId}` : undefined,\n\t].filter((part): part is string => part !== undefined);\n\treturn new PlatformError(\n\t\tErrorCode.Conflict,\n\t\t[\n\t\t\t`Hostname ${JSON.stringify(domain)} is already registered to another resource.`,\n\t\t\tapiParts.length > 0 ? `(${apiParts.join(\"; \")})` : undefined,\n\t\t\t\"Declare it only on the branch that owns it (use the branch closure), or delete it there first with `neon function domains delete`.\",\n\t\t]\n\t\t\t.filter((part): part is string => part !== undefined)\n\t\t\t.join(\" \"),\n\t\t{ cause: err, details: { ...err.details } },\n\t);\n}\n\nfunction enrichDeclaredCustomDomains(args: {\n\tresult: PushResult;\n\tpreview: RemotePreviewState | undefined;\n\tfunctions: ResolvedFunctionConfig[];\n\tapplied: AppliedChange[];\n\twarnings: string[];\n}): void {\n\tconst declared: Array<{ domain: string; slug: string }> = [];\n\tfor (const fn of args.functions) {\n\t\tfor (const domain of fn.customDomains ?? []) {\n\t\t\tdeclared.push({ domain, slug: fn.slug });\n\t\t}\n\t}\n\tif (declared.length === 0) return;\n\n\tconst blockedDomains = new Set(\n\t\targs.result.conflicts.flatMap((conflict) => {\n\t\t\tif (conflict.field !== \"customDomain\") return [];\n\t\t\tconst match = /^custom domain \"([^\"]+)\"/.exec(conflict.reason);\n\t\t\treturn match?.[1] !== undefined ? [match[1]] : [];\n\t\t}),\n\t);\n\n\tconst cnameByDomain = new Map<string, string>();\n\tfor (const remote of args.preview?.customDomains ?? []) {\n\t\tif (blockedDomains.has(remote.domain)) continue;\n\t\tcnameByDomain.set(remote.domain, remote.cnameTarget);\n\t}\n\tfor (const change of args.applied) {\n\t\tconst domain =\n\t\t\ttypeof change.details?.domain === \"string\"\n\t\t\t\t? change.details.domain\n\t\t\t\t: undefined;\n\t\tconst cnameTarget = change.details?.cnameTarget;\n\t\tif (domain !== undefined && typeof cnameTarget === \"string\") {\n\t\t\tcnameByDomain.set(domain, cnameTarget);\n\t\t}\n\t}\n\n\targs.result.customDomains = declared.map(({ domain, slug }) => {\n\t\tconst entry: { domain: string; slug: string; cnameTarget?: string } = {\n\t\t\tdomain,\n\t\t\tslug,\n\t\t};\n\t\tconst cnameTarget = cnameByDomain.get(domain);\n\t\tif (cnameTarget !== undefined) entry.cnameTarget = cnameTarget;\n\t\tif (cnameTarget === \"\") {\n\t\t\targs.warnings.push(\n\t\t\t\t`No CNAME target for ${domain}; this region has no custom-domains front door.`,\n\t\t\t);\n\t\t}\n\t\treturn entry;\n\t});\n}\n\nfunction triggerChangeDetails(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): Record<string, unknown> {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\tfunctionSlug,\n\t\t\ttype: trigger.type,\n\t\t\tcron: trigger.cron,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\tfunctionSlug,\n\t\ttype: trigger.type,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tenabled: trigger.enabled,\n\t};\n}\n\nfunction createTriggerInput(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): CreateTriggerInput {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\ttype: \"schedule\",\n\t\t\tname: trigger.name,\n\t\t\tfunctionSlug,\n\t\t\tcron: trigger.cron,\n\t\t\tfunctionPath: trigger.functionPath,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\ttype: \"storage_object_created\",\n\t\tname: trigger.name,\n\t\tfunctionSlug,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tfunctionPath: trigger.functionPath,\n\t\tenabled: trigger.enabled,\n\t};\n}\n\nfunction updateTriggerInput(\n\tfunctionSlug: string,\n\ttrigger: ResolvedFunctionTrigger,\n): UpdateTriggerInput {\n\tif (trigger.type === \"schedule\") {\n\t\treturn {\n\t\t\ttype: \"schedule\",\n\t\t\tname: trigger.name,\n\t\t\tfunctionSlug,\n\t\t\tcron: trigger.cron,\n\t\t\tfunctionPath: trigger.functionPath,\n\t\t\tenabled: trigger.enabled,\n\t\t};\n\t}\n\treturn {\n\t\ttype: \"storage_object_created\",\n\t\tname: trigger.name,\n\t\tfunctionSlug,\n\t\tbucketName: trigger.bucketName,\n\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\tfunctionPath: trigger.functionPath,\n\t\tenabled: trigger.enabled,\n\t};\n}\n"],"mappings":";;AA4BA,MAAM,6BACJ,cACD,OAAO,OAAoD;CAC1D,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAC7C,OAAO,oBAAoB,IAAI,EAAE,UAAU,CAAC;AAC7C;;;;;;;;;;AA+HD,eAAsB,WACrB,QACA,SACsB;CACtB,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAI1B,MAAM,WAAqB,CAAC;CAE5B,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,iBAAiB,QAAQ,mBAAmB;CAClD,MAAM,uBAAuB,QAAQ,yBAAyB;CAI9D,MAAM,cAAc,cAAc,IAAI,WAAW,SAAS,CAAC;CAC3D,MAAM,YAAY,cACjB,QAAQ,IAAI,CACX,QAAQ,IAAI,aAAa,SAAS,CAAC,GACnC,QAAQ,IAAI,cAAc,SAAS,CAAC,CACrC,CAAC,CACF;CACA,MAAM,gBAAgB,MAAM;CAC5B,MAAM,CAAC,UAAU,aAAa,MAAM;CACpC,MAAM,SAAS,oBAAoB,QAAQ,UAAU,QAAQ;CAC7D,MAAM,WAAW,cAAc,QAAQ;EACtC,MAAM,OAAO;EACb,IAAI,OAAO;EACX,QAAQ,QAAQ,iBAAiB;EACjC,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;EACvD,WAAW,OAAO;EAClB,aAAa,OAAO;EACpB,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;CAC3D,CAAC;CACD,MAAM,eAAe,cACpB,oBAAoB;EACnB;EACA,WAAW,cAAc;EACzB;EACA,WAAW,SAAS;EACpB,cACC,SAAS,kBACT,SAAS,kBAAkB;CAC7B,CAAC,CACF;CAKA,MAAM,iBAAiB,SAAS;CAChC,MAAM,cAAc,iBACjB,cACA,oBAAoB;EACnB;EACA,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,SAAS;EACT,gBAAgB,SAAS,UAAU,UAAU,KAAK;CACnD,CAAC,CACF,IACC,KAAA;CACH,MAAM,WAAW,MAAM;CACvB,MAAM,SAAsB;EAC3B,WAAW,cAAc;EACzB;EACA,UAAU,UAAU,MAClB,OAAO,GAAG,SAAS,gBAAgB,GAAG,aAAa,OAAO,EAC5D;EACA;CACD;CACA,IAAI,aACH,OAAO,UAAU,MAAM;CAMxB,MAAM,OAAO,WAAW,UAAU,QAAQ,EAAE,gBAAgB,KAAK,CAAC;CAElE,MAAM,uBADgB,KAAK,KAAK,OAAO,cACE,CAAC,CAAC,SAAS,KAAK,CAAC;CAC1D,MAAM,wBAAwB,OAAO,aAAa,CAAC;CAEnD,IAAI,CAAC,UAAU,KAAK,UAAU,SAAS,GACtC,MAAM,IAAI,kBAAkB,KAAK,SAAS;CAG3C,IAAI,CAAC,WAAW,wBAAwB,wBAAwB;EAC/D,IAAI,QAAQ,SAYP;OAAA,CAAC,MAXY,QAAQ,QAAQ;IAChC,YAAY,OAAO;IACnB,iBAAiB;IACjB,iBAAiB;IAGjB,WAAW,uBACR,WAAW,UAAU,QAAQ,EAAE,gBAAgB,MAAM,CAAC,CAAC,CACtD,YACD,CAAC;GACL,CAAC,GACQ;IACR,MAAM,UAAuD,CAAC;IAC9D,IAAI,uBAAuB,QAAQ,KAAK,kBAAkB;IAC1D,IAAI,sBAAsB,QAAQ,KAAK,kBAAkB;IACzD,MAAM,IAAI,iBAAiB,OAAO,MAAM,OAAO;GAChD;SACM,IAAI,sBAAsB;GAIhC,MAAM,SAAS,WAAW,UAAU,QAAQ,EAC3C,gBAAgB,MACjB,CAAC;GACD,MAAM,IAAI,kBAAkB,OAAO,SAAS;EAC7C;CAGD;CAEA,IAAI,CAAC,QAAQ,MAAM,QAAQ,kBAAkB;CAE7C,MAAM,UAA2B,CAChC;EAAE,MAAM;EAAU,QAAQ;EAAQ,YAAY,OAAO;CAAK,CAC3D;CAEA,MAAM,aAAa,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAU,CAAC;CAClE,MAAM,eAAe,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAU,CAAC;CACtE,MAAM,MAAoB;EACzB;EACA,iBAAiB,cAAc;EAC/B;EACA;EACA,gBACC,QAAQ,kBACR,2BAA2B,YAAY;GACtC,SAAS,KAAK,OAAO;EACtB,CAAC;EACF,oCAAoB,IAAI,IAAI;CAC7B;CAEA,KAAK,MAAM,QAAQ,KAAK,MAAM;EAC7B,MAAM,SAAS,SACZ,wBAAwB,IAAI,IAC5B,MAAM,UAAU,MAAM,GAAG;EAC5B,QAAQ,KAAK,MAAM;CACpB;CAIA,MAAM,6BAA6B;EAClC;EACA,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,MAAM,KAAK;EACX;EACA,SAAS,OAAO;EAChB;CACD,CAAC;CAED,MAAM,SAAqB;EAC1B,WAAW,cAAc;EACzB,UAAU,OAAO;EACjB,YAAY,OAAO;EACnB;EACA;EACA,WAAW,KAAK;EAChB;CACD;CACA,IAAI,cAAc,OAAO,OAAO,QAAQ,cAAc;CACtD,4BAA4B;EAC3B;EACA,SAAS,OAAO;EAChB,WAAW,SAAS,SAAS,aAAa,CAAC;EAC3C;EACA;CACD,CAAC;CACD,OAAO;AACR;AAEA,SAAS,eAAe,MAAyB;CAChD,OACC,KAAK,SAAS,uBACd,KAAK,SAAS,6BACd,KAAK,SAAS,qBACd,KAAK,SAAS,qBACd,KAAK,SAAS,sBACd,KAAK,SAAS;AAEhB;;;;;;;AAQA,SAAS,wBAAwB,MAA+B;CAC/D,QAAQ,KAAK,MAAb;EACC,KAAK,qBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,OAAO;IAAO,WAAW,KAAK;GAAU;EACpD;EACD,KAAK,2BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,OAAO;IAAa,WAAW,KAAK;GAAU;EAC1D;EACD,KAAK,mBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IACR,OAAO;IACP,YAAY,KAAK;IACjB,UAAU,KAAK;GAChB;EACD;EACD,KAAK,eAIJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAO;EAChE,KAAK,mBACJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAU;EACnE,KAAK,mBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY;GACZ,SAAS;IAAE,OAAO;IAAY,UAAU,KAAK;GAAS;EACvD;EACD,KAAK,oBACJ,OAAO;GAAE,MAAM;GAAW,QAAQ;GAAU,YAAY;EAAU;EACnE,KAAK,iBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,YAAY,KAAK;IACjB,aAAa,KAAK;GACnB;EACD;EACD,KAAK,mBACJ,OAAO;GACN,MAAM;GAEN,QAAQ,KAAK,iBAAiB,WAAW;GACzC,YAAY,YAAY,KAAK,GAAG;GAChC,SAAS;IACR,MAAM,KAAK,GAAG;IACd,QAAQ,KAAK,GAAG;IAChB,SAAS,KAAK,GAAG;GAClB;EACD;EACD,KAAK,kBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;GACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;EAC9D;EACD,KAAK,kBACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;GACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;EAC9D;EACD,KAAK,0BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,QAAQ,KAAK;IACb,MAAM,KAAK;GACZ;EACD;EACD,KAAK,0BACJ,OAAO;GACN,MAAM;GACN,QAAQ;GACR,YAAY,UAAU,KAAK;GAC3B,SAAS;IACR,QAAQ,KAAK;IACb,MAAM,KAAK;IACX,cAAc,KAAK;GACpB;EACD;CACF;AACD;AAEA,SAAS,qBAAqB,SAAqC;CAClE,OAAO,yBAAyB,cAAc;EAC7C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;AAEA,SAAS,oBACR,UACA,UACqB;CACrB,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,QAAQ;CACpD,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cACT,UAAU,gBACV;EACC,yBAAyB,KAAK,UAAU,QAAQ,EAAE;EAClD,uBAAuB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS;EACzF;CACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS;EAAE;EAAU,WAAW,SAAS,KAAK,MAAM,EAAE,EAAE;CAAE,EAAE,CAC/D;AACD;;;;;;;AAQA,SAAS,QAAW,MAAoC;CACvD,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAA,CAAS;CAC7B,OAAO;AACR;;;;;AAMA,SAAS,QAAW,SAAiC;CACpD,QAAQ,YAAY,KAAA,CAAS;CAC7B,OAAO;AACR;;;;AAKA,eAAe,oBAAoB,MAMH;CAC/B,MAAM,EAAE,KAAK,WAAW,QAAQ,WAAW,iBAAiB;CAC5D,IAAI,CAAC,aAAa,CAAC,cAClB,OAAO;EACN,cAAc;EACd,aAAa;EACb,gBAAgB;CACjB;CAGD,MAAM,eAAe,MAAM,wBAC1B,KACA,WACA,OAAO,EACR;CAEA,MAAM,CAAC,MAAM,WAAW,MAAM,QAAQ,IAAI,CACzC,YACG,QAAQ,IAAI,YAAY,WAAW,OAAO,EAAE,CAAC,IAC7C,QAAQ,QAAQ,IAAI,GACvB,eACG,QAAQ,IAAI,eAAe,WAAW,OAAO,IAAI,YAAY,CAAC,IAC9D,QAAQ,QAAQ,IAAI,CACxB,CAAC;CACD,MAAM,SAA6B;EAClC;EACA,aAAa,SAAS;EACtB,gBAAgB,YAAY;CAC7B;CAGA,IAAI,SAAS,OAAO,kBAAkB,QAAQ,YAAY;CAC1D,OAAO;AACR;;;;;;;;;AAUA,eAAe,oBAAoB,MAMH;CAC/B,MAAM,EAAE,KAAK,WAAW,UAAU,SAAS,kBAAkB;CAM7D,MAAM,qBAAqB,QAAQ,UAAU,MAC3C,QAAQ,GAAG,eAAe,UAAU,KAAK,CAC3C;CACA,MAAM,kBAAkB,qBACrB,uBAAuB,GAAG,IAC1B,KAAA;CACH,MAAM,CAAC,SAAS,WAAW,UAAU,iBAAiB,MAAM,QAAQ,IAAI;EACvE,QAAQ,QAAQ,SAAS,IACtB,QAAQ,IAAI,kBAAkB,WAAW,QAAQ,CAAC,IAClD,QAAQ,QAAQ,CAAC,CAAC;EACrB,QAAQ,UAAU,SAAS,IACxB,QAAQ,IAAI,oBAAoB,WAAW,QAAQ,CAAC,IACpD,QAAQ,QAAQ,CAAC,CAAC;EACrB,gBACG,QAAQ,IAAI,mBAAmB,WAAW,QAAQ,CAAC,IACnD,QAAQ,QAAQ,CAAC,CAAC;EACrB,kBACG,QACA,gBAAgB,wBACf,WACA,QACD,CACD,IACC,QAAQ,QAAQ,CAAC,CAAC;CACtB,CAAC;CACD,MAAM,UAA8B;EAAE;EAAS;EAAW;CAAS;CACnE,IAAI,oBAAoB,QAAQ,gBAAgB;CAChD,OAAO;AACR;;;;;;;AAQA,eAAe,wBACd,KACA,WACA,UACkB;CAClB,MAAM,YAAY,MAAM,IAAI,oBAAoB,WAAW,QAAQ;CACnE,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,QAAQ;CACxD,IAAI,QAAQ,OAAO,OAAO;CAC1B,OAAO,UAAU,EAAE,EAAE,QAAQ;AAC9B;AAWA,eAAe,UACd,MACA,KACyB;CACzB,QAAQ,KAAK,MAAb;EACC,KAAK,qBAAqB;GACzB,MAAM,UAAU,MAAM,IAAI,IAAI,aAC7B,IAAI,iBACJ,KAAK,UACL,EACC,WAAW,KAAK,aAAa,KAC9B,CACD;GACA,IAAI,WAAW,IAAI,QAAQ,IAAI,OAAO;GACtC,IAAI,aAAa,IAAI,QAAQ,MAAM,OAAO;GAC1C,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,QAAQ;IACpB,SAAS;KAAE,OAAO;KAAO,WAAW,KAAK;IAAU;GACpD;EACD;EACA,KAAK,2BAA2B;GAC/B,MAAM,UAAU,MAAM,IAAI,IAAI,aAC7B,IAAI,iBACJ,KAAK,UACL,EAAE,WAAW,KAAK,UAAU,CAC7B;GACA,IAAI,WAAW,IAAI,QAAQ,IAAI,OAAO;GACtC,IAAI,aAAa,IAAI,QAAQ,MAAM,OAAO;GAC1C,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,QAAQ;IACpB,SAAS;KAAE,OAAO;KAAa,WAAW,KAAK;IAAU;GAC1D;EACD;EACA,KAAK,mBAAmB;GACvB,MAAM,UAAU,MAAM,IAAI,IAAI,eAC7B,IAAI,iBACJ,KAAK,YACL,KAAK,QACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,KAAK;IACjB,SAAS;KACR,OAAO;KACP,YAAY,QAAQ;KACpB,UAAU,KAAK;IAChB;GACD;EACD;EACA,KAAK;GACJ,MAAM,IAAI,IAAI,eAAe,IAAI,iBAAiB,KAAK,UAAU,EAChE,GAAI,KAAK,eACN,EAAE,cAAc,KAAK,aAAa,IAClC,CAAC,EACL,CAAC;GACD,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,cACL,KAAK,KACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,cACL,KAAK,QACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,SAAS;KAAE,OAAO;KAAY,UAAU,KAAK;IAAS;GACvD;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,2BACb,IAAI,iBACJ,KAAK,UACL,KAAK,YACN;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY;GACb;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,mBACb,IAAI,iBACJ,KAAK,UACL;IAAE,MAAM,KAAK;IAAY,aAAa,KAAK;GAAY,CACxD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,YAAY,KAAK;KACjB,aAAa,KAAK;IACnB;GACD;EAED,KAAK,mBAAmB;GACvB,MAAM,SAAS,MAAM,IAAI,eAAe,KAAK,EAAE;GAG/C,MAAM,aAAa,MAAM,IAAI,IAAI,qBAChC,IAAI,iBACJ,KAAK,UACL,KAAK,GAAG,MACR;IACC;IACA,SAAS,KAAK,GAAG;IACjB,aAAa,KAAK,GAAG;GACtB,CACD;GACA,IAAI,mBAAmB,IAAI,KAAK,GAAG,MAAM,WAAW,EAAE;GACtD,OAAO;IACN,MAAM;IACN,QAAQ,KAAK,iBAAiB,WAAW;IACzC,YAAY,YAAY,KAAK,GAAG;IAChC,SAAS;KACR,MAAM,KAAK,GAAG;KACd,QAAQ,KAAK,GAAG;KAChB,SAAS,KAAK,GAAG;KACjB,cAAc,WAAW;IAC1B;GACD;EACD;EACA,KAAK;GACJ,MAAM,IAAI,IAAI,oBACb,IAAI,iBACJ,KAAK,UACL,mBAAmB,KAAK,cAAc,KAAK,OAAO,CACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;IACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;GAC9D;EAED,KAAK;GACJ,MAAM,IAAI,IAAI,oBACb,IAAI,iBACJ,KAAK,UACL,KAAK,WACL,mBAAmB,KAAK,cAAc,KAAK,OAAO,CACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,WAAW,KAAK,aAAa,GAAG,KAAK,QAAQ;IACzD,SAAS,qBAAqB,KAAK,cAAc,KAAK,OAAO;GAC9D;EAED,KAAK,0BAA0B;GAC9B,MAAM,UAAU,uBAAuB,IAAI,GAAG;GAC9C,IAAI;GACJ,IAAI;IACH,WAAW,MAAM,QAAQ,2BACxB,IAAI,iBACJ,KAAK,UACL;KAAE,QAAQ,KAAK;KAAQ,cAAc,KAAK;IAAa,CACxD;GACD,SAAS,KAAK;IACb,MAAM,4BAA4B,KAAK,KAAK,MAAM;GACnD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,QAAQ,SAAS;KACjB,MAAM,KAAK;KACX,aAAa,SAAS;IACvB;GACD;EACD;EACA,KAAK,0BAA0B;GAC9B,MAAM,UAAU,uBAAuB,IAAI,GAAG;GAC9C,MAAM,eAAe,IAAI,mBAAmB,IAAI,KAAK,YAAY;GACjE,IAAI,iBAAiB,KAAA,GACpB,MAAM,IAAI,cACT,UAAU,aACV,wCAAwC,KAAK,UAAU,KAAK,YAAY,EAAE,2CAC3E;GAED,MAAM,mCAAmC;IACxC,KAAK,IAAI;IACT,WAAW,IAAI;IACf,UAAU,KAAK;IACf,MAAM,KAAK;IACX;GACD,CAAC;GACD,MAAM,YACL,MAAM,QAAQ,wBACb,IAAI,iBACJ,KAAK,QACN,EAAA,CACC,MAAM,SAAS,KAAK,WAAW,KAAK,MAAM;GAC5C,IACC,aAAa,KAAA,KACb,SAAS,eAAe,cACxB,SAAS,aAAa,KAAK,cAC1B;IACD,MAAM,OACL,aAAa,KAAA,IACV,oBACA,GAAG,SAAS,WAAW,GAAG,KAAK,UAAU,SAAS,QAAQ;IAC9D,MAAM,IAAI,cACT,UAAU,UACV,mBAAmB,KAAK,UAAU,KAAK,MAAM,EAAE,+BAA+B,KAAK,UAAU,KAAK,YAAY,EAAE,aAAa,KAAK,4BACnI;GACD;GACA,MAAM,QAAQ,yBACb,IAAI,iBACJ,KAAK,UACL,KAAK,MACN;GACA,IAAI;GACJ,IAAI;IACH,WAAW,MAAM,QAAQ,2BACxB,IAAI,iBACJ,KAAK,UACL;KAAE,QAAQ,KAAK;KAAQ,cAAc,KAAK;IAAa,CACxD;GACD,SAAS,KAAK;IACb,MAAM,YAAY,4BAA4B,KAAK,KAAK,MAAM;IAC9D,MAAM,UACL,qBAAqB,gBAClB,UAAU,UACV,qBAAqB,QACpB,UAAU,UACV,OAAO,SAAS;IACrB,MAAM,IAAI,cACT,qBAAqB,gBAClB,UAAU,OACV,UAAU,aACb,wCAAwC,KAAK,UAAU,KAAK,MAAM,EAAE,aAAa,KAAK,UAAU,KAAK,YAAY,EAAE,iCAAiC,KAAK,UAAU,KAAK,YAAY,EAAE,qFAAqF,WAC3Q;KACC,OAAO,qBAAqB,QAAQ,YAAY;KAChD,SACC,qBAAqB,gBAClB,EAAE,GAAG,UAAU,QAAQ,IACvB,CAAC;IACN,CACD;GACD;GACA,OAAO;IACN,MAAM;IACN,QAAQ;IACR,YAAY,UAAU,KAAK;IAC3B,SAAS;KACR,QAAQ,SAAS;KACjB,MAAM,KAAK;KACX,cAAc,KAAK;KACnB,aAAa,SAAS;IACvB;GACD;EACD;CACD;AACD;;;;;;;;;;;;AAaA,eAAe,6BAA6B,MAQ1B;CACjB,MAAM,EAAE,KAAK,WAAW,UAAU,MAAM,SAAS,SAAS,WAAW;CACrE,MAAM,gBAAgB,KAAK,SAAS,SACnC,KAAK,SAAS,oBAAoB,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CACrD;CACA,IAAI,cAAc,WAAW,GAAG;CAEhC,MAAM,YAAY,IAAI,KACpB,SAAS,aAAa,CAAC,EAAA,CAAG,KACzB,OAAO,CAAC,GAAG,MAAM,GAAG,aAAa,CACnC,CACD;CAKA,IADsB,cAAc,MAAM,SAAS,CAAC,UAAU,IAAI,IAAI,CACtD,KAAK,CAAC,QACrB,IAAI;EACH,KAAK,MAAM,MAAM,MAAM,IAAI,oBAC1B,WACA,QACD,GACC,UAAU,IAAI,GAAG,MAAM,GAAG,aAAa;CAEzC,QAAQ,CAER;CAGD,KAAK,MAAM,UAAU,SAAS;EAC7B,MAAM,OAAO,2BAA2B,OAAO,UAAU;EACzD,IAAI,SAAS,KAAA,GAAW;EACxB,MAAM,gBAAgB,UAAU,IAAI,IAAI;EACxC,IAAI,kBAAkB,KAAA,GAAW;EACjC,OAAO,UAAU;GAAE,GAAG,OAAO;GAAS;EAAc;CACrD;AACD;;AAGA,SAAS,2BAA2B,YAAwC;CAE3E,OAAO,WAAW,WAAW,WAAM,IAChC,WAAW,MAAM,CAAa,IAC9B,KAAA;AACJ;AAEA,eAAe,mCAAmC,MAMhC;CACjB,MAAM,MAAM,KAAK,IAAI;CACrB,IAAI,CAAC,KACJ,MAAM,IAAI,cACT,UAAU,oBACV,wCAAwC,KAAK,UAAU,KAAK,IAAI,EAAE,sHACnE;CAED,MAAM,aACL,OAAO,QAAQ,IAAI,+BAA+B,KAAK;CACxD,MAAM,YACL,OAAO,QAAQ,IAAI,8BAA8B,KAAK;CACvD,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,SAAS;EAOR,MAAM,OAAM,MANK,IAAI,KACpB,KAAK,KACL,KAAK,WACL,KAAK,UACL,KAAK,IACN,EAAA,CACe;EAEf,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,KAAK,cACtC,MAAM,IAAI,cACT,UAAU,aACV,wCAAwC,KAAK,UAAU,KAAK,IAAI,EAAE,0BAA0B,IAAI,GAAG,yBAAyB,KAAK,aAAa,yDAC/I;EAED,IAAI,QAAQ,KAAA,KAAa,IAAI,OAAO,KAAK,cAAc;GACtD,IAAI,IAAI,WAAW,aAAa;GAChC,IAAI,IAAI,WAAW,UAClB,MAAM,IAAI,cACT,UAAU,aACV,0BAA0B,KAAK,UAAU,KAAK,IAAI,EAAE,gEACrD;EAEF;EACA,IAAI,KAAK,IAAI,KAAK,UACjB,MAAM,IAAI,cACT,UAAU,aACV,kCAAkC,KAAK,UAAU,KAAK,IAAI,EAAE,6EAC7D;EAED,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,UAAU,CAAC;CAC/D;AACD;AAEA,SAAS,uBAAuB,KAM9B;CACD,MAAM,OAAO,IAAI;CACjB,MAAM,WAAW,IAAI;CACrB,MAAM,SAAS,IAAI;CACnB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAC1B,MAAM,IAAI,cACT,UAAU,oBACV,4LACD;CAED,OAAO;EACN,yBAAyB,KAAK,KAAK,GAAG;EACtC,4BAA4B,SAAS,KAAK,GAAG;EAC7C,0BAA0B,OAAO,KAAK,GAAG;CAC1C;AACD;AAEA,SAAS,4BAA4B,KAAc,QAAyB;CAC3E,IAAI,EAAE,eAAe,kBAAkB,IAAI,SAAS,UAAU,UAC7D,OAAO;CAER,MAAM,cACL,OAAO,IAAI,QAAQ,gBAAgB,WAChC,IAAI,QAAQ,cACZ,KAAA;CACJ,MAAM,YACL,OAAO,IAAI,QAAQ,cAAc,WAC9B,IAAI,QAAQ,YACZ,KAAA;CACJ,MAAM,SACL,OAAO,IAAI,QAAQ,WAAW,WAAW,IAAI,QAAQ,SAAS,KAAA;CAC/D,MAAM,WAAW;EAChB,WAAW,KAAA,IAAY,QAAQ,WAAW,KAAA;EAC1C,cAAc,mBAAmB,YAAY,KAAK,KAAA;EAClD,YAAY,cAAc,cAAc,KAAA;CACzC,CAAC,CAAC,QAAQ,SAAyB,SAAS,KAAA,CAAS;CACrD,OAAO,IAAI,cACV,UAAU,UACV;EACC,YAAY,KAAK,UAAU,MAAM,EAAE;EACnC,SAAS,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,KAAK,KAAA;EACnD;CACD,CAAC,CACC,QAAQ,SAAyB,SAAS,KAAA,CAAS,CAAC,CACpD,KAAK,GAAG,GACV;EAAE,OAAO;EAAK,SAAS,EAAE,GAAG,IAAI,QAAQ;CAAE,CAC3C;AACD;AAEA,SAAS,4BAA4B,MAM5B;CACR,MAAM,WAAoD,CAAC;CAC3D,KAAK,MAAM,MAAM,KAAK,WACrB,KAAK,MAAM,UAAU,GAAG,iBAAiB,CAAC,GACzC,SAAS,KAAK;EAAE;EAAQ,MAAM,GAAG;CAAK,CAAC;CAGzC,IAAI,SAAS,WAAW,GAAG;CAE3B,MAAM,iBAAiB,IAAI,IAC1B,KAAK,OAAO,UAAU,SAAS,aAAa;EAC3C,IAAI,SAAS,UAAU,gBAAgB,OAAO,CAAC;EAC/C,MAAM,QAAQ,2BAA2B,KAAK,SAAS,MAAM;EAC7D,OAAO,QAAQ,OAAO,KAAA,IAAY,CAAC,MAAM,EAAE,IAAI,CAAC;CACjD,CAAC,CACF;CAEA,MAAM,gCAAgB,IAAI,IAAoB;CAC9C,KAAK,MAAM,UAAU,KAAK,SAAS,iBAAiB,CAAC,GAAG;EACvD,IAAI,eAAe,IAAI,OAAO,MAAM,GAAG;EACvC,cAAc,IAAI,OAAO,QAAQ,OAAO,WAAW;CACpD;CACA,KAAK,MAAM,UAAU,KAAK,SAAS;EAClC,MAAM,SACL,OAAO,OAAO,SAAS,WAAW,WAC/B,OAAO,QAAQ,SACf,KAAA;EACJ,MAAM,cAAc,OAAO,SAAS;EACpC,IAAI,WAAW,KAAA,KAAa,OAAO,gBAAgB,UAClD,cAAc,IAAI,QAAQ,WAAW;CAEvC;CAEA,KAAK,OAAO,gBAAgB,SAAS,KAAK,EAAE,QAAQ,WAAW;EAC9D,MAAM,QAAgE;GACrE;GACA;EACD;EACA,MAAM,cAAc,cAAc,IAAI,MAAM;EAC5C,IAAI,gBAAgB,KAAA,GAAW,MAAM,cAAc;EACnD,IAAI,gBAAgB,IACnB,KAAK,SAAS,KACb,uBAAuB,OAAO,gDAC/B;EAED,OAAO;CACR,CAAC;AACF;AAEA,SAAS,qBACR,cACA,SAC0B;CAC1B,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN;EACA,MAAM,QAAQ;EACd,MAAM,QAAQ;EACd,SAAS,QAAQ;CAClB;CAED,OAAO;EACN;EACA,MAAM,QAAQ;EACd,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,SAAS,QAAQ;CAClB;AACD;AAEA,SAAS,mBACR,cACA,SACqB;CACrB,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;CAED,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;AACD;AAEA,SAAS,mBACR,cACA,SACqB;CACrB,IAAI,QAAQ,SAAS,YACpB,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,MAAM,QAAQ;EACd,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;CAED,OAAO;EACN,MAAM;EACN,MAAM,QAAQ;EACd;EACA,YAAY,QAAQ;EACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACjE,cAAc,QAAQ;EACtB,SAAS,QAAQ;CAClB;AACD"}

package/dist/lib/resolve-package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-package.d.ts","names":[],"sources":["../../src/lib/resolve-package.ts"],"mappings":";;AAkBA;AAgBA;AAoBA;;;;;;;;;;;;iBApCgB,cAAA;;iBAgBA,mBAAA,eAEb;;;;;;iBAkBa,uBAAA"}
+{"version":3,"file":"resolve-package.d.ts","names":["findPackageDir","readPackageManifest","Record","installedPackageVersion","findPackageDir","fromDir","name","readPackageManifest","dir","Record","installedPackageVersion"],"sources":["../../src/lib/resolve-package.ts"],"mappings":";;AAkBA;AAgBA;AAoBA;;;;;;;;;;;;iBApCgBA,cAAAA;;iBAgBAC,mBAAAA,eAEbC;;;;;;iBAkBaC,uBAAAA"}

package/dist/lib/run-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-hook.d.ts","names":[],"sources":["../../src/lib/run-hook.ts"],"mappings":";;;;;;AAQA;AAAgC;AAGd;AAKR,cARG,kBAAA,SAA2B,KAAA,CAQvB;EARuB,SAAA,OAAA,EAAA,MAAA;EAAK,SAAA,QAAA,EAAA,MAAA,GAAA,IAAA;EAwB5B,SAAA,MAAA,EArBC,MAAA,CAAO,OA4BlB,GAAM,IAAA;EAmBS,WAAO,CAAA,OAAA,EAAA,MAAA,EAAA,QAAA,EAAA,MAAA,GAAA,IAAA,EAAA,MAAA,EA1CnB,MAAA,CAAO,OA0CY,GAAA,IAAA,EAAA,KAAA,CAAA,EAAA,OAAA;AAAA;AACjB;AAAK,UA3BA,cAAA,CA2BA;EAAV;EACD,GAAA,CAAA,EAAA,MAAA;EACI;AACC;AAAR;AAAO;EAcY,GAAA,CAAA,EArCf,MAqCe,CAAA,MAAY,EAAA,MAAA,GAAA,SAAA,CAAA;EAAA;EAC3B,QAAA,CAAA,EAAA,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,IAAA;AACG;AACP;AAAO;;;;;;;;;;;;;iBArBY,2BACf,KAAK,KAAK,0BACX,eACI,iBACP,QAAQ;;;;;;iBAcW,YAAA,OACf,qBACG,iBACP"}
+{"version":3,"file":"run-hook.d.ts","names":["Hook","ShellHook","HookExecutionError","NodeJS","Signals","Error","RunHookOptions","Record","runHook","Ctx","Result","Promise","runShellHook","Hook","ShellHook","HookExecutionError","Error","command","exitCode","signal","NodeJS","Signals","constructor","cause","RunHookOptions","cwd","env","Record","onOutput","chunk","runHook","hook","Ctx","Result","ctx","options","Promise","runShellHook"],"sources":["../../src/lib/run-hook.ts"],"mappings":";;;;;;AAQA;AAAgC;AAGdG;AAKRA,cARGD,kBAAAA,SAA2BG,KAAAA,CAQvBD;EARuBC,SAAAA,OAAAA,EAAAA,MAAAA;EAAK,SAAAa,QAAA,EAAA,MAAA,GAAA,IAAA;EAwB5BZ,SAAAA,MAAAA,EArBCH,MAAAA,CAAOC,OA4BlBG,GAAM,IAAA;EAmBSC,WAAOc,CAAAL,OAAA,EAAA,MAAA,EAAAC,QAAA,EAAA,MAAA,GAAA,IAAA,EAAAC,MAAA,EA1CnBhB,MAAAA,CAAOC,OA0CY,GAAA,IAAA,EAAAmB,KAAA,CAAA,EAAA,OAAA;AAAA;AACjBd;AAAKC,UA3BAJ,cAAAA,CA2BAI;EAAVV;EACDS,GAAAA,CAAAA,EAAAA,MAAAA;EACIH;AACCI;AAARC;AAAO;EAcYC,GAAAA,CAAAA,EArCfL,MAqCeK,CAAAA,MAAY,EAAA,MAAA,GAAA,SAAA,CAAA;EAAA;EAC3BX,QAAAA,CAAAA,EAAAA,CAAAA,KAAAA,EAAAA,MAAAA,EAAAA,GAAAA,IAAAA;AACGK;AACPK;AAAO;;;;;;;;;;;;;iBArBYH,2BACfR,KAAKS,KAAKC,0BACXD,eACIH,iBACPK,QAAQD;;;;;;iBAcWE,YAAAA,OACfX,qBACGK,iBACPK"}

package/dist/lib/run-hook.test-d.js

@@ -1,6 +1,6 @@
 import { runHook, runShellHook } from "./run-hook.js";
 import { describe, test } from "../node_modules/.pnpm/@vitest_runner@3.0.9/node_modules/@vitest/runner/dist/index.js";
-import { import_dist } from "../node_modules/.pnpm/vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_lightning_c62fa9cfd5255ee94a9655ae033e9be4/node_modules/vitest/dist/index.js";
+import { import_dist } from "../node_modules/.pnpm/vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_@noble_ha_0258998ed4eee0dc3e7b1b8446e9e9d6/node_modules/vitest/dist/index.js";
 //#region src/lib/run-hook.test-d.ts
 describe("runHook return typing", () => {
 	test("a function hook resolves to `Result | undefined`, inferred from the function", () => {

package/dist/node_modules/.pnpm/{vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_lightning_c62fa9cfd5255ee94a9655ae033e9be4 → vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_@noble_ha_0258998ed4eee0dc3e7b1b8446e9e9d6}/node_modules/vitest/dist/index.js

@@ -2,7 +2,7 @@ import "../../../../chai@5.2.0/node_modules/chai/chai.js";
 import { describe, test } from "../../../../@vitest_runner@3.0.9/node_modules/@vitest/runner/dist/index.js";
 import "../../../../@vitest_runner@3.0.9/node_modules/@vitest/runner/dist/utils.js";
 import { require_dist } from "../../../../expect-type@1.2.1/node_modules/expect-type/dist/index.js";
-//#region ../../node_modules/.pnpm/vitest@3.0.9_@types+debug@4.1.13_@types+node@20.19.17_jiti@2.7.0_jsdom@29.1.1_lightning_c62fa9cfd5255ee94a9655ae033e9be4/node_modules/vitest/dist/index.js
+//#region ../../node_modules/.pnpm/vitest@3.0.9_@types+debug@4.1.13_@types+node@20.19.17_jiti@2.7.0_jsdom@29.1.1_@noble+ha_0258998ed4eee0dc3e7b1b8446e9e9d6/node_modules/vitest/dist/index.js
 var import_dist = require_dist();
 //#endregion
 export { describe, import_dist, test };

package/dist/node_modules/.pnpm/{vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_lightning_c62fa9cfd5255ee94a9655ae033e9be4 → vitest@3.0.9_@types_debug@4.1.13_@types_node@20.19.17_jiti@2.7.0_jsdom@29.1.1_@noble_ha_0258998ed4eee0dc3e7b1b8446e9e9d6}/node_modules/vitest/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../../../../../../node_modules/.pnpm/vitest@3.0.9_@types+debug@4.1.13_@types+node@20.19.17_jiti@2.7.0_jsdom@29.1.1_lightning_c62fa9cfd5255ee94a9655ae033e9be4/node_modules/vitest/dist/index.js"],"sourcesContent":["export { c as createExpect, a as expect, i as inject, v as vi, b as vitest } from './chunks/vi.nSCvwQ7l.js';\nexport { i as isFirstRun, a as runOnce } from './chunks/run-once.2ogXb3JV.js';\nexport { a as assertType, g as getRunningMode, i as isWatchMode } from './chunks/index.D7Ny8f_s.js';\nexport { b as bench } from './chunks/benchmark.DL72EVN-.js';\nexport { expectTypeOf } from 'expect-type';\nexport { afterAll, afterEach, beforeAll, beforeEach, describe, it, onTestFailed, onTestFinished, suite, test } from '@vitest/runner';\nimport * as chai from 'chai';\nexport { chai };\nexport { assert, should } from 'chai';\nimport '@vitest/expect';\nimport '@vitest/runner/utils';\nimport './chunks/utils.C8RiOc4B.js';\nimport '@vitest/utils';\nimport './chunks/_commonjsHelpers.BFTU3MAI.js';\nimport '@vitest/snapshot';\nimport '@vitest/utils/error';\nimport '@vitest/spy';\nimport '@vitest/utils/source-map';\nimport './chunks/date.W2xKR2qe.js';\n"],"x_google_ignoreList":[0],"mappings":""}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../../../../../../node_modules/.pnpm/vitest@3.0.9_@types+debug@4.1.13_@types+node@20.19.17_jiti@2.7.0_jsdom@29.1.1_@noble+ha_0258998ed4eee0dc3e7b1b8446e9e9d6/node_modules/vitest/dist/index.js"],"sourcesContent":["export { c as createExpect, a as expect, i as inject, v as vi, b as vitest } from './chunks/vi.nSCvwQ7l.js';\nexport { i as isFirstRun, a as runOnce } from './chunks/run-once.2ogXb3JV.js';\nexport { a as assertType, g as getRunningMode, i as isWatchMode } from './chunks/index.D7Ny8f_s.js';\nexport { b as bench } from './chunks/benchmark.DL72EVN-.js';\nexport { expectTypeOf } from 'expect-type';\nexport { afterAll, afterEach, beforeAll, beforeEach, describe, it, onTestFailed, onTestFinished, suite, test } from '@vitest/runner';\nimport * as chai from 'chai';\nexport { chai };\nexport { assert, should } from 'chai';\nimport '@vitest/expect';\nimport '@vitest/runner/utils';\nimport './chunks/utils.C8RiOc4B.js';\nimport '@vitest/utils';\nimport './chunks/_commonjsHelpers.BFTU3MAI.js';\nimport '@vitest/snapshot';\nimport '@vitest/utils/error';\nimport '@vitest/spy';\nimport '@vitest/utils/source-map';\nimport './chunks/date.W2xKR2qe.js';\n"],"x_google_ignoreList":[0],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neon/config-runtime",
-  "version": "1.7.6",
+  "version": "1.8.0",
   "description": "Imperative runtime for @neon/config: inspect/plan/apply a neon.ts policy against the Neon API and bundle + deploy Neon Functions. Pulls in esbuild; import this from CLIs and CI, not from neon.ts.",
   "keywords": [
     "neon",
@@ -47,14 +47,14 @@
     "tsdown": "^0.14.1",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon/sdk": "7.0.1",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon/e2e-harness": "0.0.0",
+    "@neon/sdk": "7.0.1"
   },
   "dependencies": {
     "@vercel/nft": "^1.10.2",
     "esbuild": "^0.28.1",
     "fflate": "^0.8.3",
-    "@neon/config": "1.8.4"
+    "@neon/config": "1.8.6"
   },
   "engines": {
     "node": ">=20.19.0"