neon 4.13.0 → 4.14.0

package/dist/commands/dev.js

@@ -2,10 +2,11 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
+import { _ as functionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { i as resolveDevEnv } from "../_chunks/env-NbA61JR3.js";
-import { resolveFunctionsFromConfig } from "../dev/functions.js";
+import { i as resolveDevEnv } from "../_chunks/env-CZmstYrY.js";
+import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
@@ -14,6 +15,7 @@ import chalk from "chalk";
 import { spawn, spawnSync } from "node:child_process";
 import { bundleAsIs, describeNativeFinding, findUndeclaredNativePackages, resolveEsbuildEntry } from "@neon/config-runtime";
 import { once } from "node:events";
+import { createServer } from "node:net";
 //#region src/commands/dev.ts
 var dev_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
@@ -24,7 +26,10 @@ var dev_exports = /* @__PURE__ */ __exportAll({
 	diffUnits: () => diffUnits,
 	formatEnvSummary: () => formatEnvSummary,
 	handler: () => handler,
-	reportDevCredential: () => reportDevCredential
+	localFunctionUrlEnv: () => localFunctionUrlEnv,
+	planFunctionsToUnits: () => planFunctionsToUnits,
+	reportDevCredential: () => reportDevCredential,
+	sourceFunctionUrlOverlay: () => sourceFunctionUrlOverlay
 });
 const command = "dev";
 const describe = "Run Neon Functions locally with a dev server";
@@ -44,6 +49,11 @@ const builder = (argv) => argv.usage("$0 dev [--source <path>] [options]").examp
 	"object storage and the AI Gateway where the branch has them. A neon.ts in",
 	"this directory decides instead, exactly as it does for `env pull`.",
 	"",
+	"NEON_FUNCTION_<SLUG>_BASE_URL from `env pull` / `neon-env run` is the production",
+	"invocation URL. `dev` rewrites it to `http://localhost:<port>` for each function",
+	"this process is serving (every neon.ts function, or the matching slug when",
+	"`--source` names one).",
+	"",
 	"`dev` reads your .env / .env.local to reuse the branch credential behind the",
 	"AI Gateway and object storage, and never writes to them. With no such file it",
 	"issues a credential on every start, so run `env pull` once if you restart often."
@@ -110,11 +120,16 @@ const runSingleSource = async (props) => {
 	const branchId = await resolveBranchId(props);
 	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
 	reportDevCredential(credential);
+	const match = await findConfigFunctionBySource(process.cwd(), source);
+	const { overlay, port } = await sourceFunctionUrlOverlay(match, props.port);
 	const unit = {
 		slug: null,
 		source,
 		bundleDir: devBundleDir(process.cwd()),
-		childEnv: buildChildEnv(neonEnv, portFromProps(props.port)),
+		childEnv: buildChildEnv({
+			...neonEnv,
+			...overlay
+		}, port),
 		label: null,
 		envSummary: {
 			neon: Object.keys(neonEnv),
@@ -135,11 +150,11 @@ const runFromConfig = async (props) => {
 	if (functions.length === 0) throw new Error("neon.ts has no functions to serve. Add at least one under `preview.functions`, or pass --source <path>.");
 	const { vars: neonEnv, skipped, credential } = await resolveDevEnv(devEnvContext(props, branchId, process.cwd()));
 	reportDevCredential(credential);
-	const units = planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);
-	const replan = async (searchBase) => {
+	const units = await planFunctionsToUnits(functions, neonEnv, DEFAULT_PORT_BASE);
+	const replan = async (searchBase, keepPorts) => {
 		const re = await resolveFunctionsFromConfig(process.cwd());
 		if (re === null) return null;
-		return planFunctionsToUnits(re.functions, neonEnv, searchBase);
+		return planFunctionsToUnits(re.functions, neonEnv, searchBase, keepPorts);
 	};
 	await runSupervisor(units, {
 		reload: {
@@ -149,22 +164,112 @@ const runFromConfig = async (props) => {
 		...skipped ? { envNote: skipped.reason } : {}
 	});
 };
-/**
-* Map a list of {@link PlannedFunction}s to {@link ServedUnit}s, coordinating the search
-* base across them so search-mode functions don't all probe the same starting port.
-*
-* Each search-mode (no `dev.port`) function gets a distinct base starting at
-* `searchBase`; the runtime still walks upward from its base, so an occupied base
-* self-resolves and this never fails — the offset just makes startup deterministic.
-*/
-const planFunctionsToUnits = (functions, neonEnv, searchBase) => {
+/** Ports are chosen before spawn so every sibling's localhost URL can be overlaid. */
+const planFunctionsToUnits = async (functions, neonEnv, searchBase, keepPorts = /* @__PURE__ */ new Map()) => {
+	const reserved = /* @__PURE__ */ new Set();
+	const portBySlug = /* @__PURE__ */ new Map();
+	for (const fn of functions) {
+		if (fn.port === void 0) continue;
+		portBySlug.set(fn.slug, fn.port);
+		reserved.add(fn.port);
+	}
+	for (const fn of functions) {
+		if (portBySlug.has(fn.slug)) continue;
+		const kept = keepPorts.get(fn.slug);
+		if (kept !== void 0 && !reserved.has(kept)) {
+			portBySlug.set(fn.slug, kept);
+			reserved.add(kept);
+		}
+	}
 	let searchOffset = 0;
-	return functions.map((fn) => {
-		const base = searchBase + searchOffset;
-		if (fn.port === void 0) searchOffset += 1;
-		return plannedToUnit(fn, neonEnv, base);
+	for (const fn of functions) {
+		if (portBySlug.has(fn.slug)) continue;
+		const port = await pickFreePort(searchBase + searchOffset, reserved);
+		portBySlug.set(fn.slug, port);
+		reserved.add(port);
+		searchOffset = port - searchBase + 1;
+	}
+	const assigned = functions.map((fn) => {
+		const port = portBySlug.get(fn.slug);
+		if (port === void 0) throw new Error(`planFunctionsToUnits: no port for ${fn.slug}`);
+		return {
+			fn,
+			port
+		};
 	});
+	const overlay = localFunctionUrlEnv(assigned.map(({ fn, port }) => ({
+		slug: fn.slug,
+		port
+	})));
+	const branchEnv = {
+		...neonEnv,
+		...overlay
+	};
+	return assigned.map(({ fn, port }) => plannedToUnit(fn, branchEnv, {
+		mode: "explicit",
+		port
+	}, overlay));
+};
+/**
+* Local invocation URLs for functions `neon dev` is serving, so siblings call each
+* other on localhost instead of the production compute host.
+*/
+const localFunctionUrlEnv = (functions) => {
+	const out = {};
+	for (const fn of functions) out[functionBaseUrlKey(fn.slug)] = `http://localhost:${fn.port}`;
+	return out;
+};
+/**
+* `--source` serves one file. If that file is a neon.ts function, rewrite only that
+* slug to localhost — this process is not listening for the others.
+*/
+const sourceFunctionUrlOverlay = async (match, cliPort) => {
+	const portSpec = portFromProps(cliPort);
+	if (match === void 0) return {
+		overlay: {},
+		port: portSpec
+	};
+	const port = portSpec.mode === "explicit" ? portSpec.port : match.port ?? await pickFreePort(portSpec.from);
+	return {
+		overlay: localFunctionUrlEnv([{
+			slug: match.slug,
+			port
+		}]),
+		port: {
+			mode: "explicit",
+			port
+		}
+	};
 };
+const pickFreePort = (from, reserved = /* @__PURE__ */ new Set()) => new Promise((resolvePort, reject) => {
+	const tryPort = (port) => {
+		if (port > 65535) {
+			reject(/* @__PURE__ */ new Error(`No free port at or above ${from}`));
+			return;
+		}
+		if (reserved.has(port)) {
+			tryPort(port + 1);
+			return;
+		}
+		const server = createServer();
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") {
+				tryPort(port + 1);
+				return;
+			}
+			reject(err);
+		});
+		server.listen(port, "127.0.0.1", () => {
+			const addr = server.address();
+			const bound = typeof addr === "object" && addr !== null ? addr.port : port;
+			server.close((closeErr) => {
+				if (closeErr) reject(closeErr);
+				else resolvePort(bound);
+			});
+		});
+	};
+	tryPort(from);
+});
 /**
 * Resolve the selected branch id from props, if any. Best-effort: a failure here only
 * means env injection is skipped, so it never throws.
@@ -211,19 +316,11 @@ const portFromProps = (port) => {
 */
 const devBundleDir = (cwd, slug) => slug === void 0 ? join(cwd, "node_modules", ".neon-dev") : join(cwd, "node_modules", ".neon-dev", slug);
 /**
-* Translate a {@link PlannedFunction} into a {@link ServedUnit}. Port rules:
-*   - explicit `dev.port`: bind exactly, fail if taken.
-*   - no `dev.port`: search for a free port (base coordinated by the caller).
+* Translate a {@link PlannedFunction} into a {@link ServedUnit}. The bind port is
+* already chosen by the caller so sibling localhost URLs can be overlaid first.
 * Per-function neon.ts env layers over the shared branch env.
 */
-const plannedToUnit = (fn, branchEnv, searchBase) => {
-	const port = fn.port !== void 0 ? {
-		mode: "explicit",
-		port: fn.port
-	} : {
-		mode: "search",
-		from: searchBase
-	};
+const plannedToUnit = (fn, branchEnv, port, overlay = {}) => {
 	const childEnv = buildChildEnv({
 		...branchEnv,
 		...fn.env
@@ -244,6 +341,7 @@ const plannedToUnit = (fn, branchEnv, searchBase) => {
 			source: fn.source,
 			port: fn.port ?? null,
 			env: fn.env,
+			overlay,
 			externalPackages: fn.externalPackages ?? null,
 			bundler: typeof fn.bundler === "function" ? "custom" : fn.bundler ?? null
 		})
@@ -442,7 +540,7 @@ const reconcileOnce = async (running, replan, ops) => {
 	if (ops.isShuttingDown()) return;
 	let desired;
 	try {
-		desired = await replan(nextSearchBase(running));
+		desired = await replan(nextSearchBase(running), keepPortsFromRunning(running));
 	} catch (err) {
 		log.info(chalk.red("neon.ts change ignored: ") + (err instanceof Error ? err.message : String(err)) + chalk.dim(" (fix it and save again)"));
 		return;
@@ -470,10 +568,23 @@ const reconcileOnce = async (running, replan, ops) => {
 		}
 	}
 };
+const keepPortsFromRunning = (running) => {
+	const keep = /* @__PURE__ */ new Map();
+	for (const r of running) {
+		if (r.unit.slug === null) continue;
+		const bound = r.boundPort;
+		if (bound !== null) {
+			keep.set(r.unit.slug, bound);
+			continue;
+		}
+		const pending = Number(r.unit.childEnv.NEON_DEV_PORT);
+		if (Number.isFinite(pending) && pending > 0) keep.set(r.unit.slug, pending);
+	}
+	return keep;
+};
 /**
-* Choose a port search base above every port the live units already bound, so a hot-added
-* search-mode function starts probing where there's room. The runtime still walks upward
-* from here, so it never fails even if this guess is taken — it just keeps things tidy.
+* Start pickFreePort above every port live units already bound, so a hot-added
+* function is not probed on a port a sibling is serving.
 */
 const nextSearchBase = (running) => {
 	let max = 8786;
@@ -757,4 +868,4 @@ const resolveRuntimePath = () => {
 	return candidate;
 };
 //#endregion
-export { builder, command, describe, devBundleDir, devEnvContext, diffUnits, formatEnvSummary, handler, reportDevCredential, dev_exports as t };
+export { builder, command, describe, devBundleDir, devEnvContext, diffUnits, formatEnvSummary, handler, localFunctionUrlEnv, planFunctionsToUnits, reportDevCredential, sourceFunctionUrlOverlay, dev_exports as t };

package/dist/commands/env.js

@@ -4,11 +4,11 @@ import { ensureGitignored } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_UNAVAILABLE, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_SERVICES } from "../_chunks/env_services-Tz9G4JeT.js";
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, f as NEON_ENV_VAR_KEYS, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, v as isFunctionBaseUrlKey } from "../_chunks/env_services-CAWrZTWa.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { a as resolveNeonEnvVars } from "../_chunks/env-NbA61JR3.js";
+import { a as resolveNeonEnvVars } from "../_chunks/env-CZmstYrY.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
 //#region src/commands/env.ts
@@ -51,7 +51,7 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	}),
 	env: {
 		alias: "e",
-		describe: `Pull only these individual variables: ${ENV_PULL_KEYS.join(", ")}. Repeat the flag or comma-separate. Overrides neon.ts. Combines with --service as a union; it never narrows a service bundle.`,
+		describe: `Pull only these individual variables: ${ENV_PULL_KEY_HELP}. Repeat the flag or comma-separate. Overrides neon.ts. Combines with --service as a union; it never narrows a service bundle.`,
 		type: "array",
 		string: true
 	}
@@ -59,19 +59,19 @@ const builder = (argv) => argv.usage("$0 env <sub-command> [options]").options({
 	"",
 	"What gets pulled, in precedence order:",
 	"  1. --service / --env, when given — their union, ignoring neon.ts.",
-	"  2. neon.ts, when this directory has one.",
+	"  2. neon.ts, when this directory has one — including derived function",
+	"     URLs (the function does not have to be deployed).",
 	"  3. Otherwise everything the branch has, plus the AI Gateway —",
 	"     which mints a branch credential for it.",
 	"",
 	"The pull bundled into link / checkout / config apply follows 2 and 3",
 	"without the AI Gateway, so it never mints a credential you did not ask",
 	"for. Run `env pull` to add it."
-].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables").example("$0 env pull -e DATABASE_URL", "Pull only the pooled Postgres connection string").example("$0 env pull -s auth -e DATABASE_URL", "Pull all Auth variables plus DATABASE_URL").strict(), async (args) => {
+].join("\n")).example("$0 env pull", "Write the linked branch's Neon vars into .env.local (or .env if present)").example("$0 env pull --branch preview --file .env.preview", "Pull a specific branch into a specific file").example("$0 env pull -s ai-gateway -s postgres", "Pull only the AI Gateway and Postgres variables").example("$0 env pull -e DATABASE_URL", "Pull only the pooled Postgres connection string").example("$0 env pull -s auth -e DATABASE_URL", "Pull all Auth variables plus DATABASE_URL").example("$0 env pull -s functions", "Pull NEON_FUNCTION_<SLUG>_BASE_URL for every deployed function").example("$0 env pull -e NEON_FUNCTION_HELLO_BASE_URL", "Write that function's production invocation URL (no deploy required)").strict(), async (args) => {
 	const rawServices = servicesFlagValue(args.service);
 	const rawEnvKeys = envPullFlagValue(args.env);
 	const services = rawServices ? parseServices(rawServices, {
 		allowed: ENV_PULL_SERVICES,
-		whyUnavailable: ENV_PULL_UNAVAILABLE,
 		flag: "--service",
 		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
 	}) : void 0;
@@ -127,16 +127,17 @@ const pull = async (props, opts = {}) => {
 		...props.services ? { services: props.services } : {},
 		...props.envKeys ? { envKeys: props.envKeys } : {},
 		...opts.implyAiGateway ? { implyAiGateway: true } : {},
+		omitUnsetFunctionEnv: true,
 		...props.apiKey ? { apiKey: props.apiKey } : {},
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...props.runtimeApi ? { api: props.runtimeApi } : {}
 	});
-	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys);
+	const neonVars = pickSelectedVars(pickNeonVars(vars), selectedKeys, props.services);
 	if (Object.keys(neonVars).length === 0) {
 		log.info("No Neon env variables to pull for this branch (no DATABASE_URL or enabled Auth / Data API).");
 		return { status: "empty" };
 	}
-	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId)) });
+	const { written, removed } = mergeEnvFile(targetPath, neonVars, { managedKeys: managedKeysFor(selectedKeys, unreachedButCurrent(skipped, existingEnv, branchId), existingEnv, props.services, props.envKeys) });
 	log.info("Pulled %d Neon variable%s into %s: %s", written.length, written.length === 1 ? "" : "s", targetPath, written.join(", "));
 	if (removed.length > 0) log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
 	if (credential?.issued) {
@@ -164,42 +165,32 @@ const pull = async (props, opts = {}) => {
 		...skipped && skipped.length > 0 ? { skipped } : {}
 	};
 };
-/**
-* The keys this pull is allowed to prune, i.e. the ones it is authoritative for.
-*
-* An explicit selection narrows that to the service bundles and individual keys it named:
-* `env pull -s ai-gateway` and `env pull -e NEON_AI_GATEWAY_TOKEN` both say nothing about
-* `DATABASE_URL`. `unreached` is subtracted for the same reason — see
-* {@link unreachedButCurrent}.
-*/
-const managedKeysFor = (selectedKeys, unreached) => {
-	const owned = selectedKeys ? NEON_OWNED_ENV_KEYS.filter((key) => selectedKeys.includes(key)) : [...NEON_OWNED_ENV_KEYS];
+/** Prevents scoped or unavailable services from pruning values they did not resolve. */
+const managedKeysFor = (selectedKeys, unreached, existingEnv, services, envKeys) => {
+	const existingFunctionKeys = Object.keys(existingEnv).filter(isFunctionBaseUrlKey);
+	const namedFunctionKeys = (envKeys ?? []).filter(isFunctionBaseUrlKey);
+	const ownedFunctionKeys = selectedKeys === void 0 || (services?.includes("functions") ?? false) ? existingFunctionKeys : namedFunctionKeys;
+	const owned = selectedKeys ? [...NEON_OWNED_ENV_KEYS.filter((key) => selectedKeys.includes(key)), ...ownedFunctionKeys] : [...NEON_OWNED_ENV_KEYS, ...ownedFunctionKeys];
 	if (unreached.length === 0) return owned;
 	const keep = new Set(ownedEnvServiceKeys(unreached));
-	return owned.filter((key) => !keep.has(key));
+	return owned.filter((key) => {
+		if (unreached.includes("functions") && isFunctionBaseUrlKey(key)) return false;
+		return !keep.has(key);
+	});
 };
 /**
-* Of the services this pull could not reach, the ones whose variables already on disk belong
-* to the branch being pulled — the only ones worth keeping.
-*
-* Failing to reach a service is not evidence that the branch stopped having it:
-* `PLATFORM_FEATURE_UNAVAILABLE` covers a transient incident as well as a project that
-* genuinely lacks the feature, and pruning would delete a token whose secret exists nowhere
-* else and strand the live credential behind it. But that only argues for keeping *this
-* branch's* values. Variables left over from another branch are stale by definition, and
-* keeping those would leave an app pointed at the wrong branch's gateway — a worse failure
-* than losing a token, because it is silent.
-*
-* The gateway is the only service that can be unreached (only it is implied rather than
-* observed), and its base URL is branch-scoped, so the persisted URL is what tells the two
-* cases apart. Anything that does not resolve to this branch's gateway host is pruned, which
-* is the safe direction: a stale entry costs a re-pull, a wrongly-kept one silently misroutes
-* traffic.
+* Endpoint failure is not evidence that existing values are stale; the gateway host check
+* avoids preserving credentials for a different branch.
 */
 const unreachedButCurrent = (skipped, existingEnv, branchId) => {
-	if (!skipped?.includes("ai-gateway")) return [];
-	const baseUrl = existingEnv[NEON_ENV_VAR_KEYS.aiGateway.baseUrl];
-	return baseUrl !== void 0 && isBranchGatewayUrl(baseUrl, branchId) ? ["ai-gateway"] : [];
+	if (!skipped) return [];
+	const keep = [];
+	if (skipped.includes("ai-gateway")) {
+		const baseUrl = existingEnv[NEON_ENV_VAR_KEYS.aiGateway.baseUrl];
+		if (baseUrl !== void 0 && isBranchGatewayUrl(baseUrl, branchId)) keep.push("ai-gateway");
+	}
+	if (skipped.includes("functions")) keep.push("functions");
+	return keep;
 };
 /**
 * Whether a persisted `NEON_AI_GATEWAY_BASE_URL` addresses `branchId`'s gateway.
@@ -216,10 +207,11 @@ const isBranchGatewayUrl = (baseUrl, branchId) => URL.canParse(baseUrl) && new U
 * supporting values that were not selected (the direct connection URI derives the AI Gateway
 * host, for example); those must not land in the target file.
 */
-const pickSelectedVars = (vars, selectedKeys) => {
+const pickSelectedVars = (vars, selectedKeys, services) => {
 	if (!selectedKeys) return vars;
 	const wanted = new Set(selectedKeys);
-	return Object.fromEntries(Object.entries(vars).filter(([key]) => wanted.has(key)));
+	const keepFunctionUrls = services?.includes("functions") ?? false;
+	return Object.fromEntries(Object.entries(vars).filter(([key]) => wanted.has(key) || keepFunctionUrls && isFunctionBaseUrlKey(key)));
 };
 /**
 * Pull a freshly-pinned branch's Neon env vars into a local `.env`, bundled into `link` and
@@ -254,10 +246,7 @@ Run \`${getCliName()} env pull\` once resolved (e.g. \`${getCliName()} deploy\`
 */
 const pickNeonVars = (vars) => {
 	const out = {};
-	for (const name of NEON_VAR_NAMES) {
-		const value = vars[name];
-		if (value !== void 0) out[name] = value;
-	}
+	for (const [name, value] of Object.entries(vars)) if (NEON_VAR_NAMES.some((key) => key === name) || isFunctionBaseUrlKey(name)) out[name] = value;
 	return out;
 };
 //#endregion

package/dist/commands/functions.js

@@ -2,11 +2,13 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
+import { deleteCustomDomain, listCustomDomains, registerCustomDomain } from "../custom_domains_api.js";
 import { createDeployment, deleteFunction, getFunction, listFunctions } from "../functions_api.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
 import { zipBundle } from "../utils/zip.js";
+import { DEPLOY_COMMANDS_EPILOGUE } from "./deploy_help.js";
 import { statSync } from "node:fs";
 import { dirname } from "node:path";
 import { FUNCTION_SOURCE_ENTRIES } from "@neon/config";
@@ -26,6 +28,13 @@ const FUNCTION_FIELDS = [
 	"created_at"
 ];
 const FUNCTIONS_LIST_LIMIT = 100;
+const CUSTOM_DOMAINS_LIST_LIMIT = 100;
+const CUSTOM_DOMAIN_FIELDS = [
+	"domain",
+	"entity_type",
+	"entity_id",
+	"cname_target"
+];
 const LIST_TABLE_FIELDS = [
 	"slug",
 	"name",
@@ -107,7 +116,7 @@ const builder = (argv) => argv.usage("$0 function <sub-command> [options]").opti
 		type: "boolean",
 		default: true
 	}
-}), (args) => deploy(args)).command("list", "List functions on the branch", (yargs) => yargs, (args) => list(args)).command("get <slug>", "Show a function's details", (yargs) => yargs.positional("slug", {
+}).epilogue(DEPLOY_COMMANDS_EPILOGUE), (args) => deploy(args)).command("list", "List functions on the branch", (yargs) => yargs, (args) => list(args)).command("get <slug>", "Show a function's details", (yargs) => yargs.positional("slug", {
 	describe: "Function slug",
 	type: "string",
 	demandOption: true
@@ -120,7 +129,19 @@ const builder = (argv) => argv.usage("$0 function <sub-command> [options]").opti
 	describe: "Function slug",
 	type: "string",
 	demandOption: true
-}), (args) => deleteFn(args));
+}), (args) => deleteFn(args)).command(["domains", "domain"], "Manage custom domains on the branch (beta)", (yargs) => yargs.demandCommand(1).command("list", "List custom domains on the branch", (yargs) => yargs, (args) => listDomains(args)).command("register <domain>", "Point a domain you already own at a function on the branch", (yargs) => yargs.positional("domain", {
+	describe: "Domain you already own (for example docs.example.com)",
+	type: "string",
+	demandOption: true
+}).options({ slug: {
+	describe: "Function slug this domain should point at",
+	type: "string",
+	demandOption: true
+} }), (args) => registerDomain(args)).command("delete <domain>", "Delete a custom domain from the branch", (yargs) => yargs.positional("domain", {
+	describe: "Custom domain",
+	type: "string",
+	demandOption: true
+}), (args) => deleteDomain(args)));
 const handler = (args) => {
 	return args;
 };
@@ -314,5 +335,45 @@ const list = async (props) => {
 		emptyMessage: "No functions found on this branch."
 	});
 };
+const listDomains = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const domains = [];
+	let cursor;
+	for (;;) {
+		const page = await listCustomDomains(props.apiClient, props.projectId, branchId, {
+			cursor,
+			limit: CUSTOM_DOMAINS_LIST_LIMIT
+		});
+		domains.push(...page.custom_domains);
+		if (!page.next || page.next === cursor) break;
+		cursor = page.next;
+	}
+	writer(props).end(domains, {
+		fields: CUSTOM_DOMAIN_FIELDS,
+		emptyMessage: "No custom domains found on this branch."
+	});
+};
+const registerDomain = async (props) => {
+	if (!SLUG_PATTERN.test(props.slug)) throw new Error(`Invalid function slug "${props.slug}". ${SLUG_HELP}`);
+	const branchId = await branchIdFromProps(props);
+	const registered = await retryOnLock(() => registerCustomDomain(props.apiClient, props.projectId, branchId, {
+		domain: props.domain,
+		entity_type: "function",
+		entity_id: props.slug
+	}));
+	writer(props).end(registered, { fields: CUSTOM_DOMAIN_FIELDS });
+	if (registered.cname_target) log.info(`CNAME ${registered.domain} to ${registered.cname_target}`);
+	else log.info(`No CNAME target for ${registered.domain}; this region has no custom-domains front door.`);
+};
+const deleteDomain = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	try {
+		await retryOnLock(() => deleteCustomDomain(props.apiClient, props.projectId, branchId, props.domain));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) throw new Error(`Custom domain "${props.domain}" not found on branch ${branchId}.`);
+		throw err;
+	}
+	log.info(`Custom domain ${props.domain} deleted from branch ${branchId}`);
+};
 //#endregion
 export { aliases, builder, command, describe, handler, functions_exports as t };

package/dist/commands/profile.js

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-YeAxg9Xn.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-D8AR-jvB.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
-import { a as isOwnedCredentialPath, n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
 import { setAuthContext } from "../auth_context.js";
+import { a as isOwnedCredentialPath, n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
 import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "../_chunks/profiles-CvnFEQyd.js";
 import { auth, revokeToken } from "../auth.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";

package/dist/config_services.js

@@ -14,5 +14,40 @@ const declaredNeonServices = (config) => {
 	if (isToggleEnabled(config.preview?.aiGateway)) services.push("ai-gateway");
 	return services;
 };
+const dataApiSettingsToSnake = (settings) => {
+	const out = {};
+	if (settings.dbAggregatesEnabled !== void 0) out.db_aggregates_enabled = settings.dbAggregatesEnabled;
+	if (settings.dbAnonRole !== void 0) out.db_anon_role = settings.dbAnonRole;
+	if (settings.dbExtraSearchPath !== void 0) out.db_extra_search_path = settings.dbExtraSearchPath;
+	if (settings.dbMaxRows !== void 0) out.db_max_rows = settings.dbMaxRows;
+	if (settings.dbSchemas !== void 0) out.db_schemas = settings.dbSchemas;
+	if (settings.jwtRoleClaimKey !== void 0) out.jwt_role_claim_key = settings.jwtRoleClaimKey;
+	if (settings.jwtCacheMaxLifetime !== void 0) out.jwt_cache_max_lifetime = settings.jwtCacheMaxLifetime;
+	if (settings.openapiMode !== void 0) out.openapi_mode = settings.openapiMode;
+	if (settings.serverCorsAllowedOrigins !== void 0) out.server_cors_allowed_origins = settings.serverCorsAllowedOrigins;
+	if (settings.serverTimingEnabled !== void 0) out.server_timing_enabled = settings.serverTimingEnabled;
+	return out;
+};
+/** Omitting this body preserves the server heuristic used by `--service data-api`. */
+const claimableDataApiCreateBody = (config) => {
+	if (!isToggleEnabled(config.dataApi)) return void 0;
+	const input = config.dataApi;
+	if (typeof input !== "object") return { auth_provider: "neon_auth" };
+	const settings = input.settings ? dataApiSettingsToSnake(input.settings) : void 0;
+	const withSettings = (body) => settings && Object.keys(settings).length > 0 ? {
+		...body,
+		settings
+	} : body;
+	if (input.authProvider === "external") {
+		if (input.jwksUrl === void 0 || input.jwksUrl.length === 0) throw new Error("neon.ts dataApi.authProvider \"external\" requires dataApi.jwksUrl.");
+		return withSettings({
+			auth_provider: "external",
+			jwks_url: input.jwksUrl,
+			...input.providerName !== void 0 ? { provider_name: input.providerName } : {},
+			...input.jwtAudience !== void 0 ? { jwt_audience: input.jwtAudience } : {}
+		});
+	}
+	return withSettings({ auth_provider: "neon_auth" });
+};
 //#endregion
-export { declaredNeonServices };
+export { claimableDataApiCreateBody, declaredNeonServices };

package/dist/credential_io.js

@@ -1,2 +1,2 @@
-import { t as storeFor } from "./_chunks/credential_io-YeAxg9Xn.js";
+import { t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
 export { storeFor };

package/dist/custom_domains_api.js

@@ -0,0 +1,37 @@
+//#region src/custom_domains_api.ts
+const customDomainsPath = (projectId, branchId) => `/projects/${encodeURIComponent(projectId)}/branches/${encodeURIComponent(branchId)}/custom-domains`;
+const listCustomDomains = async (apiClient, projectId, branchId, { cursor, limit } = {}) => {
+	const { data } = await apiClient.request({
+		path: customDomainsPath(projectId, branchId),
+		method: "GET",
+		query: {
+			cursor,
+			limit
+		},
+		secure: true,
+		format: "json"
+	});
+	return {
+		custom_domains: data.custom_domains ?? [],
+		next: data.pagination?.next
+	};
+};
+const registerCustomDomain = async (apiClient, projectId, branchId, input) => {
+	const { data } = await apiClient.request({
+		path: customDomainsPath(projectId, branchId),
+		method: "POST",
+		body: input,
+		format: "json",
+		secure: true
+	});
+	return data;
+};
+const deleteCustomDomain = async (apiClient, projectId, branchId, domain) => {
+	await apiClient.request({
+		path: `${customDomainsPath(projectId, branchId)}/${encodeURIComponent(domain)}`,
+		method: "DELETE",
+		secure: true
+	});
+};
+//#endregion
+export { deleteCustomDomain, listCustomDomains, registerCustomDomain };

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveNeonEnvVars, i as resolveDevEnv, n as MissingBranchContextError, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-NbA61JR3.js";
+import { a as resolveNeonEnvVars, i as resolveDevEnv, n as MissingBranchContextError, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-CZmstYrY.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, resolveDevEnv, resolveNeonEnvVars };