neon 4.17.4 → 4.18.0

package/README.md

@@ -736,6 +736,8 @@ neon function domains delete docs.example.com
 
 Register prints the record, then an INFO line `CNAME <domain> to <cname_target>`. The domain goes live after that CNAME resolves and a certificate is issued on the first request.
 
+A `neon.ts` `customDomains` list is applied by `neon config plan`, `neon config apply`, and `neon checkout` only on the project's default branch. Other branches still deploy the function. Set `customDomains` in the `branch` closure to register a hostname on a child. See [`@neon/config` Default-branch-only fields](../config/README.md#default-branch-only-fields).
+
 When a package cannot be bundled — a native addon with no esbuild loader, or an optional peer dependency a library references on an untaken code path — list it in that function's `externalPackages` and the bundler leaves the import alone. `neon dev` honours the same list. It does not make the package resolvable in the deployed archive (there is no `node_modules` next to the bundle), so it only unblocks an import that is never evaluated — a dependency the handler actually calls has to be bundled, and a natively-backed one cannot be. See [`@neon/config`](../config/README.md#unbundleable-dependencies-externalpackages).
 
 ## Scaffold a project (`bootstrap`)

package/dist/commands/config.js

@@ -12,7 +12,7 @@ import { loadEnvFileIntoProcess } from "../env_file.js";
 import { writer } from "../writer.js";
 import { assertAiGatewayProvisionable, warnAiGateway } from "../utils/ai_gateway_notice.js";
 import { announceTargetBranch } from "../utils/branch_notice.js";
-import { renderAppliedChanges, renderBranchSettingConflicts } from "../utils/config_diff.js";
+import { renderAppliedChanges, renderBranchSettingConflicts, renderCustomDomainFollowup } from "../utils/config_diff.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { formatInstallCommand, installArgs, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { bundleEntry } from "../utils/esbuild.js";
@@ -70,6 +70,7 @@ const neonctlBundler = async (fn) => {
 	assertZipWithinLimits(fn.slug, zip, entries);
 	return zip;
 };
+const reasonAllowsUpdateExisting = (reason) => reason.includes("Pass `updateExisting: true`");
 const INSPECT_FIELDS = [
 	"project",
 	"branch",
@@ -381,6 +382,7 @@ const planCmd = async (props) => {
 	});
 	const services = utilizedServices(config);
 	reportPushResult(props, result, "plan", services);
+	if (result.conflicts.some((conflict) => conflict.field === "customDomain" && !reasonAllowsUpdateExisting(conflict.reason))) process.exitCode = 1;
 	if (services.includes("AI Gateway")) await warnAiGateway({
 		apiClient: props.apiClient,
 		projectId: props.projectId,
@@ -411,7 +413,8 @@ const applyCmd = async (props) => {
 	} catch (err) {
 		if (err instanceof PushConflictError) {
 			reportConflicts(props, err.conflicts);
-			throw new Error("Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above.");
+			const overrideable = err.conflicts.every((c) => reasonAllowsUpdateExisting(c.reason));
+			throw new Error(overrideable ? "Branch settings conflict with the policy. Re-run with --update-existing to apply the changes shown above." : "The policy conflicts with remote state. --update-existing will not resolve every conflict shown above.");
 		}
 		throw err;
 	}
@@ -472,9 +475,16 @@ const reportPushResult = (props, result, mode, services) => {
 	}
 	const color = props.color !== false;
 	const out = writer(props);
-	const noChanges = appliedChanges.length === 0;
+	const noChanges = appliedChanges.length === 0 && result.conflicts.length === 0;
 	const appliedText = renderAppliedChanges(appliedChanges, mode === "plan" ? "Planned changes" : "Applied changes", { color });
 	if (appliedText) out.text(`${appliedText}\n`);
+	if (result.conflicts.length > 0) {
+		const conflictText = renderBranchSettingConflicts(result.conflicts, { color });
+		if (conflictText) out.text(`\n${conflictText}\n`);
+		for (const conflict of result.conflicts) if (!reasonAllowsUpdateExisting(conflict.reason)) out.text(`  ! ${conflict.field}: ${conflict.reason}\n`);
+	}
+	const followup = renderCustomDomainFollowup(result, { color });
+	if (followup) out.text(`\n${followup}\n`);
 	if (functionUrlBySlug.size > 0) {
 		const heading = mode === "plan" ? "Function URLs (after apply)" : "Function URLs";
 		out.text(`\n${isCi() ? heading : chalk.bold(heading)}\n`);
@@ -498,7 +508,7 @@ const reportConflicts = (props, conflicts) => {
 	const out = writer(props);
 	const text = renderBranchSettingConflicts([...conflicts], { color: props.color !== false });
 	if (text) out.text(`${text}\n`);
-	for (const conflict of conflicts) if (!/updateExisting/i.test(conflict.reason)) out.text(`  ! ${conflict.field}: ${conflict.reason}\n`);
+	for (const conflict of conflicts) if (!reasonAllowsUpdateExisting(conflict.reason)) out.text(`  ! ${conflict.field}: ${conflict.reason}\n`);
 };
 /**
 * Block provisioning the AI Gateway on a Free plan from the `checkout` policy paths, which
@@ -565,11 +575,20 @@ const applyPolicyOnCreate = async (props) => {
 */
 const logPolicyResult = (result, opts) => {
 	const changes = result.applied.filter((c) => c.action !== "noop");
-	if (changes.length === 0) {
+	if (changes.length === 0 && result.conflicts.length === 0) {
 		log.info("neon.ts applied — no changes were needed.");
+		const followup = renderCustomDomainFollowup(result, opts);
+		if (followup) log.info("%s", followup);
 		return;
 	}
-	log.info("%s", renderAppliedChanges(changes, `neon.ts applied — ${changes.length} change${changes.length === 1 ? "" : "s"}:`, opts));
+	if (changes.length > 0) log.info("%s", renderAppliedChanges(changes, `neon.ts applied — ${changes.length} change${changes.length === 1 ? "" : "s"}:`, opts));
+	if (result.conflicts.length > 0) {
+		const conflictText = renderBranchSettingConflicts(result.conflicts, opts);
+		if (conflictText) log.info("%s", conflictText);
+		for (const conflict of result.conflicts) if (!reasonAllowsUpdateExisting(conflict.reason)) log.info("  ! %s: %s", conflict.field, conflict.reason);
+	}
+	const followup = renderCustomDomainFollowup(result, opts);
+	if (followup) log.info("%s", followup);
 };
 /**
 * Create a branch **from** the local `neon.ts` policy. Returns `null` when there is no

package/dist/utils/config_diff.js

@@ -75,11 +75,19 @@ const renderBranchGroups = (byBranch, paint) => {
 	return lines;
 };
 /** Friendly label for a service change identifier (`bucket:x` → `bucket x`). */
-const serviceLabel = (identifier) => {
+const serviceLabel = (identifier, details) => {
 	if (identifier === "auth") return "Neon Auth";
 	if (identifier === "dataApi") return "Data API";
 	if (identifier.startsWith("bucket:")) return `bucket ${identifier.slice(7)}`;
 	if (identifier.startsWith("function:")) return `function ${identifier.slice(9)}`;
+	if (identifier.startsWith("domain:")) {
+		const domain = identifier.slice(7);
+		const previous = typeof details?.previousSlug === "string" ? details.previousSlug : void 0;
+		const slug = typeof details?.slug === "string" ? details.slug : void 0;
+		if (previous !== void 0 && slug !== void 0) return `domain ${domain}: ${previous} → ${slug}`;
+		if (slug !== void 0) return `domain ${domain} -> ${slug}`;
+		return `domain ${domain}`;
+	}
 	return identifier;
 };
 /**
@@ -110,7 +118,7 @@ const renderAppliedChanges = (changes, title, opts) => {
 	const lines = [paint.title(title)];
 	const services = changes.filter((c) => c.kind === "service").sort((a, b) => a.identifier.localeCompare(b.identifier));
 	for (const service of services) {
-		const label = serviceLabel(service.identifier);
+		const label = serviceLabel(service.identifier, service.details);
 		const line = service.action === "create" ? `+ ${label}` : service.action === "delete" ? `- ${label}` : `~ ${label}`;
 		lines.push(`  ${service.action === "create" ? paint.added(line) : service.action === "delete" ? paint.removed(line) : paint.arrow(line)}`);
 	}
@@ -122,22 +130,39 @@ const renderAppliedChanges = (changes, title, opts) => {
 	lines.push(...renderBranchGroups(byBranch, paint));
 	return lines.join("\n");
 };
-/**
-* Render branch-setting **conflicts** (drift the policy wants to change but that
-* needs `--update-existing`) as a `git diff`-style before→after report: grouped
-* per branch, sorted by field, `current → desired` with the old value in red and
-* the new in green. Conflicts already carry both sides, so this is the fullest
-* form of the diff. Returns "" when there are no conflicts.
-*/
+const isOverrideableConflict = (conflict) => conflict.reason.includes("Pass `updateExisting: true`");
+const CUSTOM_DOMAIN_REASON = /^custom domain "([^"]+)"/;
+const labeledConflictField = (conflict) => {
+	if (conflict.field !== "customDomain") return conflict.field;
+	const match = CUSTOM_DOMAIN_REASON.exec(conflict.reason);
+	return match?.[1] !== void 0 ? `customDomain ${match[1]}` : conflict.field;
+};
 const renderBranchSettingConflicts = (conflicts, opts) => {
 	if (conflicts.length === 0) return "";
 	const paint = palette(opts.color);
 	const byBranch = /* @__PURE__ */ new Map();
 	for (const conflict of conflicts) {
 		const existing = byBranch.get(conflict.identifier) ?? [];
-		byBranch.set(conflict.identifier, [...existing, ...expandField(conflict.field, conflict.current, conflict.desired)]);
+		byBranch.set(conflict.identifier, [...existing, ...expandField(labeledConflictField(conflict), conflict.current, conflict.desired)]);
+	}
+	const heading = conflicts.every(isOverrideableConflict) ? "Branch settings differ (re-run with --update-existing to apply)" : "Branch settings differ";
+	return [paint.title(heading), ...renderBranchGroups(byBranch, paint)].join("\n");
+};
+const renderCustomDomainFollowup = (result, opts) => {
+	const paint = palette(opts.color);
+	const lines = [];
+	const cnames = (result.customDomains ?? []).filter((d) => d.cnameTarget !== void 0 && d.cnameTarget !== "");
+	if (cnames.length > 0) {
+		lines.push(paint.title("Custom domains"));
+		for (const d of cnames) lines.push(`  CNAME ${d.domain} -> ${d.cnameTarget}`);
+		lines.push("  Point each hostname at the CNAME target. Neon does not create DNS records.");
 	}
-	return [paint.title("Branch settings differ (re-run with --update-existing to apply)"), ...renderBranchGroups(byBranch, paint)].join("\n");
+	if (result.warnings.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push(paint.title("Warnings"));
+		for (const warning of result.warnings) lines.push(`  ${warning}`);
+	}
+	return lines.join("\n");
 };
 //#endregion
-export { renderAppliedChanges, renderBranchSettingConflicts };
+export { renderAppliedChanges, renderBranchSettingConflicts, renderCustomDomainFollowup };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.17.4",
+  "version": "4.18.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.4.3",
+    "@neon/config": "1.5.0",
     "@neon/sdk": "5.0.0",
-    "@neon/config-runtime": "1.3.3"
+    "@neon/config-runtime": "1.4.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -97,8 +97,8 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.15",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.16",
     "@neon/e2e-harness": "0.0.0",
     "@neon/functions": "0.10.0"
   },