@neon/env 0.0.0 → 0.9.0

package/dist/config/dist/lib/neon-api.d.ts

@@ -0,0 +1,375 @@
+import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from "./types.js";
+
+//#region ../config/dist/lib/neon-api.d.ts
+
+//#region src/lib/neon-api.d.ts
+/**
+ * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream
+ * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream
+ * shape — keeping the surface narrow makes the in-memory fake practical to maintain.
+ */
+interface NeonProjectSnapshot {
+  id: string;
+  name: string;
+  regionId: string;
+  pgVersion: number;
+  orgId?: string;
+  defaultEndpointSettings?: ComputeSettings;
+}
+interface NeonBranchSnapshot {
+  id: string;
+  name: string;
+  parentId?: string;
+  isDefault: boolean;
+  /** Whether the branch is marked protected on Neon. */
+  protected: boolean;
+  expiresAt?: string;
+}
+interface NeonEndpointSnapshot {
+  id: string;
+  branchId: string;
+  type: "read_only" | "read_write";
+  autoscalingLimitMinCu: ComputeSettings["autoscalingLimitMinCu"];
+  autoscalingLimitMaxCu: ComputeSettings["autoscalingLimitMaxCu"];
+  suspendTimeout: ComputeSettings["suspendTimeout"];
+}
+interface CreateProjectInput {
+  name: string;
+  regionId: string;
+  pgVersion?: number;
+  orgId?: string;
+  defaultEndpointSettings?: ComputeSettings;
+  /**
+   * Optional name for the project's auto-created default branch. When omitted, Neon
+   * uses its own default (`main`).
+   */
+  defaultBranchName?: string;
+}
+interface CreateBranchInput {
+  name: string;
+  parentId?: string;
+  expiresAt?: string;
+  /** When `true`, the branch is created with the `protected` flag set on Neon. */
+  protected?: boolean;
+  computeSettings?: ComputeSettings;
+}
+interface UpdateBranchInput {
+  name?: string;
+  expiresAt?: string | null;
+  /** When set, toggles the branch's `protected` flag on Neon. */
+  protected?: boolean;
+}
+/**
+ * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by
+ * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI
+ * with the role's password baked in.
+ */
+interface NeonRoleSnapshot {
+  name: string;
+  branchId: string;
+  /** Whether the role is system-protected (cannot be deleted). */
+  protected: boolean;
+}
+/**
+ * A database on a Neon branch (e.g. `neondb`).
+ */
+interface NeonDatabaseSnapshot {
+  name: string;
+  branchId: string;
+  /** The role that owns the database (one role can own multiple databases). */
+  ownerName: string;
+}
+/**
+ * Bits of a Neon Auth integration. The key fields are optional because the Neon API only
+ * includes them on create / rotate responses; `GET /auth` returns the public fields.
+ */
+interface NeonAuthSnapshot {
+  /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */
+  projectId: string;
+  /** Public client key (`pub_client_key`), only present on create / rotate responses. */
+  publishableClientKey?: string;
+  /** Secret server key (`secret_server_key`), only present on create / rotate responses. */
+  secretServerKey?: string;
+  /** JWKS URL for verifying tokens issued by Neon Auth. */
+  jwksUrl: string;
+  /** Optional base URL of the Neon Auth deployment. */
+  baseUrl?: string;
+}
+/**
+ * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of
+ * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed
+ * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing
+ * when present and ignored when absent.
+ */
+interface NeonDataApiSnapshot {
+  /** REST endpoint URL. */
+  url: string;
+  /** Deployment status (e.g. `"ready"`), when reported. */
+  status?: string;
+  /** Current runtime settings (SubZero only); `null`/absent when not reported. */
+  settings?: DataApiSettings | null;
+}
+/**
+ * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data
+ * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the
+ * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).
+ * `authProvider` is the friendly `"neon"` / `"external"` value (mapped to the API's
+ * `neon_auth` / `external` by the adapter).
+ */
+interface EnableDataApiInput {
+  authProvider?: DataApiAuthProvider;
+  jwksUrl?: string;
+  providerName?: string;
+  jwtAudience?: string;
+  settings?: DataApiSettings;
+}
+/**
+ * A branchable object-storage bucket (Preview). Backed by the Neon Platform
+ * branchable-storage service.
+ */
+interface NeonBucketSnapshot {
+  name: string;
+  accessLevel: BucketAccessLevel;
+}
+/**
+ * S3-compatible connection details for a branch's object storage (Preview) — the
+ * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it
+ * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from
+ * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's
+ * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the
+ * path).
+ */
+interface NeonBranchStorageSnapshot {
+  /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */
+  s3Endpoint: string;
+  /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */
+  region: string;
+  /** Whether the S3 client must use path-style addressing (always `true` today). */
+  forcePathStyle: boolean;
+}
+/**
+ * Input for creating a bucket on a branch.
+ */
+interface CreateBucketInput {
+  name: string;
+  accessLevel?: BucketAccessLevel;
+}
+/**
+ * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:
+ * the immutable `slug`, the display `name`, and the active deployment id when one exists.
+ */
+interface NeonFunctionSnapshot {
+  /** Opaque, stable function identifier. */
+  id: string;
+  /** Branch-unique slug (the invocation path segment). Immutable. */
+  slug: string;
+  /** Free-form display name. */
+  name: string;
+  /** URL at which the function is invoked. */
+  invocationUrl: string;
+  /** Id (platform version number) of the active deployment, when any code is deployed. */
+  activeDeploymentId?: number;
+}
+/**
+ * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the
+ * function source — building it (esbuild + zip) is an imperative step performed by the
+ * caller, not by the {@link NeonApi} adapter.
+ */
+interface DeployFunctionInput {
+  bundle: Uint8Array;
+  runtime: FunctionRuntime;
+  environment: Record<string, string>;
+}
+/**
+ * A function deployment (Preview).
+ */
+interface NeonFunctionDeploymentSnapshot {
+  /** The deployment id (monotonic per function). */
+  id: number;
+  status: "pending" | "building" | "completed" | "failed";
+}
+/**
+ * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`
+ * (`POST .../credentials`, `x-stability-level: beta`):
+ *
+ * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's
+ *   enabled Preview features, never hand-authored).
+ * - `principalType` — `user` (developer/app) or `function` (a deployed function).
+ * - `functionId` — required when `principalType === "function"`.
+ * - `name` — optional free-form label echoed back on the response.
+ */
+interface CreateCredentialInput {
+  scopes: CredentialScope[];
+  principalType: CredentialPrincipalType;
+  functionId?: string;
+  name?: string;
+}
+/**
+ * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API
+ * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly
+ * once** (they are not stored server-side), so the caller must persist them immediately;
+ * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`
+ * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles
+ * as the S3 access-key id.
+ */
+interface NeonCredentialSecret {
+  tokenId: string;
+  tokenIdShort: string;
+  name?: string;
+  /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */
+  apiToken: string;
+  /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */
+  s3SecretAccessKey: string;
+  scopes: CredentialScope[];
+  branchId: string;
+  createdAt: string;
+  /** When the credential expires; absent means it never expires. */
+  expiresAt?: string;
+}
+/**
+ * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by
+ * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.
+ */
+interface NeonCredentialMeta {
+  tokenId: string;
+  tokenIdShort: string;
+  name?: string;
+  scopes: CredentialScope[];
+  principalType: CredentialPrincipalType;
+  functionId?: string;
+  branchId?: string;
+  createdAt: string;
+  lastUsedAt?: string;
+  revokedAt?: string;
+  expiresAt?: string;
+}
+/**
+ * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`
+ * are optional — when omitted, the API uses the project's default branch and that
+ * branch's read-write endpoint, respectively.
+ */
+interface GetConnectionUriInput {
+  branchId?: string;
+  endpointId?: string;
+  databaseName: string;
+  roleName: string;
+  /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */
+  pooled?: boolean;
+}
+/**
+ * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`
+ * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us
+ * inject a real in-memory fake during tests without resorting to module mocks.
+ */
+interface NeonApi {
+  listProjects(filter: {
+    orgId?: string;
+  }): Promise<NeonProjectSnapshot[]>;
+  getProject(projectId: string): Promise<NeonProjectSnapshot>;
+  createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;
+  updateProject(projectId: string, input: {
+    name?: string;
+    defaultEndpointSettings?: ComputeSettings;
+  }): Promise<NeonProjectSnapshot>;
+  listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;
+  createBranch(projectId: string, input: CreateBranchInput): Promise<{
+    branch: NeonBranchSnapshot;
+    endpoints: NeonEndpointSnapshot[];
+  }>;
+  updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;
+  listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;
+  updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;
+  /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */
+  listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;
+  /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */
+  listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;
+  /**
+   * Fetch a Postgres connection URI for the given role + database on a branch.
+   * Returns the same string the Neon Console shows under "Connection Details".
+   */
+  getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{
+    uri: string;
+  }>;
+  /**
+   * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when
+   * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`
+   * namespace can be populated.
+   */
+  getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;
+  /**
+   * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration
+   * is already enabled, the existing snapshot is returned unchanged. Used by
+   * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.
+   */
+  enableNeonAuth(projectId: string, branchId: string, input?: {
+    databaseName?: string;
+  }): Promise<NeonAuthSnapshot>;
+  /**
+   * Fetch the Neon Data API integration attached to a specific branch + database.
+   * Returns `null` when no integration is enabled — used by `fetchEnv` to decide
+   * whether the `env.dataApi` namespace can be populated.
+   */
+  getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;
+  /**
+   * Enable the Neon Data API integration on a specific branch + database. Idempotent:
+   * if an integration is already enabled, the existing snapshot is returned unchanged.
+   * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The
+   * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial
+   * settings; omit it for an all-defaults, Neon-Auth integration.
+   */
+  enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;
+  /**
+   * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration
+   * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only
+   * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at
+   * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.
+   */
+  updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;
+  /** List branchable object-storage buckets visible on a branch. */
+  listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;
+  /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */
+  createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;
+  /** Delete a bucket from a branch. */
+  deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;
+  /**
+   * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,
+   * path-style). Returns `null` when storage is not enabled for the branch (the API's 404
+   * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env
+   * alongside the minted credential's access keys.
+   */
+  getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;
+  /** List functions on a branch. */
+  listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;
+  /** Delete a function (by slug) from a branch. */
+  deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;
+  /**
+   * Deploy a built bundle to a function, creating the function if it does not yet exist —
+   * Neon has no separate create endpoint, so the first deployment to a slug creates the
+   * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)
+   * by the caller and passed in as bytes.
+   */
+  deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;
+  /**
+   * Mint a new scoped service credential on a branch (`POST .../credentials`). The
+   * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`
+   * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the
+   * unified credential for the branch's enabled Preview features (object storage, AI
+   * Gateway, Functions).
+   */
+  createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;
+  /**
+   * List the secret-free metadata for credentials issued on a branch
+   * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)
+   * and to verify a persisted credential still exists / isn't revoked.
+   */
+  listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;
+  /**
+   * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).
+   * Idempotent.
+   */
+  revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;
+}
+//#endregion
+//#endregion
+export { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };
+//# sourceMappingURL=neon-api.d.ts.map

package/dist/config/dist/lib/neon-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon-api.d.ts","names":["BucketAccessLevel","ComputeSettings","CredentialPrincipalType","CredentialScope","DataApiAuthProvider","DataApiSettings","FunctionRuntime","NeonProjectSnapshot","NeonBranchSnapshot","NeonEndpointSnapshot","CreateProjectInput","CreateBranchInput","UpdateBranchInput","NeonRoleSnapshot","NeonDatabaseSnapshot","NeonAuthSnapshot","NeonDataApiSnapshot","EnableDataApiInput","NeonBucketSnapshot","NeonBranchStorageSnapshot","CreateBucketInput","NeonFunctionSnapshot","DeployFunctionInput","Uint8Array","Record","NeonFunctionDeploymentSnapshot","CreateCredentialInput","NeonCredentialSecret","NeonCredentialMeta","GetConnectionUriInput","NeonApi","Promise"],"sources":["../../../../../config/dist/lib/neon-api.d.ts"],"sourcesContent":["import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from \"./types.js\";\n\n//#region src/lib/neon-api.d.ts\n\n/**\n * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream\n * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream\n * shape — keeping the surface narrow makes the in-memory fake practical to maintain.\n */\ninterface NeonProjectSnapshot {\n  id: string;\n  name: string;\n  regionId: string;\n  pgVersion: number;\n  orgId?: string;\n  defaultEndpointSettings?: ComputeSettings;\n}\ninterface NeonBranchSnapshot {\n  id: string;\n  name: string;\n  parentId?: string;\n  isDefault: boolean;\n  /** Whether the branch is marked protected on Neon. */\n  protected: boolean;\n  expiresAt?: string;\n}\ninterface NeonEndpointSnapshot {\n  id: string;\n  branchId: string;\n  type: \"read_only\" | \"read_write\";\n  autoscalingLimitMinCu: ComputeSettings[\"autoscalingLimitMinCu\"];\n  autoscalingLimitMaxCu: ComputeSettings[\"autoscalingLimitMaxCu\"];\n  suspendTimeout: ComputeSettings[\"suspendTimeout\"];\n}\ninterface CreateProjectInput {\n  name: string;\n  regionId: string;\n  pgVersion?: number;\n  orgId?: string;\n  defaultEndpointSettings?: ComputeSettings;\n  /**\n   * Optional name for the project's auto-created default branch. When omitted, Neon\n   * uses its own default (`main`).\n   */\n  defaultBranchName?: string;\n}\ninterface CreateBranchInput {\n  name: string;\n  parentId?: string;\n  expiresAt?: string;\n  /** When `true`, the branch is created with the `protected` flag set on Neon. */\n  protected?: boolean;\n  computeSettings?: ComputeSettings;\n}\ninterface UpdateBranchInput {\n  name?: string;\n  expiresAt?: string | null;\n  /** When set, toggles the branch's `protected` flag on Neon. */\n  protected?: boolean;\n}\n/**\n * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by\n * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI\n * with the role's password baked in.\n */\ninterface NeonRoleSnapshot {\n  name: string;\n  branchId: string;\n  /** Whether the role is system-protected (cannot be deleted). */\n  protected: boolean;\n}\n/**\n * A database on a Neon branch (e.g. `neondb`).\n */\ninterface NeonDatabaseSnapshot {\n  name: string;\n  branchId: string;\n  /** The role that owns the database (one role can own multiple databases). */\n  ownerName: string;\n}\n/**\n * Bits of a Neon Auth integration. The key fields are optional because the Neon API only\n * includes them on create / rotate responses; `GET /auth` returns the public fields.\n */\ninterface NeonAuthSnapshot {\n  /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */\n  projectId: string;\n  /** Public client key (`pub_client_key`), only present on create / rotate responses. */\n  publishableClientKey?: string;\n  /** Secret server key (`secret_server_key`), only present on create / rotate responses. */\n  secretServerKey?: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth. */\n  jwksUrl: string;\n  /** Optional base URL of the Neon Auth deployment. */\n  baseUrl?: string;\n}\n/**\n * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of\n * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed\n * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing\n * when present and ignored when absent.\n */\ninterface NeonDataApiSnapshot {\n  /** REST endpoint URL. */\n  url: string;\n  /** Deployment status (e.g. `\"ready\"`), when reported. */\n  status?: string;\n  /** Current runtime settings (SubZero only); `null`/absent when not reported. */\n  settings?: DataApiSettings | null;\n}\n/**\n * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data\n * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the\n * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).\n * `authProvider` is the friendly `\"neon\"` / `\"external\"` value (mapped to the API's\n * `neon_auth` / `external` by the adapter).\n */\ninterface EnableDataApiInput {\n  authProvider?: DataApiAuthProvider;\n  jwksUrl?: string;\n  providerName?: string;\n  jwtAudience?: string;\n  settings?: DataApiSettings;\n}\n/**\n * A branchable object-storage bucket (Preview). Backed by the Neon Platform\n * branchable-storage service.\n */\ninterface NeonBucketSnapshot {\n  name: string;\n  accessLevel: BucketAccessLevel;\n}\n/**\n * S3-compatible connection details for a branch's object storage (Preview) — the\n * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it\n * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from\n * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's\n * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the\n * path).\n */\ninterface NeonBranchStorageSnapshot {\n  /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */\n  s3Endpoint: string;\n  /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */\n  region: string;\n  /** Whether the S3 client must use path-style addressing (always `true` today). */\n  forcePathStyle: boolean;\n}\n/**\n * Input for creating a bucket on a branch.\n */\ninterface CreateBucketInput {\n  name: string;\n  accessLevel?: BucketAccessLevel;\n}\n/**\n * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:\n * the immutable `slug`, the display `name`, and the active deployment id when one exists.\n */\ninterface NeonFunctionSnapshot {\n  /** Opaque, stable function identifier. */\n  id: string;\n  /** Branch-unique slug (the invocation path segment). Immutable. */\n  slug: string;\n  /** Free-form display name. */\n  name: string;\n  /** URL at which the function is invoked. */\n  invocationUrl: string;\n  /** Id (platform version number) of the active deployment, when any code is deployed. */\n  activeDeploymentId?: number;\n}\n/**\n * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the\n * function source — building it (esbuild + zip) is an imperative step performed by the\n * caller, not by the {@link NeonApi} adapter.\n */\ninterface DeployFunctionInput {\n  bundle: Uint8Array;\n  runtime: FunctionRuntime;\n  environment: Record<string, string>;\n}\n/**\n * A function deployment (Preview).\n */\ninterface NeonFunctionDeploymentSnapshot {\n  /** The deployment id (monotonic per function). */\n  id: number;\n  status: \"pending\" | \"building\" | \"completed\" | \"failed\";\n}\n/**\n * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`\n * (`POST .../credentials`, `x-stability-level: beta`):\n *\n * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's\n *   enabled Preview features, never hand-authored).\n * - `principalType` — `user` (developer/app) or `function` (a deployed function).\n * - `functionId` — required when `principalType === \"function\"`.\n * - `name` — optional free-form label echoed back on the response.\n */\ninterface CreateCredentialInput {\n  scopes: CredentialScope[];\n  principalType: CredentialPrincipalType;\n  functionId?: string;\n  name?: string;\n}\n/**\n * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API\n * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly\n * once** (they are not stored server-side), so the caller must persist them immediately;\n * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`\n * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles\n * as the S3 access-key id.\n */\ninterface NeonCredentialSecret {\n  tokenId: string;\n  tokenIdShort: string;\n  name?: string;\n  /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */\n  apiToken: string;\n  /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */\n  s3SecretAccessKey: string;\n  scopes: CredentialScope[];\n  branchId: string;\n  createdAt: string;\n  /** When the credential expires; absent means it never expires. */\n  expiresAt?: string;\n}\n/**\n * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by\n * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.\n */\ninterface NeonCredentialMeta {\n  tokenId: string;\n  tokenIdShort: string;\n  name?: string;\n  scopes: CredentialScope[];\n  principalType: CredentialPrincipalType;\n  functionId?: string;\n  branchId?: string;\n  createdAt: string;\n  lastUsedAt?: string;\n  revokedAt?: string;\n  expiresAt?: string;\n}\n/**\n * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`\n * are optional — when omitted, the API uses the project's default branch and that\n * branch's read-write endpoint, respectively.\n */\ninterface GetConnectionUriInput {\n  branchId?: string;\n  endpointId?: string;\n  databaseName: string;\n  roleName: string;\n  /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */\n  pooled?: boolean;\n}\n/**\n * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`\n * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us\n * inject a real in-memory fake during tests without resorting to module mocks.\n */\ninterface NeonApi {\n  listProjects(filter: {\n    orgId?: string;\n  }): Promise<NeonProjectSnapshot[]>;\n  getProject(projectId: string): Promise<NeonProjectSnapshot>;\n  createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;\n  updateProject(projectId: string, input: {\n    name?: string;\n    defaultEndpointSettings?: ComputeSettings;\n  }): Promise<NeonProjectSnapshot>;\n  listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;\n  createBranch(projectId: string, input: CreateBranchInput): Promise<{\n    branch: NeonBranchSnapshot;\n    endpoints: NeonEndpointSnapshot[];\n  }>;\n  updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;\n  listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;\n  updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;\n  /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */\n  listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;\n  /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */\n  listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;\n  /**\n   * Fetch a Postgres connection URI for the given role + database on a branch.\n   * Returns the same string the Neon Console shows under \"Connection Details\".\n   */\n  getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{\n    uri: string;\n  }>;\n  /**\n   * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when\n   * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`\n   * namespace can be populated.\n   */\n  getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;\n  /**\n   * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration\n   * is already enabled, the existing snapshot is returned unchanged. Used by\n   * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.\n   */\n  enableNeonAuth(projectId: string, branchId: string, input?: {\n    databaseName?: string;\n  }): Promise<NeonAuthSnapshot>;\n  /**\n   * Fetch the Neon Data API integration attached to a specific branch + database.\n   * Returns `null` when no integration is enabled — used by `fetchEnv` to decide\n   * whether the `env.dataApi` namespace can be populated.\n   */\n  getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;\n  /**\n   * Enable the Neon Data API integration on a specific branch + database. Idempotent:\n   * if an integration is already enabled, the existing snapshot is returned unchanged.\n   * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The\n   * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial\n   * settings; omit it for an all-defaults, Neon-Auth integration.\n   */\n  enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;\n  /**\n   * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration\n   * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only\n   * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at\n   * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.\n   */\n  updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;\n  /** List branchable object-storage buckets visible on a branch. */\n  listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;\n  /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */\n  createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;\n  /** Delete a bucket from a branch. */\n  deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;\n  /**\n   * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,\n   * path-style). Returns `null` when storage is not enabled for the branch (the API's 404\n   * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env\n   * alongside the minted credential's access keys.\n   */\n  getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;\n  /** List functions on a branch. */\n  listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;\n  /** Delete a function (by slug) from a branch. */\n  deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;\n  /**\n   * Deploy a built bundle to a function, creating the function if it does not yet exist —\n   * Neon has no separate create endpoint, so the first deployment to a slug creates the\n   * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)\n   * by the caller and passed in as bytes.\n   */\n  deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;\n  /**\n   * Mint a new scoped service credential on a branch (`POST .../credentials`). The\n   * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`\n   * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the\n   * unified credential for the branch's enabled Preview features (object storage, AI\n   * Gateway, Functions).\n   */\n  createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;\n  /**\n   * List the secret-free metadata for credentials issued on a branch\n   * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)\n   * and to verify a persisted credential still exists / isn't revoked.\n   */\n  listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;\n  /**\n   * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).\n   * Idempotent.\n   */\n  revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;\n}\n//#endregion\nexport { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };\n//# sourceMappingURL=neon-api.d.ts.map"],"mappings":";;;;;AAe2C;AAEf;;;;UARlBO,mBAAAA,CAuBQN;EAAe,EAAA,EAAA,MAAA;EAAA,IAEvBS,EAAAA,MAAAA;EAKiC,QAOjCC,EAAAA,MAAAA;EAMyB,SAEzBC,EAAAA,MAAAA;EAAiB,KAWjBC,CAAAA,EAAAA,MAAAA;EAAgB,uBAShBC,CAAAA,EA3DkBb,eA2DE;AAAA;AAUJ,UAnEhBO,kBAAAA,CAqFmB;EAMD,EASlBS,EAAAA,MAAAA;EAAkB,IAAA,EAAA,MAAA;UACXb,CAAAA,EAAAA,MAAAA;WAIJC,EAAAA,OAAAA;EAAe;EAAA,SAMlBa,EAAAA,OAAAA;EAEsB,SAUtBC,CAAAA,EAAAA,MAAAA;AAAyB;AAaF,UA/HvBV,oBAAAA,CAqIoB;EAAA,EAiBpBa,EAAAA,MAAAA;EAAmB,QAAA,EAAA,MAAA;QACnBC,WAAAA,GAAAA,YAAAA;uBACCjB,EApJcL,eAoJdK,CAAAA,uBAAAA,CAAAA;uBACIkB,EApJUvB,eAoJVuB,CAAAA,uBAAAA,CAAAA;EAAM,cAAA,EAnJHvB,eAmJG,CAAA,gBAAA,CAAA;AAAA;AAKmB,UAtJ9BS,kBAAAA,CAqKqB;EAAA,IAAA,EAAA,MAAA;UACrBP,EAAAA,MAAAA;WACOD,CAAAA,EAAAA,MAAAA;EAAuB,KAAA,CAAA,EAAA,MAAA;EAAA,uBAY9ByB,CAAAA,EA9KkB1B,eAsLlBE;EAAe;;;;EAee,iBAAA,CAAA,EAAA,MAAA;AAAA;AAaT,UA3MrBQ,iBAAAA,CAwNO;EAAA,IAAA,EAAA,MAAA;UAGHJ,CAAAA,EAAAA,MAAAA;WAARwB,CAAAA,EAAAA,MAAAA;;WAC2BA,CAAAA,EAAAA,OAAAA;iBACVrB,CAAAA,EAvNHT,eAuNGS;;UArNbE,iBAAAA,CAqNkCmB;OAGd9B,EAAAA,MAAAA;WAChBM,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;;WAC6BC,CAAAA,EAAAA,OAAAA;;;;;;;UA/MjCK,gBAAAA,CAoN6EL;QAARuB,MAAAA;UACnCtB,EAAAA,MAAAA;;WACsBR,EAAAA,OAAAA;;;;;UA7MxDa,oBAAAA,CAiN0DA;QAARiB,MAAAA;UAKfF,EAAAA,MAAAA;;WAQed,EAAAA,MAAAA;;;;;;UApNlDA,gBAAAA,CA0OsFE;;WAAqBc,EAAAA,MAAAA;;sBAOOf,CAAAA,EAAAA,MAAAA;;iBAE1DE,CAAAA,EAAAA,MAAAA;;SAEDE,EAAAA,MAAAA;;SAAoBW,CAAAA,EAAAA,MAAAA;;;;;;;;UAnO3Ef,mBAAAA,CAuPqGS;;OAQhDC,MAAAA;;QAAwBK,CAAAA,EAAAA,MAAAA;;UAM/BA,CAAAA,EA/P3C1B,eA+P2C0B,GAAAA,IAAAA;;AAKyB;;;;;;;UA3PvEd,kBAAAA;iBACOb;;;;aAIJC;;;;;;UAMHa,kBAAAA;;eAEKlB;;;;;;;;;;UAULmB,yBAAAA;;;;;;;;;;;UAWAC,iBAAAA;;gBAEMpB;;;;;;UAMNqB,oBAAAA;;;;;;;;;;;;;;;;;UAiBAC,mBAAAA;UACAC;WACCjB;eACIkB;;;;;UAKLC,8BAAAA;;;;;;;;;;;;;;;UAeAC,qBAAAA;UACAvB;iBACOD;;;;;;;;;;;;UAYPyB,oBAAAA;;;;;;;;UAQAxB;;;;;;;;;;UAUAyB,kBAAAA;;;;UAIAzB;iBACOD;;;;;;;;;;;;;UAaP2B,qBAAAA;;;;;;;;;;;;;UAaAC,OAAAA;;;MAGJC,QAAQxB;iCACmBwB,QAAQxB;uBAClBG,qBAAqBqB,QAAQxB;;;8BAGtBN;MACxB8B,QAAQxB;mCACqBwB,QAAQvB;yCACFG,oBAAoBoB;YACjDvB;eACGC;;2DAE4CG,oBAAoBmB,QAAQvB;oCACnDuB,QAAQtB;kEACsBR,kBAAkB8B,QAAQtB;;wDAEpCsB,QAAQlB;;4DAEJkB,QAAQjB;;;;;6CAKvBe,wBAAwBE;;;;;;;;oDAQjBA,QAAQhB;;;;;;;;MAQtDgB,QAAQhB;;;;;;6EAM+DgB,QAAQf;;;;;;;;gGAQWC,qBAAqBc,QAAQf;;;;;;;kGAO3BX,kBAAkB0B,QAAQf;;0DAElEe,QAAQb;;iEAEDE,oBAAoBW,QAAQb;;+EAEda;;;;;;;gEAOfA,QAAQZ;;4DAEZY,QAAQV;;2EAEOU;;;;;;;iFAOMT,sBAAsBS,QAAQN;;;;;;;;+DAQhDC,wBAAwBK,QAAQJ;;;;;;wDAMvCI,QAAQH;;;;;0EAKUG"}