@neon/env 1.3.5 → 1.4.1

package/README.md

@@ -121,7 +121,7 @@ These are the OS-level vars `fetchEnv` / `parseEnv` read and `toEntries` (so `ne
 | --- | --- |
 | `NEON_DATA_API_URL` | Data API (PostgREST) integration URL |
 
-**Object storage** (Preview — when `preview.buckets` declares at least one bucket). Projected onto the AWS SDK's standard config vars so an S3 client works from env alone (set `forcePathStyle: true`):
+**Object storage** (when `buckets` declares at least one bucket). Projected onto the AWS SDK's standard config vars so an S3 client works from env alone (set `forcePathStyle: true`):
 
 | Key | From |
 | --- | --- |
@@ -130,14 +130,14 @@ These are the OS-level vars `fetchEnv` / `parseEnv` read and `toEntries` (so `ne
 | `AWS_ENDPOINT_URL_S3` | branch's S3-compatible endpoint URL |
 | `AWS_REGION` | branch region (e.g. `us-east-2`) |
 
-**AI Gateway** (Preview — when `preview.aiGateway` is enabled). Emitted under the Neon-branded vars the deployed Functions runtime injects; clients like [`@neon/ai-sdk-provider`](../ai-sdk-provider) read these and append the `/ai-gateway/<dialect>/…` routes themselves:
+**AI Gateway** (when `aiGateway` is enabled). Emitted under the Neon-branded vars the deployed Functions runtime injects; clients like [`@neon/ai-sdk-provider`](../ai-sdk-provider) read these and append the `/ai-gateway/<dialect>/…` routes themselves:
 
 | Key | From |
 | --- | --- |
 | `NEON_AI_GATEWAY_TOKEN` | branch credential's API token (bearer) |
 | `NEON_AI_GATEWAY_BASE_URL` | bare branch gateway host (`https://<branch>-api.ai.<region>.…`, no path) |
 
-**Functions** (Preview — when `preview.functions` declares at least one slug). Each declared slug requires `NEON_FUNCTION_<SLUG>_BASE_URL`, typed as `env.functions.<slug>.baseUrl: string`. These are the public function URLs, not the function's declared `env` secrets (those are uploaded at deploy). `fetchEnv` / `neon env pull` derive the URL from the branch connection host; the function does not have to be deployed. `parseEnv` requires the var to be a URL. `neon dev` injects `http://localhost:<port>` instead.
+**Functions** (when `functions` declares at least one slug). Each declared slug requires `NEON_FUNCTION_<SLUG>_BASE_URL`, typed as `env.functions.<slug>.baseUrl: string`. These are the public function URLs, not the function's declared `env` secrets (those are uploaded at deploy). `fetchEnv` / `neon env pull` derive the URL from the branch connection host; the function does not have to be deployed. `parseEnv` requires the var to be a URL. `neon dev` injects `http://localhost:<port>` instead.
 
 | Key | From |
 | --- | --- |

package/dist/env.js

@@ -204,7 +204,7 @@ async function fetchEnvKeysState(config, options, keys) {
 		let storage = null;
 		if (wantsStorage) {
 			storage = await api.getProjectBranchStorage(projectId, branch.id);
-			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets."].join(" "), { details: {
+			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets."].join(" "), { details: {
 				projectId,
 				branchId: branch.id
 			} });

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/env.js"],"sourcesContent":["import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from \"@neon/config/v1\";\n//#region src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema}.\n*/\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: { name: \"NEON_BRANCH\" },\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nconst FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;\nconst FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;\nfunction functionBaseUrlKey(slug) {\n\tif (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);\n\treturn `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;\n}\nfunction parseFunctionBaseUrlKey(key) {\n\tconst match = FUNCTION_BASE_URL_KEY.exec(key);\n\treturn match ? match[1].toLowerCase() : null;\n}\nfunction isFunctionBaseUrlKey(key) {\n\treturn parseFunctionBaseUrlKey(key) !== null;\n}\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\nasync function fetchEnvKeysState(config, options, keys) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst functionUrlMode = options.functionUrls ?? \"policy\";\n\tconst declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);\n\tconst selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);\n\tconst constructSlugs = functionUrlSlugsToConstruct({\n\t\tfunctionUrlMode,\n\t\tselection,\n\t\tdeclaredSlugs,\n\t\tselectedFunctionKeys,\n\t\twants\n\t});\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name)) result.branch = { name: branch.name };\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await api.getProjectBranchStorage(projectId, branch.id);\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\tconst wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;\n\tconst functions = {};\n\tlet functionUrlsUnavailable = false;\n\tif (functionUrlMode === \"all-live\" && wantsAnyFunctionUrl) {\n\t\tconst listed = options.listedFunctions === void 0 ? await listFunctionInvocationUrls(api, projectId, branch.id) : listedFromSnapshots(options.listedFunctions);\n\t\tif (listed.status === \"unavailable\") {\n\t\t\tif (selection === null) functionUrlsUnavailable = true;\n\t\t} else for (const fn of listed.functions) {\n\t\t\tif (!wants(functionBaseUrlKey(fn.slug))) continue;\n\t\t\tfunctions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };\n\t\t}\n\t}\n\tconst missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);\n\tif (missingConstructSlugs.length > 0) {\n\t\tconst uri = requiredValue(unpooled, \"direct connection URI for function invocation URLs\").uri;\n\t\tfor (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };\n\t}\n\tassertSelectedFunctionUrls(selectedFunctionKeys, functions);\n\tif (Object.keys(functions).length > 0) result.functions = functions;\n\treturn {\n\t\tenv: result,\n\t\tfunctionUrlsUnavailable\n\t};\n}\nfunction functionUrlSlugsToConstruct(args) {\n\tconst slugs = [];\n\tif (args.functionUrlMode === \"policy\" && args.selection === null) {\n\t\tfor (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);\n\t\treturn slugs;\n\t}\n\tfor (const key of args.selectedFunctionKeys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug !== null) slugs.push(slug);\n\t}\n\treturn slugs;\n}\nfunction listedFromSnapshots(snapshots) {\n\treturn {\n\t\tstatus: \"ok\",\n\t\tfunctions: snapshots.filter((fn) => fn.invocationUrl !== \"\").map((fn) => ({\n\t\t\tslug: fn.slug,\n\t\t\tinvocationUrl: fn.invocationUrl\n\t\t})).sort((left, right) => left.slug.localeCompare(right.slug))\n\t};\n}\nfunction assertSelectedFunctionUrls(keys, functions) {\n\tfor (const key of keys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);\n\t}\n}\nasync function listFunctionInvocationUrls(api, projectId, branchId) {\n\ttry {\n\t\treturn listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));\n\t} catch (error) {\n\t\tif (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {\n\t\t\tstatus: \"unavailable\",\n\t\t\terror\n\t\t};\n\t\tthrow error;\n\t}\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\tconst branch = resolveBranch(branchRef, branches);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tif (needsStorage && storageDefault) {\n\t\tconst revealed = await args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId);\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (needsGateway && gatewayDefault) secrets.apiToken = (await args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`\n* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).\n*/\nfunction asEnvBaseUrl(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);\n\treturn parsed.origin;\n}\n/** Derived from the connection URI so undeployed functions have a cell-routed URL. */\nfunction functionInvocationUrl(branchId, slug, connectionUri) {\n\tconst suffix = connectionHostSuffix(connectionUri);\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive the invocation URL for function \"${slug}\": the direct connection URI has no host suffix.`);\n\treturn `https://${branchId}-${slug}.compute.${suffix}`;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tif (roles.length === 1) return roles[0].name;\n\tconst owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);\n\tif (owner) return owner.name;\n\tconst appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));\n\tif (appRoles.length === 1) return appRoles[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\tif (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);\n\treturn out;\n}\n//#endregion\nexport { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,0BAA0B;;;;;;AAMhC,MAAM,wBAAwB;;;;;;;;AAQ9B,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;AACD,MAAM,oBAAoB;;;;;;CAMzB,QAAQ,EAAE,MAAM,cAAc;CAC9B,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;;;;;;CAMpC,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,SAAS,mBAAmB,MAAM;CACjC,IAAI,CAAC,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,IAAI,EAAE,0CAA0C;CACrI,OAAO,iBAAiB,KAAK,YAAY,EAAE;AAC5C;AACA,SAAS,wBAAwB,KAAK;CACrC,MAAM,QAAQ,sBAAsB,KAAK,GAAG;CAC5C,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AACzC;AACA,SAAS,qBAAqB,KAAK;CAClC,OAAO,wBAAwB,GAAG,MAAM;AACzC;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;AACA,eAAe,kBAAkB,QAAQ,SAAS,MAAM;CACvD,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CAC1E,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,kBAAkB,QAAQ,gBAAgB;CAChD,MAAM,iBAAiB,QAAQ,SAAS,aAAa,CAAC,EAAA,CAAG,KAAK,OAAO,GAAG,IAAI;CAC5E,MAAM,uBAAuB,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,oBAAoB;CACjG,MAAM,iBAAiB,4BAA4B;EAClD;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,eAAe,SAAS;CAC/G,MAAM,wBAAwB,eAAe;CAC7C,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAC9D,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,IAAI,wBAAwB,WAAW,OAAO,EAAE;GAChE,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0GAA0G,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,oIAAoI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/V;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,MAAM,sBAAsB,cAAc,QAAQ,qBAAqB,SAAS;CAChF,MAAM,YAAY,CAAC;CACnB,IAAI,0BAA0B;CAC9B,IAAI,oBAAoB,cAAc,qBAAqB;EAC1D,MAAM,SAAS,QAAQ,oBAAoB,KAAK,IAAI,MAAM,2BAA2B,KAAK,WAAW,OAAO,EAAE,IAAI,oBAAoB,QAAQ,eAAe;EAC7J,IAAI,OAAO,WAAW,eACjB;OAAA,cAAc,MAAM,0BAA0B;EAAA,OAC5C,KAAK,MAAM,MAAM,OAAO,WAAW;GACzC,IAAI,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG;GACzC,UAAU,GAAG,QAAQ,EAAE,SAAS,aAAa,GAAG,aAAa,EAAE;EAChE;CACD;CACA,MAAM,wBAAwB,eAAe,QAAQ,SAAS,UAAU,UAAU,KAAK,CAAC;CACxF,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,MAAM,cAAc,UAAU,oDAAoD,CAAC,CAAC;EAC1F,KAAK,MAAM,QAAQ,uBAAuB,UAAU,QAAQ,EAAE,SAAS,sBAAsB,OAAO,IAAI,MAAM,GAAG,EAAE;CACpH;CACA,2BAA2B,sBAAsB,SAAS;CAC1D,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,OAAO,YAAY;CAC1D,OAAO;EACN,KAAK;EACL;CACD;AACD;AACA,SAAS,4BAA4B,MAAM;CAC1C,MAAM,QAAQ,CAAC;CACf,IAAI,KAAK,oBAAoB,YAAY,KAAK,cAAc,MAAM;EACjE,KAAK,MAAM,QAAQ,KAAK,eAAe,IAAI,KAAK,MAAM,mBAAmB,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI;EAChG,OAAO;CACR;CACA,KAAK,MAAM,OAAO,KAAK,sBAAsB;EAC5C,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,MAAM,MAAM,KAAK,IAAI;CACnC;CACA,OAAO;AACR;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO;EACN,QAAQ;EACR,WAAW,UAAU,QAAQ,OAAO,GAAG,kBAAkB,EAAE,CAAC,CAAC,KAAK,QAAQ;GACzE,MAAM,GAAG;GACT,eAAe,GAAG;EACnB,EAAE,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC9D;AACD;AACA,SAAS,2BAA2B,MAAM,WAAW;CACpD,KAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,QAAQ,UAAU,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,qBAAqB,IAAI,EAAE;CAC7F;AACD;AACA,eAAe,2BAA2B,KAAK,WAAW,UAAU;CACnE,IAAI;EACH,OAAO,oBAAoB,MAAM,IAAI,oBAAoB,WAAW,QAAQ,CAAC;CAC9E,SAAS,OAAO;EACf,IAAI,gBAAgB,KAAK,KAAK,MAAM,SAAS,UAAU,oBAAoB,OAAO;GACjF,QAAQ;GACR;EACD;EACA,MAAM;CACP;AACD;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK;CACxD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,MAAM,SAAS,cAAc,WAAW,QAAQ;CAChD,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,IAAI,gBAAgB,gBAAgB;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO;EACtG,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,gBAAgB,gBAAgB,QAAQ,YAAY,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,EAAA,CAAG;CAChJ,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,aAAa,KAAK;CAC1B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,GAAG,GAAG;CACzF;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,sDAAsD,KAAK,UAAU,GAAG,GAAG;CAC5J,OAAO,OAAO;AACf;;AAEA,SAAS,sBAAsB,UAAU,MAAM,eAAe;CAC7D,MAAM,SAAS,qBAAqB,aAAa;CACjD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,4DAA4D,KAAK,iDAAiD;CACrJ,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW;AAC/C;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,IAAI,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC;CACxC,MAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,uBAAuB;CAClE,IAAI,OAAO,OAAO,MAAM;CACxB,MAAM,WAAW,MAAM,QAAQ,MAAM,CAAC,wBAAwB,IAAI,EAAE,IAAI,CAAC;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS,EAAE,CAAC;CAC9C,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,IAAI,IAAI,WAAW,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,IAAI,GAAG,IAAI,UAAU,KAAK,EAAE,OAAO;CACnI,OAAO;AACR"}
+{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/env.js"],"sourcesContent":["import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from \"@neon/config/v1\";\n//#region src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema}.\n*/\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: { name: \"NEON_BRANCH\" },\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nconst FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;\nconst FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;\nfunction functionBaseUrlKey(slug) {\n\tif (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);\n\treturn `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;\n}\nfunction parseFunctionBaseUrlKey(key) {\n\tconst match = FUNCTION_BASE_URL_KEY.exec(key);\n\treturn match ? match[1].toLowerCase() : null;\n}\nfunction isFunctionBaseUrlKey(key) {\n\treturn parseFunctionBaseUrlKey(key) !== null;\n}\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\nasync function fetchEnvKeysState(config, options, keys) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst functionUrlMode = options.functionUrls ?? \"policy\";\n\tconst declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);\n\tconst selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);\n\tconst constructSlugs = functionUrlSlugsToConstruct({\n\t\tfunctionUrlMode,\n\t\tselection,\n\t\tdeclaredSlugs,\n\t\tselectedFunctionKeys,\n\t\twants\n\t});\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name)) result.branch = { name: branch.name };\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await api.getProjectBranchStorage(projectId, branch.id);\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\tconst wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;\n\tconst functions = {};\n\tlet functionUrlsUnavailable = false;\n\tif (functionUrlMode === \"all-live\" && wantsAnyFunctionUrl) {\n\t\tconst listed = options.listedFunctions === void 0 ? await listFunctionInvocationUrls(api, projectId, branch.id) : listedFromSnapshots(options.listedFunctions);\n\t\tif (listed.status === \"unavailable\") {\n\t\t\tif (selection === null) functionUrlsUnavailable = true;\n\t\t} else for (const fn of listed.functions) {\n\t\t\tif (!wants(functionBaseUrlKey(fn.slug))) continue;\n\t\t\tfunctions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };\n\t\t}\n\t}\n\tconst missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);\n\tif (missingConstructSlugs.length > 0) {\n\t\tconst uri = requiredValue(unpooled, \"direct connection URI for function invocation URLs\").uri;\n\t\tfor (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };\n\t}\n\tassertSelectedFunctionUrls(selectedFunctionKeys, functions);\n\tif (Object.keys(functions).length > 0) result.functions = functions;\n\treturn {\n\t\tenv: result,\n\t\tfunctionUrlsUnavailable\n\t};\n}\nfunction functionUrlSlugsToConstruct(args) {\n\tconst slugs = [];\n\tif (args.functionUrlMode === \"policy\" && args.selection === null) {\n\t\tfor (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);\n\t\treturn slugs;\n\t}\n\tfor (const key of args.selectedFunctionKeys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug !== null) slugs.push(slug);\n\t}\n\treturn slugs;\n}\nfunction listedFromSnapshots(snapshots) {\n\treturn {\n\t\tstatus: \"ok\",\n\t\tfunctions: snapshots.filter((fn) => fn.invocationUrl !== \"\").map((fn) => ({\n\t\t\tslug: fn.slug,\n\t\t\tinvocationUrl: fn.invocationUrl\n\t\t})).sort((left, right) => left.slug.localeCompare(right.slug))\n\t};\n}\nfunction assertSelectedFunctionUrls(keys, functions) {\n\tfor (const key of keys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);\n\t}\n}\nasync function listFunctionInvocationUrls(api, projectId, branchId) {\n\ttry {\n\t\treturn listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));\n\t} catch (error) {\n\t\tif (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {\n\t\t\tstatus: \"unavailable\",\n\t\t\terror\n\t\t};\n\t\tthrow error;\n\t}\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\tconst branch = resolveBranch(branchRef, branches);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tif (needsStorage && storageDefault) {\n\t\tconst revealed = await args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId);\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (needsGateway && gatewayDefault) secrets.apiToken = (await args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`\n* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).\n*/\nfunction asEnvBaseUrl(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);\n\treturn parsed.origin;\n}\n/** Derived from the connection URI so undeployed functions have a cell-routed URL. */\nfunction functionInvocationUrl(branchId, slug, connectionUri) {\n\tconst suffix = connectionHostSuffix(connectionUri);\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive the invocation URL for function \"${slug}\": the direct connection URI has no host suffix.`);\n\treturn `https://${branchId}-${slug}.compute.${suffix}`;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tif (roles.length === 1) return roles[0].name;\n\tconst owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);\n\tif (owner) return owner.name;\n\tconst appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));\n\tif (appRoles.length === 1) return appRoles[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\tif (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);\n\treturn out;\n}\n//#endregion\nexport { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,0BAA0B;;;;;;AAMhC,MAAM,wBAAwB;;;;;;;;AAQ9B,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;AACD,MAAM,oBAAoB;;;;;;CAMzB,QAAQ,EAAE,MAAM,cAAc;CAC9B,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;;;;;;CAMpC,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,SAAS,mBAAmB,MAAM;CACjC,IAAI,CAAC,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,IAAI,EAAE,0CAA0C;CACrI,OAAO,iBAAiB,KAAK,YAAY,EAAE;AAC5C;AACA,SAAS,wBAAwB,KAAK;CACrC,MAAM,QAAQ,sBAAsB,KAAK,GAAG;CAC5C,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AACzC;AACA,SAAS,qBAAqB,KAAK;CAClC,OAAO,wBAAwB,GAAG,MAAM;AACzC;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;AACA,eAAe,kBAAkB,QAAQ,SAAS,MAAM;CACvD,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CAC1E,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,kBAAkB,QAAQ,gBAAgB;CAChD,MAAM,iBAAiB,QAAQ,SAAS,aAAa,CAAC,EAAA,CAAG,KAAK,OAAO,GAAG,IAAI;CAC5E,MAAM,uBAAuB,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,oBAAoB;CACjG,MAAM,iBAAiB,4BAA4B;EAClD;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,eAAe,SAAS;CAC/G,MAAM,wBAAwB,eAAe;CAC7C,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAC9D,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,IAAI,wBAAwB,WAAW,OAAO,EAAE;GAChE,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,kGAAkG,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,4HAA4H,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/U;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,MAAM,sBAAsB,cAAc,QAAQ,qBAAqB,SAAS;CAChF,MAAM,YAAY,CAAC;CACnB,IAAI,0BAA0B;CAC9B,IAAI,oBAAoB,cAAc,qBAAqB;EAC1D,MAAM,SAAS,QAAQ,oBAAoB,KAAK,IAAI,MAAM,2BAA2B,KAAK,WAAW,OAAO,EAAE,IAAI,oBAAoB,QAAQ,eAAe;EAC7J,IAAI,OAAO,WAAW,eACjB;OAAA,cAAc,MAAM,0BAA0B;EAAA,OAC5C,KAAK,MAAM,MAAM,OAAO,WAAW;GACzC,IAAI,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG;GACzC,UAAU,GAAG,QAAQ,EAAE,SAAS,aAAa,GAAG,aAAa,EAAE;EAChE;CACD;CACA,MAAM,wBAAwB,eAAe,QAAQ,SAAS,UAAU,UAAU,KAAK,CAAC;CACxF,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,MAAM,cAAc,UAAU,oDAAoD,CAAC,CAAC;EAC1F,KAAK,MAAM,QAAQ,uBAAuB,UAAU,QAAQ,EAAE,SAAS,sBAAsB,OAAO,IAAI,MAAM,GAAG,EAAE;CACpH;CACA,2BAA2B,sBAAsB,SAAS;CAC1D,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,OAAO,YAAY;CAC1D,OAAO;EACN,KAAK;EACL;CACD;AACD;AACA,SAAS,4BAA4B,MAAM;CAC1C,MAAM,QAAQ,CAAC;CACf,IAAI,KAAK,oBAAoB,YAAY,KAAK,cAAc,MAAM;EACjE,KAAK,MAAM,QAAQ,KAAK,eAAe,IAAI,KAAK,MAAM,mBAAmB,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI;EAChG,OAAO;CACR;CACA,KAAK,MAAM,OAAO,KAAK,sBAAsB;EAC5C,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,MAAM,MAAM,KAAK,IAAI;CACnC;CACA,OAAO;AACR;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO;EACN,QAAQ;EACR,WAAW,UAAU,QAAQ,OAAO,GAAG,kBAAkB,EAAE,CAAC,CAAC,KAAK,QAAQ;GACzE,MAAM,GAAG;GACT,eAAe,GAAG;EACnB,EAAE,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC9D;AACD;AACA,SAAS,2BAA2B,MAAM,WAAW;CACpD,KAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,QAAQ,UAAU,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,qBAAqB,IAAI,EAAE;CAC7F;AACD;AACA,eAAe,2BAA2B,KAAK,WAAW,UAAU;CACnE,IAAI;EACH,OAAO,oBAAoB,MAAM,IAAI,oBAAoB,WAAW,QAAQ,CAAC;CAC9E,SAAS,OAAO;EACf,IAAI,gBAAgB,KAAK,KAAK,MAAM,SAAS,UAAU,oBAAoB,OAAO;GACjF,QAAQ;GACR;EACD;EACA,MAAM;CACP;AACD;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK;CACxD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,MAAM,SAAS,cAAc,WAAW,QAAQ;CAChD,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,IAAI,gBAAgB,gBAAgB;EACnC,MAAM,WAAW,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO;EACtG,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,gBAAgB,gBAAgB,QAAQ,YAAY,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,EAAA,CAAG;CAChJ,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,aAAa,KAAK;CAC1B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,GAAG,GAAG;CACzF;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,sDAAsD,KAAK,UAAU,GAAG,GAAG;CAC5J,OAAO,OAAO;AACf;;AAEA,SAAS,sBAAsB,UAAU,MAAM,eAAe;CAC7D,MAAM,SAAS,qBAAqB,aAAa;CACjD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,4DAA4D,KAAK,iDAAiD;CACrJ,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW;AAC/C;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,IAAI,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC;CACxC,MAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,uBAAuB;CAClE,IAAI,OAAO,OAAO,MAAM;CACxB,MAAM,WAAW,MAAM,QAAQ,MAAM,CAAC,wBAAwB,IAAI,EAAE,IAAI,CAAC;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS,EAAE,CAAC;CAC9C,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,IAAI,IAAI,WAAW,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,IAAI,GAAG,IAAI,UAAU,KAAK,EAAE,OAAO;CACnI,OAAO;AACR"}

package/dist/index.d.ts

@@ -94,8 +94,8 @@ interface NeonDataApiEnv {
   url: string;
 }
 /**
- * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only
- * when the policy declares `preview.buckets`. Combines a minted branch credential's access
+ * S3-compatible object-storage access for the branch. Present on `NeonEnv` only
+ * when the policy declares `buckets` (or deprecated `preview.buckets`). Combines a minted branch credential's access
  * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the
  * storage gateway authenticates against; `secretAccessKey` = its
  * `s3_secret_access_key`) with the branch's non-secret connection details
@@ -113,8 +113,8 @@ interface NeonStorageEnv {
   region: string;
 }
 /**
- * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy
- * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);
+ * AI Gateway access for the branch. Present on `NeonEnv` only when the policy
+ * enables `aiGateway` (or deprecated `preview.aiGateway`). `apiKey` is the minted credential's bearer (`api_token`);
  * `baseUrl` is the bare branch-scoped gateway host
  * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env
  * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`
@@ -151,38 +151,47 @@ type ServiceOn<T> = [T] extends [false] ? false : [T] extends [{
 }] ? true : [T] extends [object] ? true : false;
 /** True when `T` has at least one known key; `false` for `{}` / `never`. */
 type HasKeys<T> = [keyof T] extends [never] ? false : true;
+type OrBool<A extends boolean, B extends boolean> = A extends true ? true : B;
 /**
- * Whether the policy's **static** `preview` block declares at least one object-storage bucket
- * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.
+ * Whether a top-level optional record (GA `functions` / `buckets`) has known keys.
+ * A string index signature (`Record<string, …>`, the default `Config` param) is treated
+ * as empty so an untyped policy yields just `{ postgres }`, matching {@link HasPreviewBuckets}.
+ */
+type HasGaRecord<T> = [NonNullable<T>] extends [never] ? false : string extends keyof NonNullable<T> ? false : HasKeys<NonNullable<T>>;
+type HasGaToggle<T> = [NonNullable<T>] extends [never] ? false : ServiceOn<NonNullable<T>>;
+/**
+ * Whether the policy declares at least one object-storage bucket (`buckets` or
+ * deprecated `preview.buckets`). Drives whether {@link NeonEnv} carries the `storage`
+ * namespace.
  *
  * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,
  * `NonNullable<C["preview"]>` is `never`, and without the guard the `extends { … }` probe
  * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`
  * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.
  */
-type HasBuckets<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+type HasPreviewBuckets<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
   buckets: infer B;
 } ? HasKeys<NonNullable<B>> : false;
+type HasBuckets<C extends Config> = OrBool<HasGaRecord<C["buckets"]>, HasPreviewBuckets<C>>;
 /**
- * Whether the policy's **static** `preview` block enables the AI Gateway
- * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.
- *
- * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when
- * a policy has no `preview`, `NonNullable<C["preview"]>` is `never`, and a naked `never` in the
- * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`
- * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.
+ * Whether the policy enables the AI Gateway (`aiGateway` or deprecated `preview.aiGateway`).
+ * Drives whether {@link NeonEnv} carries the `aiGateway` namespace.
  */
-type AiGatewayOn<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+type HasPreviewAiGateway<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
   aiGateway: infer A;
 } ? ServiceOn<NonNullable<A>> : false;
+type AiGatewayOn<C extends Config> = OrBool<HasGaToggle<C["aiGateway"]>, HasPreviewAiGateway<C>>;
 /** The tuple guard prevents a missing preview block from enabling functions. */
-type HasFunctions<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+type HasPreviewFunctions<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
   functions: infer F;
 } ? HasKeys<NonNullable<F>> : false;
+type HasFunctions<C extends Config> = OrBool<HasGaRecord<C["functions"]>, HasPreviewFunctions<C>>;
+type GaFunctionsOfConfig<C extends Config> = [NonNullable<C["functions"]>] extends [never] ? Record<never, never> : string extends keyof NonNullable<C["functions"]> ? Record<never, never> : NonNullable<C["functions"]>;
 type PreviewFunctionsOfConfig<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? Record<never, never> : NonNullable<C["preview"]> extends {
   functions: infer F;
 } ? F : Record<never, never>;
-type FunctionSlugOfConfig<C extends Config> = Extract<keyof PreviewFunctionsOfConfig<C>, string>;
+type FunctionsOfConfig<C extends Config> = [keyof GaFunctionsOfConfig<C>] extends [never] ? PreviewFunctionsOfConfig<C> : [keyof PreviewFunctionsOfConfig<C>] extends [never] ? GaFunctionsOfConfig<C> : GaFunctionsOfConfig<C> & PreviewFunctionsOfConfig<C>;
+type FunctionSlugOfConfig<C extends Config> = Extract<keyof FunctionsOfConfig<C>, string>;
 type NeonFunctionsEnv<C extends Config> = { [S in FunctionSlugOfConfig<C>]: NeonFunctionUrlEnv };
 type FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends infer S ? S extends string ? FunctionBaseUrlKey<S> : never : never;
 /**
@@ -196,9 +205,9 @@ type FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends in
  * - `postgres` is always present.
  * - `auth` is added iff `config.auth` is statically enabled.
  * - `dataApi` is added iff `config.dataApi` is statically enabled.
- * - `storage` is added iff `config.preview.buckets` declares at least one bucket.
- * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.
- * - `functions` is added iff `config.preview.functions` declares at least one slug.
+ * - `storage` is added iff `config.buckets` (or deprecated `preview.buckets`) declares at least one bucket.
+ * - `aiGateway` is added iff `config.aiGateway` (or deprecated `preview.aiGateway`) is statically enabled.
+ * - `functions` is added iff `config.functions` (or deprecated `preview.functions`) declares at least one slug.
  */
 type NeonEnv<C extends Config = Config> = {
   postgres: NeonPostgresEnv;
@@ -469,10 +478,12 @@ type ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> }
 //#endregion
 //#endregion
 //#region src/lib/parse-env.d.ts
-/** The static `preview.functions` record of a config, or an empty record when absent. */
-type PreviewFunctionsOf<C extends Config> = NonNullable<C["preview"]> extends {
+/** The static `functions` record of a config (GA or deprecated `preview.functions`). */
+type GaFunctionsOf<C extends Config> = [NonNullable<C["functions"]>] extends [never] ? Record<never, never> : string extends keyof NonNullable<C["functions"]> ? Record<never, never> : NonNullable<C["functions"]>;
+type PreviewFunctionsHome<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? Record<never, never> : NonNullable<C["preview"]> extends {
   functions: infer F;
 } ? F : Record<never, never>;
+type PreviewFunctionsOf<C extends Config> = [keyof GaFunctionsOf<C>] extends [never] ? PreviewFunctionsHome<C> : [keyof PreviewFunctionsHome<C>] extends [never] ? GaFunctionsOf<C> : GaFunctionsOf<C> & PreviewFunctionsHome<C>;
 /** The declared function slugs of a config (record keys), as a string union. */
 type FunctionSlugOf<C extends Config> = Extract<keyof PreviewFunctionsOf<C>, string>;
 /**
@@ -483,7 +494,7 @@ type FunctionSlugOf<C extends Config> = Extract<keyof PreviewFunctionsOf<C>, str
  * editor offers it as the single completion, so the empty completion list is explained rather
  * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.
  */
-type NoFunctionScopeHint = "this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env";
+type NoFunctionScopeHint = "this policy declares no `functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env";
 /**
  * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug
  * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no
@@ -521,7 +532,7 @@ type NeonFunctionEnv<C extends Config, S extends string> = {
  * The second argument is a **scope** or a **key filter**:
  * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the
  *   full `{ postgres, auth?, dataApi?, … }` the policy enables.
- * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are
+ * - a **function slug** (a key of `config.functions`) — *function* scope: you are
  *   running inside that function. Returns the same branch secrets **plus** a typed
  *   `function` namespace with the function's declared env-var keys. The slug autocompletes
  *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","NeonCredentialMeta","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","FunctionBaseUrlKey","Slug","Uppercase","functionBaseUrlKey","S","parseFunctionBaseUrlKey","isFunctionBaseUrlKey","FunctionUrlMode","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","HasKeys","HasBuckets","C","NonNullable","B","AiGatewayOn","A","HasFunctions","F","PreviewFunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","FetchEnvKeysOptions","ResolvedNeonEnv","FetchEnvKeysState","ReadonlyArray","fetchEnvKeysState","resolveBranchPolicy","Pick","ReturnType","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","isLiveCredential","defaultStorageCredential","defaultAiGatewayCredential","createApiFromOptions","toEntries","Partial"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, NeonCredentialMeta, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\ntype FunctionBaseUrlKey<Slug extends string = string> = `NEON_FUNCTION_${Uppercase<Slug>}_BASE_URL`;\ndeclare function functionBaseUrlKey<S extends string>(slug: S): FunctionBaseUrlKey<S>;\ndeclare function parseFunctionBaseUrlKey(key: string): string | null;\ndeclare function isFunctionBaseUrlKey(key: string): key is FunctionBaseUrlKey;\n/** `all-live` lists deployed functions. Policy mode derives declared slugs from the connection host. */\ntype FunctionUrlMode = \"policy\" | \"all-live\";\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/**\n * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only\n * when the policy declares `preview.buckets`. Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy\n * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\ninterface NeonFunctionUrlEnv {\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\n/**\n * Whether the policy's **static** `preview` block declares at least one object-storage bucket\n * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\n/**\n * Whether the policy's **static** `preview` block enables the AI Gateway\n * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n *\n * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when\n * a policy has no `preview`, `NonNullable<C[\"preview\"]>` is `never`, and a naked `never` in the\n * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`\n * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.\n */\ntype AiGatewayOn<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\n/** The tuple guard prevents a missing preview block from enabling functions. */\ntype HasFunctions<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? HasKeys<NonNullable<F>> : false;\ntype PreviewFunctionsOfConfig<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? Record<never, never> : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? F : Record<never, never>;\ntype FunctionSlugOfConfig<C extends Config> = Extract<keyof PreviewFunctionsOfConfig<C>, string>;\ntype NeonFunctionsEnv<C extends Config> = { [S in FunctionSlugOfConfig<C>]: NeonFunctionUrlEnv };\ntype FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends infer S ? S extends string ? FunctionBaseUrlKey<S> : never : never;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.preview.buckets` declares at least one bucket.\n * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.\n * - `functions` is added iff `config.preview.functions` declares at least one slug.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace) & (HasFunctions<C> extends true ? {\n  functions: NeonFunctionsEnv<C>;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace] | FunctionBaseUrlKeyOf<C>;\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype SelectedFunctionKeys<K extends string> = Extract<K, FunctionBaseUrlKey>;\ntype FunctionSlugFromKey<K extends string> = K extends `NEON_FUNCTION_${infer S}_BASE_URL` ? Lowercase<S> : never;\ntype FunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]: NeonFunctionUrlEnv };\n};\ntype OptionalFunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions?: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]?: NeonFunctionUrlEnv };\n};\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & FunctionsFilteredEnv<K>;\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & OptionalFunctionsFilteredEnv<K>;\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\ntype FetchEnvKeysState = {\n  env: ResolvedNeonEnv;\n  /** Prevents endpoint failure from being mistaken for a confirmed empty function list. */\n  functionUrlsUnavailable: boolean;\n};\ntype FetchEnvKeysOptions = FetchEnvOptions & {\n  functionUrls?: FunctionUrlMode;\n  /**\n   * Keys to skip even when {@link fetchEnvKeys} is unscoped (`keys === null`).\n   * {@link fetchEnvReusingSecrets} uses this to keep already-verified secrets\n   * without converting an unscoped fetch into a static policy-key list — that\n   * list cannot name `NEON_FUNCTION_*_BASE_URL`, so it would drop function URLs.\n   */\n  omitKeys?: readonly string[];\n  /**\n   * Skip a second `listBranchFunctions` when the caller already listed.\n   * `--service functions` uses this so a later `FeatureUnavailable` cannot be\n   * swallowed as `skipped`.\n   */\n  listedFunctions?: ReadonlyArray<{\n    slug: string;\n    invocationUrl: string;\n  }>;\n};\ndeclare function fetchEnvKeysState(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<FetchEnvKeysState>;\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi): Promise<{\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n}>;\n/**\n * Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n * *require* secrets; functions never force a credential. `functions:invoke` rides along only\n * when this path still has to mint (defaults already cover storage and the gateway).\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\ndeclare function isLiveCredential(meta: NeonCredentialMeta, now: number): boolean;\ndeclare function defaultStorageCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function defaultAiGatewayCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> } & {\n  functions?: Record<string, NeonFunctionUrlEnv>;\n};\n//#endregion\nexport { FetchEnvKeysOptions, FetchEnvKeysState, FetchEnvOptions, FilteredNeonEnv, FunctionBaseUrlKey, FunctionUrlMode, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionUrlEnv, NeonFunctionsEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AA8CC,cA1CaO,iBA2CS,EAAA;EAAA;AAA4DE;AAAVC;AAAS;AAAA;EAC/C,SAAA,MAAA,EAAA;IAAyBE,SAAAA,IAAAA,EAAAA,aAAAA;EAAuBA,CAAAA;EAAnBJ,SAAAA,QAAAA,EAAAA;IAAkB,SAAA,WAAA,EAAA,cAAA;IACjEK,SAAAA,mBAAuB,EAAA,uBAAA;EAAA,CAAA;EAGpB,SAOVG,IAAAA,EAAAA;IAIAC,SAAAA,OAAAA,EAAe,oBAAA;IAsBfC,SAAAA,OAAW,EAAA,oBAAA;EAAA,CAAA;EAMG,SAcdE,OAAAA,EAAAA;IAgBAC,SAAAA,GAAAA,EAAAA,mBAAgB;EAAA,CAAA;EAIE;AAQH;AAYX;AAAOK;AAA8BA;EAErCA,SAAAA,OAAAA,EAAAA;IAAkCA,SAAAA,WAAAA,EAAAA,mBAAAA;IAA4BA,SAAAA,eAAAA,EAAAA,uBAAAA;IAE/DA,SAAAA,QAAAA,EAAAA,qBAAAA;IAAC,SAAA,MAAA,EAAA,YAAA;EAAA,CAAA;EAEY;AAUX;AAAW1B;AAAuB6B;AAAZC;AAAiED;AAAZC;EAElEC,SAAAA,SAAAA,EAAAA;IAAZD,SAAAA,MAAAA,EAAAA,uBAAAA;IAARH,SAAAA,OAAAA,EAAAA,0BAAAA;EAAO,CAAA;AAAA,CAAA;AAUK,KA9HXnB,kBA8HW,CAAA,aAAA,MAAA,GAAA,MAAA,CAAA,GAAA,iBA9HyDE,SA8HzD,CA9HmED,IA8HnE,CAAA,WAAA;AAAWT,iBA7HVW,kBA6HUX,CAAAA,UAAAA,MAAAA,CAAAA,CAAAA,IAAAA,EA7HiCY,CA6HjCZ,CAAAA,EA7HqCQ,kBA6HrCR,CA7HwDY,CA6HxDZ,CAAAA;AAAuB6B,iBA5HjChB,uBAAAA,CA4HiCgB,GAAAA,EAAAA,MAAAA,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;AAAZC,iBA3HrBhB,oBAAAA,CA2HqBgB,GAAAA,EAAAA,MAAAA,CAAAA,EAAAA,GAAAA,IA3HqBtB,kBA2HrBsB;AAAiED;;AAE7EI;AAAZH;AAAVL;AAAS;AAAA;AAEI;AAAWzB,UAtHlBgB,aAAAA,CAsHkBhB;EAAuB6B,IAAAA,EAAAA,MAAAA;AAAZC;AAAiED;AAAZC,UAlHlFb,eAAAA,CAkHkFa;EAEpEK;AAAZL;AAARH;AAAO;EAAA,WACNS,EAAAA,MAAAA;EAAwB;AAAWpC;AAAuB6B;AAAZC;AAA6CN;EAAmCK,mBAAAA,EAAAA,MAAAA;AAAZC;AAEnHK;AAAIX;AAAM;AAAA;AACW;AAAWxB;AAAiD6B;AAAzBO;AAAdE;AAAO,UAlG3CpB,WAAAA,CAkG2C;EAAA,OAChDqB,EAAAA,MAAAA;EAAgB;EAAWvC,OAAAA,EAAAA,MAAAA;AAAuC6B;AAArBQ;AAA0Bf,UA7FlEH,cAAAA,CA6FkEG;EAAkB,GAAA,EAAA,MAAA;AAAA;AACrE;AAAWtB;AAA+B6B;AAArBQ;AAA0CzB;AAAsCA;AAAnBJ;AAAkB;AAAA;AAgBjH;AAAWR;AAASA,UAhGtBoB,cAAAA,CAgGsBpB;EACpBiB,WAAAA,EAAAA,MAAAA;EAKDD,eAAAA,EAAAA,MAAAA;EACgBa;EAAZC,QAAAA,EAAAA,MAAAA;EAAVL;EACGP,MAAAA,EAAAA,MAAAA;AACJK;AAAsCM;AAAZC;AAAVL;AACTN;AACPI;AAA2BM;AAAXD;AACTR;AACPG,UA7FMF,gBAAAA,CA6FNE;EAA4BM,MAAAA,EAAAA,MAAAA;EAAZG,OAAAA,EAAAA,MAAAA;AACPX;AACTE,UA3FMD,kBAAAA,CA2FNC;EAA6BM,OAAAA,EAAAA,MAAAA;AAAbK;AACUL;AAAjBU;AACThB;AAAW;AAAA;AAQa,KA7FvBA,WAAAA,GAAcC,MAsGG,CAAA,KAAA,EAAA,KAAA,CAAA;AAAA;AACVP;AACFD;AACFE;AACGC;AACAC;AACEC;AAAgB;AAAA;AAGP;AAoBD;AAAWrB,KAvH3ByB,SAuH2BzB,CAAAA,CAAAA,CAAAA,GAAAA,CAvHX0B,CAuHW1B,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAvHmB0B,CAuHnB1B,CAAAA,SAAAA,CAAAA;EAAU0C,OAAAA,EAAAA,KAAAA;AAAiCb,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CArH7DH,CAqH6DG,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CArH3BH,CAqH2BG,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CArHCH,CAqHDG,CAAAA,SAAAA,CAAAA;EAARY,OAAAA,EAAAA,IAAAA;AAAmBC,CAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CAnHzEhB,CAmHyEgB,CAAAA,SAAAA,CAAAA,MAAAA,CAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAA2Cb;AAArBW,KAjHvGb,OAiHuGa,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,MAjHnFd,CAiHmFc,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA;AAAoB;AAAA;AAgBvG;AAA6BO;AAAGvC;AAAX8B;AAAO;AAAA;AAC7B;AAAqBS,KAxHxCnB,UAwHwCmB,CAAAA,UAxHnB/C,MAwHmB+C,CAAAA,GAAAA,CAxHRjB,WAwHQiB,CAxHIlB,CAwHJkB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAxH6CjB,WAwH7CiB,CAxHyDlB,CAwHzDkB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAA0DnC,OAAAA,EAAAA,KAAAA,EAAAA;AAAVqC,CAAAA,GAtHzFtB,OAsHyFsB,CAtHjFnB,WAsHiFmB,CAtHrElB,CAsHqEkB,CAAAA,CAAAA,GAAAA,KAAAA;AAAS;AAAA;AAC7E;AAA2CF;AAArBD;AACLC;AAArBD;AAA+CK;AAApBH;AAAyB1B,KA9GpEU,WA8GoEV,CAAAA,UA9G9CtB,MA8G8CsB,CAAAA,GAAAA,CA9GnCQ,WA8GmCR,CA9GvBO,CA8GuBP,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA9GkBQ,WA8GlBR,CA9G8BO,CA8G9BP,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAkB,SAAA,EAAA,KAAA,EAAA;AAAA,CAAA,GA5GvFG,SA8GC2B,CA9GStB,WA8GTsB,CA9GqBnB,CA8GrBmB,CAAAA,CAAAA,GAAAA,KAA4B;AAAA;AAA2CL,KA5GvEb,YA4GuEa,CAAAA,UA5GhD/C,MA4GgD+C,CAAAA,GAAAA,CA5GrCjB,WA4GqCiB,CA5GzBlB,CA4GyBkB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA5GgBjB,WA4GhBiB,CA5G4BlB,CA4G5BkB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAArBD,SAAAA,EAAAA,KAAAA,EAAAA;AACZC,CAAAA,GA3GvCpB,OA2GuCoB,CA3G/BjB,WA2G+BiB,CA3GnBZ,CA2GmBY,CAAAA,CAAAA,GAAAA,KAAAA;AAArBD,KA1GjBV,wBA0GiBU,CAAAA,UA1GkB9C,MA0GlB8C,CAAAA,GAAAA,CA1G6BhB,WA0G7BgB,CA1GyCjB,CA0GzCiB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA1G0EtB,MA0G1EsB,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GA1GiGhB,WA0GjGgB,CA1G6GjB,CA0G7GiB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAA+CK,SAAAA,EAAAA,KAAAA,EAAAA;AAApBH,CAAAA,GAxG7Cb,CAwG6Ca,GAxGzCxB,MAwGyCwB,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAA0B1B,KAvGtEe,oBAuGsEf,CAAAA,UAvGvCtB,MAuGuCsB,CAAAA,GAvG7BgB,OAuG6BhB,CAAAA,MAvGfc,wBAuGed,CAvGUO,CAuGVP,CAAAA,EAAAA,MAAAA,CAAAA;AAAkB,KAtGxFiB,gBAsGwF,CAAA,UAtG7DvC,MAsG6D,CAAA,GAAA,QAtG3CqC,oBAsG2C,CAtGtBR,CAsGsB,CAAA,GAtGjBP,kBAsGiB,EAAA;AAAA,KArGxFkB,oBAuGe,CAAA,UAvGgBxC,MAuGhB,CAAA,GAvG0BqC,oBAuG1B,CAvG+CR,CAuG/C,CAAA,SAAA,KAAA,EAAA,GAvGoEjB,CAuGpE,SAAA,MAAA,GAvGuFJ,kBAuGvF,CAvG0GI,CAuG1G,CAAA,GAAA,KAAA,GAAA,KAAA;AAAA;AAAmC8B;AAA+BK;AAAGL;AAAmBY;AAA9BhB;AAA6DgB;AAAoBP;AAAGL;AAAmBY;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAgBD;AAAaW,KAvF3Ob,OAuF2Oa,CAAAA,UAvFzNtD,MAuFyNsD,GAvFhNtD,MAuFgNsD,CAAAA,GAAAA;EAAGV,QAAAA,EAtFvO3B,eAsFuO2B;EAAaO;AAAUP;AAAsBD;AAAaW;EAA+BP,MAAAA,CAAAA,EAjFjU/B,aAiFiU+B;AAArBG,CAAAA,GAAAA,CAhFlTzB,SAgFkTyB,CAhFxSpB,WAgFwSoB,CAhF5RrB,CAgF4RqB,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAoB,IAAA,EA/EnUhC,WA+EmU;AAAA,CAAA,GA9EvUK,WAoFCgC,CAAAA,GAAAA,CApFe9B,SAoFf8B,CApFyBzB,WAoFF,CApFcD,CAoFd,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EAnFjBV,cAmFiB;AAAmCuB,CAAAA,GAlF3DnB,WAkF2DmB,CAAAA,GAAAA,CAlF3Cd,UAkF2Cc,CAlFhCb,CAkFgCa,CAAAA,SAAAA,IAAAA,GAAAA;EAA+BK,OAAAA,EAjFnF3B,cAiFmF2B;AAAGL,CAAAA,GAhF7FnB,WAgF6FmB,CAAAA,GAAAA,CAhF7EV,WAgF6EU,CAhFjEb,CAgFiEa,CAAAA,SAAAA,IAAAA,GAAAA;EAAmBY,SAAAA,EA/EvGjC,gBA+EuGiC;AAA9BhB,CAAAA,GA9ElFf,WA8EkFe,CAAAA,GAAAA,CA9ElEJ,YA8EkEI,CA9ErDT,CA8EqDS,CAAAA,SAAAA,IAAAA,GAAAA;EAA6DgB,SAAAA,EA7EtIf,gBA6EsIe,CA7ErHzB,CA6EqHyB,CAAAA;AAAqBP,CAAAA,GA5EpKxB,WA4EoKwB,CAAAA;AAAGL;AAAmBY;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAiBD;AAAaW,UApEhPZ,kBAAAA,CAoEgPY;EAAGV,QAAAA,EAAAA,cAAAA,GAAAA,uBAAAA;EAAaO,MAAAA,EAAAA,aAAAA;EAAUP,IAAAA,EAAAA,oBAAAA,GAAAA,oBAAAA;EAAsBD,OAAAA,EAAAA,mBAAAA;EAAaW,OAAAA,EAAAA,mBAAAA,GAAAA,uBAAAA,GAAAA,qBAAAA,GAAAA,YAAAA;EAAuCP,SAAAA,EAAAA,uBAAAA,GAAAA,0BAAAA;AAA7BK;AAA4B;AAAA,UA3DnVT,YAAAA,CA6DE;EAAA,QAAA,EA5DA1B,eA4DA;EAAYS,MAAAA,EA3DdV,aA2DcU;EAAKA,IAAAA,EA1DrBR,WA0DqBQ;EAAU+B,OAAAA,EAzD5BtC,cAyD4BsC;EAASA,OAAAA,EAxDrCrC,cAwDqCqC;EAAgB/B,SAAAA,EAvDnDL,gBAuDmDK;AAAC;AAAA;AAE/C,UAtDRkB,YAAAA,CAsDQ;EAAiClB,YAAAA,EAAAA,aAAAA;EAAgCA,qBAAAA,EAAAA,qBAAAA;EAAiGiC,WAAAA,EAAAA,MAAAA;EAARH,kBAAAA,EAAAA,SAAAA;EAAqCI,kBAAAA,EAAAA,SAAAA;EAAdF,iBAAAA,EAAAA,KAAAA;EAAa,iBAAA,EAAA,aAAA;EAAA,qBAS5L,EAAA,iBAAA;EAAA,mBAAA,EAAA,UAAA;EAAmCI,UAAAA,EAAAA,QAAAA;EAAgDA,qBAAAA,EAAAA,QAAAA;EAAyCA,wBAAAA,EAAAA,SAAAA;AAAxBP;AAAsDO;AAAdJ;AAA2DI;AAAxBP;AAAwDO;AAAhBT;AAAe,KA3CrPR,gBA2CqP,CAAA,UA3C1N7C,MA2C0N,CAAA,GA3ChN0C,kBA2CgN,CAAA,MA3CvLD,OA2CuL,CA3C/KZ,CA2C+K,CAAA,GAAA,MA3CpKa,kBA2CoK,CAAA,GA3C9IF,oBA2C8I,CA3CzHX,CA2CyH,CAAA;AAAA;AAC9N;AACJ;AAGI;AAAuDiC;AAA8FH;AAAeO;AAAsCN;AAAMM;AAA9BD;AAAuB;AAAA;AAC9L;AAA2DH;AAAxBG;AAA0FH,KAjC/JhB,oBAiC+JgB,CAAAA,UAAAA,MAAAA,CAAAA,GAjCtHxB,OAiCsHwB,CAjC9Gf,CAiC8Ge,EAjC3GtD,kBAiC2GsD,CAAAA;AAAxBG,KAhCvIjB,mBAgCuIiB,CAAAA,UAAAA,MAAAA,CAAAA,GAhC/FlB,CAgC+FkB,SAAAA,iBAAAA,KAAAA,EAAAA,WAAAA,GAhC/ChB,SAgC+CgB,CAhCrCrD,CAgCqCqD,CAAAA,GAAAA,KAAAA;AAAuB,KA/B9Jf,oBA+B8J,CAAA,UAAA,MAAA,CAAA,GAAA,CA/BpHJ,oBA+BoH,CA/B/FC,CA+B+F,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,OAAA,GAAA;EAAA,SAK9JqB,EAAAA,QAnCgBtB,oBAmCM,CAnCeC,CAmCf,CAAA,IAnCqBC,mBAmCrB,CAnCyCG,CAmCzC,CAAA,GAnC8C7B,kBAmC9C,EAAA;AAAA,CAAA;AAAmCwC,KAjCzDV,4BAiCyDU,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAjCPhB,oBAiCOgB,CAjCcf,CAiCde,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAAsCA,SAAAA,CAAAA,EAAAA,QAhC9EhB,oBAgC8EgB,CAhCzDf,CAgCyDe,CAAAA,IAhCnDd,mBAgCmDc,CAhC/BX,CAgC+BW,CAAAA,IAhCzBxC,kBAgCyBwC,EAAAA;AAAkCA,CAAAA;AAAcC,KA9B/IV,eA8B+IU,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MA9B7FrB,kBA8B6FqB,IAAAA,CA9BtEzB,OA8BsEyB,CA9B9DhB,CA8B8DgB,EA9B3DrB,kBA8B2DqB,CA9BxCT,CA8BwCS,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA9BTT,CA8BSS,GAAAA,QA9BGzB,OA8BHyB,CA9BWhB,CA8BXgB,EA9BcrB,kBA8BdqB,CA9BiCT,CA8BjCS,CAAAA,CAAAA,IA9BwCnB,YA8BxCmB,CA9BqDZ,CA8BrDY,GAAAA,MA9B+DnB,YA8B/DmB,CAAAA,GA9B+EpB,YA8B/EoB,CA9B4FT,CA8B5FS,CAAAA,CA9B+FnB,YA8B/FmB,CA9B4GZ,CA8B5GY,GAAAA,MA9BsHnB,YA8BtHmB,CAAAA,GAAAA,MA9B4IpB,YA8B5IoB,CA9ByJT,CA8BzJS,CAAAA,CAAAA,EAAAA,EAAAA,GA9BmKb,oBA8BnKa,CA9BwLhB,CA8BxLgB,CAAAA;AAAtBzB;AAA6GwB;AAAnCK;AAAgEL;AAAI;AAAA,KAxBvQP,uBAyBAc,CAAAA,UAAwB,MAAA,CAAA,GAAA,QAAA,MAzBkC3B,kBAyBlC,IAAA,CAzByDJ,OAyBzD,CAzBiES,CAyBjE,EAzBoEL,kBAyBpE,CAzBuFY,CAyBvF,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAzBsHA,CAyBtH,IAAA,QAzBmIhB,OAyBnI,CAzB2IS,CAyB3I,EAzB8IL,kBAyB9I,CAzBiKY,CAyBjK,CAAA,CAAA,IAzBwKV,YAyBxK,CAzBqLO,CAyBrL,GAAA,MAzB+LP,YAyB/L,CAAA,IAzBgND,YAyBhN,CAzB6NW,CAyB7N,CAAA,CAzBgOV,YAyBhO,CAzB6OO,CAyB7O,GAAA,MAzBuPP,YAyBvP,CAAA,GAAA,MAzB6QD,YAyB7Q,CAzB0RW,CAyB1R,CAAA,CAAA,EAAA,EAAA,GAzBoSF,4BAyBpS,CAzBiUL,CAyBjU,CAAA;AAAA;AAA2De,KAvBnFN,OAuBmFM,CAAAA,CAAAA,EAAAA,QAvBhEpC,CAuBgEoC,CAAAA,GAvB3DpC,CAuB2DoC,SAvBjDL,KAuBiDK,GAAAA,CAvBxCL,KAuBwCK,CAAAA,SAAAA,CAvBxBpC,CAuBwBoC,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAvBM;AAA0DJ,KArBtHN,aAqBsHM,CAAAA,UAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GArBxEtC,CAqBwEsC,SAAAA,SAAAA,EAAAA,GAAAA,KAAAA,GArBxCtC,CAqBwCsC,SAAAA,SAAAA,CAAAA,KAAAA,KAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,SArBiDR,OAqBjDQ,CArByDL,IAqBzDK,CAAAA,GAAAA,IAAAA,GArBwEN,aAqBxEM,CArBsFJ,IAqBtFI,CAAAA,GAAAA,IAAAA;AAAmB;AAAA;AACrH;AAAoCO;AAEzDT;AAAI;AAAA;AACyB;AAAkFS,KAhB9GV,eAgB8GU,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAhB5DT,IAgB4DS,SAAAA,SAAAA,MAAAA,EAAAA,GAAAA,MAAAA,SAhBZT,IAgBYS,CAAAA,QAAAA,CAAAA,GAhBKhB,uBAgBLgB,CAhB6BT,IAgB7BS,CAAAA,MAAAA,CAAAA,CAAAA,GAhB6Cb,aAgB7Ca,CAhB2DT,IAgB3DS,CAAAA,SAAAA,IAAAA,GAhBgFhB,uBAgBhFgB,CAhBwGT,IAgBxGS,CAAAA,MAAAA,CAAAA,CAAAA,GAhBwHlB,eAgBxHkB,CAhBwIT,IAgBxIS,CAAAA,MAAAA,CAAAA,CAAAA,GAAAA,KAAAA;AAArBD,KAfzFP,uBAAAA,GAeyFO,mBAAAA,GAAAA,uBAAAA;AAAzBD,KAdhEL,mBAAAA,GAcgEK;EAAwB,SAAA,iFAAA,EAAA,KAAA;AAAA,CAAA;AAE/D,KAbzBJ,uBAayB,CAAA,aAAA,SAAA,MAAA,EAAA,EAAA,YAAA,MAAA,CAAA,GAbqDH,IAarD,SAAA,SAAA,CAAA,KAAA,cAAA,MAAA,EAAA,GAAA,KAAA,cAAA,SAAA,MAAA,EAAA,CAAA,GAAA,CAbmJH,IAanJ,CAAA,SAAA,CAbkKO,GAalK,CAAA,GAAA,IAAA,GAbgLD,uBAahL,CAbwML,IAaxM,EAb8MM,GAa9M,CAAA,GAAA,KAAA;AAA8BnB,KAZvDoB,kCAYuDpB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAZckB,uBAYdlB,CAZsCe,IAYtCf,EAAAA,mBAAAA,CAAAA,SAAAA,IAAAA,GAZgFkB,uBAYhFlB,CAZwGe,IAYxGf,EAAAA,uBAAAA,CAAAA,SAAAA,IAAAA,GAAAA,IAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAGgB;AAAXzB;AAAiEyB;AAAgChB;AAAciB,KAP9JI,sBAO8JJ,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAPrGF,IAOqGE,SAAAA,OAAAA,GAAAA,MAAAA,SAP/DF,IAO+DE,CAAAA,QAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAPrC1B,OAOqC0B,CAP7BF,IAO6BE,CAAAA,MAAAA,CAAAA,EAPfD,uBAOeC,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAPqCG,kCAOrCH,CAPwEF,IAOxEE,CAAAA,SAAAA,IAAAA,GAAAA,KAAAA,GAPqGF,IAOrGE,GAAAA,KAAAA;AAAmB,KANjLK,wBAMiL,CAAA,aAAA,SAAA,MAAA,EAAA,CAAA,GAAA,CANrHD,sBAMqH,CAN9FN,IAM8F,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,OAAA,GAN3DE,mBAM2D;AAAA,KALjLM,oBAMoB,CAAA,aAiCjBpE,SAAO,OAAA,EAAA,CAAA,GAvC8CqE,IAuC9C,CAAA,CAAA,CAAA,SAAA;EAAA,IA+CEI,EAAAA,KAAAA,cAAQ,SAAA,MAAA,EAAA;AAAA,CAAA,GApFrBb,IAoFqB,GAAA,KAAA;AAAiB9D,KAnFrCwE,4BAmFqCxE,CAAAA,aAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAnF2BqE,wBAmF3BrE,CAnFoDsE,oBAmFpDtE,CAnFyEuE,IAmFzEvE,CAAAA,CAAAA;AAA8C0E;AAkBtD7C,KAnG7B4C,yBAmG6B5C,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAnGkBS,OAmGlBT,CAnG0BkB,CAmG1BlB,EAnG6BkC,uBAmG7BlC,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAnGmFkC,uBAmGnFlC,SAnGmHkB,CAmGnHlB,GAAAA,OAAAA,GAnGiImC,mBAmGjInC;AAAjBgB,UAlGP6B,eAAAA,CAkGO7B;EACLhB;AAAY0C;AAA4CA;AAARK;EAA7BJ,SAAAA,EAAAA,MAAAA;EAAmGD;AAARK;AAArBN;AAAhBT;AAARgB;EAAO,MAAA,CAAA,EAAA,MAAA;EAAA;AAC3D;AAAiB7E;AAAyC6B;AAAjBgB;EAAqChB,QAAAA,CAAAA,EAAAA,MAAAA;EAAqBkB;AAAR6B;AAAsCF;AACjI3B;AAAR6B;EACqB7B,MAAAA,CAAAA,EAAAA,MAAAA;EAAR6B;AAA1BH;AAAwE1B;AAAR6B;EAAhBvB,OAAAA,CAAAA,EAAAA,MAAAA;EAARwB;AAAO;AAAA;AAC1B;EAAiB7E,GAAAA,CAAAA,EAtElCE,OAsEkCF;EAAgB6B;AAAY6C;AAElD7C;AAARY;AAARoC;AAAO;AAAA;EAEc,QAAA,CAAA,EAAA,MAAA;EAAiB7E;AAAqD6B;AAAjBgB;AAA+BhB;AAAY6C;AACjHZ;AACJE;EAAsBa,YAAAA,CAAAA,EAAAA,MAAAA;AAAO;AAuEuC;AAY9C;AAAMG;AAAkBxD;AAAM;AAAA;AAOpC;AAAiBmB;AAAwBA;AAAaW;AAArB0C;AACxB1E;AAAfE;AAAM;;;;AC/ekB;AAIf;AAAW;AACrB;AAAZ;AAGG;AACA;AAAM;AAGV;AAA0B;AAAW;AACX;AAAnB,iBD0WUmD,QC1WV,CAAA,gBD0WmC3E,MC1WnC,EAAA,mBAAA,SAAA,CAAA,OAAA,ED0WiF0E,eC1WjF,GAAA;EADwC;AAAO;AAetD;AACyK;AASlJ;AAAW;AAClB;AAAf;AAEE;AACA;AAAC;AAAA;AAGkB;AACX;AAEP;AAAmC;AAAnB;EACc,IAAA,EAAA,SDyVjB7B,gBCzViB,CDyVAhB,CCzVA,CAAA,EAAA;AAAnB,CAAA,CAAA,CAAA,CAAA,MAAA,ED0VHA,CC1VG,EAAA,GAAA,IAAA,ED0VS0C,IC1VT,GD0VgBC,4BC1VhB,CD0V6CI,OC1V7C,CD0VqDL,IC1VrD,CAAA,CAAA,CAAA,ED0V8DM,OC1V9D,CD0VsEhB,eC1VtE,CD0VsFS,oBC1VtF,CD0V2GM,OC1V3G,CD0VmHL,IC1VnH,CAAA,CAAA,CAAA,CAAA;AAAsB,iBD2VpBI,QC3VoB,CAAA,gBD2VK3E,MC3VL,EAAA,gBD2V6B6C,gBC3V7B,CD2V8ChB,CC3V9C,CAAA,GAAA,KAAA,CAAA,CAAA,MAAA,ED2VkEA,CC3VlE,EAAA,OAAA,EAAA,CD2V+E+C,OC3V/E,CD2VuF7B,CC3VvF,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GD2VqH2B,eC3VrH,GAAA;EAAlC,IAAA,EAAA,SD4VcE,OC5Vd,CD4VsB7B,CC5VtB,CAAA,EAAA;AACe,CAAA,GD4Vd0B,yBC5Vc,CD4VYG,OC5VZ,CD4VoB7B,CC5VpB,CAAA,CAAA,CAAA,ED4V0B8B,OC5V1B,CD4VkCxB,eC5VlC,CD4VkDuB,OC5VlD,CD4V0D7B,CC5V1D,CAAA,CAAA,CAAA;AAAd,iBD6Va4B,QC7Vb,CAAA,gBD6VsC3E,MC7VtC,CAAA,CAAA,MAAA,ED6VsD6B,CC7VtD,EAAA,OAAA,ED6VkE6C,eC7VlE,GAAA;EAAO,IAAA,CAAA,EAAA,KAAA;AAQX,CAAA,CAAA,EDuVIG,OCvVQ,CDuVApC,OCvVA,CDuVQZ,CCvVR,CAAe,CAAA;AAAA;AAAW,iBDyVrB8C,QCzVqB,CAAA,gBDyVI3E,MCzVJ,EAAA,mBAAA,SDyVwC6C,gBCzVxC,CDyVyDhB,CCzVzD,CAAA,EAAA,CAAA,CAAA,MAAA,EDyVuEA,CCzVvE,EAAA,OAAA,EDyVmF6C,eCzVnF,GAAA;EACF,IAAA,EDyV5BZ,ICzV4B;AAAG,CAAA,GD0VnCE,mBC1VmC,CAAA,ED0Vba,OC1Va,CAAA,KAAA,CAAA;AAArB;AAAP;AAAM;AAiIjB;AAAwB;AAAiB;AAAgB;AAAY;AAAR;;;;;;;;;;;;;iBD4S5CkB,SAAAA,MAAef,kBAAkBxD;;;;;;;KAO7CwD,eAAAA,iBAAgCrC,gBAAgBqD,QAAQrD,aAAaW;cAC5D9B,eAAeF;;;;;AA9d+BV;AAAuBA,KCb9E,kBDa8EA,CAAAA,UCbjD,MDaiDA,CAAAA,GCZlF,WDYkFA,CCZtE,CDYsEA,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAnBJ,SAAAA,EAAAA,KAAAA,EAAAA;AAAkB,CAAA,GCT9E,CDS8E,GCR9E,MDQ8E,CAAA,KAAA,EAAA,KAAA,CAAA;AAAA;AAEjEM,KCPL,cDOKA,CAAoB,UCPA,MDOsBN,CAAAA,GCPZ,ODOYA,CAAAA,MCNpD,kBDMsE,CCNnD,CDMmD,CAAA,EAAA,MAAA,CAAA;AAEzD;AAOG;AAIE;AAsBJ;AAMG;AAcA;AAgBE;AAIE;AAoBvBiB,KCvFO,mBAAA,GDuFE,uKAAA;AAAA;AAAOC;AAA8BA;AAErCA;AAAkCA;AAA4BA;AAE/DA;AAAC,KCjFT,kBDiFS,CAAA,UCjFoB,MDiFpB,EAAA,UAAA,MAAA,CAAA,GAAA,CChFb,cDkFW,CClFI,CDkFJ,CAAA,CAAc,SAUrBE,CAAAA,KAAAA,CAAU,GC1FZ,mBD0FY,GCzFZ,CDyFY;AAAA;AAAW5B,KCtFrB,iBDsFqBA,CAAAA,UCrFf,MDqFeA,EAAAA,UAAAA,MAAAA,CAAAA,GCnFtB,CDmFsBA,SAAAA,MCnFN,kBDmFMA,CCnFa,CDmFbA,CAAAA,GClFvB,WDkFuBA,CClFX,kBDkFWA,CClFQ,CDkFRA,CAAAA,CClFW,CDkFXA,CAAAA,CAAAA,SAAAA;EAAuB6B,GAAAA,EAAAA,KAAAA,EAAAA;AAAZC,CAAAA,GCjFjC,ODiFiCA,CAAAA,MCjFnB,CDiFmBA,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAiED;AAAZC;AAElEC;AAAZD;AAARH,KC3EQ,eD2ERA,CAAAA,UC3EkC,MD2ElCA,EAAAA,UAAAA,MAAAA,CAAAA,GAAAA;EAAO,QAAA,EC1EA,MD0EA,CC1EO,iBD0EP,CC1EyB,CD0EzB,EC1E4B,CD0E5B,CAAA,EAAA,MAAA,CAAA;AAAA,CAAA;AAUK;AAAW3B;AAAuB6B;AAAZC;AAAiED;AAAZC;AAEjEG;AAAZH;AAAVL;AAAS;AAAA;AAEI;AAAWzB;AAAuB6B;AAAZC;AAAiED;AAAZC;AAEpEK;AAAZL;AAARH;AAAO;AAAA;AACkB;AAAW3B;AAAuB6B;AAAZC;AAA6CN;AAAmCK;AAAZC;AAEnHK;AAAIX;AAAM;AAAA;AACW;AAAWxB;AAAiD6B;AAAzBO;AAAdE;AAAO;AAAA;AAChC;AAAWtC;AAAuC6B;AAArBQ;AAA0Bf;AAAkB;AAAA;AACrE;AAAWtB;AAA+B6B,iBCiCnD,QDjCmDA,CAAAA,gBCiC1B,MDjC0BA,CAAAA,CAAAA,MAAAA,ECiCV,CDjCUA,CAAAA,ECiCN,ODjCMA,CCiCE,CDjCFA,CAAAA;AAArBQ,iBC0C9B,QD1C8BA,CAAAA,gBC2C7B,MD3C6BA,EAAAA,gBC4C7B,cD5C6BA,CC4Cd,CD5CcA,CAAAA,CAAAA,CAAAA,MAAAA,EC8CrC,CD9CqCA,EAAAA,KAAAA,EC+CtC,kBD/CsCA,CC+CnB,CD/CmBA,EC+ChB,CD/CgBA,CAAAA,CAAAA,ECgD3C,ODhD2CA,CCgDnC,CDhDmCA,CAAAA,GCgD9B,eDhD8BA,CCgDd,CDhDcA,ECgDX,CDhDWA,CAAAA;AAA0CzB,iBCiDxE,QDjDwEA,CAAAA,gBCkDvE,MDlDuEA,EAAAA,gBCmDvE,gBDnDuEA,CCmDtD,CDnDsDA,CAAAA,CAAAA,CAAAA,MAAAA,ECoD9E,CDpD8EA,EAAAA,IAAAA,EAAAA,SCoD5D,CDpD4DA,EAAAA,CAAAA,ECoDtD,eDpDsDA,CCoDtC,CDpDsCA,CAAAA"}
+{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","NeonCredentialMeta","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","FunctionBaseUrlKey","Slug","Uppercase","functionBaseUrlKey","S","parseFunctionBaseUrlKey","isFunctionBaseUrlKey","FunctionUrlMode","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","HasKeys","OrBool","A","B","HasGaRecord","NonNullable","HasGaToggle","HasPreviewBuckets","C","HasBuckets","HasPreviewAiGateway","AiGatewayOn","HasPreviewFunctions","F","HasFunctions","GaFunctionsOfConfig","PreviewFunctionsOfConfig","FunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","FetchEnvKeysOptions","ResolvedNeonEnv","FetchEnvKeysState","ReadonlyArray","fetchEnvKeysState","resolveBranchPolicy","Pick","ReturnType","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","isLiveCredential","defaultStorageCredential","defaultAiGatewayCredential","createApiFromOptions","toEntries","Partial"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, NeonCredentialMeta, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\ntype FunctionBaseUrlKey<Slug extends string = string> = `NEON_FUNCTION_${Uppercase<Slug>}_BASE_URL`;\ndeclare function functionBaseUrlKey<S extends string>(slug: S): FunctionBaseUrlKey<S>;\ndeclare function parseFunctionBaseUrlKey(key: string): string | null;\ndeclare function isFunctionBaseUrlKey(key: string): key is FunctionBaseUrlKey;\n/** `all-live` lists deployed functions. Policy mode derives declared slugs from the connection host. */\ntype FunctionUrlMode = \"policy\" | \"all-live\";\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/**\n * S3-compatible object-storage access for the branch. Present on `NeonEnv` only\n * when the policy declares `buckets` (or deprecated `preview.buckets`). Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch. Present on `NeonEnv` only when the policy\n * enables `aiGateway` (or deprecated `preview.aiGateway`). `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\ninterface NeonFunctionUrlEnv {\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\ntype OrBool<A extends boolean, B extends boolean> = A extends true ? true : B;\n/**\n * Whether a top-level optional record (GA `functions` / `buckets`) has known keys.\n * A string index signature (`Record<string, …>`, the default `Config` param) is treated\n * as empty so an untyped policy yields just `{ postgres }`, matching {@link HasPreviewBuckets}.\n */\ntype HasGaRecord<T> = [NonNullable<T>] extends [never] ? false : string extends keyof NonNullable<T> ? false : HasKeys<NonNullable<T>>;\ntype HasGaToggle<T> = [NonNullable<T>] extends [never] ? false : ServiceOn<NonNullable<T>>;\n/**\n * Whether the policy declares at least one object-storage bucket (`buckets` or\n * deprecated `preview.buckets`). Drives whether {@link NeonEnv} carries the `storage`\n * namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasPreviewBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\ntype HasBuckets<C extends Config> = OrBool<HasGaRecord<C[\"buckets\"]>, HasPreviewBuckets<C>>;\n/**\n * Whether the policy enables the AI Gateway (`aiGateway` or deprecated `preview.aiGateway`).\n * Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n */\ntype HasPreviewAiGateway<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\ntype AiGatewayOn<C extends Config> = OrBool<HasGaToggle<C[\"aiGateway\"]>, HasPreviewAiGateway<C>>;\n/** The tuple guard prevents a missing preview block from enabling functions. */\ntype HasPreviewFunctions<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? HasKeys<NonNullable<F>> : false;\ntype HasFunctions<C extends Config> = OrBool<HasGaRecord<C[\"functions\"]>, HasPreviewFunctions<C>>;\ntype GaFunctionsOfConfig<C extends Config> = [NonNullable<C[\"functions\"]>] extends [never] ? Record<never, never> : string extends keyof NonNullable<C[\"functions\"]> ? Record<never, never> : NonNullable<C[\"functions\"]>;\ntype PreviewFunctionsOfConfig<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? Record<never, never> : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? F : Record<never, never>;\ntype FunctionsOfConfig<C extends Config> = [keyof GaFunctionsOfConfig<C>] extends [never] ? PreviewFunctionsOfConfig<C> : [keyof PreviewFunctionsOfConfig<C>] extends [never] ? GaFunctionsOfConfig<C> : GaFunctionsOfConfig<C> & PreviewFunctionsOfConfig<C>;\ntype FunctionSlugOfConfig<C extends Config> = Extract<keyof FunctionsOfConfig<C>, string>;\ntype NeonFunctionsEnv<C extends Config> = { [S in FunctionSlugOfConfig<C>]: NeonFunctionUrlEnv };\ntype FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends infer S ? S extends string ? FunctionBaseUrlKey<S> : never : never;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.buckets` (or deprecated `preview.buckets`) declares at least one bucket.\n * - `aiGateway` is added iff `config.aiGateway` (or deprecated `preview.aiGateway`) is statically enabled.\n * - `functions` is added iff `config.functions` (or deprecated `preview.functions`) declares at least one slug.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace) & (HasFunctions<C> extends true ? {\n  functions: NeonFunctionsEnv<C>;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace] | FunctionBaseUrlKeyOf<C>;\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype SelectedFunctionKeys<K extends string> = Extract<K, FunctionBaseUrlKey>;\ntype FunctionSlugFromKey<K extends string> = K extends `NEON_FUNCTION_${infer S}_BASE_URL` ? Lowercase<S> : never;\ntype FunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]: NeonFunctionUrlEnv };\n};\ntype OptionalFunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions?: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]?: NeonFunctionUrlEnv };\n};\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & FunctionsFilteredEnv<K>;\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & OptionalFunctionsFilteredEnv<K>;\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\ntype FetchEnvKeysState = {\n  env: ResolvedNeonEnv;\n  /** Prevents endpoint failure from being mistaken for a confirmed empty function list. */\n  functionUrlsUnavailable: boolean;\n};\ntype FetchEnvKeysOptions = FetchEnvOptions & {\n  functionUrls?: FunctionUrlMode;\n  /**\n   * Keys to skip even when {@link fetchEnvKeys} is unscoped (`keys === null`).\n   * {@link fetchEnvReusingSecrets} uses this to keep already-verified secrets\n   * without converting an unscoped fetch into a static policy-key list — that\n   * list cannot name `NEON_FUNCTION_*_BASE_URL`, so it would drop function URLs.\n   */\n  omitKeys?: readonly string[];\n  /**\n   * Skip a second `listBranchFunctions` when the caller already listed.\n   * `--service functions` uses this so a later `FeatureUnavailable` cannot be\n   * swallowed as `skipped`.\n   */\n  listedFunctions?: ReadonlyArray<{\n    slug: string;\n    invocationUrl: string;\n  }>;\n};\ndeclare function fetchEnvKeysState(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<FetchEnvKeysState>;\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi): Promise<{\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n}>;\n/**\n * Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n * *require* secrets; functions never force a credential. `functions:invoke` rides along only\n * when this path still has to mint (defaults already cover storage and the gateway).\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\ndeclare function isLiveCredential(meta: NeonCredentialMeta, now: number): boolean;\ndeclare function defaultStorageCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function defaultAiGatewayCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> } & {\n  functions?: Record<string, NeonFunctionUrlEnv>;\n};\n//#endregion\nexport { FetchEnvKeysOptions, FetchEnvKeysState, FetchEnvOptions, FilteredNeonEnv, FunctionBaseUrlKey, FunctionUrlMode, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionUrlEnv, NeonFunctionsEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AA8CC,cA1CaO,iBA2CS,EAAA;EAAA;AAA4DE;AAAVC;AAAS;AAAA;EAC/C,SAAA,MAAA,EAAA;IAAyBE,SAAAA,IAAAA,EAAAA,aAAAA;EAAuBA,CAAAA;EAAnBJ,SAAAA,QAAAA,EAAAA;IAAkB,SAAA,WAAA,EAAA,cAAA;IACjEK,SAAAA,mBAAuB,EAAA,uBAAA;EAAA,CAAA;EAGpB,SAOVG,IAAAA,EAAAA;IAIAC,SAAAA,OAAAA,EAAe,oBAAA;IAsBfC,SAAAA,OAAW,EAAA,oBAAA;EAAA,CAAA;EAMG,SAcdE,OAAAA,EAAAA;IAgBAC,SAAAA,GAAAA,EAAAA,mBAAgB;EAAA,CAAA;EAIE;AAQH;AAYX;AAAOK;AAA8BA;EAErCA,SAAAA,OAAAA,EAAAA;IAAkCA,SAAAA,WAAAA,EAAAA,mBAAAA;IAA4BA,SAAAA,eAAAA,EAAAA,uBAAAA;IAE/DA,SAAAA,QAAAA,EAAAA,qBAAAA;IAAC,SAAA,MAAA,EAAA,YAAA;EAAA,CAAA;EAEY;AACf;AAAyCG;AAAwBC;AAAC;AAAA;AAM7D;EAAmBJ,SAAAA,SAAAA,EAAAA;IAAZM,SAAAA,MAAAA,EAAAA,uBAAAA;IAA2EN,SAAAA,OAAAA,EAAAA,0BAAAA;EAAZM,CAAAA;AAA6CN,CAAAA;AAAZM,KA/GlHxB,kBA+GkHwB,CAAAA,aAAAA,MAAAA,GAAAA,MAAAA,CAAAA,GAAAA,iBA/G9CtB,SA+G8CsB,CA/GpCvB,IA+GoCuB,CAAAA,WAAAA;AAARL,iBA9G9FhB,kBA8G8FgB,CAAAA,UAAAA,MAAAA,CAAAA,CAAAA,IAAAA,EA9GnDf,CA8GmDe,CAAAA,EA9G/CnB,kBA8G+CmB,CA9G5Bf,CA8G4Be,CAAAA;AAAO,iBA7GrGd,uBAAAA,CA6GqG,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;AAAA,iBA5GrGC,oBAAAA,CA6GD,GAAA,EAAA,MAAA,CAAA,EAAA,GAAA,IA7G2CN,kBA6G3C;AAAA;;AAAOwB;AAAgEN;AAAZM;AAAVP;AAAS;AAAA;AAWpD,UA/GZT,aAAAA,CA+GY;EAAWhB,IAAAA,EAAAA,MAAAA;AAAuBmC;AAAZH;AAAiEG,UA3GnGlB,eAAAA,CA2GmGkB;EAAZH;AAEzEF;AAAZE;AAARL;EAAO,WAAA,EAAA,MAAA;EAAA;AACI;AAAW3B;AAA6BmC;AAAZJ;EAA6CI,mBAAAA,EAAAA,MAAAA;AAAlBD;AAAlCN;AAAM;AAAA;AAKlB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEH,UA/FhBX,WAAAA,CA+FgBW;EAAZG,OAAAA,EAAAA,MAAAA;EAAVP;EAAS,OAAA,EAAA,MAAA;AAAA;AACG;AAAWzB,UA1FjBmB,cAAAA,CA0FiBnB;EAA6BmC,GAAAA,EAAAA,MAAAA;AAAZF;AAAiDE;AAApBE;AAApCT;AAAM;AAAA;AAEnB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAE3EQ,UAhFdpB,cAAAA,CAgFcoB;EAAZR,WAAAA,EAAAA,MAAAA;EAARL,eAAAA,EAAAA,MAAAA;EAAO;EAAA,QACNc,EAAAA,MAAAA;EAAY;EAAWzC,MAAAA,EAAAA,MAAAA;AAA6BmC;AAAZJ;AAAiDI;AAApBI;AAApCX;AAAM;AAAA;AACpB;AAAW5B;AAAuBmC,UAlEhDd,gBAAAA,CAkEgDc;EAAZH,MAAAA,EAAAA,MAAAA;EAA+CR,OAAAA,EAAAA,MAAAA;AAAwDW;AAAZH,UA9D/HV,kBAAAA,CA8D+HU;EAA8BR,OAAAA,EAAAA,MAAAA;AAAmCW;AAAZH;AAAW;AAAA;AAC5K;AAAWhC;AAAuBmC,KAvD1DZ,WAAAA,GAAcC,MAuD4CW,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAZH;AAA6CR;AAAmCW;AAAZH;AAEnHQ;AAAIhB;AAAM;AAAA;AACQ;AAAWxB;AAAqCmC;AAApBO,KA9C7CjB,SA8C6CiB,CAAAA,CAAAA,CAAAA,GAAAA,CA9C7BhB,CA8C6BgB,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA9CChB,CA8CDgB,CAAAA,SAAAA,CAAAA;EAAmEP,OAAAA,EAAAA,KAAAA;AAAzBQ,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA5C9EjB,CA4C8EiB,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA5C5CjB,CA4C4CiB,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CA5ChBjB,CA4CgBiB,CAAAA,SAAAA,CAAAA;EAA8DR,OAAAA,EAAAA,IAAAA;AAAzBQ,CAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CA1CpHjB,CA0CoHiB,CAAAA,SAAAA,CAAAA,MAAAA,CAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAmER;AAApBO,KAxC3Kf,OAwC2Ke,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,MAxCvJhB,CAwCuJgB,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA;AAA6CP,KAvCxNP,MAuCwNO,CAAAA,UAAAA,OAAAA,EAAAA,UAAAA,OAAAA,CAAAA,GAvCzKN,CAuCyKM,SAAAA,IAAAA,GAAAA,IAAAA,GAvCjJL,CAuCiJK;AAApBO;AAAkDP;AAAzBQ;AAAwB;AAAA;AACjO,KAlCpBZ,WAkCoB,CAAA,CAAA,CAAA,GAAA,CAlCFC,WAkCE,CAlCUN,CAkCV,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,MAAA,SAAA,MAlC6DM,WAkC7D,CAlCyEN,CAkCzE,CAAA,GAAA,KAAA,GAlCsFC,OAkCtF,CAlC8FK,WAkC9F,CAlC0GN,CAkC1G,CAAA,CAAA;AAAW1B,KAjC/BiC,WAiC+BjC,CAAAA,CAAAA,CAAAA,GAAAA,CAjCbgC,WAiCahC,CAjCD0B,CAiCC1B,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAjC6ByB,SAiC7BzB,CAjCuCgC,WAiCvChC,CAjCmD0B,CAiCnD1B,CAAAA,CAAAA;AAA0CmC;AAAlBS;AAAdE;AAAO;AAAA;AAChC;AAAW9C;AAAuCmC;AAArBU;AAA0BvB;AAAkB,KAvBzFY,iBAuByF,CAAA,UAvB7DlC,MAuB6D,CAAA,GAAA,CAvBlDgC,WAuBkD,CAvBtCG,CAuBsC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAvBGH,WAuBH,CAvBeG,CAuBf,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,OACzFa,EAAAA,KAAAA,EAAAA;AAAoB,CAAA,GAtBrBrB,OAsBqB,CAtBbK,WAsBa,CAtBDF,CAsBC,CAAA,CAAA,GAAA,KAAA;AAAW9B,KArB/BoC,UAqB+BpC,CAAAA,UArBVA,MAqBUA,CAAAA,GArBA4B,MAqBA5B,CArBO+B,WAqBP/B,CArBmBmC,CAqBnBnC,CAAAA,SAAAA,CAAAA,CAAAA,EArBkCkC,iBAqBlClC,CArBoDmC,CAqBpDnC,CAAAA,CAAAA;AAA+BmC;AAArBU;AAA0CjC;AAAsCA;AAAnBJ,KAhBtG6B,mBAgBsG7B,CAAAA,UAhBxER,MAgBwEQ,CAAAA,GAAAA,CAhB7DwB,WAgB6DxB,CAhBjD2B,CAgBiD3B,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAhBRwB,WAgBQxB,CAhBI2B,CAgBJ3B,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAkB,SAAA,EAAA,KAAA,EAAA;AAAA,CAAA,GAdzHiB,SA8BCwB,CA9BSjB,WA8BF,CA9BcH,CA8Bd,CAAA,CAAA,GAAA,KAAA;AAAA,KA7BPS,WA6BO,CAAA,UA7BetC,MA6Bf,CAAA,GA7ByB4B,MA6BzB,CA7BgCK,WA6BhC,CA7B4CE,CA6B5C,CAAA,WAAA,CAAA,CAAA,EA7B6DE,mBA6B7D,CA7BiFF,CA6BjF,CAAA,CAAA;AAAWnC;AAASA,KA3B3BuC,mBA2B2BvC,CAAAA,UA3BGA,MA2BHA,CAAAA,GAAAA,CA3BcgC,WA2BdhC,CA3B0BmC,CA2B1BnC,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA3BmEgC,WA2BnEhC,CA3B+EmC,CA2B/EnC,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EACpBiB,SAAAA,EAAAA,KAAAA,EAAAA;AAKDD,CAAAA,GA/BPW,OA+BOX,CA/BCgB,WA+BDhB,CA/BawB,CA+BbxB,CAAAA,CAAAA,GAAAA,KAAAA;AACgBmB,KA/BtBM,YA+BsBN,CAAAA,UA/BCnC,MA+BDmC,CAAAA,GA/BWP,MA+BXO,CA/BkBJ,WA+BlBI,CA/B8BA,CA+B9BA,CAAAA,WAAAA,CAAAA,CAAAA,EA/B+CI,mBA+B/CJ,CA/BmEA,CA+BnEA,CAAAA,CAAAA;AAAZH,KA9BVU,mBA8BUV,CAAAA,UA9BoBhC,MA8BpBgC,CAAAA,GAAAA,CA9B+BA,WA8B/BA,CA9B2CG,CA8B3CH,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA9B8ER,MA8B9EQ,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GAAAA,MAAAA,SAAAA,MA9B0HA,WA8B1HA,CA9BsIG,CA8BtIH,CAAAA,WAAAA,CAAAA,CAAAA,GA9BwJR,MA8BxJQ,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GA9B+KA,WA8B/KA,CA9B2LG,CA8B3LH,CAAAA,WAAAA,CAAAA,CAAAA;AAAVP,KA7BAkB,wBA6BAlB,CAAAA,UA7BmCzB,MA6BnCyB,CAAAA,GAAAA,CA7B8CO,WA6B9CP,CA7B0DU,CA6B1DV,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA7B2FD,MA6B3FC,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GA7BkHO,WA6BlHP,CA7B8HU,CA6B9HV,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EACGP,SAAAA,EAAAA,KAAAA,EAAAA;AACJK,CAAAA,GA7BAiB,CA6BAjB,GA7BIC,MA6BJD,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAsCY,KA5BrCS,iBA4BqCT,CAAAA,UA5BTnC,MA4BSmC,CAAAA,GAAAA,CAAAA,MA5BQO,mBA4BRP,CA5B4BA,CA4B5BA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA5BkDQ,wBA4BlDR,CA5B2EA,CA4B3EA,CAAAA,GAAAA,CAAAA,MA5BuFQ,wBA4BvFR,CA5BgHA,CA4BhHA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA5BsIO,mBA4BtIP,CA5B0JA,CA4B1JA,CAAAA,GA5B+JO,mBA4B/JP,CA5BmLA,CA4BnLA,CAAAA,GA5BwLQ,wBA4BxLR,CA5BiNA,CA4BjNA,CAAAA;AAAZH,KA3BzBa,oBA2ByBb,CAAAA,UA3BMhC,MA2BNgC,CAAAA,GA3BgBc,OA2BhBd,CAAAA,MA3B8BY,iBA2B9BZ,CA3BgDG,CA2BhDH,CAAAA,EAAAA,MAAAA,CAAAA;AAAVP,KA1BfsB,gBA0BetB,CAAAA,UA1BYzB,MA0BZyB,CAAAA,GAAAA,QA1B8BoB,oBA0B9BpB,CA1BmDU,CA0BnDV,CAAAA,GA1BwDH,kBA0BxDG,EAAAA;AACTN,KA1BN6B,oBA0BM7B,CAAAA,UA1ByBnB,MA0BzBmB,CAAAA,GA1BmC0B,oBA0BnC1B,CA1BwDgB,CA0BxDhB,CAAAA,SAAAA,KAAAA,EAAAA,GA1B6EP,CA0B7EO,SAAAA,MAAAA,GA1BgGX,kBA0BhGW,CA1BmHP,CA0BnHO,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AACPI;AAA2BY;AAAXC;AACThB;AACPG;AAA4BY;AAAZG;AACPjB;AACTE;AAA6BY;AAAbM;AACUN;AAAjBY;AACTxB;AAAW;AAAA,KAjBV0B,OAyBKC,CAAAA,UAzBalD,MAyBK,GAzBIA,MAyBJ,CAAA,GAAA;EAAA,QASlBmD,EAjCElC,eAiCU;EAAA;AACVA;AACFD;AACFE;EACGC,MAAAA,CAAAA,EAhCAH,aAgCAG;AACAC,CAAAA,GAAAA,CAhCNK,SAgCML,CAhCIY,WAgCJZ,CAhCgBe,CAgChBf,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EACEC,IAAAA,EAhCLH,WAgCKG;AAAgB,CAAA,GA/BzBE,WA+ByB,CAAA,GAAA,CA/BTE,SA+BS,CA/BCO,WA+BD,CA/BaG,CA+Bb,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAA,OAGnBiB,EAjCCjC,cAiCW;AAAA,CAAA,GAhClBI,WAoDC8B,CAAAA,GAAAA,CApDejB,UAoDC,CApDUD,CAoDV,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EAnDVf,cAmDU;AAAWpB,CAAAA,GAlD5BuB,WAkD4BvB,CAAAA,GAAAA,CAlDZsC,WAkDYtC,CAlDAmC,CAkDAnC,CAAAA,SAAAA,IAAAA,GAAAA;EAAUkD,SAAAA,EAjD7B7B,gBAiD6B6B;AAAiCf,CAAAA,GAhDvEZ,WAgDuEY,CAAAA,GAAAA,CAhDvDM,YAgDuDN,CAhD1CA,CAgD0CA,CAAAA,SAAAA,IAAAA,GAAAA;EAARc,SAAAA,EA/CtDF,gBA+CsDE,CA/CrCd,CA+CqCc,CAAAA;AAAmBC,CAAAA,GA9ClF3B,WA8CkF2B,CAAAA;AAA2Cf;AAArBa;AAAoB;AAAA;AAgBvG;AAA6BO;AAAG/C;AAAXsC,UAtDpCI,kBAAAA,CAsDoCJ;EAAO,QAAA,EAAA,cAAA,GAAA,uBAAA;EAAA,MAChDU,EAAAA,aAAAA;EAAmB,IAAA,EAAA,oBAAA,GAAA,oBAAA;EAAqBD,OAAAA,EAAAA,mBAAAA;EAA0D3C,OAAAA,EAAAA,mBAAAA,GAAAA,uBAAAA,GAAAA,qBAAAA,GAAAA,YAAAA;EAAV6C,SAAAA,EAAAA,uBAAAA,GAAAA,0BAAAA;AAAS;AAAA;AAC7E,UA/CfN,YAAAA,CA+Ce;EAA2CI,QAAAA,EA9CxDtC,eA8CwDsC;EAArBD,MAAAA,EA7CrCtC,aA6CqCsC;EACLC,IAAAA,EA7ClCrC,WA6CkCqC;EAArBD,OAAAA,EA5CVnC,cA4CUmC;EAA+CK,OAAAA,EA3CzDvC,cA2CyDuC;EAApBH,SAAAA,EA1CnCnC,gBA0CmCmC;AAAyBlC;AAAkB;AAAA,UAvCjF8B,YAAAA,CAyCLQ;EAA4B,YAAA,EAAA,aAAA;EAA2CL,qBAAAA,EAAAA,qBAAAA;EAArBD,WAAAA,EAAAA,MAAAA;EACZC,kBAAAA,EAAAA,SAAAA;EAArBD,kBAAAA,EAAAA,SAAAA;EAA+CK,iBAAAA,EAAAA,KAAAA;EAApBH,iBAAAA,EAAAA,aAAAA;EAA0BlC,qBAAAA,EAAAA,iBAAAA;EAAkB,mBAAA,EAAA,UAAA;EAAA,UAExFuC,EAAAA,QAAe;EAAA,qBAAA,EAAA,QAAA;EAAmCX,wBAAAA,EAAAA,SAAAA;AAA+BK;AAAGL;AAAmBY;AAA9BhB;AAA6DgB;AAAoBP;AAAGL;AAAmBY,KAxBhLT,gBAwBgLS,CAAAA,UAxBrJ9D,MAwBqJ8D,CAAAA,GAxB3IZ,kBAwB2IY,CAAAA,MAxBlHb,OAwBkHa,CAxB1G3B,CAwB0G2B,CAAAA,GAAAA,MAxB/FZ,kBAwB+FY,CAAAA,GAxBzEd,oBAwByEc,CAxBpD3B,CAwBoD2B,CAAAA;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAgBD;AAAaW;AAAGV;AAAaO;AAAUP;AAAsBD;AAAaW;AAA+BP;AAArBG;AAAoB;AAAA;AAM/S,KAdvBJ,oBAcuB,CAAA,UAAA,MAAA,CAAA,GAdkBR,OAclB,CAd0BS,CAc1B,EAd6B/C,kBAc7B,CAAA;AAAmC0C,KAb1DM,mBAa0DN,CAAAA,UAAAA,MAAAA,CAAAA,GAblBK,CAakBL,SAAAA,iBAAAA,KAAAA,EAAAA,WAAAA,GAb8BO,SAa9BP,CAbwCtC,CAaxCsC,CAAAA,GAAAA,KAAAA;AAA+BK,KAZzFG,oBAYyFH,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAZ/CD,oBAY+CC,CAZ1BA,CAY0BA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAAGL,SAAAA,EAAAA,QAX5EI,oBAW4EJ,CAXvDK,CAWuDL,CAAAA,IAXjDM,mBAWiDN,CAX7BS,CAW6BT,CAAAA,GAXxB5B,kBAWwB4B,EAAAA;AAAmBY,CAAAA;AAA9BhB,KATjFc,4BASiFd,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAT/BQ,oBAS+BR,CATVS,CASUT,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAA6DgB,SAAAA,CAAAA,EAAAA,QAR7HR,oBAQ6HQ,CARxGP,CAQwGO,CAAAA,IARlGN,mBAQkGM,CAR9EH,CAQ8EG,CAAAA,IARxExC,kBAQwEwC,EAAAA;AAAqBP,CAAAA;AAAGL,KANtKW,eAMsKX,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MANpHA,kBAMoHA,IAAAA,CAN7FJ,OAM6FI,CANrFK,CAMqFL,EANlFA,kBAMkFA,CAN/DY,CAM+DZ,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GANhCY,CAMgCZ,GAAAA,QANpBJ,OAMoBI,CANZK,CAMYL,EANTA,kBAMSA,CANUY,CAMVZ,CAAAA,CAAAA,IANiBE,YAMjBF,CAN8BS,CAM9BT,GAAAA,MANwCE,YAMxCF,CAAAA,GANwDC,YAMxDD,CANqEY,CAMrEZ,CAAAA,CANwEE,YAMxEF,CANqFS,CAMrFT,GAAAA,MAN+FE,YAM/FF,CAAAA,GAAAA,MANqHC,YAMrHD,CANkIY,CAMlIZ,CAAAA,CAAAA,EAAAA,EAAAA,GAN4IQ,oBAM5IR,CANiKK,CAMjKL,CAAAA;AAAmBY;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAiBD,KAAxOY,uBAAwOZ,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MAA9KD,kBAA8KC,IAAAA,CAAvJL,OAAuJK,CAA/II,CAA+IJ,EAA5ID,kBAA4IC,CAAzHW,CAAyHX,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAA1FW,CAA0FX,IAAAA,QAA7EL,OAA6EK,CAArEI,CAAqEJ,EAAlED,kBAAkEC,CAA/CW,CAA+CX,CAAAA,CAAAA,IAAxCC,YAAwCD,CAA3BQ,CAA2BR,GAAAA,MAAjBC,YAAiBD,CAAAA,IAAAA,YAAAA,CAAaW,CAAbX,CAAAA,CAAgBC,YAAhBD,CAA6BQ,CAA7BR,GAAAA,MAAuCC,YAAvCD,CAAAA,GAAAA,MAA6DA,YAA7DA,CAA0EW,CAA1EX,CAAAA,CAAAA,EAAAA,EAAAA,GAAoFS,4BAApFT,CAAiHI,CAAjHJ,CAAAA;AAAaW;AAAGV,KAExPY,OAFwPZ,CAAAA,CAAAA,EAAAA,QAErO1B,CAFqO0B,CAAAA,GAEhO1B,CAFgO0B,SAEtNa,KAFsNb,GAAAA,CAE7Ma,KAF6Mb,CAAAA,SAAAA,CAE7L1B,CAF6L0B,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAaO;AAAUP,KAI/Qc,aAJ+Qd,CAAAA,UAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAIjO1B,CAJiO0B,SAAAA,SAAAA,EAAAA,GAAAA,KAAAA,GAIjM1B,CAJiM0B,SAAAA,SAAAA,CAAAA,KAAAA,KAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,SAIxGY,OAJwGZ,CAIhGe,IAJgGf,CAAAA,GAAAA,IAAAA,GAIjFc,aAJiFd,CAInEgB,IAJmEhB,CAAAA,GAAAA,IAAAA;AAAsBD;AAAaW;AAAuCP;AAA7BK;AAA4B;AAAA;AAEjV;AAAYlC;AAAKA,KAWxB2C,eAXwB3C,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAW0B4C,IAX1B5C,SAAAA,SAAAA,MAAAA,EAAAA,GAAAA,MAAAA,SAW0E4C,IAX1E5C,CAAAA,QAAAA,CAAAA,GAW2FqC,uBAX3FrC,CAWmH4C,IAXnH5C,CAAAA,MAAAA,CAAAA,CAAAA,GAWmIwC,aAXnIxC,CAWiJ4C,IAXjJ5C,CAAAA,SAAAA,IAAAA,GAWsKqC,uBAXtKrC,CAW8L4C,IAX9L5C,CAAAA,MAAAA,CAAAA,CAAAA,GAW8MmC,eAX9MnC,CAW8N4C,IAX9N5C,CAAAA,MAAAA,CAAAA,CAAAA,GAAAA,KAAAA;AAAUuC,KAYlCM,uBAAAA,GAZkCN,mBAAAA,GAAAA,uBAAAA;AAASA,KAa3CO,mBAAAA,GAb2CP;EAAgBvC,SAAAA,iFAAAA,EAAAA,KAAAA;AAAC,CAAA;AAAA,KAgB5D+C,uBAda,CAAA,aAAA,SAAA,MAAA,EAAA,EAAA,YAAA,MAAA,CAAA,GAciEH,IAdjE,SAAA,SAAA,CAAA,KAAA,cAAA,MAAA,EAAA,GAAA,KAAA,cAAA,SAAA,MAAA,EAAA,CAAA,GAAA,CAc+JH,IAd/J,CAAA,SAAA,CAc8KO,GAd9K,CAAA,GAAA,IAAA,GAc4LD,uBAd5L,CAcoNL,IAdpN,EAc0NM,GAd1N,CAAA,GAAA,KAAA;AAAA,KAebC,kCAfa,CAAA,aAAA,SAAA,MAAA,EAAA,CAAA,GAewDF,uBAfxD,CAegFH,IAfhF,EAAA,mBAAA,CAAA,SAAA,IAAA,GAe0HG,uBAf1H,CAekJH,IAflJ,EAAA,uBAAA,CAAA,SAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,KAAA;AAAiC5C;AAAgCA;AAAiGyC;AAARH;AAAqCI,KAoB5MQ,sBApB4MR,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAoBnJE,IApBmJF,SAAAA,OAAAA,GAAAA,MAAAA,SAoB7GE,IApB6GF,CAAAA,QAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAoBnFtB,OApBmFsB,CAoB3EE,IApB2EF,CAAAA,MAAAA,CAAAA,EAoB7DG,uBApB6DH,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAoBTO,kCApBSP,CAoB0BE,IApB1BF,CAAAA,SAAAA,IAAAA,GAAAA,KAAAA,GAoBuDE,IApBvDF,GAAAA,KAAAA;AAAdF,KAqB9LW,wBArB8LX,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAqBlIU,sBArBkIV,CAqB3GI,IArB2GJ,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAqBxEM,mBArBwEN;AAAa,KAsB3MY,oBAtB2M,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GAsBnJC,IAtBmJ,CAAA,CAAA,CAAA,SAAA;EAAA,IAS3MV,EAAAA,KAAAA,cAAe,SAAA,MAAA,EAAA;AAAA,CAAA,GAehBC,IAfgB,GAAA,KAAA;AAAmCA,KAgBlDU,4BAhBkDV,CAAAA,aAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAgBcO,wBAhBdP,CAgBuCQ,oBAhBvCR,CAgB4DS,IAhB5DT,CAAAA,CAAAA;AAAgDA;AAAyCA,KAkB3IW,yBAlB2IX,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAkB5FxB,OAlB4FwB,CAkBpFf,CAlBoFe,EAkBjFC,uBAlBiFD,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAkB3BC,uBAlB2BD,SAkBKf,CAlBLe,GAAAA,OAAAA,GAkBmBE,mBAlBnBF;AAAxBP,UAmB9GmB,eAAAA,CAnB8GnB;EAAsDO;AAAdJ;AAA2DI;AAAxBP;EAAwDO,SAAAA,EAAAA,MAAAA;EAAhBT;AAAe;AAAA;AAC9N;AACJ;EAGI,MAAA,CAAA,EAAA,MAAA;EAAuDS;AAA8FH;AAAeO;AAAsCN;AAAMM;EAA9BD,QAAAA,CAAAA,EAAAA,MAAAA;EAAuB;AAAA;AAC9L;AAA2DH;AAAxBG;EAA0FH,MAAAA,CAAAA,EAAAA,MAAAA;EAAxBG;AAAuB;AAAA;AAKxI;EAAmCH,OAAAA,CAAAA,EAAAA,MAAAA;EAAsCA;AAAkCA;AAAcC;AAAtBzB;EAA6GwB,GAAAA,CAAAA,EAyCnOpE,OAzCmOoE;EAAnCK;AAAgEL;AAAI;AAAA;AAC/O;AAA2DA;AAAvBM;EAA0DJ,QAAAA,CAAAA,EAAAA,MAAAA;EAAmB;AAAA;AACrH;AAAoCO;AAEzDT;AAAI;AAAA;EACyB,YAAA,CAAA,EAAA,MAAA;AAAkFS;AAArBD;AAAzBD;AAAwB;AAAA;AAE/D;AAA8BtB;AAAGgB;AAAXzB;AAAiEyB;AAAgChB;AAAciB;AAAmB;AAAA;AAkCvK;AA+CU;AAAiBxE;AAA8CkF;AAkBtD/C;AAAjBkB;AACLlB;AAAY4C;AAA4CA;AAARK;AAA7BJ;AAAmGD;AAARK;AAArBN;AAAhBT;AAARgB;AAAO,iBAnBnEF,QAmBmE,CAAA,gBAnB1CnF,MAmB0C,EAAA,mBAAA,SAAA,CAAA,OAAA,EAnBIkF,eAmBJ,GAAA;EAAA;AAC3D;AAAiBlF;AAAyCmC;AAAjBkB;AAAqClB;AAAqBoB;AAAR6B;AAAsCF;AACjI3B;AAAR6B;AACqB7B;AAAR6B;AAA1BH;AAAwE1B;AAAR6B;AAAhBvB;EAARwB,IAAAA,EAAAA,SAJ3BhC,gBAI2BgC,CAJVlD,CAIUkD,CAAAA,EAAAA;AAAO,CAAA,CAAA,CAAA,CAAA,MAAA,EAHvClD,CAGuC,EAAA,GAAA,IAAA,EAH3B4C,IAG2B,GAHpBC,4BAGoB,CAHSI,OAGT,CAHiBL,IAGjB,CAAA,CAAA,CAAA,EAH0BM,OAG1B,CAHkChB,eAGlC,CAHkDS,oBAGlD,CAHuEM,OAGvE,CAH+EL,IAG/E,CAAA,CAAA,CAAA,CAAA;AAAA,iBAFlCI,QAGQ,CAAA,gBAHiBnF,MAGjB,EAAA,gBAHyCqD,gBAGzC,CAH0DlB,CAG1D,CAAA,GAAA,KAAA,CAAA,CAAA,MAAA,EAH8EA,CAG9E,EAAA,OAAA,EAAA,CAH2FiD,OAG3F,CAHmG7B,CAGnG,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAHiI2B,eAGjI,GAAA;EAAA,IAAA,EAAA,SAFRE,OAEQ,CAFA7B,CAEA,CAAA,EAAA;AAAiBvD,CAAAA,GADtCiF,yBACsCjF,CADZoF,OACYpF,CADJuD,CACIvD,CAAAA,CAAAA,CAAAA,EADEqF,OACFrF,CADU6D,eACV7D,CAD0BoF,OAC1BpF,CADkCuD,CAClCvD,CAAAA,CAAAA,CAAAA;AAAgBmC,iBAAzCgD,QAAyChD,CAAAA,gBAAhBnC,MAAgBmC,CAAAA,CAAAA,MAAAA,EAAAA,CAAAA,EAAAA,OAAAA,EAAY+C,eAAZ/C,GAAAA;EAAY+C,IAAAA,CAAAA,EAAAA,KAAAA;AAElD/C,CAAAA,CAAAA,EAAhBkD,OAAgBlD,CAARc,OAAQd,CAAAA,CAAAA,CAAAA,CAAAA;AAARc;AAARoC,iBAEaF,QAFbE,CAAAA,gBAEsCrF,MAFtCqF,EAAAA,mBAAAA,SAE0EhC,gBAF1EgC,CAE2FlD,CAF3FkD,CAAAA,EAAAA,CAAAA,CAAAA,MAAAA,EAEyGlD,CAFzGkD,EAAAA,OAAAA,EAEqHH,eAFrHG,GAAAA;EAAO,IAAA,EAGHf,IAHG;AAAA,CAAA,GAIPE,mBAFqB,CAAA,EAECa,OAFD,CAAA,KAAA,CAAA;AAAA;AAAiBrF;AAAqDmC;AAAjBkB;AAA+BlB;AAAY+C;AACjHZ;AACJE;AAAsBa;;AC7XqB;AAAO;AAetD;AACiK;AAS1I;AAAW;AAClB;AAAf;AAEE;AACA;AAAC;AAAA,iBDmbakB,SAAAA,CChbK,GAAA,EDgbUf,eChbV,CAAA,EDgb4BhE,MChb5B,CAAA,MAAA,EAAA,MAAA,CAAA;AAAA;AACX;AAEP;AAAmC;AAAnB;AACc;AAAnB,KDmbVgE,eAAAA,GCnbU,QAAA,MDmbsBrC,YCnbtB,IDmbsCqD,OCnbtC,CDmb8CrD,YCnb9C,CDmb2DW,CCnb3D,CAAA,CAAA,EAAA,GAAA;EAAsB,SAAA,CAAA,EDobvBtC,MCpbuB,CAAA,MAAA,EDobRF,kBCpbQ,CAAA;AAAlC,CAAA;AACe;;;ADpD0CV;AAAuBA,KCV9E,aDU8EA,CAAAA,UCVtD,MDUsDA,CAAAA,GAAAA,CCV3C,WDU2CA,CCV/B,CDU+BA,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAnBJ,KAAAA,CAAkB,GCP/E,MDO+E,CAAA,KAAA,EAAA,KAAA,CAAA,GAAA,MAAA,SAAA,MCN1D,WDM0D,CCN9C,CDM8C,CAAA,WAAA,CAAA,CAAA,GCL9E,MDK8E,CAAA,KAAA,EAAA,KAAA,CAAA,GCJ9E,WDI8E,CCJlE,CDIkE,CAAA,WAAA,CAAA,CAAA;AAAA,KCF7E,oBDGYK,CAAAA,UCHmB,MDGI,CAAA,GAAA,CCFvC,WDGgBC,CCHJ,CDGIA,CAAAA,SAAoB,CAAA,CAAA,CAEjB,SAOVE,CAAAA,KAAAA,CAAAA,GCVP,MDUoB,CAAA,KAAA,EAAA,KAAA,CAAA,GCTpB,WDSoB,CCTR,CDSQ,CAAA,SAAA,CAAA,CAAA,SAAA;EAIbC,SAAAA,EAAAA,KAAAA,EAAe;AAAA,CAAA,GCZrB,CDkCMC,GCjCN,MDiCMA,CAAAA,KAAW,EAAA,KAAA,CAAA;AAAA,KC/BhB,kBDqCmB,CAAA,UCrCU,MDqCV,CAAA,GAAA,CAAA,MCrC2B,aDqC3B,CCrCyC,CDqCzC,CAAA,CAAA,SAAA,CAcdE,KAAAA,CAAc,GChDrB,oBDgEuB,CChEF,CDgEE,CAAA,GAAA,CAAA,MC/DhB,oBD+DgB,CC/DK,CD+DL,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GC9DtB,aD8DsB,CC9DR,CD8DQ,CAAA,GC7DtB,aD6DsB,CC7DR,CD6DQ,CAAA,GC7DH,oBD6DG,CC7DkB,CD6DlB,CAAA;AAAA;AAYrBG,KCtEO,cDsEI,CAAA,UCtEqB,MDsEZ,CAAA,GCtEsB,ODsEtB,CAAA,MCrElB,kBDqEkB,CCrEC,CDqED,CAAA,EAAA,MAAA,CAAA;AAAA;AAYX;AAAOG;AAA8BA;AAErCA;AAAkCA;AAA4BA;AAE/DA;AAAC,KCvEF,mBAAA,GDuEE,+JAAA;AAAA;AAEY;AACf;AAAyCG;AAAwBC;AAAC;AAAA;AAM7D,KCtEX,kBDsEW,CAAA,UCtEkB,MDsElB,EAAA,UAAA,MAAA,CAAA,GAAA,CCrEf,cDqEkCJ,CCrEnB,CDqEmBA,CAAAA,CAAZM,SAAAA,CAAAA,KAAAA,CAAAA,GCnEpB,mBDmEoBA,GClEpB,CDkEoBA;AAA2EN;AAAZM,KC/DjF,iBD+DiFA,CAAAA,UC9D3E,MD8D2EA,EAAAA,UAAAA,MAAAA,CAAAA,GC5DlF,CD4DkFA,SAAAA,MC5DlE,kBD4DkEA,CC5D/C,CD4D+CA,CAAAA,GC3DnF,WD2DmFA,CC3DvE,kBD2DuEA,CC3DpD,CD2DoDA,CAAAA,CC3DjD,CD2DiDA,CAAAA,CAAAA,SAAAA;EAA6CN,GAAAA,EAAAA,KAAAA,EAAAA;AAAZM,CAAAA,GC1DnH,OD0DmHA,CAAAA,MC1DrG,CD0DqGA,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAARL;AAAO;AAAA;AACtG;AAAmBD,KCnDvB,eDmDuBA,CAAAA,UCnDG,MDmDHA,EAAAA,UAAAA,MAAAA,CAAAA,GAAAA;EAAZM,QAAAA,EClDZ,MDkDYA,CClDL,iBDkDKA,CClDa,CDkDbA,EClDgB,CDkDhBA,CAAAA,EAAAA,MAAAA,CAAAA;AAAgEN,CAAAA;AAAZM;AAAVP;AAAS;AAAA;AAWpD;AAAWzB;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEF;AAAZE;AAARL;AAAO;AAAA;AACI;AAAW3B;AAA6BmC;AAAZJ;AAA6CI;AAAlBD;AAAlCN;AAAM;AAAA;AAKlB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEH;AAAZG;AAAVP;AAAS;AAAA;AACG;AAAWzB;AAA6BmC;AAAZF;AAAiDE;AAApBE;AAApCT;AAAM;AAAA;AAEnB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH,iBCuDnF,QDvDmFA,CAAAA,gBCuD1D,MDvD0DA,CAAAA,CAAAA,MAAAA,ECuD1C,CDvD0CA,CAAAA,ECuDtC,ODvDsCA,CCuD9B,CDvD8BA,CAAAA;AAE3EQ,iBC8DR,QD9DQA,CAAAA,gBC+DP,MD/DOA,EAAAA,gBCgEP,cDhEOA,CCgEQ,CDhERA,CAAAA,CAAAA,CAAAA,MAAAA,ECkEf,CDlEeA,EAAAA,KAAAA,ECmEhB,kBDnEgBA,CCmEG,CDnEHA,ECmEM,CDnENA,CAAAA,CAAAA,ECoErB,ODpEqBA,CCoEb,CDpEaA,CAAAA,GCoER,eDpEQA,CCoEQ,CDpERA,ECoEW,CDpEXA,CAAAA;AAAZR,iBCqEI,QDrEJA,CAAAA,gBCsEK,MDtELA,EAAAA,gBCuEK,gBDvELA,CCuEsB,CDvEtBA,CAAAA,CAAAA,CAAAA,MAAAA,ECwEF,CDxEEA,EAAAA,IAAAA,EAAAA,SCwEgB,CDxEhBA,EAAAA,CAAAA,ECwEsB,eDxEtBA,CCwEsC,CDxEtCA,CAAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { f as parseFunctionBaseUrlKey, h as toEntries, l as functionBaseUrlKey, s as fetchEnv, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env.js";
-import { ErrorCode, PlatformError } from "@neon/config/v1";
+import { ErrorCode, PlatformError, authoredAiGateway, authoredBuckets, authoredFunctions } from "@neon/config/v1";
 import { z } from "zod";
 //#region src/lib/parse-env.ts
 /**
@@ -38,13 +38,13 @@ const aiGatewayEnvSchema = z.object({
 	NEON_AI_GATEWAY_TOKEN: z.string({ message: "NEON_AI_GATEWAY_TOKEN is missing" }).min(1, "NEON_AI_GATEWAY_TOKEN must not be empty"),
 	NEON_AI_GATEWAY_BASE_URL: z.string({ message: "NEON_AI_GATEWAY_BASE_URL is missing" }).min(1, "NEON_AI_GATEWAY_BASE_URL must not be empty")
 });
-/** Whether a **static** policy declares object storage (`preview.buckets`). No network. */
+/** Whether a **static** policy declares object storage (`buckets`). No network. */
 function configWantsStorage(config) {
-	return Object.keys(config.preview?.buckets ?? {}).length > 0;
+	return Object.keys(authoredBuckets(config) ?? {}).length > 0;
 }
-/** Whether a **static** policy enables the AI Gateway (`preview.aiGateway`). No network. */
+/** Whether a **static** policy enables the AI Gateway (`aiGateway`). No network. */
 function configWantsAiGateway(config) {
-	return isServiceEnabledInput(config.preview?.aiGateway);
+	return isServiceEnabledInput(authoredAiGateway(config));
 }
 /** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */
 function isServiceEnabledInput(toggle) {
@@ -111,7 +111,7 @@ function parseEnv(config, scopeOrKeys) {
 		};
 		else for (const issue of aiGateway.error.issues) issues.push(issue.message);
 	}
-	const declaredFunctionSlugs = Object.keys(config.preview?.functions ?? {}).sort();
+	const declaredFunctionSlugs = Object.keys(authoredFunctions(config) ?? {}).sort();
 	if (declaredFunctionSlugs.length > 0) {
 		const functions = {};
 		for (const slug of declaredFunctionSlugs) {
@@ -123,8 +123,8 @@ function parseEnv(config, scopeOrKeys) {
 		if (Object.keys(functions).length === declaredFunctionSlugs.length) result.functions = functions;
 	}
 	if (scope !== void 0) {
-		const fn = config.preview?.functions?.[scope];
-		if (!fn) throw new PlatformError(ErrorCode.EnvNotInjected, [`parseEnv: no function "${scope}" is declared in this policy's preview.functions.`, "Pass a declared function slug (or omit the scope to read external env)."].join("\n"), { details: { scope } });
+		const fn = authoredFunctions(config)?.[scope];
+		if (!fn) throw new PlatformError(ErrorCode.EnvNotInjected, [`parseEnv: no function "${scope}" is declared in this policy's functions.`, "Pass a declared function slug (or omit the scope to read external env)."].join("\n"), { details: { scope } });
 		const envOut = {};
 		for (const key of Object.keys(fn.env ?? {})) {
 			const value = source[key];

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/lib/parse-env.ts"],"sourcesContent":["/**\n * `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars\n * already injected into `process.env`, validate them against the policy, and return them in the\n * same namespaced shape.\n *\n * Lives in this package rather than in `@neon-internals/env-core` because nothing else needs\n * it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping\n * it here also keeps `zod` out of that package, and so out of every consumer that bundles it.\n */\n\nimport {\n\ttype Config,\n\tErrorCode,\n\tPlatformError,\n\ttype ServiceToggleInput,\n} from \"@neon/config/v1\";\nimport {\n\ttype FilteredNeonEnv,\n\tfunctionBaseUrlKey,\n\tisFunctionBaseUrlKey,\n\tNEON_ENV_VAR_KEYS,\n\ttype NeonAiGatewayEnv,\n\ttype NeonAuthEnv,\n\ttype NeonBranchEnv,\n\ttype NeonDataApiEnv,\n\ttype NeonEnv,\n\ttype NeonFunctionUrlEnv,\n\ttype NeonPostgresEnv,\n\ttype NeonStorageEnv,\n\tparseFunctionBaseUrlKey,\n\ttype SelectableEnvKey,\n} from \"@neon-internals/env-core/env\";\nimport { z } from \"zod\";\n\n/** The static `preview.functions` record of a config, or an empty record when absent. */\ntype PreviewFunctionsOf<C extends Config> =\n\tNonNullable<C[\"preview\"]> extends {\n\t\tfunctions: infer F;\n\t}\n\t\t? F\n\t\t: Record<never, never>;\n\n/** The declared function slugs of a config (record keys), as a string union. */\nexport type FunctionSlugOf<C extends Config> = Extract<\n\tkeyof PreviewFunctionsOf<C>,\n\tstring\n>;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when\n * the policy declares no functions at all. Without it the argument's expected type is the bare\n * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '\"x\"' is not\n * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the\n * editor offers it as the single completion, so the empty completion list is explained rather\n * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.\n */\n// Exported (type-only) for the type tests in `env.test-d.ts`; intentionally not re-exported\n// from `index.ts`, so it stays an internal implementation detail.\nexport type NoFunctionScopeHint =\n\t\"this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env\";\n\n/**\n * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug\n * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no\n * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes\n * the returned `function` namespace exact — it stays the one function's env keys instead of\n * widening to every declared function's.\n */\ntype FunctionScopeField<C extends Config, S extends string> = [\n\tFunctionSlugOf<C>,\n] extends [never]\n\t? NoFunctionScopeHint\n\t: S;\n\n/** The declared env-var keys of one function `S`, as a string union. */\ntype FunctionEnvKeysOf<\n\tC extends Config,\n\tS extends string,\n> = S extends keyof PreviewFunctionsOf<C>\n\t? NonNullable<PreviewFunctionsOf<C>[S]> extends { env: infer E }\n\t\t? Extract<keyof E, string>\n\t\t: never\n\t: never;\n\n/**\n * The extra `function` namespace added to `parseEnv`'s result when called with a function\n * slug scope: the declared env-var keys for that function, each resolved to a `string`.\n */\nexport type NeonFunctionEnv<C extends Config, S extends string> = {\n\tfunction: Record<FunctionEnvKeysOf<C, S>, string>;\n};\n\n// ───────────────────────── parseEnv ─────────────────────────\n\n/**\n * Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from\n * `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.\n *\n * `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include\n * URL-illegal characters in the password (rare but legal in Neon's connection-string\n * format) fail the WHATWG `URL` parse, so we settle for \"non-empty string\".\n */\nconst postgresEnvSchema = z.object({\n\tDATABASE_URL: z\n\t\t.string({ message: \"DATABASE_URL is missing\" })\n\t\t.min(1, \"DATABASE_URL must not be empty\"),\n\tDATABASE_URL_UNPOOLED: z\n\t\t.string({ message: \"DATABASE_URL_UNPOOLED is missing\" })\n\t\t.min(1, \"DATABASE_URL_UNPOOLED must not be empty\"),\n});\n\nconst authEnvSchema = z.object({\n\tNEON_AUTH_BASE_URL: z\n\t\t.string({ message: \"NEON_AUTH_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_BASE_URL must not be empty\"),\n\tNEON_AUTH_JWKS_URL: z\n\t\t.string({ message: \"NEON_AUTH_JWKS_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_JWKS_URL must not be empty\"),\n});\n\nconst dataApiEnvSchema = z.object({\n\tNEON_DATA_API_URL: z\n\t\t.string({ message: \"NEON_DATA_API_URL is missing\" })\n\t\t.min(1, \"NEON_DATA_API_URL must not be empty\"),\n});\n\nconst storageEnvSchema = z.object({\n\tAWS_ACCESS_KEY_ID: z\n\t\t.string({ message: \"AWS_ACCESS_KEY_ID is missing\" })\n\t\t.min(1, \"AWS_ACCESS_KEY_ID must not be empty\"),\n\tAWS_SECRET_ACCESS_KEY: z\n\t\t.string({ message: \"AWS_SECRET_ACCESS_KEY is missing\" })\n\t\t.min(1, \"AWS_SECRET_ACCESS_KEY must not be empty\"),\n\tAWS_ENDPOINT_URL_S3: z\n\t\t.string({ message: \"AWS_ENDPOINT_URL_S3 is missing\" })\n\t\t.min(1, \"AWS_ENDPOINT_URL_S3 must not be empty\"),\n\tAWS_REGION: z\n\t\t.string({ message: \"AWS_REGION is missing\" })\n\t\t.min(1, \"AWS_REGION must not be empty\"),\n});\n\nconst aiGatewayEnvSchema = z.object({\n\tNEON_AI_GATEWAY_TOKEN: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_TOKEN is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_TOKEN must not be empty\"),\n\tNEON_AI_GATEWAY_BASE_URL: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_BASE_URL must not be empty\"),\n});\n\n/** Whether a **static** policy declares object storage (`preview.buckets`). No network. */\nfunction configWantsStorage(config: Config): boolean {\n\treturn Object.keys(config.preview?.buckets ?? {}).length > 0;\n}\n\n/** Whether a **static** policy enables the AI Gateway (`preview.aiGateway`). No network. */\nfunction configWantsAiGateway(config: Config): boolean {\n\treturn isServiceEnabledInput(config.preview?.aiGateway);\n}\n\n/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */\nfunction isServiceEnabledInput(\n\ttoggle: ServiceToggleInput | undefined,\n): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/**\n * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates\n * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the\n * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed\n * `process.env.DATABASE_URL` lookups.\n *\n * Designed for the **\"env-vars-already-injected\"** path:\n * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.\n * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.\n * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.\n *\n * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now\n * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without\n * evaluating the per-branch closure.\n *\n * The second argument is a **scope** or a **key filter**:\n * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the\n *   full `{ postgres, auth?, dataApi?, … }` the policy enables.\n * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are\n *   running inside that function. Returns the same branch secrets **plus** a typed\n *   `function` namespace with the function's declared env-var keys. The slug autocompletes\n *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.\n * - an **array of OS-level env-var keys** (e.g. `[\"DATABASE_URL\", \"NEON_AUTH_BASE_URL\"]`) —\n *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced\n *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only\n *   pick vars the policy actually enables. Use this when a process needs just a subset (a\n *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't\n *   want `parseEnv` to throw over vars you never use.\n *\n * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env\n * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.\n *\n * ```ts\n * import config from \"../neon\";\n * import { parseEnv } from \"@neon/env\";\n *\n * // External (app / build):\n * const env = parseEnv(config);\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n *\n * // Inside the \"hello\" function:\n * const env = parseEnv(config, \"hello\");\n * env.function.resendApiKey; // typed from hello's declared env keys\n *\n * // Filtered: only enforce + return the pooled URL.\n * const { postgres } = parseEnv(config, [\"DATABASE_URL\"]);\n * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent\n * ```\n */\nexport function parseEnv<const C extends Config>(config: C): NeonEnv<C>;\n// Overload order is load-bearing for **editor autocomplete**, not for type checking: when the\n// argument is a half-typed string literal the call resolves against no signature, and the\n// editor takes its string-literal completions from the first candidate overload. With the\n// `keys` overload listed first, the expected type of `parseEnv(config, \"…\")` is read as\n// `readonly K[]` — an array has no literal completions, so typing a function slug offered\n// nothing. Keep the slug overload ahead of the array one: `env.completions.test.ts` asserts the\n// completions through the language service, and `env.test-d.ts` locks the order itself (the\n// last overload is observable as `Parameters<typeof parseEnv>`), so `tsc` fails on a reorder.\nexport function parseEnv<\n\tconst C extends Config,\n\tconst S extends FunctionSlugOf<C>,\n>(\n\tconfig: C,\n\tscope: FunctionScopeField<C, S>,\n): NeonEnv<C> & NeonFunctionEnv<C, S>;\nexport function parseEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;\nexport function parseEnv(\n\tconfig: Config,\n\tscopeOrKeys?: string | readonly string[],\n): unknown {\n\tconst source = process.env;\n\tif (Array.isArray(scopeOrKeys)) {\n\t\treturn parseFilteredEnv(source, scopeOrKeys);\n\t}\n\t// `Array.isArray` doesn't narrow a `readonly string[]` out of the union, so re-derive the\n\t// function-slug scope from the remaining `string` shape explicitly.\n\tconst scope = typeof scopeOrKeys === \"string\" ? scopeOrKeys : undefined;\n\tconst issues: string[] = [];\n\tconst result: Record<string, unknown> = {};\n\n\tconst pg = postgresEnvSchema.safeParse({\n\t\tDATABASE_URL: source.DATABASE_URL,\n\t\tDATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED,\n\t});\n\tif (pg.success) {\n\t\tresult.postgres = {\n\t\t\tdatabaseUrl: pg.data.DATABASE_URL,\n\t\t\tdatabaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED,\n\t\t} satisfies NeonPostgresEnv;\n\t} else {\n\t\tfor (const issue of pg.error.issues) issues.push(issue.message);\n\t}\n\n\t// Branch identity is optional: the Functions runtime injects `NEON_BRANCH` on every\n\t// branch by default and `neon dev` / `neon-env run` / `env pull` emit it too, but older\n\t// runtimes and platform integrations may not, so a missing value is not an error — we\n\t// just omit the namespace rather than failing the whole parse.\n\tconst branchName = source[NEON_ENV_VAR_KEYS.branch.name];\n\tif (branchName !== undefined && branchName !== \"\") {\n\t\tresult.branch = { name: branchName } satisfies NeonBranchEnv;\n\t}\n\n\tif (isServiceEnabledInput(config.auth)) {\n\t\tconst auth = authEnvSchema.safeParse({\n\t\t\tNEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,\n\t\t\tNEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL,\n\t\t});\n\t\tif (auth.success) {\n\t\t\tresult.auth = {\n\t\t\t\tbaseUrl: auth.data.NEON_AUTH_BASE_URL,\n\t\t\t\tjwksUrl: auth.data.NEON_AUTH_JWKS_URL,\n\t\t\t} satisfies NeonAuthEnv;\n\t\t} else {\n\t\t\tfor (const issue of auth.error.issues) issues.push(issue.message);\n\t\t}\n\t}\n\n\tif (isServiceEnabledInput(config.dataApi)) {\n\t\tconst dataApi = dataApiEnvSchema.safeParse({\n\t\t\tNEON_DATA_API_URL: source.NEON_DATA_API_URL,\n\t\t});\n\t\tif (dataApi.success) {\n\t\t\tresult.dataApi = {\n\t\t\t\turl: dataApi.data.NEON_DATA_API_URL,\n\t\t\t} satisfies NeonDataApiEnv;\n\t\t} else {\n\t\t\tfor (const issue of dataApi.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsStorage(config)) {\n\t\tconst storage = storageEnvSchema.safeParse({\n\t\t\tAWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,\n\t\t\tAWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,\n\t\t\tAWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,\n\t\t\tAWS_REGION: source.AWS_REGION,\n\t\t});\n\t\tif (storage.success) {\n\t\t\tresult.storage = {\n\t\t\t\taccessKeyId: storage.data.AWS_ACCESS_KEY_ID,\n\t\t\t\tsecretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,\n\t\t\t\tendpoint: storage.data.AWS_ENDPOINT_URL_S3,\n\t\t\t\tregion: storage.data.AWS_REGION,\n\t\t\t} satisfies NeonStorageEnv;\n\t\t} else {\n\t\t\tfor (const issue of storage.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsAiGateway(config)) {\n\t\tconst aiGateway = aiGatewayEnvSchema.safeParse({\n\t\t\tNEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,\n\t\t\tNEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL,\n\t\t});\n\t\tif (aiGateway.success) {\n\t\t\tresult.aiGateway = {\n\t\t\t\tapiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,\n\t\t\t\tbaseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL,\n\t\t\t} satisfies NeonAiGatewayEnv;\n\t\t} else {\n\t\t\tfor (const issue of aiGateway.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tconst declaredFunctionSlugs = Object.keys(\n\t\tconfig.preview?.functions ?? {},\n\t).sort();\n\tif (declaredFunctionSlugs.length > 0) {\n\t\tconst functions: Record<string, NeonFunctionUrlEnv> = {};\n\t\tfor (const slug of declaredFunctionSlugs) {\n\t\t\tconst key = functionBaseUrlKey(slug);\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (parsed.ok) {\n\t\t\t\tfunctions[slug] = { baseUrl: parsed.value };\n\t\t\t} else {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t}\n\t\t}\n\t\tif (Object.keys(functions).length === declaredFunctionSlugs.length) {\n\t\t\tresult.functions = functions;\n\t\t}\n\t}\n\n\tif (scope !== undefined) {\n\t\tconst fn = config.preview?.functions?.[scope];\n\t\tif (!fn) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.EnvNotInjected,\n\t\t\t\t[\n\t\t\t\t\t`parseEnv: no function \"${scope}\" is declared in this policy's preview.functions.`,\n\t\t\t\t\t\"Pass a declared function slug (or omit the scope to read external env).\",\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t{ details: { scope } },\n\t\t\t);\n\t\t}\n\t\tconst envOut: Record<string, string> = {};\n\t\tfor (const key of Object.keys(fn.env ?? {})) {\n\t\t\tconst value = source[key];\n\t\t\t// Only a truly *unset* var is \"not injected\". Function env values carry no\n\t\t\t// non-empty constraint (unlike DATABASE_URL / NEON_AUTH_BASE_URL), so a\n\t\t\t// deliberately empty value is a present, valid value and is passed through.\n\t\t\tif (value === undefined) {\n\t\t\t\tissues.push(`${key} is missing (function \"${scope}\")`);\n\t\t\t} else {\n\t\t\t\tenvOut[key] = value;\n\t\t\t}\n\t\t}\n\t\tresult.function = envOut;\n\t}\n\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\n\treturn result;\n}\n\nfunction isFunctionBaseUrlIssue(issue: string): boolean {\n\treturn /^NEON_FUNCTION_[A-Z0-9]+_BASE_URL (is missing|must not be empty|must be a URL)$/.test(\n\t\tissue,\n\t);\n}\n\nfunction readFunctionBaseUrl(\n\tkey: string,\n\tvalue: string | undefined,\n): { ok: true; value: string } | { ok: false; issue: string } {\n\tif (value === undefined) {\n\t\treturn { ok: false, issue: `${key} is missing` };\n\t}\n\tif (value === \"\") {\n\t\treturn { ok: false, issue: `${key} must not be empty` };\n\t}\n\ttry {\n\t\tnew URL(value);\n\t} catch {\n\t\treturn { ok: false, issue: `${key} must be a URL` };\n\t}\n\treturn { ok: true, value };\n}\n\nfunction parseEnvInjectHint(issues: readonly string[]): string[] {\n\tif (issues.length > 0 && issues.every(isFunctionBaseUrlIssue)) {\n\t\treturn [\n\t\t\t\"Inject them via `neon env pull` or `neon-env run` (production URL), or `neon dev` (`http://localhost:<port>`).\",\n\t\t];\n\t}\n\tconst lines = [\n\t\t\"Inject them via one of:\",\n\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t];\n\tif (issues.some((issue) => issue.includes('(function \"'))) {\n\t\tlines.push(\n\t\t\t\"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.\",\n\t\t);\n\t}\n\tif (issues.some(isFunctionBaseUrlIssue)) {\n\t\tlines.push(\n\t\t\t\"  - for NEON_FUNCTION_*_BASE_URL: `neon env pull` or `neon dev`.\",\n\t\t);\n\t}\n\treturn lines;\n}\n\n/**\n * Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`\n * in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /\n * {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only\n * aliases).\n */\nconst FILTERABLE_ENV_KEYS: Record<string, readonly [string, string]> = {\n\tDATABASE_URL: [\"postgres\", \"databaseUrl\"],\n\tDATABASE_URL_UNPOOLED: [\"postgres\", \"databaseUrlUnpooled\"],\n\tNEON_BRANCH: [\"branch\", \"name\"],\n\tNEON_AUTH_BASE_URL: [\"auth\", \"baseUrl\"],\n\tNEON_AUTH_JWKS_URL: [\"auth\", \"jwksUrl\"],\n\tNEON_DATA_API_URL: [\"dataApi\", \"url\"],\n\tAWS_ACCESS_KEY_ID: [\"storage\", \"accessKeyId\"],\n\tAWS_SECRET_ACCESS_KEY: [\"storage\", \"secretAccessKey\"],\n\tAWS_ENDPOINT_URL_S3: [\"storage\", \"endpoint\"],\n\tAWS_REGION: [\"storage\", \"region\"],\n\tNEON_AI_GATEWAY_TOKEN: [\"aiGateway\", \"apiKey\"],\n\tNEON_AI_GATEWAY_BASE_URL: [\"aiGateway\", \"baseUrl\"],\n};\n\n/**\n * Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly\n * selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike\n * the full reader it never consults the policy — the selection alone decides what's required —\n * so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without\n * throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.\n */\nfunction parseFilteredEnv(\n\tsource: NodeJS.ProcessEnv,\n\tkeys: readonly string[],\n): Record<string, unknown> {\n\tconst issues: string[] = [];\n\tconst result: Record<string, Record<string, unknown>> = {};\n\tconst functionUrls: Record<string, NeonFunctionUrlEnv> = {};\n\tfor (const key of keys) {\n\t\tif (isFunctionBaseUrlKey(key)) {\n\t\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\t\tif (slug === null) continue;\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (!parsed.ok) {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfunctionUrls[slug] = { baseUrl: parsed.value };\n\t\t\tcontinue;\n\t\t}\n\t\t// Unknown keys are blocked at the type level; a runtime caller bypassing the types\n\t\t// gets a clear error rather than a silently-dropped selection.\n\t\tif (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {\n\t\t\tissues.push(`${key} is not a selectable Neon env variable`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst value = source[key];\n\t\tif (value === undefined) {\n\t\t\tissues.push(`${key} is missing`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (value === \"\") {\n\t\t\tissues.push(`${key} must not be empty`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst [namespace, property] = FILTERABLE_ENV_KEYS[key];\n\t\tconst bucket = result[namespace] ?? {};\n\t\tbucket[property] = value;\n\t\tresult[namespace] = bucket;\n\t}\n\tif (Object.keys(functionUrls).length > 0) {\n\t\tresult.functions = functionUrls;\n\t}\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsGA,MAAM,oBAAoB,EAAE,OAAO;CAClC,cAAc,EACZ,OAAO,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAC9C,IAAI,GAAG,gCAAgC;CACzC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;AACnD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC9B,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;CAC/C,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;AAChD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC,EAC/C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,qBAAqB,EACnB,OAAO,EAAE,SAAS,iCAAiC,CAAC,CAAC,CACrD,IAAI,GAAG,uCAAuC;CAChD,YAAY,EACV,OAAO,EAAE,SAAS,wBAAwB,CAAC,CAAC,CAC5C,IAAI,GAAG,8BAA8B;AACxC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CACnC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,0BAA0B,EACxB,OAAO,EAAE,SAAS,sCAAsC,CAAC,CAAC,CAC1D,IAAI,GAAG,4CAA4C;AACtD,CAAC;;AAGD,SAAS,mBAAmB,QAAyB;CACpD,OAAO,OAAO,KAAK,OAAO,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,qBAAqB,QAAyB;CACtD,OAAO,sBAAsB,OAAO,SAAS,SAAS;AACvD;;AAGA,SAAS,sBACR,QACU;CACV,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;AAuEA,SAAgB,SACf,QACA,aACU;CACV,MAAM,SAAS,QAAQ;CACvB,IAAI,MAAM,QAAQ,WAAW,GAC5B,OAAO,iBAAiB,QAAQ,WAAW;CAI5C,MAAM,QAAQ,OAAO,gBAAgB,WAAW,cAAc,KAAA;CAC9D,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkC,CAAC;CAEzC,MAAM,KAAK,kBAAkB,UAAU;EACtC,cAAc,OAAO;EACrB,uBAAuB,OAAO;CAC/B,CAAC;CACD,IAAI,GAAG,SACN,OAAO,WAAW;EACjB,aAAa,GAAG,KAAK;EACrB,qBAAqB,GAAG,KAAK;CAC9B;MAEA,KAAK,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAO/D,MAAM,aAAa,OAAO,kBAAkB,OAAO;CACnD,IAAI,eAAe,KAAA,KAAa,eAAe,IAC9C,OAAO,SAAS,EAAE,MAAM,WAAW;CAGpC,IAAI,sBAAsB,OAAO,IAAI,GAAG;EACvC,MAAM,OAAO,cAAc,UAAU;GACpC,oBAAoB,OAAO;GAC3B,oBAAoB,OAAO;EAC5B,CAAC;EACD,IAAI,KAAK,SACR,OAAO,OAAO;GACb,SAAS,KAAK,KAAK;GACnB,SAAS,KAAK,KAAK;EACpB;OAEA,KAAK,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAElE;CAEA,IAAI,sBAAsB,OAAO,OAAO,GAAG;EAC1C,MAAM,UAAU,iBAAiB,UAAU,EAC1C,mBAAmB,OAAO,kBAC3B,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU,EAChB,KAAK,QAAQ,KAAK,kBACnB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,mBAAmB,MAAM,GAAG;EAC/B,MAAM,UAAU,iBAAiB,UAAU;GAC1C,mBAAmB,OAAO;GAC1B,uBAAuB,OAAO;GAC9B,qBAAqB,OAAO;GAC5B,YAAY,OAAO;EACpB,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU;GAChB,aAAa,QAAQ,KAAK;GAC1B,iBAAiB,QAAQ,KAAK;GAC9B,UAAU,QAAQ,KAAK;GACvB,QAAQ,QAAQ,KAAK;EACtB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,qBAAqB,MAAM,GAAG;EACjC,MAAM,YAAY,mBAAmB,UAAU;GAC9C,uBAAuB,OAAO;GAC9B,0BAA0B,OAAO;EAClC,CAAC;EACD,IAAI,UAAU,SACb,OAAO,YAAY;GAClB,QAAQ,UAAU,KAAK;GACvB,SAAS,UAAU,KAAK;EACzB;OAEA,KAAK,MAAM,SAAS,UAAU,MAAM,QACnC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,MAAM,wBAAwB,OAAO,KACpC,OAAO,SAAS,aAAa,CAAC,CAC/B,CAAC,CAAC,KAAK;CACP,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,YAAgD,CAAC;EACvD,KAAK,MAAM,QAAQ,uBAAuB;GACzC,MAAM,MAAM,mBAAmB,IAAI;GACnC,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,OAAO,IACV,UAAU,QAAQ,EAAE,SAAS,OAAO,MAAM;QAE1C,OAAO,KAAK,OAAO,KAAK;EAE1B;EACA,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,sBAAsB,QAC3D,OAAO,YAAY;CAErB;CAEA,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,KAAK,OAAO,SAAS,YAAY;EACvC,IAAI,CAAC,IACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,0BAA0B,MAAM,oDAChC,yEACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;EAED,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG;GAC5C,MAAM,QAAQ,OAAO;GAIrB,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,GAAG,IAAI,yBAAyB,MAAM,GAAG;QAErD,OAAO,OAAO;EAEhB;EACA,OAAO,WAAW;CACnB;CAEA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAGD,OAAO;AACR;AAEA,SAAS,uBAAuB,OAAwB;CACvD,OAAO,kFAAkF,KACxF,KACD;AACD;AAEA,SAAS,oBACR,KACA,OAC6D;CAC7D,IAAI,UAAU,KAAA,GACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAa;CAEhD,IAAI,UAAU,IACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAoB;CAEvD,IAAI;EACH,IAAI,IAAI,KAAK;CACd,QAAQ;EACP,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,IAAI;EAAgB;CACnD;CACA,OAAO;EAAE,IAAI;EAAM;CAAM;AAC1B;AAEA,SAAS,mBAAmB,QAAqC;CAChE,IAAI,OAAO,SAAS,KAAK,OAAO,MAAM,sBAAsB,GAC3D,OAAO,CACN,gHACD;CAED,MAAM,QAAQ;EACb;EACA;EACA;CACD;CACA,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,cAAa,CAAC,GACvD,MAAM,KACL,gHACD;CAED,IAAI,OAAO,KAAK,sBAAsB,GACrC,MAAM,KACL,kEACD;CAED,OAAO;AACR;;;;;;;AAQA,MAAM,sBAAiE;CACtE,cAAc,CAAC,YAAY,aAAa;CACxC,uBAAuB,CAAC,YAAY,qBAAqB;CACzD,aAAa,CAAC,UAAU,MAAM;CAC9B,oBAAoB,CAAC,QAAQ,SAAS;CACtC,oBAAoB,CAAC,QAAQ,SAAS;CACtC,mBAAmB,CAAC,WAAW,KAAK;CACpC,mBAAmB,CAAC,WAAW,aAAa;CAC5C,uBAAuB,CAAC,WAAW,iBAAiB;CACpD,qBAAqB,CAAC,WAAW,UAAU;CAC3C,YAAY,CAAC,WAAW,QAAQ;CAChC,uBAAuB,CAAC,aAAa,QAAQ;CAC7C,0BAA0B,CAAC,aAAa,SAAS;AAClD;;;;;;;;AASA,SAAS,iBACR,QACA,MAC0B;CAC1B,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkD,CAAC;CACzD,MAAM,eAAmD,CAAC;CAC1D,KAAK,MAAM,OAAO,MAAM;EACvB,IAAI,qBAAqB,GAAG,GAAG;GAC9B,MAAM,OAAO,wBAAwB,GAAG;GACxC,IAAI,SAAS,MAAM;GACnB,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,CAAC,OAAO,IAAI;IACf,OAAO,KAAK,OAAO,KAAK;IACxB;GACD;GACA,aAAa,QAAQ,EAAE,SAAS,OAAO,MAAM;GAC7C;EACD;EAGA,IAAI,CAAC,OAAO,OAAO,qBAAqB,GAAG,GAAG;GAC7C,OAAO,KAAK,GAAG,IAAI,uCAAuC;GAC1D;EACD;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GAAW;GACxB,OAAO,KAAK,GAAG,IAAI,YAAY;GAC/B;EACD;EACA,IAAI,UAAU,IAAI;GACjB,OAAO,KAAK,GAAG,IAAI,mBAAmB;GACtC;EACD;EACA,MAAM,CAAC,WAAW,YAAY,oBAAoB;EAClD,MAAM,SAAS,OAAO,cAAc,CAAC;EACrC,OAAO,YAAY;EACnB,OAAO,aAAa;CACrB;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GACtC,OAAO,YAAY;CAEpB,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAED,OAAO;AACR"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/lib/parse-env.ts"],"sourcesContent":["/**\n * `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars\n * already injected into `process.env`, validate them against the policy, and return them in the\n * same namespaced shape.\n *\n * Lives in this package rather than in `@neon-internals/env-core` because nothing else needs\n * it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping\n * it here also keeps `zod` out of that package, and so out of every consumer that bundles it.\n */\n\nimport {\n\tauthoredAiGateway,\n\tauthoredBuckets,\n\tauthoredFunctions,\n\ttype Config,\n\tErrorCode,\n\tPlatformError,\n\ttype ServiceToggleInput,\n} from \"@neon/config/v1\";\nimport {\n\ttype FilteredNeonEnv,\n\tfunctionBaseUrlKey,\n\tisFunctionBaseUrlKey,\n\tNEON_ENV_VAR_KEYS,\n\ttype NeonAiGatewayEnv,\n\ttype NeonAuthEnv,\n\ttype NeonBranchEnv,\n\ttype NeonDataApiEnv,\n\ttype NeonEnv,\n\ttype NeonFunctionUrlEnv,\n\ttype NeonPostgresEnv,\n\ttype NeonStorageEnv,\n\tparseFunctionBaseUrlKey,\n\ttype SelectableEnvKey,\n} from \"@neon-internals/env-core/env\";\nimport { z } from \"zod\";\n\n/** The static `functions` record of a config (GA or deprecated `preview.functions`). */\ntype GaFunctionsOf<C extends Config> = [NonNullable<C[\"functions\"]>] extends [\n\tnever,\n]\n\t? Record<never, never>\n\t: string extends keyof NonNullable<C[\"functions\"]>\n\t\t? Record<never, never>\n\t\t: NonNullable<C[\"functions\"]>;\n\ntype PreviewFunctionsHome<C extends Config> = [\n\tNonNullable<C[\"preview\"]>,\n] extends [never]\n\t? Record<never, never>\n\t: NonNullable<C[\"preview\"]> extends { functions: infer F }\n\t\t? F\n\t\t: Record<never, never>;\n\ntype PreviewFunctionsOf<C extends Config> = [keyof GaFunctionsOf<C>] extends [\n\tnever,\n]\n\t? PreviewFunctionsHome<C>\n\t: [keyof PreviewFunctionsHome<C>] extends [never]\n\t\t? GaFunctionsOf<C>\n\t\t: GaFunctionsOf<C> & PreviewFunctionsHome<C>;\n\n/** The declared function slugs of a config (record keys), as a string union. */\nexport type FunctionSlugOf<C extends Config> = Extract<\n\tkeyof PreviewFunctionsOf<C>,\n\tstring\n>;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when\n * the policy declares no functions at all. Without it the argument's expected type is the bare\n * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '\"x\"' is not\n * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the\n * editor offers it as the single completion, so the empty completion list is explained rather\n * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.\n */\n// Exported (type-only) for the type tests in `env.test-d.ts`; intentionally not re-exported\n// from `index.ts`, so it stays an internal implementation detail.\nexport type NoFunctionScopeHint =\n\t\"this policy declares no `functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env\";\n\n/**\n * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug\n * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no\n * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes\n * the returned `function` namespace exact — it stays the one function's env keys instead of\n * widening to every declared function's.\n */\ntype FunctionScopeField<C extends Config, S extends string> = [\n\tFunctionSlugOf<C>,\n] extends [never]\n\t? NoFunctionScopeHint\n\t: S;\n\n/** The declared env-var keys of one function `S`, as a string union. */\ntype FunctionEnvKeysOf<\n\tC extends Config,\n\tS extends string,\n> = S extends keyof PreviewFunctionsOf<C>\n\t? NonNullable<PreviewFunctionsOf<C>[S]> extends { env: infer E }\n\t\t? Extract<keyof E, string>\n\t\t: never\n\t: never;\n\n/**\n * The extra `function` namespace added to `parseEnv`'s result when called with a function\n * slug scope: the declared env-var keys for that function, each resolved to a `string`.\n */\nexport type NeonFunctionEnv<C extends Config, S extends string> = {\n\tfunction: Record<FunctionEnvKeysOf<C, S>, string>;\n};\n\n// ───────────────────────── parseEnv ─────────────────────────\n\n/**\n * Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from\n * `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.\n *\n * `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include\n * URL-illegal characters in the password (rare but legal in Neon's connection-string\n * format) fail the WHATWG `URL` parse, so we settle for \"non-empty string\".\n */\nconst postgresEnvSchema = z.object({\n\tDATABASE_URL: z\n\t\t.string({ message: \"DATABASE_URL is missing\" })\n\t\t.min(1, \"DATABASE_URL must not be empty\"),\n\tDATABASE_URL_UNPOOLED: z\n\t\t.string({ message: \"DATABASE_URL_UNPOOLED is missing\" })\n\t\t.min(1, \"DATABASE_URL_UNPOOLED must not be empty\"),\n});\n\nconst authEnvSchema = z.object({\n\tNEON_AUTH_BASE_URL: z\n\t\t.string({ message: \"NEON_AUTH_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_BASE_URL must not be empty\"),\n\tNEON_AUTH_JWKS_URL: z\n\t\t.string({ message: \"NEON_AUTH_JWKS_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_JWKS_URL must not be empty\"),\n});\n\nconst dataApiEnvSchema = z.object({\n\tNEON_DATA_API_URL: z\n\t\t.string({ message: \"NEON_DATA_API_URL is missing\" })\n\t\t.min(1, \"NEON_DATA_API_URL must not be empty\"),\n});\n\nconst storageEnvSchema = z.object({\n\tAWS_ACCESS_KEY_ID: z\n\t\t.string({ message: \"AWS_ACCESS_KEY_ID is missing\" })\n\t\t.min(1, \"AWS_ACCESS_KEY_ID must not be empty\"),\n\tAWS_SECRET_ACCESS_KEY: z\n\t\t.string({ message: \"AWS_SECRET_ACCESS_KEY is missing\" })\n\t\t.min(1, \"AWS_SECRET_ACCESS_KEY must not be empty\"),\n\tAWS_ENDPOINT_URL_S3: z\n\t\t.string({ message: \"AWS_ENDPOINT_URL_S3 is missing\" })\n\t\t.min(1, \"AWS_ENDPOINT_URL_S3 must not be empty\"),\n\tAWS_REGION: z\n\t\t.string({ message: \"AWS_REGION is missing\" })\n\t\t.min(1, \"AWS_REGION must not be empty\"),\n});\n\nconst aiGatewayEnvSchema = z.object({\n\tNEON_AI_GATEWAY_TOKEN: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_TOKEN is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_TOKEN must not be empty\"),\n\tNEON_AI_GATEWAY_BASE_URL: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_BASE_URL must not be empty\"),\n});\n\n/** Whether a **static** policy declares object storage (`buckets`). No network. */\nfunction configWantsStorage(config: Config): boolean {\n\treturn Object.keys(authoredBuckets(config) ?? {}).length > 0;\n}\n\n/** Whether a **static** policy enables the AI Gateway (`aiGateway`). No network. */\nfunction configWantsAiGateway(config: Config): boolean {\n\treturn isServiceEnabledInput(authoredAiGateway(config));\n}\n\n/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */\nfunction isServiceEnabledInput(\n\ttoggle: ServiceToggleInput | undefined,\n): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/**\n * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates\n * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the\n * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed\n * `process.env.DATABASE_URL` lookups.\n *\n * Designed for the **\"env-vars-already-injected\"** path:\n * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.\n * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.\n * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.\n *\n * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now\n * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without\n * evaluating the per-branch closure.\n *\n * The second argument is a **scope** or a **key filter**:\n * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the\n *   full `{ postgres, auth?, dataApi?, … }` the policy enables.\n * - a **function slug** (a key of `config.functions`) — *function* scope: you are\n *   running inside that function. Returns the same branch secrets **plus** a typed\n *   `function` namespace with the function's declared env-var keys. The slug autocompletes\n *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.\n * - an **array of OS-level env-var keys** (e.g. `[\"DATABASE_URL\", \"NEON_AUTH_BASE_URL\"]`) —\n *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced\n *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only\n *   pick vars the policy actually enables. Use this when a process needs just a subset (a\n *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't\n *   want `parseEnv` to throw over vars you never use.\n *\n * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env\n * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.\n *\n * ```ts\n * import config from \"../neon\";\n * import { parseEnv } from \"@neon/env\";\n *\n * // External (app / build):\n * const env = parseEnv(config);\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n *\n * // Inside the \"hello\" function:\n * const env = parseEnv(config, \"hello\");\n * env.function.resendApiKey; // typed from hello's declared env keys\n *\n * // Filtered: only enforce + return the pooled URL.\n * const { postgres } = parseEnv(config, [\"DATABASE_URL\"]);\n * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent\n * ```\n */\nexport function parseEnv<const C extends Config>(config: C): NeonEnv<C>;\n// Overload order is load-bearing for **editor autocomplete**, not for type checking: when the\n// argument is a half-typed string literal the call resolves against no signature, and the\n// editor takes its string-literal completions from the first candidate overload. With the\n// `keys` overload listed first, the expected type of `parseEnv(config, \"…\")` is read as\n// `readonly K[]` — an array has no literal completions, so typing a function slug offered\n// nothing. Keep the slug overload ahead of the array one: `env.completions.test.ts` asserts the\n// completions through the language service, and `env.test-d.ts` locks the order itself (the\n// last overload is observable as `Parameters<typeof parseEnv>`), so `tsc` fails on a reorder.\nexport function parseEnv<\n\tconst C extends Config,\n\tconst S extends FunctionSlugOf<C>,\n>(\n\tconfig: C,\n\tscope: FunctionScopeField<C, S>,\n): NeonEnv<C> & NeonFunctionEnv<C, S>;\nexport function parseEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;\nexport function parseEnv(\n\tconfig: Config,\n\tscopeOrKeys?: string | readonly string[],\n): unknown {\n\tconst source = process.env;\n\tif (Array.isArray(scopeOrKeys)) {\n\t\treturn parseFilteredEnv(source, scopeOrKeys);\n\t}\n\t// `Array.isArray` doesn't narrow a `readonly string[]` out of the union, so re-derive the\n\t// function-slug scope from the remaining `string` shape explicitly.\n\tconst scope = typeof scopeOrKeys === \"string\" ? scopeOrKeys : undefined;\n\tconst issues: string[] = [];\n\tconst result: Record<string, unknown> = {};\n\n\tconst pg = postgresEnvSchema.safeParse({\n\t\tDATABASE_URL: source.DATABASE_URL,\n\t\tDATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED,\n\t});\n\tif (pg.success) {\n\t\tresult.postgres = {\n\t\t\tdatabaseUrl: pg.data.DATABASE_URL,\n\t\t\tdatabaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED,\n\t\t} satisfies NeonPostgresEnv;\n\t} else {\n\t\tfor (const issue of pg.error.issues) issues.push(issue.message);\n\t}\n\n\t// Branch identity is optional: the Functions runtime injects `NEON_BRANCH` on every\n\t// branch by default and `neon dev` / `neon-env run` / `env pull` emit it too, but older\n\t// runtimes and platform integrations may not, so a missing value is not an error — we\n\t// just omit the namespace rather than failing the whole parse.\n\tconst branchName = source[NEON_ENV_VAR_KEYS.branch.name];\n\tif (branchName !== undefined && branchName !== \"\") {\n\t\tresult.branch = { name: branchName } satisfies NeonBranchEnv;\n\t}\n\n\tif (isServiceEnabledInput(config.auth)) {\n\t\tconst auth = authEnvSchema.safeParse({\n\t\t\tNEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,\n\t\t\tNEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL,\n\t\t});\n\t\tif (auth.success) {\n\t\t\tresult.auth = {\n\t\t\t\tbaseUrl: auth.data.NEON_AUTH_BASE_URL,\n\t\t\t\tjwksUrl: auth.data.NEON_AUTH_JWKS_URL,\n\t\t\t} satisfies NeonAuthEnv;\n\t\t} else {\n\t\t\tfor (const issue of auth.error.issues) issues.push(issue.message);\n\t\t}\n\t}\n\n\tif (isServiceEnabledInput(config.dataApi)) {\n\t\tconst dataApi = dataApiEnvSchema.safeParse({\n\t\t\tNEON_DATA_API_URL: source.NEON_DATA_API_URL,\n\t\t});\n\t\tif (dataApi.success) {\n\t\t\tresult.dataApi = {\n\t\t\t\turl: dataApi.data.NEON_DATA_API_URL,\n\t\t\t} satisfies NeonDataApiEnv;\n\t\t} else {\n\t\t\tfor (const issue of dataApi.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsStorage(config)) {\n\t\tconst storage = storageEnvSchema.safeParse({\n\t\t\tAWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,\n\t\t\tAWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,\n\t\t\tAWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,\n\t\t\tAWS_REGION: source.AWS_REGION,\n\t\t});\n\t\tif (storage.success) {\n\t\t\tresult.storage = {\n\t\t\t\taccessKeyId: storage.data.AWS_ACCESS_KEY_ID,\n\t\t\t\tsecretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,\n\t\t\t\tendpoint: storage.data.AWS_ENDPOINT_URL_S3,\n\t\t\t\tregion: storage.data.AWS_REGION,\n\t\t\t} satisfies NeonStorageEnv;\n\t\t} else {\n\t\t\tfor (const issue of storage.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsAiGateway(config)) {\n\t\tconst aiGateway = aiGatewayEnvSchema.safeParse({\n\t\t\tNEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,\n\t\t\tNEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL,\n\t\t});\n\t\tif (aiGateway.success) {\n\t\t\tresult.aiGateway = {\n\t\t\t\tapiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,\n\t\t\t\tbaseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL,\n\t\t\t} satisfies NeonAiGatewayEnv;\n\t\t} else {\n\t\t\tfor (const issue of aiGateway.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tconst declaredFunctionSlugs = Object.keys(\n\t\tauthoredFunctions(config) ?? {},\n\t).sort();\n\tif (declaredFunctionSlugs.length > 0) {\n\t\tconst functions: Record<string, NeonFunctionUrlEnv> = {};\n\t\tfor (const slug of declaredFunctionSlugs) {\n\t\t\tconst key = functionBaseUrlKey(slug);\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (parsed.ok) {\n\t\t\t\tfunctions[slug] = { baseUrl: parsed.value };\n\t\t\t} else {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t}\n\t\t}\n\t\tif (Object.keys(functions).length === declaredFunctionSlugs.length) {\n\t\t\tresult.functions = functions;\n\t\t}\n\t}\n\n\tif (scope !== undefined) {\n\t\tconst fn = authoredFunctions(config)?.[scope];\n\t\tif (!fn) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.EnvNotInjected,\n\t\t\t\t[\n\t\t\t\t\t`parseEnv: no function \"${scope}\" is declared in this policy's functions.`,\n\t\t\t\t\t\"Pass a declared function slug (or omit the scope to read external env).\",\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t{ details: { scope } },\n\t\t\t);\n\t\t}\n\t\tconst envOut: Record<string, string> = {};\n\t\tfor (const key of Object.keys(fn.env ?? {})) {\n\t\t\tconst value = source[key];\n\t\t\t// Only a truly *unset* var is \"not injected\". Function env values carry no\n\t\t\t// non-empty constraint (unlike DATABASE_URL / NEON_AUTH_BASE_URL), so a\n\t\t\t// deliberately empty value is a present, valid value and is passed through.\n\t\t\tif (value === undefined) {\n\t\t\t\tissues.push(`${key} is missing (function \"${scope}\")`);\n\t\t\t} else {\n\t\t\t\tenvOut[key] = value;\n\t\t\t}\n\t\t}\n\t\tresult.function = envOut;\n\t}\n\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\n\treturn result;\n}\n\nfunction isFunctionBaseUrlIssue(issue: string): boolean {\n\treturn /^NEON_FUNCTION_[A-Z0-9]+_BASE_URL (is missing|must not be empty|must be a URL)$/.test(\n\t\tissue,\n\t);\n}\n\nfunction readFunctionBaseUrl(\n\tkey: string,\n\tvalue: string | undefined,\n): { ok: true; value: string } | { ok: false; issue: string } {\n\tif (value === undefined) {\n\t\treturn { ok: false, issue: `${key} is missing` };\n\t}\n\tif (value === \"\") {\n\t\treturn { ok: false, issue: `${key} must not be empty` };\n\t}\n\ttry {\n\t\tnew URL(value);\n\t} catch {\n\t\treturn { ok: false, issue: `${key} must be a URL` };\n\t}\n\treturn { ok: true, value };\n}\n\nfunction parseEnvInjectHint(issues: readonly string[]): string[] {\n\tif (issues.length > 0 && issues.every(isFunctionBaseUrlIssue)) {\n\t\treturn [\n\t\t\t\"Inject them via `neon env pull` or `neon-env run` (production URL), or `neon dev` (`http://localhost:<port>`).\",\n\t\t];\n\t}\n\tconst lines = [\n\t\t\"Inject them via one of:\",\n\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t];\n\tif (issues.some((issue) => issue.includes('(function \"'))) {\n\t\tlines.push(\n\t\t\t\"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.\",\n\t\t);\n\t}\n\tif (issues.some(isFunctionBaseUrlIssue)) {\n\t\tlines.push(\n\t\t\t\"  - for NEON_FUNCTION_*_BASE_URL: `neon env pull` or `neon dev`.\",\n\t\t);\n\t}\n\treturn lines;\n}\n\n/**\n * Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`\n * in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /\n * {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only\n * aliases).\n */\nconst FILTERABLE_ENV_KEYS: Record<string, readonly [string, string]> = {\n\tDATABASE_URL: [\"postgres\", \"databaseUrl\"],\n\tDATABASE_URL_UNPOOLED: [\"postgres\", \"databaseUrlUnpooled\"],\n\tNEON_BRANCH: [\"branch\", \"name\"],\n\tNEON_AUTH_BASE_URL: [\"auth\", \"baseUrl\"],\n\tNEON_AUTH_JWKS_URL: [\"auth\", \"jwksUrl\"],\n\tNEON_DATA_API_URL: [\"dataApi\", \"url\"],\n\tAWS_ACCESS_KEY_ID: [\"storage\", \"accessKeyId\"],\n\tAWS_SECRET_ACCESS_KEY: [\"storage\", \"secretAccessKey\"],\n\tAWS_ENDPOINT_URL_S3: [\"storage\", \"endpoint\"],\n\tAWS_REGION: [\"storage\", \"region\"],\n\tNEON_AI_GATEWAY_TOKEN: [\"aiGateway\", \"apiKey\"],\n\tNEON_AI_GATEWAY_BASE_URL: [\"aiGateway\", \"baseUrl\"],\n};\n\n/**\n * Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly\n * selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike\n * the full reader it never consults the policy — the selection alone decides what's required —\n * so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without\n * throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.\n */\nfunction parseFilteredEnv(\n\tsource: NodeJS.ProcessEnv,\n\tkeys: readonly string[],\n): Record<string, unknown> {\n\tconst issues: string[] = [];\n\tconst result: Record<string, Record<string, unknown>> = {};\n\tconst functionUrls: Record<string, NeonFunctionUrlEnv> = {};\n\tfor (const key of keys) {\n\t\tif (isFunctionBaseUrlKey(key)) {\n\t\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\t\tif (slug === null) continue;\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (!parsed.ok) {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfunctionUrls[slug] = { baseUrl: parsed.value };\n\t\t\tcontinue;\n\t\t}\n\t\t// Unknown keys are blocked at the type level; a runtime caller bypassing the types\n\t\t// gets a clear error rather than a silently-dropped selection.\n\t\tif (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {\n\t\t\tissues.push(`${key} is not a selectable Neon env variable`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst value = source[key];\n\t\tif (value === undefined) {\n\t\t\tissues.push(`${key} is missing`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (value === \"\") {\n\t\t\tissues.push(`${key} must not be empty`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst [namespace, property] = FILTERABLE_ENV_KEYS[key];\n\t\tconst bucket = result[namespace] ?? {};\n\t\tbucket[property] = value;\n\t\tresult[namespace] = bucket;\n\t}\n\tif (Object.keys(functionUrls).length > 0) {\n\t\tresult.functions = functionUrls;\n\t}\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0HA,MAAM,oBAAoB,EAAE,OAAO;CAClC,cAAc,EACZ,OAAO,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAC9C,IAAI,GAAG,gCAAgC;CACzC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;AACnD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC9B,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;CAC/C,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;AAChD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC,EAC/C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,qBAAqB,EACnB,OAAO,EAAE,SAAS,iCAAiC,CAAC,CAAC,CACrD,IAAI,GAAG,uCAAuC;CAChD,YAAY,EACV,OAAO,EAAE,SAAS,wBAAwB,CAAC,CAAC,CAC5C,IAAI,GAAG,8BAA8B;AACxC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CACnC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,0BAA0B,EACxB,OAAO,EAAE,SAAS,sCAAsC,CAAC,CAAC,CAC1D,IAAI,GAAG,4CAA4C;AACtD,CAAC;;AAGD,SAAS,mBAAmB,QAAyB;CACpD,OAAO,OAAO,KAAK,gBAAgB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,qBAAqB,QAAyB;CACtD,OAAO,sBAAsB,kBAAkB,MAAM,CAAC;AACvD;;AAGA,SAAS,sBACR,QACU;CACV,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;AAuEA,SAAgB,SACf,QACA,aACU;CACV,MAAM,SAAS,QAAQ;CACvB,IAAI,MAAM,QAAQ,WAAW,GAC5B,OAAO,iBAAiB,QAAQ,WAAW;CAI5C,MAAM,QAAQ,OAAO,gBAAgB,WAAW,cAAc,KAAA;CAC9D,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkC,CAAC;CAEzC,MAAM,KAAK,kBAAkB,UAAU;EACtC,cAAc,OAAO;EACrB,uBAAuB,OAAO;CAC/B,CAAC;CACD,IAAI,GAAG,SACN,OAAO,WAAW;EACjB,aAAa,GAAG,KAAK;EACrB,qBAAqB,GAAG,KAAK;CAC9B;MAEA,KAAK,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAO/D,MAAM,aAAa,OAAO,kBAAkB,OAAO;CACnD,IAAI,eAAe,KAAA,KAAa,eAAe,IAC9C,OAAO,SAAS,EAAE,MAAM,WAAW;CAGpC,IAAI,sBAAsB,OAAO,IAAI,GAAG;EACvC,MAAM,OAAO,cAAc,UAAU;GACpC,oBAAoB,OAAO;GAC3B,oBAAoB,OAAO;EAC5B,CAAC;EACD,IAAI,KAAK,SACR,OAAO,OAAO;GACb,SAAS,KAAK,KAAK;GACnB,SAAS,KAAK,KAAK;EACpB;OAEA,KAAK,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAElE;CAEA,IAAI,sBAAsB,OAAO,OAAO,GAAG;EAC1C,MAAM,UAAU,iBAAiB,UAAU,EAC1C,mBAAmB,OAAO,kBAC3B,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU,EAChB,KAAK,QAAQ,KAAK,kBACnB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,mBAAmB,MAAM,GAAG;EAC/B,MAAM,UAAU,iBAAiB,UAAU;GAC1C,mBAAmB,OAAO;GAC1B,uBAAuB,OAAO;GAC9B,qBAAqB,OAAO;GAC5B,YAAY,OAAO;EACpB,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU;GAChB,aAAa,QAAQ,KAAK;GAC1B,iBAAiB,QAAQ,KAAK;GAC9B,UAAU,QAAQ,KAAK;GACvB,QAAQ,QAAQ,KAAK;EACtB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,qBAAqB,MAAM,GAAG;EACjC,MAAM,YAAY,mBAAmB,UAAU;GAC9C,uBAAuB,OAAO;GAC9B,0BAA0B,OAAO;EAClC,CAAC;EACD,IAAI,UAAU,SACb,OAAO,YAAY;GAClB,QAAQ,UAAU,KAAK;GACvB,SAAS,UAAU,KAAK;EACzB;OAEA,KAAK,MAAM,SAAS,UAAU,MAAM,QACnC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,MAAM,wBAAwB,OAAO,KACpC,kBAAkB,MAAM,KAAK,CAAC,CAC/B,CAAC,CAAC,KAAK;CACP,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,YAAgD,CAAC;EACvD,KAAK,MAAM,QAAQ,uBAAuB;GACzC,MAAM,MAAM,mBAAmB,IAAI;GACnC,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,OAAO,IACV,UAAU,QAAQ,EAAE,SAAS,OAAO,MAAM;QAE1C,OAAO,KAAK,OAAO,KAAK;EAE1B;EACA,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,sBAAsB,QAC3D,OAAO,YAAY;CAErB;CAEA,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,KAAK,kBAAkB,MAAM,CAAC,GAAG;EACvC,IAAI,CAAC,IACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,0BAA0B,MAAM,4CAChC,yEACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;EAED,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG;GAC5C,MAAM,QAAQ,OAAO;GAIrB,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,GAAG,IAAI,yBAAyB,MAAM,GAAG;QAErD,OAAO,OAAO;EAEhB;EACA,OAAO,WAAW;CACnB;CAEA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAGD,OAAO;AACR;AAEA,SAAS,uBAAuB,OAAwB;CACvD,OAAO,kFAAkF,KACxF,KACD;AACD;AAEA,SAAS,oBACR,KACA,OAC6D;CAC7D,IAAI,UAAU,KAAA,GACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAa;CAEhD,IAAI,UAAU,IACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAoB;CAEvD,IAAI;EACH,IAAI,IAAI,KAAK;CACd,QAAQ;EACP,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,IAAI;EAAgB;CACnD;CACA,OAAO;EAAE,IAAI;EAAM;CAAM;AAC1B;AAEA,SAAS,mBAAmB,QAAqC;CAChE,IAAI,OAAO,SAAS,KAAK,OAAO,MAAM,sBAAsB,GAC3D,OAAO,CACN,gHACD;CAED,MAAM,QAAQ;EACb;EACA;EACA;CACD;CACA,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,cAAa,CAAC,GACvD,MAAM,KACL,gHACD;CAED,IAAI,OAAO,KAAK,sBAAsB,GACrC,MAAM,KACL,kEACD;CAED,OAAO;AACR;;;;;;;AAQA,MAAM,sBAAiE;CACtE,cAAc,CAAC,YAAY,aAAa;CACxC,uBAAuB,CAAC,YAAY,qBAAqB;CACzD,aAAa,CAAC,UAAU,MAAM;CAC9B,oBAAoB,CAAC,QAAQ,SAAS;CACtC,oBAAoB,CAAC,QAAQ,SAAS;CACtC,mBAAmB,CAAC,WAAW,KAAK;CACpC,mBAAmB,CAAC,WAAW,aAAa;CAC5C,uBAAuB,CAAC,WAAW,iBAAiB;CACpD,qBAAqB,CAAC,WAAW,UAAU;CAC3C,YAAY,CAAC,WAAW,QAAQ;CAChC,uBAAuB,CAAC,aAAa,QAAQ;CAC7C,0BAA0B,CAAC,aAAa,SAAS;AAClD;;;;;;;;AASA,SAAS,iBACR,QACA,MAC0B;CAC1B,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkD,CAAC;CACzD,MAAM,eAAmD,CAAC;CAC1D,KAAK,MAAM,OAAO,MAAM;EACvB,IAAI,qBAAqB,GAAG,GAAG;GAC9B,MAAM,OAAO,wBAAwB,GAAG;GACxC,IAAI,SAAS,MAAM;GACnB,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,CAAC,OAAO,IAAI;IACf,OAAO,KAAK,OAAO,KAAK;IACxB;GACD;GACA,aAAa,QAAQ,EAAE,SAAS,OAAO,MAAM;GAC7C;EACD;EAGA,IAAI,CAAC,OAAO,OAAO,qBAAqB,GAAG,GAAG;GAC7C,OAAO,KAAK,GAAG,IAAI,uCAAuC;GAC1D;EACD;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GAAW;GACxB,OAAO,KAAK,GAAG,IAAI,YAAY;GAC/B;EACD;EACA,IAAI,UAAU,IAAI;GACjB,OAAO,KAAK,GAAG,IAAI,mBAAmB;GACtC;EACD;EACA,MAAM,CAAC,WAAW,YAAY,oBAAoB;EAClD,MAAM,SAAS,OAAO,cAAc,CAAC;EACrC,OAAO,YAAY;EACnB,OAAO,aAAa;CACrB;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GACtC,OAAO,YAAY;CAEpB,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAED,OAAO;AACR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neon/env",
-  "version": "1.3.5",
+  "version": "1.4.1",
   "description": "Resolve and inject Neon connection strings for the branch selected by your neon.ts policy. fetchEnv / parseEnv plus a `neon-env` CLI with `run` and `export`.",
   "keywords": [
     "neon",
@@ -45,15 +45,15 @@
     "tsdown": "^0.14.1",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.17",
+    "@neon-internals/env-core": "0.0.19",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/sdk": "6.0.0"
+    "@neon/sdk": "6.0.0",
+    "@neon-internals/cli-core": "0.0.0"
   },
   "dependencies": {
     "zod": "^4.4.3",
     "yargs": "^18.0.0",
-    "@neon/config": "1.5.1"
+    "@neon/config": "1.7.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"