@neon/env 1.5.3 → 1.6.1

package/README.md

@@ -24,7 +24,7 @@ Contributing? See [`CONTRIBUTING.md`](./CONTRIBUTING.md).
 
 The library functions are **filesystem- and env-agnostic**: `fetchEnv` requires an explicit `projectId` + `branch` (a branch **name** like `main`, or a `br-…` id). (The `neon-env` CLI does the `.neon`/`NEON_*` resolution and passes these in.)
 
-> `parseEnv` takes **no branch name**: the secret set is static (top-level `config.auth` / `config.dataApi`), so it reads those toggles directly without evaluating the per-branch closure. Its optional second argument is a **scope** _or_ a **key filter** — omit it for the full external (app/build) env, pass a **function slug** when running inside that deployed function (adds a typed `function` namespace of its declared env keys), or pass an **array of OS-level env-var keys** to require + return only that subset.
+> `parseEnv` takes **no branch name**: the secret set is static (`config.auth` / `config.dataApi` / `config.preview.realtime`), so it reads those toggles directly without evaluating the per-branch closure. Its optional second argument is a **scope** _or_ a **key filter** — omit it for the full external (app/build) env, pass a **function slug** when running inside that deployed function (adds a typed `function` namespace of that function's declared env keys), or pass an **array of OS-level env-var keys** to require + return only that subset.
 
 ```ts
 import config from "../neon";
@@ -50,11 +50,11 @@ const { postgres } = parseEnv(config, ["DATABASE_URL"]);
 postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent, and never required
 ```
 
-Both return the same namespaced `NeonEnv` shape: `postgres` is always present; `branch` (the branch name, surfaced as `NEON_BRANCH`) is always present on a `fetchEnv` result and present on a `parseEnv` result when `NEON_BRANCH` was injected; `auth` and `dataApi` are included (and statically typed) when the evaluated branch policy enables them.
+Both return the same namespaced `NeonEnv` shape: `postgres` is always present; `branch` (the branch name, surfaced as `NEON_BRANCH`) is always present on a `fetchEnv` result and present on a `parseEnv` result when `NEON_BRANCH` was injected; `auth`, `dataApi`, and `realtime` are included (and statically typed) when the policy enables them.
 
 | Function | Description |
 | --- | --- |
-| `fetchEnv(config, { projectId, branch, ... })` | Async. Calls the Neon API for the given project + branch and returns live connection strings (and Auth/Data API values when enabled). `projectId` and `branch` are required; `branch` accepts a branch **name** (e.g. `main`) or a `br-…` id. (The legacy id-only `branchId` option still works.) Pass `keys` to fetch only some vars — see [Fetching a subset](#fetching-a-subset). Reads nothing from `process.env` or disk. |
+| `fetchEnv(config, { projectId, branch, ... })` | Async. Calls the Neon API for the given project + branch and returns live connection strings (and Auth/Data API/Realtime values when enabled). `projectId` and `branch` are required; `branch` accepts a branch **name** (e.g. `main`) or a `br-…` id. (The legacy id-only `branchId` option still works.) Pass `keys` to fetch only some vars — see [Fetching a subset](#fetching-a-subset). Reads nothing from `process.env` or disk. |
 | `parseEnv(config)` / `parseEnv(config, slug)` / `parseEnv(config, keys)` | Sync. Reads/validates the Neon env vars already present in `process.env` against the static policy toggles. With a function `slug`, also returns a typed `function` namespace of that function's declared env keys; `functions.<slug>.baseUrl` is the invocation URL. With a `keys` array (e.g. `["DATABASE_URL"]`), only those vars are required and returned, as a narrowed namespaced shape — the keys are typesafe against the policy. Throws `PlatformError(EnvNotInjected)` listing missing vars when the env isn't populated. |
 | `toEntries(env)` | Project a resolved `NeonEnv` into `{ KEY: value }` pairs for cross-process transport (named after the web `.entries()` convention; returns a `Record`). |
 
@@ -69,7 +69,7 @@ neon-env run -- npm run dev
 neon-env run -- pnpm dev
 ```
 
-`run` loads `neon.ts`, resolves the branch (via `--branch`, `NEON_BRANCH` / `NEON_BRANCH_ID`, or the `branch` field in `.neon[/project.json]` — by name or id), fetches the connection strings from Neon, and spawns the command with `NEON_BRANCH` / `DATABASE_URL` / `DATABASE_URL_UNPOOLED` (plus the Auth, Data API, object-storage `AWS_*`, AI Gateway `NEON_AI_GATEWAY_*`, and function `NEON_FUNCTION_*_BASE_URL` vars when the policy enables them — see [Env vars produced](#env-vars-produced)) injected on top of the inherited environment. Stdio is inherited so interactive dev servers keep working, and the parent exits with the child's exit code.
+`run` loads `neon.ts`, resolves the branch (via `--branch`, `NEON_BRANCH` / `NEON_BRANCH_ID`, or the `branch` field in `.neon[/project.json]` — by name or id), fetches the connection strings from Neon, and spawns the command with `NEON_BRANCH` / `DATABASE_URL` / `DATABASE_URL_UNPOOLED` (plus the Auth, Data API, Realtime, object-storage `AWS_*`, AI Gateway `NEON_AI_GATEWAY_*`, and function `NEON_FUNCTION_*_BASE_URL` vars when the policy enables them — see [Env vars produced](#env-vars-produced)) injected on top of the inherited environment. Stdio is inherited so interactive dev servers keep working, and the parent exits with the child's exit code.
 
 ### `export` — print env to stdout
 
@@ -121,6 +121,15 @@ These are the OS-level vars `fetchEnv` / `parseEnv` read and `toEntries` (so `ne
 | --- | --- |
 | `NEON_DATA_API_URL` | Data API (PostgREST) integration URL |
 
+**Realtime** (when `preview.realtime` is enabled). `fetchEnv` waits for asynchronous provisioning or secret rotation to finish before returning these values:
+
+| Key | From |
+| --- | --- |
+| `NEON_REALTIME_URL` | WebSocket endpoint passed to `createRealtimeClient` |
+| `NEON_REALTIME_SECRET` | shared key passed to server-side `createRealtime`; never expose it to browser code |
+
+Derive the database passed to `createRealtime` from `DATABASE_URL` so the two cannot drift out of sync.
+
 **Object storage** (when `buckets` declares at least one bucket). Projected onto the AWS SDK's standard config vars so an S3 client works from env alone (set `forcePathStyle: true`):
 
 | Key | From |

package/dist/env.js

@@ -1,4 +1,30 @@
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
+//#region ../../internals/env-core/dist/roles.js
+/**
+* Neon's default branch owner role, created with every project. This is the role a
+* `DATABASE_URL` should connect as.
+*/
+const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
+/**
+* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
+* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
+* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
+* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
+* branch routinely reports more than one role.
+*/
+const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"anonymous",
+	"authenticated"
+]);
+/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */
+function defaultConnectionRole(roleNames) {
+	if (roleNames.length === 1) return roleNames[0];
+	if (roleNames.includes("neondb_owner")) return NEON_DEFAULT_OWNER_ROLE;
+	const appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));
+	return appRoles.length === 1 ? appRoles[0] : void 0;
+}
+//#endregion
 //#region ../../internals/env-core/dist/env.js
 /**
 * The Neon env core — resolving a branch's env from the Neon API, and projecting it into
@@ -19,31 +45,14 @@ import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialSco
 * Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the
 * camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used
 * by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /
-* {@link dataApiEnvSchema}.
+* {@link dataApiEnvSchema} / {@link realtimeEnvSchema}.
 */
 /**
-* Neon's default branch owner role, created with every project. This is the role a
-* `DATABASE_URL` should connect as.
-*/
-const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
-/**
 * Neon's default database, created with every project. When a branch has several databases
 * and none was requested, this is preferred for the `DATABASE_URL` so the common case (a
 * user added a second database next to `neondb`) auto-picks without asking.
 */
 const NEON_DEFAULT_DATABASE = "neondb";
-/**
-* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
-* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
-* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
-* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
-* branch routinely reports more than one role.
-*/
-const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
-	"authenticator",
-	"anonymous",
-	"authenticated"
-]);
 const NEON_ENV_VAR_KEYS = {
 	/**
 	* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
@@ -60,6 +69,10 @@ const NEON_ENV_VAR_KEYS = {
 		jwksUrl: "NEON_AUTH_JWKS_URL"
 	},
 	dataApi: { url: "NEON_DATA_API_URL" },
+	realtime: {
+		url: "NEON_REALTIME_URL",
+		secret: "NEON_REALTIME_SECRET"
+	},
 	/**
 	* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so
 	* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.
@@ -125,6 +138,55 @@ function requiredValue(value, description) {
 	if (value === null) throw new Error(`fetchEnv: missing ${description}.`);
 	return value;
 }
+const REALTIME_POLL_INTERVAL_MS = 1e3;
+/**
+* Wait for asynchronous Realtime provisioning/rotation before reading its secret. The
+* secret endpoint deliberately returns 404 until provisioning finishes, and during a
+* rotation it can still expose the previous key while `pending` is true.
+*/
+async function resolveRealtimeEnv(args) {
+	const getRealtime = args.api.getProjectBranchRealtime;
+	if (!getRealtime) throw new PlatformError(ErrorCode.FeatureUnavailable, "fetchEnv cannot resolve Realtime: this NeonApi adapter does not implement getProjectBranchRealtime.");
+	const getSecret = args.api.getProjectBranchRealtimeSecret;
+	let resolvedEnv;
+	while (resolvedEnv === void 0) {
+		const snapshot = await getRealtime.call(args.api, args.projectId, args.branch.id);
+		if (!snapshot.pending) {
+			if (!snapshot.enabled) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables realtime but Realtime is disabled on branch ${args.branch.name} (${args.branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or `npx neon deploy`) and re-run fetchEnv. Or set realtime to false or omit it."].join(" "), { details: {
+				projectId: args.projectId,
+				branchId: args.branch.id
+			} });
+			let secret;
+			if (args.wantsSecret) {
+				if (!getSecret) throw new PlatformError(ErrorCode.FeatureUnavailable, "fetchEnv cannot resolve NEON_REALTIME_SECRET: this NeonApi adapter does not implement getProjectBranchRealtimeSecret.");
+				secret = await getSecret.call(args.api, args.projectId, args.branch.id);
+			}
+			if (!secret?.pending) resolvedEnv = {
+				...args.wantsUrl ? { url: realtimeWebSocketUrl(requiredRealtimeInvocationUrl(snapshot, args.branch)) } : {},
+				...secret ? { secret: secret.secret } : {}
+			};
+		}
+		if (resolvedEnv === void 0) await new Promise((resolve) => setTimeout(resolve, REALTIME_POLL_INTERVAL_MS));
+	}
+	return resolvedEnv;
+}
+function requiredRealtimeInvocationUrl(snapshot, branch) {
+	if (snapshot.invocationUrl !== void 0 && snapshot.invocationUrl !== "") return snapshot.invocationUrl;
+	throw new PlatformError(ErrorCode.ServerError, `Realtime is enabled on branch ${branch.name} (${branch.id}), but the Neon API returned no invocation URL.`, { details: { branchId: branch.id } });
+}
+/** Normalize the control-plane invocation URL to the WebSocket URL the client SDK needs. */
+function realtimeWebSocketUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new PlatformError(ErrorCode.ServerError, `Realtime invocation URL is invalid: ${JSON.stringify(value)}.`);
+	}
+	if (parsed.protocol === "https:") parsed.protocol = "wss:";
+	else if (parsed.protocol === "http:") parsed.protocol = "ws:";
+	else if (parsed.protocol !== "wss:" && parsed.protocol !== "ws:") throw new PlatformError(ErrorCode.ServerError, `Realtime invocation URL must use http(s) or ws(s): ${JSON.stringify(value)}.`);
+	return parsed.toString();
+}
 /**
 * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
 * narrowing. Exists for callers that compute the selection at runtime — notably
@@ -154,6 +216,7 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 	const wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);
 	const wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));
 	const wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);
+	const wantsRealtime = desired.realtimePolicy === "enabled" && (wants(K.realtime.url) || wants(K.realtime.secret));
 	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
 	const functionUrlMode = options.functionUrls ?? "policy";
 	const declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);
@@ -220,6 +283,19 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 		}
 		result.dataApi = { url: dataApiSnapshot.url };
 	}
+	if (wantsRealtime) {
+		const realtime = await resolveRealtimeEnv({
+			api,
+			projectId,
+			branch,
+			wantsUrl: wants(K.realtime.url),
+			wantsSecret: wants(K.realtime.secret)
+		});
+		const realtimeEnv = {};
+		if (wants(K.realtime.url)) realtimeEnv.url = requiredValue(realtime.url, "WebSocket URL for enabled Realtime");
+		if (wants(K.realtime.secret)) realtimeEnv.secret = requiredValue(realtime.secret, "shared secret for enabled Realtime");
+		result.realtime = realtimeEnv;
+	}
 	const wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));
 	const wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));
 	const wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);
@@ -384,6 +460,7 @@ function policyEnvKeys(desired) {
 		K.branch.name,
 		...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],
 		...desired.dataApiEnabled ? [K.dataApi.url] : [],
+		...desired.realtimePolicy === "enabled" ? [K.realtime.url, K.realtime.secret] : [],
 		...(desired.preview?.buckets.length ?? 0) > 0 ? [
 			K.storage.accessKeyId,
 			K.storage.secretAccessKey,
@@ -548,11 +625,8 @@ function pickRoleName(roles, branch, requested) {
 		return requested;
 	}
 	if (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, "Create one via the Neon console or pass `roleName` explicitly."].join(" "), { details: { branchId: branch.id } });
-	if (roles.length === 1) return roles[0].name;
-	const owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);
-	if (owner) return owner.name;
-	const appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));
-	if (appRoles.length === 1) return appRoles[0].name;
+	const picked = defaultConnectionRole(roles.map((r) => r.name));
+	if (picked) return picked;
 	throw new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is "${NEON_DEFAULT_OWNER_ROLE}"; cannot auto-pick.`, `Pass \`roleName\` explicitly. Available: ${roles.map((r) => r.name).join(", ")}.`].join(" "), { details: {
 		branchId: branch.id,
 		availableRoles: roles.map((r) => r.name)
@@ -599,6 +673,8 @@ function toEntries(env) {
 	put(K.auth.baseUrl, env.auth?.baseUrl);
 	put(K.auth.jwksUrl, env.auth?.jwksUrl);
 	put(K.dataApi.url, env.dataApi?.url);
+	put(K.realtime.url, env.realtime?.url);
+	put(K.realtime.secret, env.realtime?.secret);
 	put(K.storage.accessKeyId, env.storage?.accessKeyId);
 	put(K.storage.secretAccessKey, env.storage?.secretAccessKey);
 	put(K.storage.endpoint, env.storage?.endpoint);

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/env.js"],"sourcesContent":["import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from \"@neon/config/v1\";\n//#region src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema}.\n*/\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: { name: \"NEON_BRANCH\" },\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nconst FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;\nconst FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;\nfunction functionBaseUrlKey(slug) {\n\tif (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);\n\treturn `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;\n}\nfunction parseFunctionBaseUrlKey(key) {\n\tconst match = FUNCTION_BASE_URL_KEY.exec(key);\n\treturn match ? match[1].toLowerCase() : null;\n}\nfunction isFunctionBaseUrlKey(key) {\n\treturn parseFunctionBaseUrlKey(key) !== null;\n}\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/**\n* Starts a read now and keeps an unread rejection from crashing the process; the caller\n* awaits it (and sees the error) when its turn comes. The read is called synchronously and\n* its own promise returned, so errors surface in the same order as a direct call; a\n* synchronous throw becomes the returned rejection.\n*/\nfunction started(read) {\n\tlet promise;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => void 0);\n\treturn promise;\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\n/**\n* `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n* the caller already has it.\n*/\nasync function fetchEnvKeysState(config, options, keys, policy) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = policy ?? await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst functionUrlMode = options.functionUrls ?? \"policy\";\n\tconst declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);\n\tconst selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);\n\tconst constructSlugs = functionUrlSlugsToConstruct({\n\t\tfunctionUrlMode,\n\t\tselection,\n\t\tdeclaredSlugs,\n\t\tselectedFunctionKeys,\n\t\twants\n\t});\n\tconst wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst functionsRead = functionUrlMode === \"all-live\" && wantsAnyFunctionUrl && options.listedFunctions === void 0 ? listFunctionInvocationUrls(api, projectId, branch.id) : null;\n\tfunctionsRead?.catch(() => void 0);\n\tconst storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name)) result.branch = { name: branch.name };\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await requiredValue(storageRead, \"storage read\");\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\tconst functions = {};\n\tlet functionUrlsUnavailable = false;\n\tif (functionUrlMode === \"all-live\" && wantsAnyFunctionUrl) {\n\t\tconst listed = options.listedFunctions === void 0 ? await requiredValue(functionsRead, \"function listing\") : listedFromSnapshots(options.listedFunctions);\n\t\tif (listed.status === \"unavailable\") {\n\t\t\tif (selection === null) functionUrlsUnavailable = true;\n\t\t} else for (const fn of listed.functions) {\n\t\t\tif (!wants(functionBaseUrlKey(fn.slug))) continue;\n\t\t\tfunctions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };\n\t\t}\n\t}\n\tconst missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);\n\tif (missingConstructSlugs.length > 0) {\n\t\tconst uri = requiredValue(unpooled, \"direct connection URI for function invocation URLs\").uri;\n\t\tfor (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };\n\t}\n\tassertSelectedFunctionUrls(selectedFunctionKeys, functions);\n\tif (Object.keys(functions).length > 0) result.functions = functions;\n\treturn {\n\t\tenv: result,\n\t\tfunctionUrlsUnavailable\n\t};\n}\nfunction functionUrlSlugsToConstruct(args) {\n\tconst slugs = [];\n\tif (args.functionUrlMode === \"policy\" && args.selection === null) {\n\t\tfor (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);\n\t\treturn slugs;\n\t}\n\tfor (const key of args.selectedFunctionKeys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug !== null) slugs.push(slug);\n\t}\n\treturn slugs;\n}\nfunction listedFromSnapshots(snapshots) {\n\treturn {\n\t\tstatus: \"ok\",\n\t\tfunctions: snapshots.filter((fn) => fn.invocationUrl !== \"\").map((fn) => ({\n\t\t\tslug: fn.slug,\n\t\t\tinvocationUrl: fn.invocationUrl\n\t\t})).sort((left, right) => left.slug.localeCompare(right.slug))\n\t};\n}\nfunction assertSelectedFunctionUrls(keys, functions) {\n\tfor (const key of keys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);\n\t}\n}\nasync function listFunctionInvocationUrls(api, projectId, branchId) {\n\ttry {\n\t\treturn listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));\n\t} catch (error) {\n\t\tif (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {\n\t\t\tstatus: \"unavailable\",\n\t\t\terror\n\t\t};\n\t\tthrow error;\n\t}\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api, resolved) {\n\tconst branch = resolved ?? await listAndResolveBranch(options, api);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\nasync function listAndResolveBranch(options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\treturn resolveBranch(branchRef, branches);\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tconst storageReveal = needsStorage && storageDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId)) : null;\n\tconst gatewayReveal = needsGateway && gatewayDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)) : null;\n\tif (storageReveal) {\n\t\tconst revealed = await storageReveal;\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (gatewayReveal) secrets.apiToken = (await gatewayReveal).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`\n* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).\n*/\nfunction asEnvBaseUrl(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);\n\treturn parsed.origin;\n}\n/** Derived from the connection URI so undeployed functions have a cell-routed URL. */\nfunction functionInvocationUrl(branchId, slug, connectionUri) {\n\tconst suffix = connectionHostSuffix(connectionUri);\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive the invocation URL for function \"${slug}\": the direct connection URI has no host suffix.`);\n\treturn `https://${branchId}-${slug}.compute.${suffix}`;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tif (roles.length === 1) return roles[0].name;\n\tconst owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);\n\tif (owner) return owner.name;\n\tconst appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));\n\tif (appRoles.length === 1) return appRoles[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\tif (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);\n\treturn out;\n}\n//#endregion\nexport { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,0BAA0B;;;;;;AAMhC,MAAM,wBAAwB;;;;;;;;AAQ9B,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;AACD,MAAM,oBAAoB;;;;;;CAMzB,QAAQ,EAAE,MAAM,cAAc;CAC9B,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;;;;;;CAMpC,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,SAAS,mBAAmB,MAAM;CACjC,IAAI,CAAC,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,IAAI,EAAE,0CAA0C;CACrI,OAAO,iBAAiB,KAAK,YAAY,EAAE;AAC5C;AACA,SAAS,wBAAwB,KAAK;CACrC,MAAM,QAAQ,sBAAsB,KAAK,GAAG;CAC5C,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AACzC;AACA,SAAS,qBAAqB,KAAK;CAClC,OAAO,wBAAwB,GAAG,MAAM;AACzC;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;;;;;;AAOA,SAAS,QAAQ,MAAM;CACtB,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAK,CAAC;CAC1B,OAAO;AACR;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;;;;;AAKA,eAAe,kBAAkB,QAAQ,SAAS,MAAM,QAAQ;CAC/D,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,UAAU,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CACpF,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,kBAAkB,QAAQ,gBAAgB;CAChD,MAAM,iBAAiB,QAAQ,SAAS,aAAa,CAAC,EAAA,CAAG,KAAK,OAAO,GAAG,IAAI;CAC5E,MAAM,uBAAuB,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,oBAAoB;CACjG,MAAM,iBAAiB,4BAA4B;EAClD;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,MAAM,sBAAsB,cAAc,QAAQ,qBAAqB,SAAS;CAChF,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,gBAAgB,oBAAoB,cAAc,uBAAuB,QAAQ,oBAAoB,KAAK,IAAI,2BAA2B,KAAK,WAAW,OAAO,EAAE,IAAI;CAC5K,eAAe,YAAY,KAAK,CAAC;CACjC,MAAM,cAAc,eAAe,cAAc,IAAI,wBAAwB,WAAW,OAAO,EAAE,CAAC,IAAI;CACtG,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,eAAe,SAAS;CAC/G,MAAM,wBAAwB,eAAe;CAC7C,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAC9D,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,cAAc,aAAa,cAAc;GACzD,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,kGAAkG,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,4HAA4H,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/U;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,MAAM,YAAY,CAAC;CACnB,IAAI,0BAA0B;CAC9B,IAAI,oBAAoB,cAAc,qBAAqB;EAC1D,MAAM,SAAS,QAAQ,oBAAoB,KAAK,IAAI,MAAM,cAAc,eAAe,kBAAkB,IAAI,oBAAoB,QAAQ,eAAe;EACxJ,IAAI,OAAO,WAAW,eACjB;OAAA,cAAc,MAAM,0BAA0B;EAAA,OAC5C,KAAK,MAAM,MAAM,OAAO,WAAW;GACzC,IAAI,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG;GACzC,UAAU,GAAG,QAAQ,EAAE,SAAS,aAAa,GAAG,aAAa,EAAE;EAChE;CACD;CACA,MAAM,wBAAwB,eAAe,QAAQ,SAAS,UAAU,UAAU,KAAK,CAAC;CACxF,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,MAAM,cAAc,UAAU,oDAAoD,CAAC,CAAC;EAC1F,KAAK,MAAM,QAAQ,uBAAuB,UAAU,QAAQ,EAAE,SAAS,sBAAsB,OAAO,IAAI,MAAM,GAAG,EAAE;CACpH;CACA,2BAA2B,sBAAsB,SAAS;CAC1D,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,OAAO,YAAY;CAC1D,OAAO;EACN,KAAK;EACL;CACD;AACD;AACA,SAAS,4BAA4B,MAAM;CAC1C,MAAM,QAAQ,CAAC;CACf,IAAI,KAAK,oBAAoB,YAAY,KAAK,cAAc,MAAM;EACjE,KAAK,MAAM,QAAQ,KAAK,eAAe,IAAI,KAAK,MAAM,mBAAmB,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI;EAChG,OAAO;CACR;CACA,KAAK,MAAM,OAAO,KAAK,sBAAsB;EAC5C,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,MAAM,MAAM,KAAK,IAAI;CACnC;CACA,OAAO;AACR;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO;EACN,QAAQ;EACR,WAAW,UAAU,QAAQ,OAAO,GAAG,kBAAkB,EAAE,CAAC,CAAC,KAAK,QAAQ;GACzE,MAAM,GAAG;GACT,eAAe,GAAG;EACnB,EAAE,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC9D;AACD;AACA,SAAS,2BAA2B,MAAM,WAAW;CACpD,KAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,QAAQ,UAAU,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,qBAAqB,IAAI,EAAE;CAC7F;AACD;AACA,eAAe,2BAA2B,KAAK,WAAW,UAAU;CACnE,IAAI;EACH,OAAO,oBAAoB,MAAM,IAAI,oBAAoB,WAAW,QAAQ,CAAC;CAC9E,SAAS,OAAO;EACf,IAAI,gBAAgB,KAAK,KAAK,MAAM,SAAS,UAAU,oBAAoB,OAAO;GACjF,QAAQ;GACR;EACD;EACA,MAAM;CACP;AACD;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK,UAAU;CAClE,MAAM,SAAS,YAAY,MAAM,qBAAqB,SAAS,GAAG;CAClE,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;AACA,eAAe,qBAAqB,SAAS,KAAK;CACjD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,OAAO,cAAc,WAAW,QAAQ;AACzC;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM;EACvB,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,eAAe,QAAQ,YAAY,MAAM,cAAA,CAAe;CAC5D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,aAAa,KAAK;CAC1B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,GAAG,GAAG;CACzF;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,sDAAsD,KAAK,UAAU,GAAG,GAAG;CAC5J,OAAO,OAAO;AACf;;AAEA,SAAS,sBAAsB,UAAU,MAAM,eAAe;CAC7D,MAAM,SAAS,qBAAqB,aAAa;CACjD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,4DAA4D,KAAK,iDAAiD;CACrJ,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW;AAC/C;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,IAAI,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC;CACxC,MAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,uBAAuB;CAClE,IAAI,OAAO,OAAO,MAAM;CACxB,MAAM,WAAW,MAAM,QAAQ,MAAM,CAAC,wBAAwB,IAAI,EAAE,IAAI,CAAC;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS,EAAE,CAAC;CAC9C,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,IAAI,IAAI,WAAW,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,IAAI,GAAG,IAAI,UAAU,KAAK,EAAE,OAAO;CACnI,OAAO;AACR"}
+{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/roles.js","../../../internals/env-core/dist/env.js"],"sourcesContent":["//#region src/roles.ts\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\n/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */\nfunction defaultConnectionRole(roleNames) {\n\tif (roleNames.length === 1) return roleNames[0];\n\tif (roleNames.includes(\"neondb_owner\")) return NEON_DEFAULT_OWNER_ROLE;\n\tconst appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));\n\treturn appRoles.length === 1 ? appRoles[0] : void 0;\n}\n//#endregion\nexport { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole };\n\n//# sourceMappingURL=roles.js.map","import { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole } from \"./roles.js\";\nimport { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from \"@neon/config/v1\";\n//#region src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema} / {@link realtimeEnvSchema}.\n*/\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: { name: \"NEON_BRANCH\" },\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\trealtime: {\n\t\turl: \"NEON_REALTIME_URL\",\n\t\tsecret: \"NEON_REALTIME_SECRET\"\n\t},\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nconst FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;\nconst FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;\nfunction functionBaseUrlKey(slug) {\n\tif (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);\n\treturn `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;\n}\nfunction parseFunctionBaseUrlKey(key) {\n\tconst match = FUNCTION_BASE_URL_KEY.exec(key);\n\treturn match ? match[1].toLowerCase() : null;\n}\nfunction isFunctionBaseUrlKey(key) {\n\treturn parseFunctionBaseUrlKey(key) !== null;\n}\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/**\n* Starts a read now and keeps an unread rejection from crashing the process; the caller\n* awaits it (and sees the error) when its turn comes. The read is called synchronously and\n* its own promise returned, so errors surface in the same order as a direct call; a\n* synchronous throw becomes the returned rejection.\n*/\nfunction started(read) {\n\tlet promise;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => void 0);\n\treturn promise;\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\nconst REALTIME_POLL_INTERVAL_MS = 1e3;\n/**\n* Wait for asynchronous Realtime provisioning/rotation before reading its secret. The\n* secret endpoint deliberately returns 404 until provisioning finishes, and during a\n* rotation it can still expose the previous key while `pending` is true.\n*/\nasync function resolveRealtimeEnv(args) {\n\tconst getRealtime = args.api.getProjectBranchRealtime;\n\tif (!getRealtime) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve Realtime: this NeonApi adapter does not implement getProjectBranchRealtime.\");\n\tconst getSecret = args.api.getProjectBranchRealtimeSecret;\n\tlet resolvedEnv;\n\twhile (resolvedEnv === void 0) {\n\t\tconst snapshot = await getRealtime.call(args.api, args.projectId, args.branch.id);\n\t\tif (!snapshot.pending) {\n\t\t\tif (!snapshot.enabled) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables realtime but Realtime is disabled on branch ${args.branch.name} (${args.branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon deploy`) and re-run fetchEnv. Or set realtime to false or omit it.\"].join(\" \"), { details: {\n\t\t\t\tprojectId: args.projectId,\n\t\t\t\tbranchId: args.branch.id\n\t\t\t} });\n\t\t\tlet secret;\n\t\t\tif (args.wantsSecret) {\n\t\t\t\tif (!getSecret) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve NEON_REALTIME_SECRET: this NeonApi adapter does not implement getProjectBranchRealtimeSecret.\");\n\t\t\t\tsecret = await getSecret.call(args.api, args.projectId, args.branch.id);\n\t\t\t}\n\t\t\tif (!secret?.pending) resolvedEnv = {\n\t\t\t\t...args.wantsUrl ? { url: realtimeWebSocketUrl(requiredRealtimeInvocationUrl(snapshot, args.branch)) } : {},\n\t\t\t\t...secret ? { secret: secret.secret } : {}\n\t\t\t};\n\t\t}\n\t\tif (resolvedEnv === void 0) await new Promise((resolve) => setTimeout(resolve, REALTIME_POLL_INTERVAL_MS));\n\t}\n\treturn resolvedEnv;\n}\nfunction requiredRealtimeInvocationUrl(snapshot, branch) {\n\tif (snapshot.invocationUrl !== void 0 && snapshot.invocationUrl !== \"\") return snapshot.invocationUrl;\n\tthrow new PlatformError(ErrorCode.ServerError, `Realtime is enabled on branch ${branch.name} (${branch.id}), but the Neon API returned no invocation URL.`, { details: { branchId: branch.id } });\n}\n/** Normalize the control-plane invocation URL to the WebSocket URL the client SDK needs. */\nfunction realtimeWebSocketUrl(value) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new PlatformError(ErrorCode.ServerError, `Realtime invocation URL is invalid: ${JSON.stringify(value)}.`);\n\t}\n\tif (parsed.protocol === \"https:\") parsed.protocol = \"wss:\";\n\telse if (parsed.protocol === \"http:\") parsed.protocol = \"ws:\";\n\telse if (parsed.protocol !== \"wss:\" && parsed.protocol !== \"ws:\") throw new PlatformError(ErrorCode.ServerError, `Realtime invocation URL must use http(s) or ws(s): ${JSON.stringify(value)}.`);\n\treturn parsed.toString();\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\n/**\n* `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n* the caller already has it.\n*/\nasync function fetchEnvKeysState(config, options, keys, policy) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = policy ?? await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst wantsRealtime = desired.realtimePolicy === \"enabled\" && (wants(K.realtime.url) || wants(K.realtime.secret));\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst functionUrlMode = options.functionUrls ?? \"policy\";\n\tconst declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);\n\tconst selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);\n\tconst constructSlugs = functionUrlSlugsToConstruct({\n\t\tfunctionUrlMode,\n\t\tselection,\n\t\tdeclaredSlugs,\n\t\tselectedFunctionKeys,\n\t\twants\n\t});\n\tconst wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst functionsRead = functionUrlMode === \"all-live\" && wantsAnyFunctionUrl && options.listedFunctions === void 0 ? listFunctionInvocationUrls(api, projectId, branch.id) : null;\n\tfunctionsRead?.catch(() => void 0);\n\tconst storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name)) result.branch = { name: branch.name };\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tif (wantsRealtime) {\n\t\tconst realtime = await resolveRealtimeEnv({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranch,\n\t\t\twantsUrl: wants(K.realtime.url),\n\t\t\twantsSecret: wants(K.realtime.secret)\n\t\t});\n\t\tconst realtimeEnv = {};\n\t\tif (wants(K.realtime.url)) realtimeEnv.url = requiredValue(realtime.url, \"WebSocket URL for enabled Realtime\");\n\t\tif (wants(K.realtime.secret)) realtimeEnv.secret = requiredValue(realtime.secret, \"shared secret for enabled Realtime\");\n\t\tresult.realtime = realtimeEnv;\n\t}\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await requiredValue(storageRead, \"storage read\");\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\tconst functions = {};\n\tlet functionUrlsUnavailable = false;\n\tif (functionUrlMode === \"all-live\" && wantsAnyFunctionUrl) {\n\t\tconst listed = options.listedFunctions === void 0 ? await requiredValue(functionsRead, \"function listing\") : listedFromSnapshots(options.listedFunctions);\n\t\tif (listed.status === \"unavailable\") {\n\t\t\tif (selection === null) functionUrlsUnavailable = true;\n\t\t} else for (const fn of listed.functions) {\n\t\t\tif (!wants(functionBaseUrlKey(fn.slug))) continue;\n\t\t\tfunctions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };\n\t\t}\n\t}\n\tconst missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);\n\tif (missingConstructSlugs.length > 0) {\n\t\tconst uri = requiredValue(unpooled, \"direct connection URI for function invocation URLs\").uri;\n\t\tfor (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };\n\t}\n\tassertSelectedFunctionUrls(selectedFunctionKeys, functions);\n\tif (Object.keys(functions).length > 0) result.functions = functions;\n\treturn {\n\t\tenv: result,\n\t\tfunctionUrlsUnavailable\n\t};\n}\nfunction functionUrlSlugsToConstruct(args) {\n\tconst slugs = [];\n\tif (args.functionUrlMode === \"policy\" && args.selection === null) {\n\t\tfor (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);\n\t\treturn slugs;\n\t}\n\tfor (const key of args.selectedFunctionKeys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug !== null) slugs.push(slug);\n\t}\n\treturn slugs;\n}\nfunction listedFromSnapshots(snapshots) {\n\treturn {\n\t\tstatus: \"ok\",\n\t\tfunctions: snapshots.filter((fn) => fn.invocationUrl !== \"\").map((fn) => ({\n\t\t\tslug: fn.slug,\n\t\t\tinvocationUrl: fn.invocationUrl\n\t\t})).sort((left, right) => left.slug.localeCompare(right.slug))\n\t};\n}\nfunction assertSelectedFunctionUrls(keys, functions) {\n\tfor (const key of keys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);\n\t}\n}\nasync function listFunctionInvocationUrls(api, projectId, branchId) {\n\ttry {\n\t\treturn listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));\n\t} catch (error) {\n\t\tif (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {\n\t\t\tstatus: \"unavailable\",\n\t\t\terror\n\t\t};\n\t\tthrow error;\n\t}\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api, resolved) {\n\tconst branch = resolved ?? await listAndResolveBranch(options, api);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\nasync function listAndResolveBranch(options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\treturn resolveBranch(branchRef, branches);\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...desired.realtimePolicy === \"enabled\" ? [K.realtime.url, K.realtime.secret] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tconst storageReveal = needsStorage && storageDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId)) : null;\n\tconst gatewayReveal = needsGateway && gatewayDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)) : null;\n\tif (storageReveal) {\n\t\tconst revealed = await storageReveal;\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (gatewayReveal) secrets.apiToken = (await gatewayReveal).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`\n* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).\n*/\nfunction asEnvBaseUrl(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);\n\treturn parsed.origin;\n}\n/** Derived from the connection URI so undeployed functions have a cell-routed URL. */\nfunction functionInvocationUrl(branchId, slug, connectionUri) {\n\tconst suffix = connectionHostSuffix(connectionUri);\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive the invocation URL for function \"${slug}\": the direct connection URI has no host suffix.`);\n\treturn `https://${branchId}-${slug}.compute.${suffix}`;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst picked = defaultConnectionRole(roles.map((r) => r.name));\n\tif (picked) return picked;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.realtime.url, env.realtime?.url);\n\tput(K.realtime.secret, env.realtime?.secret);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\tif (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);\n\treturn out;\n}\n//#endregion\nexport { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;AAKA,MAAM,0BAA0B;;;;;;;;AAQhC,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;;AAED,SAAS,sBAAsB,WAAW;CACzC,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU;CAC7C,IAAI,UAAU,SAAS,cAAc,GAAG,OAAO;CAC/C,MAAM,WAAW,UAAU,QAAQ,SAAS,CAAC,wBAAwB,IAAI,IAAI,CAAC;CAC9E,OAAO,SAAS,WAAW,IAAI,SAAS,KAAK,KAAK;AACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;;;;;;CAMzB,QAAQ,EAAE,MAAM,cAAc;CAC9B,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;CACpC,UAAU;EACT,KAAK;EACL,QAAQ;CACT;;;;;;CAMA,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,SAAS,mBAAmB,MAAM;CACjC,IAAI,CAAC,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,IAAI,EAAE,0CAA0C;CACrI,OAAO,iBAAiB,KAAK,YAAY,EAAE;AAC5C;AACA,SAAS,wBAAwB,KAAK;CACrC,MAAM,QAAQ,sBAAsB,KAAK,GAAG;CAC5C,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AACzC;AACA,SAAS,qBAAqB,KAAK;CAClC,OAAO,wBAAwB,GAAG,MAAM;AACzC;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;;;;;;AAOA,SAAS,QAAQ,MAAM;CACtB,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAK,CAAC;CAC1B,OAAO;AACR;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;AACA,MAAM,4BAA4B;;;;;;AAMlC,eAAe,mBAAmB,MAAM;CACvC,MAAM,cAAc,KAAK,IAAI;CAC7B,IAAI,CAAC,aAAa,MAAM,IAAI,cAAc,UAAU,oBAAoB,qGAAqG;CAC7K,MAAM,YAAY,KAAK,IAAI;CAC3B,IAAI;CACJ,OAAO,gBAAgB,KAAK,GAAG;EAC9B,MAAM,WAAW,MAAM,YAAY,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;EAChF,IAAI,CAAC,SAAS,SAAS;GACtB,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,+EAA+E,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,GAAG,KAAK,yIAAyI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC5V,WAAW,KAAK;IAChB,UAAU,KAAK,OAAO;GACvB,EAAE,CAAC;GACH,IAAI;GACJ,IAAI,KAAK,aAAa;IACrB,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,oBAAoB,uHAAuH;IAC7L,SAAS,MAAM,UAAU,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;GACvE;GACA,IAAI,CAAC,QAAQ,SAAS,cAAc;IACnC,GAAG,KAAK,WAAW,EAAE,KAAK,qBAAqB,8BAA8B,UAAU,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;IAC1G,GAAG,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;GAC1C;EACD;EACA,IAAI,gBAAgB,KAAK,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,yBAAyB,CAAC;CAC1G;CACA,OAAO;AACR;AACA,SAAS,8BAA8B,UAAU,QAAQ;CACxD,IAAI,SAAS,kBAAkB,KAAK,KAAK,SAAS,kBAAkB,IAAI,OAAO,SAAS;CACxF,MAAM,IAAI,cAAc,UAAU,aAAa,iCAAiC,OAAO,KAAK,IAAI,OAAO,GAAG,kDAAkD,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;AACjM;;AAEA,SAAS,qBAAqB,OAAO;CACpC,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,KAAK;CACvB,QAAQ;EACP,MAAM,IAAI,cAAc,UAAU,aAAa,uCAAuC,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/G;CACA,IAAI,OAAO,aAAa,UAAU,OAAO,WAAW;MAC/C,IAAI,OAAO,aAAa,SAAS,OAAO,WAAW;MACnD,IAAI,OAAO,aAAa,UAAU,OAAO,aAAa,OAAO,MAAM,IAAI,cAAc,UAAU,aAAa,sDAAsD,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/L,OAAO,OAAO,SAAS;AACxB;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;;;;;AAKA,eAAe,kBAAkB,QAAQ,SAAS,MAAM,QAAQ;CAC/D,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,UAAU,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CACpF,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,gBAAgB,QAAQ,mBAAmB,cAAc,MAAM,EAAE,SAAS,GAAG,KAAK,MAAM,EAAE,SAAS,MAAM;CAC/G,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,kBAAkB,QAAQ,gBAAgB;CAChD,MAAM,iBAAiB,QAAQ,SAAS,aAAa,CAAC,EAAA,CAAG,KAAK,OAAO,GAAG,IAAI;CAC5E,MAAM,uBAAuB,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,oBAAoB;CACjG,MAAM,iBAAiB,4BAA4B;EAClD;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,MAAM,sBAAsB,cAAc,QAAQ,qBAAqB,SAAS;CAChF,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,gBAAgB,oBAAoB,cAAc,uBAAuB,QAAQ,oBAAoB,KAAK,IAAI,2BAA2B,KAAK,WAAW,OAAO,EAAE,IAAI;CAC5K,eAAe,YAAY,KAAK,CAAC;CACjC,MAAM,cAAc,eAAe,cAAc,IAAI,wBAAwB,WAAW,OAAO,EAAE,CAAC,IAAI;CACtG,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,eAAe,SAAS;CAC/G,MAAM,wBAAwB,eAAe;CAC7C,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAC9D,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM,mBAAmB;GACzC;GACA;GACA;GACA,UAAU,MAAM,EAAE,SAAS,GAAG;GAC9B,aAAa,MAAM,EAAE,SAAS,MAAM;EACrC,CAAC;EACD,MAAM,cAAc,CAAC;EACrB,IAAI,MAAM,EAAE,SAAS,GAAG,GAAG,YAAY,MAAM,cAAc,SAAS,KAAK,oCAAoC;EAC7G,IAAI,MAAM,EAAE,SAAS,MAAM,GAAG,YAAY,SAAS,cAAc,SAAS,QAAQ,oCAAoC;EACtH,OAAO,WAAW;CACnB;CACA,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,cAAc,aAAa,cAAc;GACzD,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,kGAAkG,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,4HAA4H,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/U;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,MAAM,YAAY,CAAC;CACnB,IAAI,0BAA0B;CAC9B,IAAI,oBAAoB,cAAc,qBAAqB;EAC1D,MAAM,SAAS,QAAQ,oBAAoB,KAAK,IAAI,MAAM,cAAc,eAAe,kBAAkB,IAAI,oBAAoB,QAAQ,eAAe;EACxJ,IAAI,OAAO,WAAW,eACjB;OAAA,cAAc,MAAM,0BAA0B;EAAA,OAC5C,KAAK,MAAM,MAAM,OAAO,WAAW;GACzC,IAAI,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG;GACzC,UAAU,GAAG,QAAQ,EAAE,SAAS,aAAa,GAAG,aAAa,EAAE;EAChE;CACD;CACA,MAAM,wBAAwB,eAAe,QAAQ,SAAS,UAAU,UAAU,KAAK,CAAC;CACxF,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,MAAM,cAAc,UAAU,oDAAoD,CAAC,CAAC;EAC1F,KAAK,MAAM,QAAQ,uBAAuB,UAAU,QAAQ,EAAE,SAAS,sBAAsB,OAAO,IAAI,MAAM,GAAG,EAAE;CACpH;CACA,2BAA2B,sBAAsB,SAAS;CAC1D,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,OAAO,YAAY;CAC1D,OAAO;EACN,KAAK;EACL;CACD;AACD;AACA,SAAS,4BAA4B,MAAM;CAC1C,MAAM,QAAQ,CAAC;CACf,IAAI,KAAK,oBAAoB,YAAY,KAAK,cAAc,MAAM;EACjE,KAAK,MAAM,QAAQ,KAAK,eAAe,IAAI,KAAK,MAAM,mBAAmB,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI;EAChG,OAAO;CACR;CACA,KAAK,MAAM,OAAO,KAAK,sBAAsB;EAC5C,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,MAAM,MAAM,KAAK,IAAI;CACnC;CACA,OAAO;AACR;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO;EACN,QAAQ;EACR,WAAW,UAAU,QAAQ,OAAO,GAAG,kBAAkB,EAAE,CAAC,CAAC,KAAK,QAAQ;GACzE,MAAM,GAAG;GACT,eAAe,GAAG;EACnB,EAAE,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC9D;AACD;AACA,SAAS,2BAA2B,MAAM,WAAW;CACpD,KAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,QAAQ,UAAU,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,qBAAqB,IAAI,EAAE;CAC7F;AACD;AACA,eAAe,2BAA2B,KAAK,WAAW,UAAU;CACnE,IAAI;EACH,OAAO,oBAAoB,MAAM,IAAI,oBAAoB,WAAW,QAAQ,CAAC;CAC9E,SAAS,OAAO;EACf,IAAI,gBAAgB,KAAK,KAAK,MAAM,SAAS,UAAU,oBAAoB,OAAO;GACjF,QAAQ;GACR;EACD;EACA,MAAM;CACP;AACD;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK,UAAU;CAClE,MAAM,SAAS,YAAY,MAAM,qBAAqB,SAAS,GAAG;CAClE,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;AACA,eAAe,qBAAqB,SAAS,KAAK;CACjD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,OAAO,cAAc,WAAW,QAAQ;AACzC;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,GAAG,QAAQ,mBAAmB,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,CAAC;EACjF,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM;EACvB,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,eAAe,QAAQ,YAAY,MAAM,cAAA,CAAe;CAC5D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,aAAa,KAAK;CAC1B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,GAAG,GAAG;CACzF;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,sDAAsD,KAAK,UAAU,GAAG,GAAG;CAC5J,OAAO,OAAO;AACf;;AAEA,SAAS,sBAAsB,UAAU,MAAM,eAAe;CAC7D,MAAM,SAAS,qBAAqB,aAAa;CACjD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,4DAA4D,KAAK,iDAAiD;CACrJ,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW;AAC/C;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,MAAM,SAAS,sBAAsB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,IAAI,QAAQ,OAAO;CACnB,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,SAAS,KAAK,IAAI,UAAU,GAAG;CACrC,IAAI,EAAE,SAAS,QAAQ,IAAI,UAAU,MAAM;CAC3C,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,IAAI,IAAI,WAAW,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,IAAI,GAAG,IAAI,UAAU,KAAK,EAAE,OAAO;CACnI,OAAO;AACR"}

package/dist/index.d.ts

@@ -23,6 +23,10 @@ declare const NEON_ENV_VAR_KEYS: {
   readonly dataApi: {
     readonly url: "NEON_DATA_API_URL";
   };
+  readonly realtime: {
+    readonly url: "NEON_REALTIME_URL";
+    readonly secret: "NEON_REALTIME_SECRET";
+  };
   /**
    * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so
    * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.
@@ -93,6 +97,13 @@ interface NeonAuthEnv {
 interface NeonDataApiEnv {
   url: string;
 }
+/** Connection values for a branch with Realtime enabled. */
+interface NeonRealtimeEnv {
+  /** WebSocket endpoint passed to `createRealtimeClient`. */
+  url: string;
+  /** Server-only key passed to `createRealtime`. Never expose it to browser code. */
+  secret: string;
+}
 /**
  * S3-compatible object-storage access for the branch. Present on `NeonEnv` only
  * when the policy declares `buckets` (or deprecated `preview.buckets`). Combines a minted branch credential's access
@@ -180,6 +191,10 @@ type HasBuckets<C extends Config> = OrBool<HasGaRecord<C["buckets"]>, HasPreview
 type HasPreviewAiGateway<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
   aiGateway: infer A;
 } ? ServiceOn<NonNullable<A>> : false;
+/** Whether the policy statically enables Realtime under `preview.realtime`. */
+type RealtimeOn<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+  realtime: infer R;
+} ? ServiceOn<NonNullable<R>> : false;
 type AiGatewayOn<C extends Config> = OrBool<HasGaToggle<C["aiGateway"]>, HasPreviewAiGateway<C>>;
 /** The tuple guard prevents a missing preview block from enabling functions. */
 type HasPreviewFunctions<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
@@ -198,13 +213,14 @@ type FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends in
  * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the
  * {@link Config} so the type system knows which optional namespaces are present.
  *
- * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /
- * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct
- * read of those fields — no union-across-branches, no default-config escape hatch:
+ * Because the secret-bearing toggles live in the **static** config (not inside a per-branch
+ * closure), namespace presence is a direct read of those fields — no union-across-branches,
+ * no default-config escape hatch:
  *
  * - `postgres` is always present.
  * - `auth` is added iff `config.auth` is statically enabled.
  * - `dataApi` is added iff `config.dataApi` is statically enabled.
+ * - `realtime` is added iff `config.preview.realtime` is statically enabled.
  * - `storage` is added iff `config.buckets` (or deprecated `preview.buckets`) declares at least one bucket.
  * - `aiGateway` is added iff `config.aiGateway` (or deprecated `preview.aiGateway`) is statically enabled.
  * - `functions` is added iff `config.functions` (or deprecated `preview.functions`) declares at least one slug.
@@ -220,6 +236,8 @@ type NeonEnv<C extends Config = Config> = {
   auth: NeonAuthEnv;
 } : NoNamespace) & (ServiceOn<NonNullable<C["dataApi"]>> extends true ? {
   dataApi: NeonDataApiEnv;
+} : NoNamespace) & (RealtimeOn<C> extends true ? {
+  realtime: NeonRealtimeEnv;
 } : NoNamespace) & (HasBuckets<C> extends true ? {
   storage: NeonStorageEnv;
 } : NoNamespace) & (AiGatewayOn<C> extends true ? {
@@ -239,6 +257,7 @@ interface EnvKeysByNamespace {
   branch: "NEON_BRANCH";
   auth: "NEON_AUTH_BASE_URL" | "NEON_AUTH_JWKS_URL";
   dataApi: "NEON_DATA_API_URL";
+  realtime: "NEON_REALTIME_URL" | "NEON_REALTIME_SECRET";
   storage: "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_ENDPOINT_URL_S3" | "AWS_REGION";
   aiGateway: "NEON_AI_GATEWAY_TOKEN" | "NEON_AI_GATEWAY_BASE_URL";
 }
@@ -248,6 +267,7 @@ interface NamespaceEnv {
   branch: NeonBranchEnv;
   auth: NeonAuthEnv;
   dataApi: NeonDataApiEnv;
+  realtime: NeonRealtimeEnv;
   storage: NeonStorageEnv;
   aiGateway: NeonAiGatewayEnv;
 }
@@ -259,6 +279,8 @@ interface EnvKeyToProp {
   NEON_AUTH_BASE_URL: "baseUrl";
   NEON_AUTH_JWKS_URL: "jwksUrl";
   NEON_DATA_API_URL: "url";
+  NEON_REALTIME_URL: "url";
+  NEON_REALTIME_SECRET: "secret";
   AWS_ACCESS_KEY_ID: "accessKeyId";
   AWS_SECRET_ACCESS_KEY: "secretAccessKey";
   AWS_ENDPOINT_URL_S3: "endpoint";
@@ -526,8 +548,8 @@ type NeonFunctionEnv<C extends Config, S extends string> = {
  * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.
  *
  * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now
- * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without
- * evaluating the per-branch closure.
+ * static (`config.auth` / `config.dataApi` / `config.preview.realtime`), so it reads those
+ * directly without evaluating the per-branch closure.
  *
  * The second argument is a **scope** or a **key filter**:
  * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the
@@ -567,5 +589,5 @@ declare function parseEnv<const C extends Config>(config: C): NeonEnv<C>;
 declare function parseEnv<const C extends Config, const S extends FunctionSlugOf<C>>(config: C, scope: FunctionScopeField<C, S>): NeonEnv<C> & NeonFunctionEnv<C, S>;
 declare function parseEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;
 //#endregion
-export { type FetchEnvOptions, type FilteredNeonEnv, type FunctionBaseUrlKey, type FunctionSlugOf, NEON_ENV_VAR_KEYS, type NeonAiGatewayEnv, type NeonAuthEnv, type NeonBranchEnv, type NeonDataApiEnv, type NeonEnv, type NeonFunctionEnv, type NeonFunctionUrlEnv, type NeonFunctionsEnv, type NeonPostgresEnv, type NeonStorageEnv, type ResolvedNeonEnv, type SelectableEnvKey, type SelectedNeonEnv, fetchEnv, functionBaseUrlKey, isFunctionBaseUrlKey, parseEnv, parseFunctionBaseUrlKey, toEntries };
+export { type FetchEnvOptions, type FilteredNeonEnv, type FunctionBaseUrlKey, type FunctionSlugOf, NEON_ENV_VAR_KEYS, type NeonAiGatewayEnv, type NeonAuthEnv, type NeonBranchEnv, type NeonDataApiEnv, type NeonEnv, type NeonFunctionEnv, type NeonFunctionUrlEnv, type NeonFunctionsEnv, type NeonPostgresEnv, type NeonRealtimeEnv, type NeonStorageEnv, type ResolvedNeonEnv, type SelectableEnvKey, type SelectedNeonEnv, fetchEnv, functionBaseUrlKey, isFunctionBaseUrlKey, parseEnv, parseFunctionBaseUrlKey, toEntries };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","NeonCredentialMeta","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","FunctionBaseUrlKey","Slug","Uppercase","functionBaseUrlKey","S","parseFunctionBaseUrlKey","isFunctionBaseUrlKey","FunctionUrlMode","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","HasKeys","OrBool","A","B","HasGaRecord","NonNullable","HasGaToggle","HasPreviewBuckets","C","HasBuckets","HasPreviewAiGateway","AiGatewayOn","HasPreviewFunctions","F","HasFunctions","GaFunctionsOfConfig","PreviewFunctionsOfConfig","FunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","FetchEnvKeysOptions","ResolvedNeonEnv","FetchEnvKeysState","ReadonlyArray","fetchEnvKeysState","BranchPolicy","ReturnType","resolveBranchPolicy","Pick","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","isLiveCredential","defaultStorageCredential","defaultAiGatewayCredential","createApiFromOptions","toEntries","Partial","Config","FilteredNeonEnv","NeonEnv","SelectableEnvKey","GaFunctionsOf","C","NonNullable","Record","PreviewFunctionsHome","F","PreviewFunctionsOf","FunctionSlugOf","Extract","NoFunctionScopeHint","FunctionScopeField","S","FunctionEnvKeysOf","E","NeonFunctionEnv","parseEnv","K","Config","NeonApi","resolveConfig","NEON_ENV_VAR_KEYS","branch","name","postgres","databaseUrl","databaseUrlUnpooled","auth","baseUrl","jwksUrl","dataApi","url","storage","accessKeyId","secretAccessKey","endpoint","region","aiGateway","apiKey","FunctionBaseUrlKey","Uppercase","Slug","functionBaseUrlKey","slug","S","parseFunctionBaseUrlKey","key","isFunctionBaseUrlKey","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","enabled","HasKeys","OrBool","A","B","HasGaRecord","NonNullable","HasGaToggle","HasPreviewBuckets","C","buckets","HasBuckets","HasPreviewAiGateway","AiGatewayOn","HasPreviewFunctions","functions","F","HasFunctions","GaFunctionsOfConfig","PreviewFunctionsOfConfig","FunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","DATABASE_URL","DATABASE_URL_UNPOOLED","NEON_BRANCH","NEON_AUTH_BASE_URL","NEON_AUTH_JWKS_URL","NEON_DATA_API_URL","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_ENDPOINT_URL_S3","AWS_REGION","NEON_AI_GATEWAY_TOKEN","NEON_AI_GATEWAY_BASE_URL","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","keys","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","projectId","branchId","apiHost","api","roleName","databaseName","fetchEnv","options","config","args","NoInfer","Promise","toEntries","env","ResolvedNeonEnv","Partial","GaFunctionsOf","PreviewFunctionsHome","PreviewFunctionsOf","FunctionSlugOf","NoFunctionScopeHint","FunctionScopeField","FunctionEnvKeysOf","E","NeonFunctionEnv","function","parseEnv","scope"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, NeonCredentialMeta, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\ntype FunctionBaseUrlKey<Slug extends string = string> = `NEON_FUNCTION_${Uppercase<Slug>}_BASE_URL`;\ndeclare function functionBaseUrlKey<S extends string>(slug: S): FunctionBaseUrlKey<S>;\ndeclare function parseFunctionBaseUrlKey(key: string): string | null;\ndeclare function isFunctionBaseUrlKey(key: string): key is FunctionBaseUrlKey;\n/** `all-live` lists deployed functions. Policy mode derives declared slugs from the connection host. */\ntype FunctionUrlMode = \"policy\" | \"all-live\";\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/**\n * S3-compatible object-storage access for the branch. Present on `NeonEnv` only\n * when the policy declares `buckets` (or deprecated `preview.buckets`). Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch. Present on `NeonEnv` only when the policy\n * enables `aiGateway` (or deprecated `preview.aiGateway`). `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\ninterface NeonFunctionUrlEnv {\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\ntype OrBool<A extends boolean, B extends boolean> = A extends true ? true : B;\n/**\n * Whether a top-level optional record (GA `functions` / `buckets`) has known keys.\n * A string index signature (`Record<string, …>`, the default `Config` param) is treated\n * as empty so an untyped policy yields just `{ postgres }`, matching {@link HasPreviewBuckets}.\n */\ntype HasGaRecord<T> = [NonNullable<T>] extends [never] ? false : string extends keyof NonNullable<T> ? false : HasKeys<NonNullable<T>>;\ntype HasGaToggle<T> = [NonNullable<T>] extends [never] ? false : ServiceOn<NonNullable<T>>;\n/**\n * Whether the policy declares at least one object-storage bucket (`buckets` or\n * deprecated `preview.buckets`). Drives whether {@link NeonEnv} carries the `storage`\n * namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasPreviewBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\ntype HasBuckets<C extends Config> = OrBool<HasGaRecord<C[\"buckets\"]>, HasPreviewBuckets<C>>;\n/**\n * Whether the policy enables the AI Gateway (`aiGateway` or deprecated `preview.aiGateway`).\n * Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n */\ntype HasPreviewAiGateway<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\ntype AiGatewayOn<C extends Config> = OrBool<HasGaToggle<C[\"aiGateway\"]>, HasPreviewAiGateway<C>>;\n/** The tuple guard prevents a missing preview block from enabling functions. */\ntype HasPreviewFunctions<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? HasKeys<NonNullable<F>> : false;\ntype HasFunctions<C extends Config> = OrBool<HasGaRecord<C[\"functions\"]>, HasPreviewFunctions<C>>;\ntype GaFunctionsOfConfig<C extends Config> = [NonNullable<C[\"functions\"]>] extends [never] ? Record<never, never> : string extends keyof NonNullable<C[\"functions\"]> ? Record<never, never> : NonNullable<C[\"functions\"]>;\ntype PreviewFunctionsOfConfig<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? Record<never, never> : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? F : Record<never, never>;\ntype FunctionsOfConfig<C extends Config> = [keyof GaFunctionsOfConfig<C>] extends [never] ? PreviewFunctionsOfConfig<C> : [keyof PreviewFunctionsOfConfig<C>] extends [never] ? GaFunctionsOfConfig<C> : GaFunctionsOfConfig<C> & PreviewFunctionsOfConfig<C>;\ntype FunctionSlugOfConfig<C extends Config> = Extract<keyof FunctionsOfConfig<C>, string>;\ntype NeonFunctionsEnv<C extends Config> = { [S in FunctionSlugOfConfig<C>]: NeonFunctionUrlEnv };\ntype FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends infer S ? S extends string ? FunctionBaseUrlKey<S> : never : never;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.buckets` (or deprecated `preview.buckets`) declares at least one bucket.\n * - `aiGateway` is added iff `config.aiGateway` (or deprecated `preview.aiGateway`) is statically enabled.\n * - `functions` is added iff `config.functions` (or deprecated `preview.functions`) declares at least one slug.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace) & (HasFunctions<C> extends true ? {\n  functions: NeonFunctionsEnv<C>;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace] | FunctionBaseUrlKeyOf<C>;\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype SelectedFunctionKeys<K extends string> = Extract<K, FunctionBaseUrlKey>;\ntype FunctionSlugFromKey<K extends string> = K extends `NEON_FUNCTION_${infer S}_BASE_URL` ? Lowercase<S> : never;\ntype FunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]: NeonFunctionUrlEnv };\n};\ntype OptionalFunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions?: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]?: NeonFunctionUrlEnv };\n};\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & FunctionsFilteredEnv<K>;\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & OptionalFunctionsFilteredEnv<K>;\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\ntype FetchEnvKeysState = {\n  env: ResolvedNeonEnv;\n  /** Prevents endpoint failure from being mistaken for a confirmed empty function list. */\n  functionUrlsUnavailable: boolean;\n};\ntype FetchEnvKeysOptions = FetchEnvOptions & {\n  functionUrls?: FunctionUrlMode;\n  /**\n   * Keys to skip even when {@link fetchEnvKeys} is unscoped (`keys === null`).\n   * {@link fetchEnvReusingSecrets} uses this to keep already-verified secrets\n   * without converting an unscoped fetch into a static policy-key list — that\n   * list cannot name `NEON_FUNCTION_*_BASE_URL`, so it would drop function URLs.\n   */\n  omitKeys?: readonly string[];\n  /**\n   * Skip a second `listBranchFunctions` when the caller already listed.\n   * `--service functions` uses this so a later `FeatureUnavailable` cannot be\n   * swallowed as `skipped`.\n   */\n  listedFunctions?: ReadonlyArray<{\n    slug: string;\n    invocationUrl: string;\n  }>;\n};\n/**\n * `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n * the caller already has it.\n */\ndeclare function fetchEnvKeysState(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null, policy?: BranchPolicy): Promise<FetchEnvKeysState>;\ntype BranchPolicy = {\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n};\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi, /** The target branch, when the caller listed it already. */\nresolved?: NeonBranchSnapshot): Promise<BranchPolicy>;\n/**\n * Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n * *require* secrets; functions never force a credential. `functions:invoke` rides along only\n * when this path still has to mint (defaults already cover storage and the gateway).\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\ndeclare function isLiveCredential(meta: NeonCredentialMeta, now: number): boolean;\ndeclare function defaultStorageCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function defaultAiGatewayCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> } & {\n  functions?: Record<string, NeonFunctionUrlEnv>;\n};\n//#endregion\nexport { BranchPolicy, FetchEnvKeysOptions, FetchEnvKeysState, FetchEnvOptions, FilteredNeonEnv, FunctionBaseUrlKey, FunctionUrlMode, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionUrlEnv, NeonFunctionsEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AA8CC,cA1CaO,iBA2CS,EAAA;EAAA;AAA4DE;AAAVC;AAAS;AAAA;EAC/C,SAAAyH,MAAA,EAAA;IAAyBvH,SAAAA,IAAAA,EAAAA,aAAAA;EAAuBA,CAAAA;EAAnBJ,SAAAA,QAAAA,EAAAA;IAAkB,SAAA8H,WAAA,EAAA,cAAA;IACjEzH,SAAAA,mBAAuB,EAAA,uBAAA;EAAA,CAAA;EAGpB,SAOVG,IAAAA,EAAAA;IAIAC,SAAAA,OAAAA,EAAe,oBAAA;IAsBfC,SAAAA,OAAW,EAAA,oBAAA;EAAA,CAAA;EAMG,SAcdE,OAAAA,EAAAA;IAgBAC,SAAAA,GAAAA,EAAAA,mBAAgB;EAAA,CAAA;EAIE;AAQH;AAYX;AAAOK;AAA8BA;EAErCA,SAAAA,OAAAA,EAAAA;IAAkCA,SAAAA,WAAAA,EAAAA,mBAAAA;IAA4BA,SAAAA,eAAAA,EAAAA,uBAAAA;IAE/DA,SAAAA,QAAAA,EAAAA,qBAAAA;IAAC,SAAAuH,MAAA,EAAA,YAAA;EAAA,CAAA;EAEY;AACf;AAAyCpH;AAAwBC;AAAC;AAAA;AAM7D;EAAmBJ,SAAAA,SAAAA,EAAAA;IAAZM,SAAAA,MAAAA,EAAAA,uBAAAA;IAA2EN,SAAAA,OAAAA,EAAAA,0BAAAA;EAAZM,CAAAA;AAA6CN,CAAAA;AAAZM,KA/GlHxB,kBA+GkHwB,CAAAA,aAAAA,MAAAA,GAAAA,MAAAA,CAAAA,GAAAA,iBA/G9CtB,SA+G8CsB,CA/GpCvB,IA+GoCuB,CAAAA,WAAAA;AAARL,iBA9G9FhB,kBA8G8FgB,CAAAA,UAAAA,MAAAA,CAAAA,CAAAA,IAAAA,EA9GnDf,CA8GmDe,CAAAA,EA9G/CnB,kBA8G+CmB,CA9G5Bf,CA8G4Be,CAAAA;AAAO,iBA7GrGd,uBAAAA,CA6GqG8I,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;AAAA,iBA5GrG7I,oBAAAA,CA6GD6I,GAAA,EAAA,MAAA,CAAA,EAAAA,GAAA,IA7G2CnJ,kBA6G3C;AAAA;;AAAOwB;AAAgEN;AAAZM;AAAVP;AAAS;AAAA;AAWpD,UA/GZT,aAAAA,CA+GY;EAAWhB,IAAAA,EAAAA,MAAAA;AAAuBmC;AAAZH;AAAiEG,UA3GnGlB,eAAAA,CA2GmGkB;EAAZH;AAEzEF;AAAZE;AAARL;EAAO2G,WAAA,EAAA,MAAA;EAAA;AACI;AAAWtI;AAA6BmC;AAAZJ;EAA6CI,mBAAAA,EAAAA,MAAAA;AAAlBD;AAAlCN;AAAM;AAAA;AAKlB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEH,UA/FhBX,WAAAA,CA+FgBW;EAAZG,OAAAA,EAAAA,MAAAA;EAAVP;EAASiH,OAAA,EAAA,MAAA;AAAA;AACG;AAAW1I,UA1FjBmB,cAAAA,CA0FiBnB;EAA6BmC,GAAAA,EAAAA,MAAAA;AAAZF;AAAiDE;AAApBE;AAApCT;AAAM;AAAA;AAEnB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAE3EQ,UAhFdpB,cAAAA,CAgFcoB;EAAZR,WAAAA,EAAAA,MAAAA;EAARL,eAAAA,EAAAA,MAAAA;EAAO;EAAAqH,QACNvG,EAAAA,MAAAA;EAAY;EAAWzC,MAAAA,EAAAA,MAAAA;AAA6BmC;AAAZJ;AAAiDI;AAApBI;AAApCX;AAAM;AAAA;AACpB;AAAW5B;AAAuBmC,UAlEhDd,gBAAAA,CAkEgDc;EAAZH,MAAAA,EAAAA,MAAAA;EAA+CR,OAAAA,EAAAA,MAAAA;AAAwDW;AAAZH,UA9D/HV,kBAAAA,CA8D+HU;EAA8BR,OAAAA,EAAAA,MAAAA;AAAmCW;AAAZH;AAAW;AAAA;AAC5K;AAAWhC;AAAuBmC,KAvD1DZ,WAAAA,GAAcC,MAuD4CW,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAZH;AAA6CR;AAAmCW;AAAZH;AAEnHQ;AAAIhB;AAAM;AAAA;AACQ;AAAWxB;AAAqCmC;AAApBO,KA9C7CjB,SA8C6CiB,CAAAA,CAAAA,CAAAA,GAAAA,CA9C7BhB,CA8C6BgB,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA9CChB,CA8CDgB,CAAAA,SAAAA,CAAAA;EAAmEP,OAAAA,EAAAA,KAAAA;AAAzBQ,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA5C9EjB,CA4C8EiB,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CA5C5CjB,CA4C4CiB,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CA5ChBjB,CA4CgBiB,CAAAA,SAAAA,CAAAA;EAA8DR,OAAAA,EAAAA,IAAAA;AAAzBQ,CAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CA1CpHjB,CA0CoHiB,CAAAA,SAAAA,CAAAA,MAAAA,CAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAmER;AAApBO,KAxC3Kf,OAwC2Ke,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,MAxCvJhB,CAwCuJgB,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA;AAA6CP,KAvCxNP,MAuCwNO,CAAAA,UAAAA,OAAAA,EAAAA,UAAAA,OAAAA,CAAAA,GAvCzKN,CAuCyKM,SAAAA,IAAAA,GAAAA,IAAAA,GAvCjJL,CAuCiJK;AAApBO;AAAkDP;AAAzBQ;AAAwB;AAAA;AACjO,KAlCpBZ,WAkCoB,CAAA,CAAA,CAAA,GAAA,CAlCFC,WAkCE,CAlCUN,CAkCV,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,MAAA,SAAA,MAlC6DM,WAkC7D,CAlCyEN,CAkCzE,CAAA,GAAA,KAAA,GAlCsFC,OAkCtF,CAlC8FK,WAkC9F,CAlC0GN,CAkC1G,CAAA,CAAA;AAAW1B,KAjC/BiC,WAiC+BjC,CAAAA,CAAAA,CAAAA,GAAAA,CAjCbgC,WAiCahC,CAjCD0B,CAiCC1B,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAjC6ByB,SAiC7BzB,CAjCuCgC,WAiCvChC,CAjCmD0B,CAiCnD1B,CAAAA,CAAAA;AAA0CmC;AAAlBS;AAAdE;AAAO;AAAA;AAChC;AAAW9C;AAAuCmC;AAArBU;AAA0BvB;AAAkB,KAvBzFY,iBAuByF,CAAA,UAvB7DlC,MAuB6D,CAAA,GAAA,CAvBlDgC,WAuBkD,CAvBtCG,CAuBsC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAvBGH,WAuBH,CAvBeG,CAuBf,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA+I,OACzFlI,EAAAA,KAAAA,EAAAA;AAAoB,CAAA,GAtBrBrB,OAsBqB,CAtBbK,WAsBa,CAtBDF,CAsBC,CAAA,CAAA,GAAA,KAAA;AAAW9B,KArB/BoC,UAqB+BpC,CAAAA,UArBVA,MAqBUA,CAAAA,GArBA4B,MAqBA5B,CArBO+B,WAqBP/B,CArBmBmC,CAqBnBnC,CAAAA,SAAAA,CAAAA,CAAAA,EArBkCkC,iBAqBlClC,CArBoDmC,CAqBpDnC,CAAAA,CAAAA;AAA+BmC;AAArBU;AAA0CjC;AAAsCA;AAAnBJ,KAhBtG6B,mBAgBsG7B,CAAAA,UAhBxER,MAgBwEQ,CAAAA,GAAAA,CAhB7DwB,WAgB6DxB,CAhBjD2B,CAgBiD3B,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAhBRwB,WAgBQxB,CAhBI2B,CAgBJ3B,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAkB0I,SAAA,EAAA,KAAA,EAAA;AAAA,CAAA,GAdzHzH,SA8BCwB,CA9BSjB,WA8BF,CA9BcH,CA8Bd,CAAA,CAAA,GAAA,KAAA;AAAA,KA7BPS,WA6BO,CAAA,UA7BetC,MA6Bf,CAAA,GA7ByB4B,MA6BzB,CA7BgCK,WA6BhC,CA7B4CE,CA6B5C,CAAA,WAAA,CAAA,CAAA,EA7B6DE,mBA6B7D,CA7BiFF,CA6BjF,CAAA,CAAA;AAAWnC;AAASA,KA3B3BuC,mBA2B2BvC,CAAAA,UA3BGA,MA2BHA,CAAAA,GAAAA,CA3BcgC,WA2BdhC,CA3B0BmC,CA2B1BnC,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA3BmEgC,WA2BnEhC,CA3B+EmC,CA2B/EnC,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EACpBiB,SAAAA,EAAAA,KAAAA,EAAAA;AAKDD,CAAAA,GA/BPW,OA+BOX,CA/BCgB,WA+BDhB,CA/BawB,CA+BbxB,CAAAA,CAAAA,GAAAA,KAAAA;AACgBmB,KA/BtBM,YA+BsBN,CAAAA,UA/BCnC,MA+BDmC,CAAAA,GA/BWP,MA+BXO,CA/BkBJ,WA+BlBI,CA/B8BA,CA+B9BA,CAAAA,WAAAA,CAAAA,CAAAA,EA/B+CI,mBA+B/CJ,CA/BmEA,CA+BnEA,CAAAA,CAAAA;AAAZH,KA9BVU,mBA8BUV,CAAAA,UA9BoBhC,MA8BpBgC,CAAAA,GAAAA,CA9B+BA,WA8B/BA,CA9B2CG,CA8B3CH,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA9B8ER,MA8B9EQ,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GAAAA,MAAAA,SAAAA,MA9B0HA,WA8B1HA,CA9BsIG,CA8BtIH,CAAAA,WAAAA,CAAAA,CAAAA,GA9BwJR,MA8BxJQ,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GA9B+KA,WA8B/KA,CA9B2LG,CA8B3LH,CAAAA,WAAAA,CAAAA,CAAAA;AAAVP,KA7BAkB,wBA6BAlB,CAAAA,UA7BmCzB,MA6BnCyB,CAAAA,GAAAA,CA7B8CO,WA6B9CP,CA7B0DU,CA6B1DV,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA7B2FD,MA6B3FC,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GA7BkHO,WA6BlHP,CA7B8HU,CA6B9HV,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EACGP,SAAAA,EAAAA,KAAAA,EAAAA;AACJK,CAAAA,GA7BAiB,CA6BAjB,GA7BIC,MA6BJD,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAsCY,KA5BrCS,iBA4BqCT,CAAAA,UA5BTnC,MA4BSmC,CAAAA,GAAAA,CAAAA,MA5BQO,mBA4BRP,CA5B4BA,CA4B5BA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA5BkDQ,wBA4BlDR,CA5B2EA,CA4B3EA,CAAAA,GAAAA,CAAAA,MA5BuFQ,wBA4BvFR,CA5BgHA,CA4BhHA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA5BsIO,mBA4BtIP,CA5B0JA,CA4B1JA,CAAAA,GA5B+JO,mBA4B/JP,CA5BmLA,CA4BnLA,CAAAA,GA5BwLQ,wBA4BxLR,CA5BiNA,CA4BjNA,CAAAA;AAAZH,KA3BzBa,oBA2ByBb,CAAAA,UA3BMhC,MA2BNgC,CAAAA,GA3BgBc,OA2BhBd,CAAAA,MA3B8BY,iBA2B9BZ,CA3BgDG,CA2BhDH,CAAAA,EAAAA,MAAAA,CAAAA;AAAVP,KA1BfsB,gBA0BetB,CAAAA,UA1BYzB,MA0BZyB,CAAAA,GAAAA,QA1B8BoB,oBA0B9BpB,CA1BmDU,CA0BnDV,CAAAA,GA1BwDH,kBA0BxDG,EAAAA;AACTN,KA1BN6B,oBA0BM7B,CAAAA,UA1ByBnB,MA0BzBmB,CAAAA,GA1BmC0B,oBA0BnC1B,CA1BwDgB,CA0BxDhB,CAAAA,SAAAA,KAAAA,EAAAA,GA1B6EP,CA0B7EO,SAAAA,MAAAA,GA1BgGX,kBA0BhGW,CA1BmHP,CA0BnHO,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AACPI;AAA2BY;AAAXC;AACThB;AACPG;AAA4BY;AAAZG;AACPjB;AACTE;AAA6BY;AAAbM;AACUN;AAAjBY;AACTxB;AAAW;AAAA,KAjBV0B,OAyBKC,CAAAA,UAzBalD,MAyBK,GAzBIA,MAyBJ,CAAA,GAAA;EAAAqI,QASlBlF,EAjCElC,eAiCU;EAAA;AACVA;AACFD;AACFE;EACGC,MAAAA,CAAAA,EAhCAH,aAgCAG;AACAC,CAAAA,GAAAA,CAhCNK,SAgCML,CAhCIY,WAgCJZ,CAhCgBe,CAgChBf,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EACEC,IAAAA,EAhCLH,WAgCKG;AAAgB,CAAA,GA/BzBE,WA+ByB,CAAA,GAAA,CA/BTE,SA+BS,CA/BCO,WA+BD,CA/BaG,CA+Bb,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAAwG,OAGnBvF,EAjCCjC,cAiCW;AAAA,CAAA,GAhClBI,WAoDC8B,CAAAA,GAAAA,CApDejB,UAoDC,CApDUD,CAoDV,CAAA,SAAA,IAAA,GAAA;EAAA0G,OAAA,EAnDVzH,cAmDU;AAAWpB,CAAAA,GAlD5BuB,WAkD4BvB,CAAAA,GAAAA,CAlDZsC,WAkDYtC,CAlDAmC,CAkDAnC,CAAAA,SAAAA,IAAAA,GAAAA;EAAUkD,SAAAA,EAjD7B7B,gBAiD6B6B;AAAiCf,CAAAA,GAhDvEZ,WAgDuEY,CAAAA,GAAAA,CAhDvDM,YAgDuDN,CAhD1CA,CAgD0CA,CAAAA,SAAAA,IAAAA,GAAAA;EAARc,SAAAA,EA/CtDF,gBA+CsDE,CA/CrCd,CA+CqCc,CAAAA;AAAmBC,CAAAA,GA9ClF3B,WA8CkF2B,CAAAA;AAA2Cf;AAArBa;AAAoB;AAAA;AAgBvG;AAA6BO;AAAG/C;AAAXsC,UAtDpCI,kBAAAA,CAsDoCJ;EAAOuF,QAAA,EAAA,cAAA,GAAA,uBAAA;EAAAF,MAChD3E,EAAAA,aAAAA;EAAmBgF,IAAA,EAAA,oBAAA,GAAA,oBAAA;EAAqBjF,OAAAA,EAAAA,mBAAAA;EAA0D3C,OAAAA,EAAAA,mBAAAA,GAAAA,uBAAAA,GAAAA,qBAAAA,GAAAA,YAAAA;EAAV6C,SAAAA,EAAAA,uBAAAA,GAAAA,0BAAAA;AAAS;AAAA;AAC7E,UA/CfN,YAAAA,CA+Ce;EAA2CI,QAAAA,EA9CxDtC,eA8CwDsC;EAArBD,MAAAA,EA7CrCtC,aA6CqCsC;EACLC,IAAAA,EA7ClCrC,WA6CkCqC;EAArBD,OAAAA,EA5CVnC,cA4CUmC;EAA+CK,OAAAA,EA3CzDvC,cA2CyDuC;EAApBH,SAAAA,EA1CnCnC,gBA0CmCmC;AAAyBlC;AAAkB;AAAA,UAvCjF8B,YAAAA,CAyCLQ;EAA4ByI,YAAA,EAAA,aAAA;EAA2C9I,qBAAAA,EAAAA,qBAAAA;EAArBD,WAAAA,EAAAA,MAAAA;EACZC,kBAAAA,EAAAA,SAAAA;EAArBD,kBAAAA,EAAAA,SAAAA;EAA+CK,iBAAAA,EAAAA,KAAAA;EAApBH,iBAAAA,EAAAA,aAAAA;EAA0BlC,qBAAAA,EAAAA,iBAAAA;EAAkBuL,mBAAA,EAAA,UAAA;EAAAC,UAExFjJ,EAAAA,QAAe;EAAAkJ,qBAAA,EAAA,QAAA;EAAmC7J,wBAAAA,EAAAA,SAAAA;AAA+BK;AAAGL;AAAmBY;AAA9BhB;AAA6DgB;AAAoBP;AAAGL;AAAmBY,KAxBhLT,gBAwBgLS,CAAAA,UAxBrJ9D,MAwBqJ8D,CAAAA,GAxB3IZ,kBAwB2IY,CAAAA,MAxBlHb,OAwBkHa,CAxB1G3B,CAwB0G2B,CAAAA,GAAAA,MAxB/FZ,kBAwB+FY,CAAAA,GAxBzEd,oBAwByEc,CAxBpD3B,CAwBoD2B,CAAAA;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAgBD;AAAaW;AAAGV;AAAaO;AAAUP;AAAsBD;AAAaW;AAA+BP;AAArBG;AAAoB;AAAA;AAM/S,KAdvBJ,oBAcuB,CAAA,UAAA,MAAA,CAAA,GAdkBR,OAclB,CAd0BS,CAc1B,EAd6B/C,kBAc7B,CAAA;AAAmC0C,KAb1DM,mBAa0DN,CAAAA,UAAAA,MAAAA,CAAAA,GAblBK,CAakBL,SAAAA,iBAAAA,KAAAA,EAAAA,WAAAA,GAb8BO,SAa9BP,CAbwCtC,CAaxCsC,CAAAA,GAAAA,KAAAA;AAA+BK,KAZzFG,oBAYyFH,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAZ/CD,oBAY+CC,CAZ1BA,CAY0BA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAAGL,SAAAA,EAAAA,QAX5EI,oBAW4EJ,CAXvDK,CAWuDL,CAAAA,IAXjDM,mBAWiDN,CAX7BS,CAW6BT,CAAAA,GAXxB5B,kBAWwB4B,EAAAA;AAAmBY,CAAAA;AAA9BhB,KATjFc,4BASiFd,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAT/BQ,oBAS+BR,CATVS,CASUT,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAA6DgB,SAAAA,CAAAA,EAAAA,QAR7HR,oBAQ6HQ,CARxGP,CAQwGO,CAAAA,IARlGN,mBAQkGM,CAR9EH,CAQ8EG,CAAAA,IARxExC,kBAQwEwC,EAAAA;AAAqBP,CAAAA;AAAGL,KANtKW,eAMsKX,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MANpHA,kBAMoHA,IAAAA,CAN7FJ,OAM6FI,CANrFK,CAMqFL,EANlFA,kBAMkFA,CAN/DY,CAM+DZ,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GANhCY,CAMgCZ,GAAAA,QANpBJ,OAMoBI,CANZK,CAMYL,EANTA,kBAMSA,CANUY,CAMVZ,CAAAA,CAAAA,IANiBE,YAMjBF,CAN8BS,CAM9BT,GAAAA,MANwCE,YAMxCF,CAAAA,GANwDC,YAMxDD,CANqEY,CAMrEZ,CAAAA,CANwEE,YAMxEF,CANqFS,CAMrFT,GAAAA,MAN+FE,YAM/FF,CAAAA,GAAAA,MANqHC,YAMrHD,CANkIY,CAMlIZ,CAAAA,CAAAA,EAAAA,EAAAA,GAN4IQ,oBAM5IR,CANiKK,CAMjKL,CAAAA;AAAmBY;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAiBD,KAAxOY,uBAAwOZ,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MAA9KD,kBAA8KC,IAAAA,CAAvJL,OAAuJK,CAA/II,CAA+IJ,EAA5ID,kBAA4IC,CAAzHW,CAAyHX,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAA1FW,CAA0FX,IAAAA,QAA7EL,OAA6EK,CAArEI,CAAqEJ,EAAlED,kBAAkEC,CAA/CW,CAA+CX,CAAAA,CAAAA,IAAxCC,YAAwCD,CAA3BQ,CAA2BR,GAAAA,MAAjBC,YAAiBD,CAAAA,IAAAA,YAAAA,CAAaW,CAAbX,CAAAA,CAAgBC,YAAhBD,CAA6BQ,CAA7BR,GAAAA,MAAuCC,YAAvCD,CAAAA,GAAAA,MAA6DA,YAA7DA,CAA0EW,CAA1EX,CAAAA,CAAAA,EAAAA,EAAAA,GAAoFS,4BAApFT,CAAiHI,CAAjHJ,CAAAA;AAAaW;AAAGV,KAExPY,OAFwPZ,CAAAA,CAAAA,EAAAA,QAErO1B,CAFqO0B,CAAAA,GAEhO1B,CAFgO0B,SAEtNa,KAFsNb,GAAAA,CAE7Ma,KAF6Mb,CAAAA,SAAAA,CAE7L1B,CAF6L0B,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAaO;AAAUP,KAI/Qc,aAJ+Qd,CAAAA,UAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAIjO1B,CAJiO0B,SAAAA,SAAAA,EAAAA,GAAAA,KAAAA,GAIjM1B,CAJiM0B,SAAAA,SAAAA,CAAAA,KAAAA,KAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,SAIxGY,OAJwGZ,CAIhGe,IAJgGf,CAAAA,GAAAA,IAAAA,GAIjFc,aAJiFd,CAInEgB,IAJmEhB,CAAAA,GAAAA,IAAAA;AAAsBD;AAAaW;AAAuCP;AAA7BK;AAA4B;AAAA;AAEjV;AAAYlC;AAAKA,KAWxB2C,eAXwB3C,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAW0B4C,IAX1B5C,SAAAA,SAAAA,MAAAA,EAAAA,GAAAA,MAAAA,SAW0E4C,IAX1E5C,CAAAA,QAAAA,CAAAA,GAW2FqC,uBAX3FrC,CAWmH4C,IAXnH5C,CAAAA,MAAAA,CAAAA,CAAAA,GAWmIwC,aAXnIxC,CAWiJ4C,IAXjJ5C,CAAAA,SAAAA,IAAAA,GAWsKqC,uBAXtKrC,CAW8L4C,IAX9L5C,CAAAA,MAAAA,CAAAA,CAAAA,GAW8MmC,eAX9MnC,CAW8N4C,IAX9N5C,CAAAA,MAAAA,CAAAA,CAAAA,GAAAA,KAAAA;AAAUuC,KAYlCM,uBAAAA,GAZkCN,mBAAAA,GAAAA,uBAAAA;AAASA,KAa3CO,mBAAAA,GAb2CP;EAAgBvC,SAAAA,iFAAAA,EAAAA,KAAAA;AAAC,CAAA;AAAA,KAgB5D+C,uBAda,CAAA,aAAA,SAAA,MAAA,EAAA,EAAA,YAAA,MAAA,CAAA,GAciEH,IAdjE,SAAA,SAAA,CAAA,KAAA,cAAA,MAAA,EAAA,GAAA,KAAA,cAAA,SAAA,MAAA,EAAA,CAAA,GAAA,CAc+JH,IAd/J,CAAA,SAAA,CAc8KO,GAd9K,CAAA,GAAA,IAAA,GAc4LD,uBAd5L,CAcoNL,IAdpN,EAc0NM,GAd1N,CAAA,GAAA,KAAA;AAAA,KAebC,kCAfa,CAAA,aAAA,SAAA,MAAA,EAAA,CAAA,GAewDF,uBAfxD,CAegFH,IAfhF,EAAA,mBAAA,CAAA,SAAA,IAAA,GAe0HG,uBAf1H,CAekJH,IAflJ,EAAA,uBAAA,CAAA,SAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,KAAA;AAAiC5C;AAAgCA;AAAiGyC;AAARH;AAAqCI,KAoB5MQ,sBApB4MR,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAoBnJE,IApBmJF,SAAAA,OAAAA,GAAAA,MAAAA,SAoB7GE,IApB6GF,CAAAA,QAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAoBnFtB,OApBmFsB,CAoB3EE,IApB2EF,CAAAA,MAAAA,CAAAA,EAoB7DG,uBApB6DH,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAoBTO,kCApBSP,CAoB0BE,IApB1BF,CAAAA,SAAAA,IAAAA,GAAAA,KAAAA,GAoBuDE,IApBvDF,GAAAA,KAAAA;AAAdF,KAqB9LW,wBArB8LX,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAqBlIU,sBArBkIV,CAqB3GI,IArB2GJ,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAqBxEM,mBArBwEN;AAAa,KAsB3MY,oBAtB2M,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GAsBnJC,IAtBmJ,CAAA,CAAA,CAAA,SAAA;EAAA6J,IAS3MvK,EAAAA,KAAAA,cAAe,SAAA,MAAA,EAAA;AAAA,CAAA,GAehBC,IAfgB,GAAA,KAAA;AAAmCA,KAgBlDU,4BAhBkDV,CAAAA,aAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAgBcO,wBAhBdP,CAgBuCQ,oBAhBvCR,CAgB4DS,IAhB5DT,CAAAA,CAAAA;AAAgDA;AAAyCA,KAkB3IW,yBAlB2IX,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAkB5FxB,OAlB4FwB,CAkBpFf,CAlBoFe,EAkBjFC,uBAlBiFD,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAkB3BC,uBAlB2BD,SAkBKf,CAlBLe,GAAAA,OAAAA,GAkBmBE,mBAlBnBF;AAAxBP,UAmB9GmB,eAAAA,CAnB8GnB;EAAsDO;AAAdJ;AAA2DI;AAAxBP;EAAwDO,SAAAA,EAAAA,MAAAA;EAAhBT;AAAe;AAAA;AAC9N;AACJ;EAGIsE,MAAA,CAAA,EAAA,MAAA;EAAuD7D;AAA8FH;AAAeO;AAAsCN;AAAMM;EAA9BD,QAAAA,CAAAA,EAAAA,MAAAA;EAAuB;AAAA;AAC9L;AAA2DH;AAAxBG;EAA0FH,MAAAA,CAAAA,EAAAA,MAAAA;EAAxBG;AAAuB;AAAA;AAKxI;EAAmCH,OAAAA,CAAAA,EAAAA,MAAAA;EAAsCA;AAAkCA;AAAcC;AAAtBzB;EAA6GwB,GAAAA,CAAAA,EAyCnOpE,OAzCmOoE;EAAnCK;AAAgEL;AAAI;AAAA;AAC/O;AAA2DA;AAAvBM;EAA0DJ,QAAAA,CAAAA,EAAAA,MAAAA;EAAmB;AAAA;AACrH;AAAoCO;AAEzDT;AAAI;AAAA;EACyB+K,YAAA,CAAA,EAAA,MAAA;AAAkFtK;AAArBD;AAAzBD;AAAwB;AAAA;AAE/D;AAA8BtB;AAAGgB;AAAXzB;AAAiEyB;AAAgChB;AAAciB;AAAmB;AAAA;AAkCvK;AA+CU;AAAiBxE;AAA8CkF;AAkBtD/C;AAAjBkB;AACLlB;AAAY4C;AAA4CA;AAARK;AAA7BJ;AAAmGD;AAARK;AAArBN;AAAhBT;AAARgB;AAAO,iBAnBnEF,QAmBmE,CAAA,gBAnB1CnF,MAmB0C,EAAA,mBAAA,SAAA,CAAAuP,OAAA,EAnBIrK,eAmBJ,GAAA;EAAA;AAC3D;AAAiBlF;AAAyCmC;AAAjBkB;AAAqClB;AAAqBoB;AAAR6B;AAAsCF;AACjI3B;AAAR6B;AACqB7B;AAAR6B;AAA1BH;AAAwE1B;AAAR6B;AAAhBvB;EAARwB,IAAAA,EAAAA,SAJ3BhC,gBAI2BgC,CAJVlD,CAIUkD,CAAAA,EAAAA;AAAO,CAAA,CAAA,CAAAiK,CAAAE,MAAA,EAHvCrN,CAGuC,EAAA,GAAAsN,IAAA,EAH3B1K,IAG2B,GAHpBC,4BAGoB,CAHSI,OAGT,CAHiBL,IAGjB,CAAA,CAAA,CAAA,EAH0BM,OAG1B,CAHkChB,eAGlC,CAHkDS,oBAGlD,CAHuEM,OAGvE,CAH+EL,IAG/E,CAAA,CAAA,CAAA,CAAA;AAAA,iBAFlCI,QAGQ,CAAA,gBAHiBnF,MAGjB,EAAA,gBAHyCqD,gBAGzC,CAH0DlB,CAG1D,CAAA,GAAA,KAAA,CAAAmN,CAAAE,MAAA,EAH8ErN,CAG9E,EAAAoN,OAAA,EAAA,CAH2FnK,OAG3F,CAHmG7B,CAGnG,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAHiI2B,eAGjI,GAAA;EAAA0J,IAAA,EAAA,SAFRxJ,OAEQ,CAFA7B,CAEA,CAAA,EAAA;AAAiBvD,CAAAA,GADtCiF,yBACsCjF,CADZoF,OACYpF,CADJuD,CACIvD,CAAAA,CAAAA,CAAAA,EADEqF,OACFrF,CADU6D,eACV7D,CAD0BoF,OAC1BpF,CADkCuD,CAClCvD,CAAAA,CAAAA,CAAAA;AAAgBmC,iBAAzCgD,QAAyChD,CAAAA,gBAAhBnC,MAAgBmC,CAAAA,CAAAA,MAAAA,EAAAA,CAAAA,EAAAA,OAAAA,EAAY+C,eAAZ/C,GAAAA;EAAY+C,IAAAA,CAAAA,EAAAA,KAAAA;AAElD/C,CAAAA,CAAAA,EAAhBkD,OAAgBlD,CAARc,OAAQd,CAAAA,CAAAA,CAAAA,CAAAA;AAARc;AAARoC,iBAEaF,QAFbE,CAAAA,gBAEsCrF,MAFtCqF,EAAAA,mBAAAA,SAE0EhC,gBAF1EgC,CAE2FlD,CAF3FkD,CAAAA,EAAAA,CAAAA,CAAAA,MAAAA,EAEyGlD,CAFzGkD,EAAAA,OAAAA,EAEqHH,eAFrHG,GAAAA;EAAOuJ,IAAA,EAGHtK,IAHG;AAAA,CAAA,GAIPE,mBAFqB,CAAA,EAECa,OAFD,CAAA,KAAA,CAAA;AAAA;AAAiBrF;AAAqDmC;AAAjBkB;AAA+BlB;AAAY+C;AACjHZ;AACJE;AAAsBa;;ACnWV0B;AAAfM;AAEEE;AACAE;AAAC;AAAA;AAGkB;AACXf;AAEPe;AAAmCV;AAAnBK;AACcL,iBDkbjBP,SAAAA,CClbiBO,GAAAA,EDkbFvB,eClbEuB,CAAAA,EDkbgBvF,MClbhBuF,CAAAA,MAAAA,EAAAA,MAAAA,CAAAA;AAAnBK;AAAsBK;AAAlCT;AACeW;AAAdL;AAAO;AAQX,KDgbK9B,eAAAA,GChbsB,QAAA,MDgbUrC,YChbV,IDgb0BsD,OChb1B,CDgbkCtD,YChblC,CDgb+CW,CChb/C,CAAA,CAAA,EAAA,GAAA;EAAAyH,SAAA,CAAA,EDibb/J,MCjba,CAAA,MAAA,EDibEF,kBCjbF,CAAA;AAAWoF,CAAAA;AACFK;;;AD7DwBnG;AAAuBA,KCV9EkG,aDU8ElG,CAAAA,UCVtD8F,MDUsD9F,CAAAA,GAAAA,CCV3CoG,WDU2CpG,CCV/BmG,CDU+BnG,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAnBJ,KAAAA,CAAkB,GCP/EyG,MDO+E,CAAA,KAAA,EAAA,KAAA,CAAA,GAAA,MAAA,SAAA,MCN1DD,WDM0D,CCN9CD,CDM8C,CAAA,WAAA,CAAA,CAAA,GCL9EE,MDK8E,CAAA,KAAA,EAAA,KAAA,CAAA,GCJ9ED,WDI8E,CCJlED,CDIkE,CAAA,WAAA,CAAA,CAAA;AAAA,KCF7EG,oBDGYrG,CAAAA,UCHmB6F,MDGI,CAAA,GAAA,CCFvCM,WDGgBlG,CCHJiG,CDGIjG,CAAAA,SAAoB,CAAA,CAAA,CAEjB,SAOVE,CAAAA,KAAAA,CAAAA,GCVPiG,MDUoB,CAAA,KAAA,EAAA,KAAA,CAAA,GCTpBD,WDSoB,CCTRD,CDSQ,CAAA,SAAA,CAAA,CAAA,SAAA;EAIb9F,SAAAA,EAAAA,KAAAA,EAAe;AAAA,CAAA,GCZrBkG,CDkCMjG,GCjCN+F,MDiCM/F,CAAAA,KAAW,EAAA,KAAA,CAAA;AAAA,KC/BhBkG,kBDqCmB,CAAA,UCrCUV,MDqCV,CAAA,GAAA,CAAA,MCrC2BI,aDqC3B,CCrCyCC,CDqCzC,CAAA,CAAA,SAAA,CAcd3F,KAAAA,CAAc,GChDrB8F,oBDgEuB,CChEFH,CDgEE,CAAA,GAAA,CAAA,MC/DhBG,oBD+DgB,CC/DKH,CD+DL,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GC9DtBD,aD8DsB,CC9DRC,CD8DQ,CAAA,GC7DtBD,aD6DsB,CC7DRC,CD6DQ,CAAA,GC7DHG,oBD6DG,CC7DkBH,CD6DlB,CAAA;AAAA;AAYrBxF,KCtEO8F,cDsEI,CAAA,UCtEqBX,MDsEZ,CAAA,GCtEsBY,ODsEtB,CAAA,MCrElBF,kBDqEkB,CCrECL,CDqED,CAAA,EAAA,MAAA,CAAA;AAAA;AAYX;AAAOrF;AAA8BA;AAErCA;AAAkCA;AAA4BA;AAE/DA;AAAC,KCvEF6F,mBAAAA,GDuEE,+JAAA;AAAA;AAEY;AACf;AAAyC1F;AAAwBC;AAAC;AAAA;AAM7D,KCtEX0F,kBDsEW,CAAA,UCtEkBd,MDsElB,EAAA,UAAA,MAAA,CAAA,GAAA,CCrEfW,cDqEkC3F,CCrEnBqF,CDqEmBrF,CAAAA,CAAZM,SAAAA,CAAAA,KAAAA,CAAAA,GCnEpBuF,mBDmEoBvF,GClEpByF,CDkEoBzF;AAA2EN;AAAZM,KC/DjF0F,iBD+DiF1F,CAAAA,UC9D3E0E,MD8D2E1E,EAAAA,UAAAA,MAAAA,CAAAA,GC5DlFyF,CD4DkFzF,SAAAA,MC5DlEoF,kBD4DkEpF,CC5D/C+E,CD4D+C/E,CAAAA,GC3DnFgF,WD2DmFhF,CC3DvEoF,kBD2DuEpF,CC3DpD+E,CD2DoD/E,CAAAA,CC3DjDyF,CD2DiDzF,CAAAA,CAAAA,SAAAA;EAA6CN,GAAAA,EAAAA,KAAAA,EAAAA;AAAZM,CAAAA,GC1DnHsF,OD0DmHtF,CAAAA,MC1DrG2F,CD0DqG3F,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAARL;AAAO;AAAA;AACtG;AAAmBD,KCnDvBkG,eDmDuBlG,CAAAA,UCnDGgF,MDmDHhF,EAAAA,UAAAA,MAAAA,CAAAA,GAAAA;EAAZM,QAAAA,EClDZiF,MDkDYjF,CClDL0F,iBDkDK1F,CClDa+E,CDkDb/E,EClDgByF,CDkDhBzF,CAAAA,EAAAA,MAAAA,CAAAA;AAAgEN,CAAAA;AAAZM;AAAVP;AAAS;AAAA;AAWpD;AAAWzB;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEF;AAAZE;AAARL;AAAO;AAAA;AACI;AAAW3B;AAA6BmC;AAAZJ;AAA6CI;AAAlBD;AAAlCN;AAAM;AAAA;AAKlB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH;AAEzEH;AAAZG;AAAVP;AAAS;AAAA;AACG;AAAWzB;AAA6BmC;AAAZF;AAAiDE;AAApBE;AAApCT;AAAM;AAAA;AAEnB;AAAW5B;AAAuBmC;AAAZH;AAAiEG;AAAZH,iBCuDnF6F,QDvDmF7F,CAAAA,gBCuD1D0E,MDvD0D1E,CAAAA,CAAAA,MAAAA,ECuD1C+E,CDvD0C/E,CAAAA,ECuDtC4E,ODvDsC5E,CCuD9B+E,CDvD8B/E,CAAAA;AAE3EQ,iBC8DRqF,QD9DQrF,CAAAA,gBC+DPkE,MD/DOlE,EAAAA,gBCgEP6E,cDhEO7E,CCgEQuE,CDhERvE,CAAAA,CAAAA,CAAAA,MAAAA,ECkEfuE,CDlEevE,EAAAA,KAAAA,ECmEhBgF,kBDnEgBhF,CCmEGuE,CDnEHvE,ECmEMiF,CDnENjF,CAAAA,CAAAA,ECoErBoE,ODpEqBpE,CCoEbuE,CDpEavE,CAAAA,GCoERoF,eDpEQpF,CCoEQuE,CDpERvE,ECoEWiF,CDpEXjF,CAAAA;AAAZR,iBCqEI6F,QDrEJ7F,CAAAA,gBCsEK0E,MDtEL1E,EAAAA,gBCuEK6E,gBDvEL7E,CCuEsB+E,CDvEtB/E,CAAAA,CAAAA,CAAAA,MAAAA,ECwEF+E,CDxEE/E,EAAAA,IAAAA,EAAAA,SCwEgB8F,CDxEhB9F,EAAAA,CAAAA,ECwEsB2E,eDxEtB3E,CCwEsC8F,CDxEtC9F,CAAAA"}
+{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","NeonCredentialMeta","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","FunctionBaseUrlKey","Slug","Uppercase","functionBaseUrlKey","S","parseFunctionBaseUrlKey","isFunctionBaseUrlKey","FunctionUrlMode","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonRealtimeEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","HasKeys","OrBool","A","B","HasGaRecord","NonNullable","HasGaToggle","HasPreviewBuckets","C","HasBuckets","HasPreviewAiGateway","RealtimeOn","R","AiGatewayOn","HasPreviewFunctions","F","HasFunctions","GaFunctionsOfConfig","PreviewFunctionsOfConfig","FunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","FetchEnvKeysOptions","ResolvedNeonEnv","FetchEnvKeysState","ReadonlyArray","fetchEnvKeysState","BranchPolicy","ReturnType","resolveBranchPolicy","Pick","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","isLiveCredential","defaultStorageCredential","defaultAiGatewayCredential","createApiFromOptions","toEntries","Partial","Config","FilteredNeonEnv","NeonEnv","SelectableEnvKey","GaFunctionsOf","C","NonNullable","Record","PreviewFunctionsHome","F","PreviewFunctionsOf","FunctionSlugOf","Extract","NoFunctionScopeHint","FunctionScopeField","S","FunctionEnvKeysOf","E","NeonFunctionEnv","parseEnv","K","Config","NeonApi","resolveConfig","NEON_ENV_VAR_KEYS","branch","name","postgres","databaseUrl","databaseUrlUnpooled","auth","baseUrl","jwksUrl","dataApi","url","realtime","secret","storage","accessKeyId","secretAccessKey","endpoint","region","aiGateway","apiKey","FunctionBaseUrlKey","Uppercase","Slug","functionBaseUrlKey","slug","S","parseFunctionBaseUrlKey","key","isFunctionBaseUrlKey","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonRealtimeEnv","NeonStorageEnv","NeonAiGatewayEnv","NeonFunctionUrlEnv","NoNamespace","Record","ServiceOn","T","enabled","HasKeys","OrBool","A","B","HasGaRecord","NonNullable","HasGaToggle","HasPreviewBuckets","C","buckets","HasBuckets","HasPreviewAiGateway","RealtimeOn","R","AiGatewayOn","HasPreviewFunctions","functions","F","HasFunctions","GaFunctionsOfConfig","PreviewFunctionsOfConfig","FunctionsOfConfig","FunctionSlugOfConfig","Extract","NeonFunctionsEnv","FunctionBaseUrlKeyOf","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","DATABASE_URL","DATABASE_URL_UNPOOLED","NEON_BRANCH","NEON_AUTH_BASE_URL","NEON_AUTH_JWKS_URL","NEON_DATA_API_URL","NEON_REALTIME_URL","NEON_REALTIME_SECRET","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_ENDPOINT_URL_S3","AWS_REGION","NEON_AI_GATEWAY_TOKEN","NEON_AI_GATEWAY_BASE_URL","SelectableEnvKey","SelectedFunctionKeys","K","FunctionSlugFromKey","Lowercase","FunctionsFilteredEnv","P","OptionalFunctionsFilteredEnv","FilteredNeonEnv","N","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","keys","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","projectId","branchId","apiHost","api","roleName","databaseName","fetchEnv","options","config","args","NoInfer","Promise","toEntries","env","ResolvedNeonEnv","Partial","GaFunctionsOf","PreviewFunctionsHome","PreviewFunctionsOf","FunctionSlugOf","NoFunctionScopeHint","FunctionScopeField","FunctionEnvKeysOf","E","NeonFunctionEnv","function","parseEnv","scope"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, NeonCredentialMeta, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  readonly realtime: {\n    readonly url: \"NEON_REALTIME_URL\";\n    readonly secret: \"NEON_REALTIME_SECRET\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\ntype FunctionBaseUrlKey<Slug extends string = string> = `NEON_FUNCTION_${Uppercase<Slug>}_BASE_URL`;\ndeclare function functionBaseUrlKey<S extends string>(slug: S): FunctionBaseUrlKey<S>;\ndeclare function parseFunctionBaseUrlKey(key: string): string | null;\ndeclare function isFunctionBaseUrlKey(key: string): key is FunctionBaseUrlKey;\n/** `all-live` lists deployed functions. Policy mode derives declared slugs from the connection host. */\ntype FunctionUrlMode = \"policy\" | \"all-live\";\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/** Connection values for a branch with Realtime enabled. */\ninterface NeonRealtimeEnv {\n  /** WebSocket endpoint passed to `createRealtimeClient`. */\n  url: string;\n  /** Server-only key passed to `createRealtime`. Never expose it to browser code. */\n  secret: string;\n}\n/**\n * S3-compatible object-storage access for the branch. Present on `NeonEnv` only\n * when the policy declares `buckets` (or deprecated `preview.buckets`). Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch. Present on `NeonEnv` only when the policy\n * enables `aiGateway` (or deprecated `preview.aiGateway`). `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\ninterface NeonFunctionUrlEnv {\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\ntype OrBool<A extends boolean, B extends boolean> = A extends true ? true : B;\n/**\n * Whether a top-level optional record (GA `functions` / `buckets`) has known keys.\n * A string index signature (`Record<string, …>`, the default `Config` param) is treated\n * as empty so an untyped policy yields just `{ postgres }`, matching {@link HasPreviewBuckets}.\n */\ntype HasGaRecord<T> = [NonNullable<T>] extends [never] ? false : string extends keyof NonNullable<T> ? false : HasKeys<NonNullable<T>>;\ntype HasGaToggle<T> = [NonNullable<T>] extends [never] ? false : ServiceOn<NonNullable<T>>;\n/**\n * Whether the policy declares at least one object-storage bucket (`buckets` or\n * deprecated `preview.buckets`). Drives whether {@link NeonEnv} carries the `storage`\n * namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasPreviewBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\ntype HasBuckets<C extends Config> = OrBool<HasGaRecord<C[\"buckets\"]>, HasPreviewBuckets<C>>;\n/**\n * Whether the policy enables the AI Gateway (`aiGateway` or deprecated `preview.aiGateway`).\n * Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n */\ntype HasPreviewAiGateway<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\n/** Whether the policy statically enables Realtime under `preview.realtime`. */\ntype RealtimeOn<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  realtime: infer R;\n} ? ServiceOn<NonNullable<R>> : false;\ntype AiGatewayOn<C extends Config> = OrBool<HasGaToggle<C[\"aiGateway\"]>, HasPreviewAiGateway<C>>;\n/** The tuple guard prevents a missing preview block from enabling functions. */\ntype HasPreviewFunctions<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? HasKeys<NonNullable<F>> : false;\ntype HasFunctions<C extends Config> = OrBool<HasGaRecord<C[\"functions\"]>, HasPreviewFunctions<C>>;\ntype GaFunctionsOfConfig<C extends Config> = [NonNullable<C[\"functions\"]>] extends [never] ? Record<never, never> : string extends keyof NonNullable<C[\"functions\"]> ? Record<never, never> : NonNullable<C[\"functions\"]>;\ntype PreviewFunctionsOfConfig<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? Record<never, never> : NonNullable<C[\"preview\"]> extends {\n  functions: infer F;\n} ? F : Record<never, never>;\ntype FunctionsOfConfig<C extends Config> = [keyof GaFunctionsOfConfig<C>] extends [never] ? PreviewFunctionsOfConfig<C> : [keyof PreviewFunctionsOfConfig<C>] extends [never] ? GaFunctionsOfConfig<C> : GaFunctionsOfConfig<C> & PreviewFunctionsOfConfig<C>;\ntype FunctionSlugOfConfig<C extends Config> = Extract<keyof FunctionsOfConfig<C>, string>;\ntype NeonFunctionsEnv<C extends Config> = { [S in FunctionSlugOfConfig<C>]: NeonFunctionUrlEnv };\ntype FunctionBaseUrlKeyOf<C extends Config> = FunctionSlugOfConfig<C> extends infer S ? S extends string ? FunctionBaseUrlKey<S> : never : never;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles live in the **static** config (not inside a per-branch\n * closure), namespace presence is a direct read of those fields — no union-across-branches,\n * no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `realtime` is added iff `config.preview.realtime` is statically enabled.\n * - `storage` is added iff `config.buckets` (or deprecated `preview.buckets`) declares at least one bucket.\n * - `aiGateway` is added iff `config.aiGateway` (or deprecated `preview.aiGateway`) is statically enabled.\n * - `functions` is added iff `config.functions` (or deprecated `preview.functions`) declares at least one slug.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (RealtimeOn<C> extends true ? {\n  realtime: NeonRealtimeEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace) & (HasFunctions<C> extends true ? {\n  functions: NeonFunctionsEnv<C>;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  realtime: \"NEON_REALTIME_URL\" | \"NEON_REALTIME_SECRET\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  realtime: NeonRealtimeEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  NEON_REALTIME_URL: \"url\";\n  NEON_REALTIME_SECRET: \"secret\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace] | FunctionBaseUrlKeyOf<C>;\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype SelectedFunctionKeys<K extends string> = Extract<K, FunctionBaseUrlKey>;\ntype FunctionSlugFromKey<K extends string> = K extends `NEON_FUNCTION_${infer S}_BASE_URL` ? Lowercase<S> : never;\ntype FunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]: NeonFunctionUrlEnv };\n};\ntype OptionalFunctionsFilteredEnv<K extends string> = [SelectedFunctionKeys<K>] extends [never] ? unknown : {\n  functions?: { [P in SelectedFunctionKeys<K> as FunctionSlugFromKey<P>]?: NeonFunctionUrlEnv };\n};\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & FunctionsFilteredEnv<K>;\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } } & OptionalFunctionsFilteredEnv<K>;\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\ntype FetchEnvKeysState = {\n  env: ResolvedNeonEnv;\n  /** Prevents endpoint failure from being mistaken for a confirmed empty function list. */\n  functionUrlsUnavailable: boolean;\n};\ntype FetchEnvKeysOptions = FetchEnvOptions & {\n  functionUrls?: FunctionUrlMode;\n  /**\n   * Keys to skip even when {@link fetchEnvKeys} is unscoped (`keys === null`).\n   * {@link fetchEnvReusingSecrets} uses this to keep already-verified secrets\n   * without converting an unscoped fetch into a static policy-key list — that\n   * list cannot name `NEON_FUNCTION_*_BASE_URL`, so it would drop function URLs.\n   */\n  omitKeys?: readonly string[];\n  /**\n   * Skip a second `listBranchFunctions` when the caller already listed.\n   * `--service functions` uses this so a later `FeatureUnavailable` cannot be\n   * swallowed as `skipped`.\n   */\n  listedFunctions?: ReadonlyArray<{\n    slug: string;\n    invocationUrl: string;\n  }>;\n};\n/**\n * `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n * the caller already has it.\n */\ndeclare function fetchEnvKeysState(config: Config, options: FetchEnvKeysOptions, keys: readonly string[] | null, policy?: BranchPolicy): Promise<FetchEnvKeysState>;\ntype BranchPolicy = {\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n};\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi, /** The target branch, when the caller listed it already. */\nresolved?: NeonBranchSnapshot): Promise<BranchPolicy>;\n/**\n * Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n * *require* secrets; functions never force a credential. `functions:invoke` rides along only\n * when this path still has to mint (defaults already cover storage and the gateway).\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\ndeclare function isLiveCredential(meta: NeonCredentialMeta, now: number): boolean;\ndeclare function defaultStorageCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function defaultAiGatewayCredential(live: readonly NeonCredentialMeta[], now: number): NeonCredentialMeta | null;\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> } & {\n  functions?: Record<string, NeonFunctionUrlEnv>;\n};\n//#endregion\nexport { BranchPolicy, FetchEnvKeysOptions, FetchEnvKeysState, FetchEnvOptions, FilteredNeonEnv, FunctionBaseUrlKey, FunctionUrlMode, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionUrlEnv, NeonFunctionsEnv, NeonPostgresEnv, NeonRealtimeEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AAkDC,cA9CaO,iBA+CS,EAAA;EAAA;AAA4DE;AAAVC;AAAS;AAAA;EAC/C,SAAA4H,MAAA,EAAA;IAAyB1H,SAAAA,IAAAA,EAAAA,aAAAA;EAAuBA,CAAAA;EAAnBJ,SAAAA,QAAAA,EAAAA;IAAkB,SAAAiI,WAAA,EAAA,cAAA;IACjE5H,SAAAA,mBAAuB,EAAA,uBAAA;EAAA,CAAA;EAGpB,SAOVG,IAAAA,EAAAA;IAIAC,SAAAA,OAAAA,EAAe,oBAAA;IAsBfC,SAAAA,OAAW,EAAA,oBAAA;EAAA,CAAA;EAMG,SAIdE,OAAAA,EAAAA;IAiBAC,SAAAA,GAAAA,EAAAA,mBAAc;EAAA,CAAA;EAgBE,SAIhBE,QAAAA,EAAAA;IAQLC,SAAAA,GAAAA,EAAW,mBAAS;IAYpBE,SAAAA,MAAS,EAAA,sBAAA;EAAA,CAAA;EAAOC;AAA8BA;AAErCA;AAAkCA;AAA4BA;EAE/DA,SAAAA,OAAAA,EAAAA;IAAC,SAAAwH,WAAA,EAAA,mBAAA;IAETvH,SAAAA,eAAqB,EAAA,uBAAA;IACrBC,SAAMwH,QAAA,EAAA,qBAAA;IAAA,SAAAC,MAAA,EAAA,YAAA;EAAyCxH,CAAAA;EAAwBC;AAAC;AAAA;AAM7D;AAAmBJ;AAAZM;AAA2EN;EAAZM,SAAAA,SAAAA,EAAAA;IAA6CN,SAAAA,MAAAA,EAAAA,uBAAAA;IAAZM,SAAAA,OAAAA,EAAAA,0BAAAA;EAARL,CAAAA;AAAO,CAAA;AAAA,KAtHjHpB,kBAuHW,CAAA,aAAA,MAAA,GAAA,MAAA,CAAA,GAAA,iBAvHyDE,SAuHzD,CAvHmED,IAuHnE,CAAA,WAAA;AAAA,iBAtHCE,kBAsHD,CAAA,UAAA,MAAA,CAAAiJ,CAAAC,IAAA,EAtH4CjJ,CAsH5C,CAAA,EAtHgDJ,kBAsHhD,CAtHmEI,CAsHnE,CAAA;AAAmBe,iBArHlBd,uBAAAA,CAqHkBc,GAAAA,EAAAA,MAAAA,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;AAAZM,iBApHNnB,oBAAAA,CAoHMmB,GAAAA,EAAAA,MAAAA,CAAAA,EAAAA,GAAAA,IApHoCzB,kBAoHpCyB;AAAgEN;;AAAtBD;AAAS;AAAA;AAWpD;AAAW1B;AAAuBoC;AAAZH,UAtHlCjB,aAAAA,CAsHkCiB;EAAiEG,IAAAA,EAAAA,MAAAA;AAAZH;AAEzEF;AAAZE,UApHFhB,eAAAA,CAoHEgB;EAARL;AAAO;AAAA;AACI;EAAW5B,WAAAA,EAAAA,MAAAA;EAA6BoC;AAAZJ;AAA6CI;AAAlBD;AAAlCN;EAAM6G,mBAAA,EAAA,MAAA;AAAA;AAKlB;AAAW1I;AAAuBoC;AAAZH;AAAiEG;AAAZH;AAEzEH;AAAZG;AAAVP;AAAS,UAtGHR,WAAAA,CAsGG;EAAA0H,OAERrG,EAAAA,MAAU;EAAA;EAAWvC,OAAAA,EAAAA,MAAAA;AAAuBoC;AAAZH;AAAiEG,UAlG5FjB,cAAAA,CAkG4FiB;EAAZH,GAAAA,EAAAA,MAAAA;AAEhEO;AAAZP;AAAVP,UAhGMN,eAAAA,CAgGNM;EAAS;EAAAqH,GACRtG,EAAAA,MAAAA;EAAW;EAAWzC,MAAAA,EAAAA,MAAAA;AAA6BoC;AAAZF;AAAiDE;AAApBE;AAApCT;AAAM;AAAA;AAEnB;AAAW7B;AAAuBoC;AAAZH;AAAiEG;AAAZH,UAlFzFZ,cAAAA,CAkFyFY;EAE3EU,WAAAA,EAAAA,MAAAA;EAAZV,eAAAA,EAAAA,MAAAA;EAARL;EAAOyH,QAAA,EAAA,MAAA;EAAA;EACMC,MAAA,EAAA,MAAA;AAAWtJ;AAA6BoC;AAAZJ;AAAiDI;AAApBM;AAApCb;AAAM;AAAA;AACpB;AAAW7B,UAtEzBsB,gBAAAA,CAsEyBtB;EAAuBoC,MAAAA,EAAAA,MAAAA;EAAZH,OAAAA,EAAAA,MAAAA;AAA+CR;AAAwDW,UAlE3Ib,kBAAAA,CAkE2Ia;EAAZH,OAAAA,EAAAA,MAAAA;AAA8BR;AAAmCW;AAAZH;AAAW;AAAA;AAC5K;AAAWjC,KA3DnCwB,WAAAA,GAAcC,MA2DqBzB,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAuBoC;AAAZH;AAA6CR;AAAmCW;AAAZH;AAEnHU;AAAIlB;AAAM;AAAA;AACQ;AAAWzB;AAAqCoC,KAlDjEV,SAkDiEU,CAAAA,CAAAA,CAAAA,GAAAA,CAlDjDT,CAkDiDS,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAlDnBT,CAkDmBS,CAAAA,SAAAA,CAAAA;EAApBS,OAAAA,EAAAA,KAAAA;AAAmET,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhDvGT,CAgDuGS,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhDrET,CAgDqES,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CAhDzCT,CAgDyCS,CAAAA,SAAAA,CAAAA;EAAzBU,OAAAA,EAAAA,IAAAA;AAA8DV,CAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CA9C7IT,CA8C6IS,CAAAA,SAAAA,CAAAA,MAAAA,CAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAzBU;AAAmEV,KA5C/LR,OA4C+LQ,CAAAA,CAAAA,CAAAA,GAAAA,CAAAA,MA5C3KT,CA4C2KS,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA;AAApBS,KA3C3KhB,MA2C2KgB,CAAAA,UAAAA,OAAAA,EAAAA,UAAAA,OAAAA,CAAAA,GA3C5Hf,CA2C4He,SAAAA,IAAAA,GAAAA,IAAAA,GA3CpGd,CA2CoGc;AAA6CT;AAApBS;AAAkDT;AAAzBU;AAAwB;AAAA,KArCrPd,WAsCAgB,CAAAA,CAAAA,CAAAA,GAAAA,CAtCkBf,WAsCE,CAtCUN,CAsCV,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,MAAA,SAAA,MAtC6DM,WAsC7D,CAtCyEN,CAsCzE,CAAA,GAAA,KAAA,GAtCsFC,OAsCtF,CAtC8FK,WAsC9F,CAtC0GN,CAsC1G,CAAA,CAAA;AAAA,KArCpBO,WAqCoB,CAAA,CAAA,CAAA,GAAA,CArCFD,WAqCE,CArCUN,CAqCV,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GArCwCD,SAqCxC,CArCkDO,WAqClD,CArC8DN,CAqC9D,CAAA,CAAA;AAAW3B;AAA0CoC;AAAlBW;AAAdE;AAAO;AAAA;AAChC;AAAWjD;AAAuCoC;AAArBY;AAA0BzB,KA3BvEY,iBA2BuEZ,CAAAA,UA3B3CvB,MA2B2CuB,CAAAA,GAAAA,CA3BhCU,WA2BgCV,CA3BpBa,CA2BoBb,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA3BqBU,WA2BrBV,CA3BiCa,CA2BjCb,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAkBiK,OAAA,EAAA,KAAA,EAAA;AAAA,CAAA,GAzB1F5J,OA0BCuB,CA1BOlB,WA0BPkB,CA1BmBpB,CA0BnBoB,CAAAA,CAAoB,GAAA,KAAA;AAAA,KAzBpBd,UAyBoB,CAAA,UAzBCrC,MAyBD,CAAA,GAzBW6B,MAyBX,CAzBkBG,WAyBlB,CAzB8BI,CAyB9B,CAAA,SAAA,CAAA,CAAA,EAzB6CD,iBAyB7C,CAzB+DC,CAyB/D,CAAA,CAAA;AAAWpC;AAA+BoC;AAArBY;AAA0CpC;AAAsCA,KApBzH0B,mBAoByH1B,CAAAA,UApB3FZ,MAoB2FY,CAAAA,GAAAA,CApBhFqB,WAoBgFrB,CApBpEwB,CAoBoExB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GApB3BqB,WAoB2BrB,CApBfwB,CAoBexB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAnBJ,SAAAA,EAAAA,KAAAA,EAAAA;AAAkB,CAAA,GAlBzHkB,SAkByH,CAlB/GO,WAkB+G,CAlBnGH,CAkBmG,CAAA,CAAA,GAAA,KAAA;AAAA;AAiBjH,KAjCPS,UAiCO,CAAA,UAjCcvC,MAiCd,CAAA,GAAA,CAjCyBiC,WAiCzB,CAjCqCG,CAiCrC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAjC8EH,WAiC9E,CAjC0FG,CAiC1F,CAAA,SAAA,CAAA,CAAA,SAAA;EAAWpC,QAAAA,EAAAA,KAAAA,EAAAA;AAASA,CAAAA,GA/B5B0B,SA+B4B1B,CA/BlBiC,WA+BkBjC,CA/BNwC,CA+BMxC,CAAAA,CAAAA,GAAAA,KAAAA;AACpBiB,KA/BPwB,WA+BOxB,CAAAA,UA/BejB,MA+BfiB,CAAAA,GA/ByBY,MA+BzBZ,CA/BgCiB,WA+BhCjB,CA/B4CmB,CA+B5CnB,CAAAA,WAAAA,CAAAA,CAAAA,EA/B6DqB,mBA+B7DrB,CA/BiFmB,CA+BjFnB,CAAAA,CAAAA;AAKDD;AACgBoB,KAnCtBM,mBAmCsBN,CAAAA,UAnCQpC,MAmCRoC,CAAAA,GAAAA,CAnCmBH,WAmCnBG,CAnC+BA,CAmC/BA,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAnCwEH,WAmCxEG,CAnCoFA,CAmCpFA,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAZH,SAAAA,EAAAA,KAAAA,EAAAA;AAAVP,CAAAA,GAjCDE,OAiCCF,CAjCOO,WAiCPP,CAjCmBiB,CAiCnBjB,CAAAA,CAAAA,GAAAA,KAAAA;AACGR,KAjCH0B,YAiCG1B,CAAAA,UAjCoBlB,MAiCpBkB,CAAAA,GAjC8BW,MAiC9BX,CAjCqCc,WAiCrCd,CAjCiDkB,CAiCjDlB,CAAAA,WAAAA,CAAAA,CAAAA,EAjCkEwB,mBAiClExB,CAjCsFkB,CAiCtFlB,CAAAA,CAAAA;AACJM,KAjCCqB,mBAiCDrB,CAAAA,UAjC+BxB,MAiC/BwB,CAAAA,GAAAA,CAjC0CS,WAiC1CT,CAjCsDY,CAiCtDZ,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAjCyFC,MAiCzFD,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GAAAA,MAAAA,SAAAA,MAjCqIS,WAiCrIT,CAjCiJY,CAiCjJZ,CAAAA,WAAAA,CAAAA,CAAAA,GAjCmKC,MAiCnKD,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GAjC0LS,WAiC1LT,CAjCsMY,CAiCtMZ,CAAAA,WAAAA,CAAAA,CAAAA;AAAsCY,KAhCrCU,wBAgCqCV,CAAAA,UAhCFpC,MAgCEoC,CAAAA,GAAAA,CAhCSH,WAgCTG,CAhCqBA,CAgCrBA,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAhCsDX,MAgCtDW,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA,GAhC6EH,WAgC7EG,CAhCyFA,CAgCzFA,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAZH,SAAAA,EAAAA,KAAAA,EAAAA;AAAVP,CAAAA,GA9BhBiB,CA8BgBjB,GA9BZD,MA8BYC,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AACTP,KA9BN4B,iBA8BM5B,CAAAA,UA9BsBnB,MA8BtBmB,CAAAA,GAAAA,CAAAA,MA9BuC0B,mBA8BvC1B,CA9B2DiB,CA8B3DjB,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA9BiF2B,wBA8BjF3B,CA9B0GiB,CA8B1GjB,CAAAA,GAAAA,CAAAA,MA9BsH2B,wBA8BtH3B,CA9B+IiB,CA8B/IjB,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GA9BqK0B,mBA8BrK1B,CA9ByLiB,CA8BzLjB,CAAAA,GA9B8L0B,mBA8B9L1B,CA9BkNiB,CA8BlNjB,CAAAA,GA9BuN2B,wBA8BvN3B,CA9BgPiB,CA8BhPjB,CAAAA;AACPK,KA9BCwB,oBA8BDxB,CAAAA,UA9BgCxB,MA8BhCwB,CAAAA,GA9B0CyB,OA8B1CzB,CAAAA,MA9BwDuB,iBA8BxDvB,CA9B0EY,CA8B1EZ,CAAAA,EAAAA,MAAAA,CAAAA;AAA2BY,KA7B1Bc,gBA6B0Bd,CAAAA,UA7BCpC,MA6BDoC,CAAAA,GAAAA,QA7BmBY,oBA6BnBZ,CA7BwCA,CA6BxCA,CAAAA,GA7B6Cb,kBA6B7Ca,EAAAA;AAAXG,KA5BfY,oBA4BeZ,CAAAA,UA5BgBvC,MA4BhBuC,CAAAA,GA5B0BS,oBA4B1BT,CA5B+CH,CA4B/CG,CAAAA,SAAAA,KAAAA,EAAAA,GA5BoE3B,CA4BpE2B,SAAAA,MAAAA,GA5BuF/B,kBA4BvF+B,CA5B0G3B,CA4B1G2B,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AACRnB;AACRI;AAA2BY;AAAXC;AACThB;AACPG;AAA4BY;AAAZK;AACPnB;AACTE;AAA6BY;AAAbQ;AACUR;AAAjBc;AACT1B;AAAW;AAAA,KAnBV4B,OA2BKC,CAAAA,UA3BarD,MA2BK,GA3BIA,MA2BJ,CAAA,GAAA;EAAAwI,QAUlBlF,EApCErC,eAoCU;EAAA;AACVA;AACFD;AACFE;EACGC,MAAAA,CAAAA,EAnCAH,aAmCAG;AACCC,CAAAA,GAAAA,CAnCPM,SAmCON,CAnCGa,WAmCHb,CAnCegB,CAmCfhB,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EACDC,IAAAA,EAnCHH,WAmCGG;AACEC,CAAAA,GAnCTE,WAmCSF,CAAAA,GAAAA,CAnCOI,SAmCPJ,CAnCiBW,WAmCjBX,CAnC6Bc,CAmC7Bd,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAgBwH,OAAA,EAlClB3H,cAkCkB;AAAA,CAAA,GAjCzBK,WAoCM+B,CAAAA,GAAY,CApCFhB,UAoCE,CApCSH,CAoCT,CAAA,SAAA,IAAA,GAAA;EAAA4G,QAsBjBxF,EAzDOpC,eAyDS;AAAA,CAAA,GAxDjBI,WAwDiB,CAAA,GAAA,CAxDDa,UAwDC,CAxDUD,CAwDV,CAAA,SAAA,IAAA,GAAA;EAAWpC,OAAAA,EAvDrBqB,cAuDqBrB;AAAUqD,CAAAA,GAtDtC7B,WAsDsC6B,CAAAA,GAAAA,CAtDtBZ,WAsDsBY,CAtDVjB,CAsDUiB,CAAAA,SAAAA,IAAAA,GAAAA;EAAiCjB,SAAAA,EArD9Dd,gBAqD8Dc;AAARgB,CAAAA,GApD/D5B,WAoD+D4B,CAAAA,GAAAA,CApD/CR,YAoD+CQ,CApDlChB,CAoDkCgB,CAAAA,SAAAA,IAAAA,GAAAA;EAAmBC,SAAAA,EAnDzEH,gBAmDyEG,CAnDxDjB,CAmDwDiB,CAAAA;AAA2CjB,CAAAA,GAlD7HZ,WAkD6HY,CAAAA;AAArBe;AAAoB;AAAA;AAgBvG;AAA6BO;AAAGlD;AAAXyC;AAAO,UA1D3CI,kBAAAA,CA0D2C;EAAAmF,QAChD7E,EAAAA,cAAmB,GAAA,uBAAA;EAAA2E,MAAA,EAAA,aAAA;EAAqB5E,IAAAA,EAAAA,oBAAAA,GAAAA,oBAAAA;EAA0D9C,OAAAA,EAAAA,mBAAAA;EAAVgD,QAAAA,EAAAA,mBAAAA,GAAAA,sBAAAA;EAASsF,OAAA,EAAA,mBAAA,GAAA,uBAAA,GAAA,qBAAA,GAAA,YAAA;EAAAK,SACjG1F,EAAAA,uBAAoB,GAAA,0BAAA;AAAA;AAA2CH;AAArBD,UAlDrCH,YAAAA,CAkDqCG;EACLC,QAAAA,EAlD9BzC,eAkD8ByC;EAArBD,MAAAA,EAjDXzC,aAiDWyC;EAA+CK,IAAAA,EAhD5D5C,WAgD4D4C;EAApBH,OAAAA,EA/CrCxC,cA+CqCwC;EAAyBpC,QAAAA,EA9C7DH,eA8C6DG;EAAkB2H,OAAA,EA7ChF7H,cA6CgF;EAAAkI,SAEtFxF,EA9CQzC,gBA8CRyC;AAA4B;AAA2CL;AAArBD,UA3C7CF,YAAAA,CA2C6CE;EACZC,YAAAA,EAAAA,aAAAA;EAArBD,qBAAAA,EAAAA,qBAAAA;EAA+CK,WAAAA,EAAAA,MAAAA;EAApBH,kBAAAA,EAAAA,SAAAA;EAA0BpC,kBAAAA,EAAAA,SAAAA;EAAkB2L,iBAAA,EAAA,KAAA;EAAAC,iBAExFnJ,EAAAA,KAAe;EAAAoJ,oBAAA,EAAA,QAAA;EAAmC/J,iBAAAA,EAAAA,aAAAA;EAA+BK,qBAAAA,EAAAA,iBAAAA;EAAGL,mBAAAA,EAAAA,UAAAA;EAAmBY,UAAAA,EAAAA,QAAAA;EAA9BhB,qBAAAA,EAAAA,QAAAA;EAA6DgB,wBAAAA,EAAAA,SAAAA;AAAoBP;AAAGL;AAAmBY;AAA9BhB;AAAqCM;AAAaO;AAAUP;AAAgBD,KAxB9NE,gBAwB8NF,CAAAA,UAxBnMtD,MAwBmMsD,CAAAA,GAxBzLD,kBAwByLC,CAAAA,MAxBhKF,OAwBgKE,CAxBxJlB,CAwBwJkB,CAAAA,GAAAA,MAxB7ID,kBAwB6IC,CAAAA,GAxBvHH,oBAwBuHG,CAxBlGlB,CAwBkGkB,CAAAA;AAAaW;AAAGV;AAAaO;AAAUP;AAAsBD;AAAaW;AAA+BP;AAArBG;AAAoB;AAAA;AAM/S;AAAmCR;AAA+BK;AAAGL;AAAmBY;AAA9BhB,KAdjFQ,oBAciFR,CAAAA,UAAAA,MAAAA,CAAAA,GAdxCA,OAcwCA,CAdhCS,CAcgCT,EAd7BzC,kBAc6ByC,CAAAA;AAA6DgB,KAb9IN,mBAa8IM,CAAAA,UAAAA,MAAAA,CAAAA,GAbtGP,CAasGO,SAAAA,iBAAAA,KAAAA,EAAAA,WAAAA,GAbtDL,SAasDK,CAb5CrD,CAa4CqD,CAAAA,GAAAA,KAAAA;AAAqBP,KAZnKG,oBAYmKH,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAZzHD,oBAYyHC,CAZpGA,CAYoGA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAAGL,SAAAA,EAAAA,QAXtJI,oBAWsJJ,CAXjIK,CAWiIL,CAAAA,IAX3HM,mBAW2HN,CAXvGS,CAWuGT,CAAAA,GAXlG9B,kBAWkG8B,EAAAA;AAAmBY,CAAAA;AAA9BhB,KAT3Jc,4BAS2Jd,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CATzGQ,oBASyGR,CATpFS,CASoFT,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAAAA;EAAqCM,SAAAA,CAAAA,EAAAA,QAR/KE,oBAQ+KF,CAR1JG,CAQ0JH,CAAAA,IARpJI,mBAQoJJ,CARhIO,CAQgIP,CAAAA,IAR1HhC,kBAQ0HgC,EAAAA;AAAaO,CAAAA;AAAUP,KANvNS,eAMuNT,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MANrKF,kBAMqKE,IAAAA,CAN9IN,OAM8IM,CANtIG,CAMsIH,EANnIF,kBAMmIE,CANhHU,CAMgHV,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GANjFU,CAMiFV,GAAAA,QANrEN,OAMqEM,CAN7DG,CAM6DH,EAN1DF,kBAM0DE,CANvCU,CAMuCV,CAAAA,CAAAA,IANhCA,YAMgCA,CANnBO,CAMmBP,GAAAA,MANTA,YAMSA,CAAAA,GANOD,YAMPC,CANoBU,CAMpBV,CAAAA,CANuBA,YAMvBA,CANoCO,CAMpCP,GAAAA,MAN8CA,YAM9CA,CAAAA,GAAAA,MANoED,YAMpEC,CANiFU,CAMjFV,CAAAA,CAAAA,EAAAA,EAAAA,GAN2FM,oBAM3FN,CANgHG,CAMhHH,CAAAA;AAAiBD;AAAaW;AAAGV;AAAaO;AAAUP;AAAsBD,KAArSY,uBAAqSZ,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MAA3OD,kBAA2OC,IAAAA,CAApNL,OAAoNK,CAA5MI,CAA4MJ,EAAzMD,kBAAyMC,CAAtLW,CAAsLX,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAvJW,CAAuJX,IAAAA,QAA1IL,OAA0IK,CAAlII,CAAkIJ,EAA/HD,kBAA+HC,CAA5GW,CAA4GX,CAAAA,CAAAA,IAArGC,YAAqGD,CAAxFQ,CAAwFR,GAAAA,MAA9EC,YAA8ED,CAAAA,IAA7DA,YAA6DA,CAAhDW,CAAgDX,CAAAA,CAA7CC,YAA6CD,CAAhCQ,CAAgCR,GAAAA,MAAtBC,YAAsBD,CAAAA,GAAAA,MAAAA,YAAAA,CAAaW,CAAbX,CAAAA,CAAAA,EAAAA,EAAAA,GAAuBS,4BAAvBT,CAAoDI,CAApDJ,CAAAA;AAAaW;AAAuCP,KAEzVS,OAFyVT,CAAAA,CAAAA,EAAAA,QAEtU/B,CAFsU+B,CAAAA,GAEjU/B,CAFiU+B,SAEvTU,KAFuTV,GAAAA,CAE9SU,KAF8SV,CAAAA,SAAAA,CAE9R/B,CAF8R+B,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAA7BK;AAA4B,KAIxVM,aAJwV,CAAA,UAAA,SAAA,OAAA,EAAA,CAAA,GAI1S1C,CAJ0S,SAAA,SAAA,EAAA,GAAA,KAAA,GAI1QA,CAJ0Q,SAAA,SAAA,CAAA,KAAA,KAAA,EAAA,GAAA,KAAA,cAAA,SAAA,OAAA,EAAA,CAAA,GAAA,IAAA,SAIjLwC,OAJiL,CAIzKG,IAJyK,CAAA,GAAA,IAAA,GAI1JD,aAJ0J,CAI5IE,IAJ4I,CAAA,GAAA,IAAA;AAAA;AAEjV;AAAY5C;AAAKA;AAAUyC;AAASA;AAAgBzC;AAAC;AAAA,KAW5D6C,eATa,CAAA,aAAA,SAAA,MAAA,EAAA,CAAA,GASqCC,IATrC,SAAA,SAAA,MAAA,EAAA,GAAA,MAAA,SASqFA,IATrF,CAAA,QAAA,CAAA,GASsGP,uBATtG,CAS8HO,IAT9H,CAAA,MAAA,CAAA,CAAA,GAS8IJ,aAT9I,CAS4JI,IAT5J,CAAA,SAAA,IAAA,GASiLP,uBATjL,CASyMO,IATzM,CAAA,MAAA,CAAA,CAAA,GASyNT,eATzN,CASyOS,IATzO,CAAA,MAAA,CAAA,CAAA,GAAA,KAAA;AAAA,KAUbC,uBAAAA,GAVa,mBAAA,GAAA,uBAAA;AAAiC/C,KAW9CgD,mBAAAA,GAX8ChD;EAAgCA,SAAAA,iFAAAA,EAAAA,KAAAA;AAAiG2C,CAAAA;AAARH,KAcvKS,uBAduKT,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,EAAAA,YAAAA,MAAAA,CAAAA,GAczFM,IAdyFN,SAAAA,SAAAA,CAAAA,KAAAA,cAAAA,MAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAcKG,IAdLH,CAAAA,SAAAA,CAcoBU,GAdpBV,CAAAA,GAAAA,IAAAA,GAckCS,uBAdlCT,CAc0DI,IAd1DJ,EAcgEU,GAdhEV,CAAAA,GAAAA,KAAAA;AAAqCI,KAe5MO,kCAf4MP,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAevIK,uBAfuIL,CAe/GE,IAf+GF,EAAAA,mBAAAA,CAAAA,SAAAA,IAAAA,GAerEK,uBAfqEL,CAe7CE,IAf6CF,EAAAA,uBAAAA,CAAAA,SAAAA,IAAAA,GAAAA,IAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAdF;AAAa;AAAA;AAS5L;AAAmCI,KAWlDM,sBAXkDN,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAWOA,IAXPA,SAAAA,OAAAA,GAAAA,MAAAA,SAW6CA,IAX7CA,CAAAA,QAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAWuExB,OAXvEwB,CAW+EA,IAX/EA,CAAAA,MAAAA,CAAAA,EAW6FC,uBAX7FD,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAWiJK,kCAXjJL,CAWoLA,IAXpLA,CAAAA,SAAAA,IAAAA,GAAAA,KAAAA,GAWiNA,IAXjNA,GAAAA,KAAAA;AAAgDA,KAYlGO,wBAZkGP,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAYtCM,sBAZsCN,CAYfA,IAZeA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAYoBE,mBAZpBF;AAAyCA,KAa3IQ,oBAb2IR,CAAAA,aAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAanFS,IAbmFT,CAAAA,CAAAA,CAAAA,SAAAA;EAAxBP,IAAAA,EAAAA,KAAAA,cAAAA,SAAAA,MAAAA,EAAAA;AAAsDO,CAAAA,GAe1KA,IAf0KA,GAAAA,KAAAA;AAAdJ,KAgB3Jc,4BAhB2Jd,CAAAA,aAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAgB3FW,wBAhB2FX,CAgBlEY,oBAhBkEZ,CAgB7Ca,IAhB6Cb,CAAAA,CAAAA;AAA2DI;AAAxBP,KAkB9LkB,yBAlB8LlB,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,CAkB/IjB,OAlB+IiB,CAkBvIR,CAlBuIQ,EAkBpIQ,uBAlBoIR,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,OAAAA,GAkB9EQ,uBAlB8ER,SAkB9CR,CAlB8CQ,GAAAA,OAAAA,GAkBhCS,mBAlBgCT;AAAwDO,UAmBjPY,eAAAA,CAnBiPZ;EAAhBT;AAAe;AAAA;AAC9N;EACJ0L,SAGnB9K,EAAAA,MAAAA;EAAuB;AAAuDH;AAA8FH;AAAeO;AAAsCN;EAAMM,MAAAA,CAAAA,EAAAA,MAAAA;EAA9BD;AAAuB;AAAA;AAC9L;AAA2DH;EAAxBG,QAAAA,CAAAA,EAAAA,MAAAA;EAA0FH;AAAxBG;AAAuB;AAAA;AAKxI;EAAmCH,MAAAA,CAAAA,EAAAA,MAAAA;EAAsCA;AAAkCA;AAAcC;AAAtBzB;EAA6GwB,OAAAA,CAAAA,EAAAA,MAAAA;EAAnCK;AAAgEL;AAAI;AAAA;EAC/OoL,GAAA,CAAA,EAwCrB3P,OAxCqB;EAA2DuE;AAAvBM;AAA0DJ;AAAmB;AAAA;AACrH;AAAoCO;EAEzDT,QAAAA,CAAAA,EAAAA,MAAAA;EAAI;AAAA;AACyB;AAAkFS;AAArBD;AAAzBD;AAAwB;EAAA+K,YAExF3K,CAAAA,EAAAA,MAAAA;AAAyB;AAA8B1B;AAAGgB;AAAXzB;AAAiEyB;AAAgChB;AAAciB;AAAmB;AAAA;AAkCvK;AA+CU;AAAiB3E;AAA8CqF;AAkBtDjD;AAAjBoB;AACLpB;AAAY8C;AAA4CA;AAARK;AAA7BJ;AAAmGD;AAARK;AAArBN;AAAhBT;AAARgB;AAAO;AAAA;AAC3D;AAAiBxF;AAAyCoC;AAAjBoB,iBApBjD8B,QAoBiD9B,CAAAA,gBApBxBxD,MAoBwBwD,EAAAA,mBAAAA,SAAAA,CAAAA,OAAAA,EApBsB6B,eAoBtB7B,GAAAA;EAAqCpB;AAAqBsB;AAAR6B;AAAsCF;AACjI3B;AAAR6B;AACqB7B;AAAR6B;AAA1BH;AAAwE1B;AAAR6B;AAAhBvB;AAARwB;AAAO;AAAA;AAC1B;AAAiBxF;EAAgBoC,IAAAA,EAAAA,SALzCoB,gBAKyCpB,CALxBA,CAKwBA,CAAAA,EAAAA;AAAYiD,CAAAA,CAAAA,CAAAA,CAAAA,MAAAA,EAJ1DjD,CAI0DiD,EAAAA,GAAAA,IAAAA,EAJ9CH,IAI8CG,GAJvCF,4BAIuCE,CAJVE,OAIUF,CAJFH,IAIEG,CAAAA,CAAAA,CAAAA,EAJOG,OAIPH,CAJeb,eAIfa,CAJ+BJ,oBAI/BI,CAJoDE,OAIpDF,CAJ4DH,IAI5DG,CAAAA,CAAAA,CAAAA,CAAAA;AAElDjD,iBALHkD,QAKGlD,CAAAA,gBALsBpC,MAKtBoC,EAAAA,gBAL8CoB,gBAK9CpB,CAL+DA,CAK/DA,CAAAA,GAAAA,KAAAA,CAAAA,CAAAA,MAAAA,EALmFA,CAKnFA,EAAAA,OAAAA,EAAAA,CALgGmD,OAKhGnD,CALwGsB,CAKxGtB,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GALsIiD,eAKtIjD,GAAAA;EAARgB,IAAAA,EAAAA,SAJKmC,OAILnC,CAJaM,CAIbN,CAAAA,EAAAA;AAARoC,CAAAA,GAHAJ,yBAGAI,CAH0BD,OAG1BC,CAHkC9B,CAGlC8B,CAAAA,CAAAA,CAAAA,EAHwCA,OAGxCA,CAHgDxB,eAGhDwB,CAHgED,OAGhEC,CAHwE9B,CAGxE8B,CAAAA,CAAAA,CAAAA;AAAO,iBAFMF,QAEN,CAAA,gBAF+BtF,MAE/B,CAAAgQ,CAAAE,MAAA,EAF+C9N,CAE/C,EAAA6N,OAAA,EAF2D5K,eAE3D,GAAA;EAAAiK,IAEMhK,CAAAA,EAAAA,KAAAA;AAAQ,CAAA,CAAA,EAFrBE,OAEqB,CAFbpC,OAEa,CAFLhB,CAEK,CAAA,CAAA;AAAiBpC;AAAqDoC,iBAA9EkD,QAA8ElD,CAAAA,gBAArDpC,MAAqDoC,EAAAA,mBAAAA,SAAjBoB,gBAAiBpB,CAAAA,CAAAA,CAAAA,EAAAA,CAAAA,CAAAA,MAAAA,EAAcA,CAAdA,EAAAA,OAAAA,EAA0BiD,eAA1BjD,GAAAA;EAAjBoB,IAAAA,EACtEiB,IADsEjB;AAA+BpB,CAAAA,GAEzGuC,mBAFyGvC,CAAAA,EAEnFoD,OAFmFpD,CAAAA,KAAAA,CAAAA;AAAYiD;AACjHZ;AACJE;AAAsBa;AAAO;AA6EuC;AAY9C;AAAMG;AAAkBlE;;AC9c9C;AAGkB;AACXoF;AAEPe;AAAmCV;AAAnBK;AACcL;AAAnBK;AAAsBK;AAAlCT;AACeW;AAAdL,iBDscad,SAAAA,CCtcbc,GAAAA,EDsc4B9B,eCtc5B8B,CAAAA,EDsc8ChG,MCtc9CgG,CAAAA,MAAAA,EAAAA,MAAAA,CAAAA;AAAO;AAQX;AAA2B;AAAWZ;AACFK;AAAGU;AAArBC,KDocblC,eAAAA,GCpcakC,QAAAA,MDocmBvE,YCpcnBuE,IDocmCjB,OCpcnCiB,CDoc2CvE,YCpc3CuE,CDocwD5D,CCpcxD4D,CAAAA,CAAAA,EAAAA,GAAAA;EAAPT,SAAAA,CAAAA,EDqcG3F,MCrcH2F,CAAAA,MAAAA,EDqckB7F,kBCrclB6F,CAAAA;AAAM,CAAA;AA0IjB;;;ADpM4DxG;AAAuBA,KCb9EqG,aDa8ErG,CAAAA,UCbtDiG,MDasDjG,CAAAA,GAAAA,CCb3CuG,WDa2CvG,CCb/BsG,CDa+BtG,CAAAA,WAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAnBJ,KAAAA,CAAkB,GCV/E4G,MDU+E,CAAA,KAAA,EAAA,KAAA,CAAA,GAAA,MAAA,SAAA,MCT1DD,WDS0D,CCT9CD,CDS8C,CAAA,WAAA,CAAA,CAAA,GCR9EE,MDQ8E,CAAA,KAAA,EAAA,KAAA,CAAA,GCP9ED,WDO8E,CCPlED,CDOkE,CAAA,WAAA,CAAA,CAAA;AAAA,KCL7EG,oBDMYxG,CAAAA,UCNmBgG,MDMI,CAAA,GAAA,CCLvCM,WDMgBrG,CCNJoG,CDMIpG,CAAAA,SAAoB,CAAA,CAAA,CAEjB,SAOVE,CAAAA,KAAAA,CAAAA,GCbPoG,MDaoB,CAAA,KAAA,EAAA,KAAA,CAAA,GCZpBD,WDYoB,CCZRD,CDYQ,CAAA,SAAA,CAAA,CAAA,SAAA;EAIbjG,SAAAA,EAAAA,KAAAA,EAAe;AAAA,CAAA,GCfrBqG,CDqCMpG,GCpCNkG,MDoCMlG,CAAAA,KAAW,EAAA,KAAA,CAAA;AAAA,KClChBqG,kBDwCmB,CAAA,UCxCUV,MDwCV,CAAA,GAAA,CAAA,MCxC2BI,aDwC3B,CCxCyCC,CDwCzC,CAAA,CAAA,SAAA,CAId9F,KAAAA,CAAe,GCzCtBiG,oBD0DqB,CC1DAH,CD0DA,CAAA,GAAA,CAAA,MCzDdG,oBDyDc,CCzDOH,CDyDP,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GCxDpBD,aDwDoB,CCxDNC,CDwDM,CAAA,GCvDpBD,aDuDoB,CCvDNC,CDuDM,CAAA,GCvDDG,oBDuDC,CCvDoBH,CDuDpB,CAAA;AAAA;AAoBd3F,KCxEEiG,cDwEgB,CAAA,UCxESX,MDwET,CAAA,GCxEmBY,ODwEnB,CAAA,MCvErBF,kBDuEqB,CCvEFL,CDuEE,CAAA,EAAA,MAAA,CAAA;AAAA;AAQH;AAYX;AAAOvF;AAA8BA;AAErCA;AAAkCA;AAA4BA;AAE/DA,KCjFD+F,mBAAAA,GDiFC/F,+JAAAA;AAAC;AAAA;AAEY;AACf;AAAyCG;AAAwBC;AAAC;AAAA,KC1ExE4F,kBDgFW,CAAA,UChFkBd,MDgFlB,EAAA,UAAA,MAAA,CAAA,GAAA,CC/EfW,cD+Ee,CC/EAN,CD+EA,CAAA,CAAmBvF,SAAAA,CAAAA,KAAAA,CAAAA,GC7EhC+F,mBD6EgC/F,GC5EhCiG,CD4EgCjG;AAAZM;AAA2EN,KCzE7FkG,iBDyE6FlG,CAAAA,UCxEvFkF,MDwEuFlF,EAAAA,UAAAA,MAAAA,CAAAA,GCtE9FiG,CDsE8FjG,SAAAA,MCtE9E4F,kBDsE8E5F,CCtE3DuF,CDsE2DvF,CAAAA,GCrE/FwF,WDqE+FxF,CCrEnF4F,kBDqEmF5F,CCrEhEuF,CDqEgEvF,CAAAA,CCrE7DiG,CDqE6DjG,CAAAA,CAAAA,SAAAA;EAAZM,GAAAA,EAAAA,KAAAA,EAAAA;AAA6CN,CAAAA,GCpE/H8F,ODoE+H9F,CAAAA,MCpEjHmG,CDoEiHnG,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAZM;AAARL;AAAO;AAAA;AACtG,KC7DJmG,eD6DI,CAAA,UC7DsBlB,MD6DtB,EAAA,UAAA,MAAA,CAAA,GAAA;EAAmBlF,QAAAA,EC5DxByF,MD4DwBzF,CC5DjBkG,iBD4DiBlG,CC5DCuF,CD4DDvF,EC5DIiG,CD4DJjG,CAAAA,EAAAA,MAAAA,CAAAA;AAAZM,CAAAA;AAAgEN;AAAZM;AAAVP;AAAS;AAAA;AAWpD;AAAW1B;AAAuBoC;AAAZH;AAAiEG;AAAZH;AAEzEF;AAAZE;AAARL;AAAO;AAAA;AACI;AAAW5B;AAA6BoC;AAAZJ;AAA6CI;AAAlBD;AAAlCN;AAAM;AAAA;AAKlB;AAAW7B;AAAuBoC;AAAZH;AAAiEG;AAAZH;AAEzEH;AAAZG;AAAVP;AAAS;AAAA;AAEE;AAAW1B;AAAuBoC;AAAZH;AAAiEG;AAAZH;AAEhEO;AAAZP;AAAVP;AAAS;AAAA;AACG;AAAW1B;AAA6BoC,iBCoDxC4F,QDpDwC5F,CAAAA,gBCoDfyE,MDpDezE,CAAAA,CAAAA,MAAAA,ECoDC8E,CDpDD9E,CAAAA,ECoDK2E,ODpDL3E,CCoDa8E,CDpDb9E,CAAAA;AAAZF,iBC6D5B8F,QD7D4B9F,CAAAA,gBC8D3B2E,MD9D2B3E,EAAAA,gBC+D3BsF,cD/D2BtF,CC+DZgF,CD/DYhF,CAAAA,CAAAA,CAAAA,MAAAA,ECiEnCgF,CDjEmChF,EAAAA,KAAAA,ECkEpCyF,kBDlEoCzF,CCkEjBgF,CDlEiBhF,ECkEd0F,CDlEc1F,CAAAA,CAAAA,ECmEzC6E,ODnEyC7E,CCmEjCgF,CDnEiChF,CAAAA,GCmE5B6F,eDnE4B7F,CCmEZgF,CDnEYhF,ECmET0F,CDnES1F,CAAAA;AAAiDE,iBCoE7E4F,QDpE6E5F,CAAAA,gBCqE5EyE,MDrE4EzE,EAAAA,gBCsE5E4E,gBDtE4E5E,CCsE3D8E,CDtE2D9E,CAAAA,CAAAA,CAAAA,MAAAA,ECuEnF8E,CDvEmF9E,EAAAA,IAAAA,EAAAA,SCuEjE6F,CDvEiE7F,EAAAA,CAAAA,ECuE3D0E,eDvE2D1E,CCuE3C6F,CDvE2C7F,CAAAA"}

package/dist/index.js

@@ -28,6 +28,10 @@ const authEnvSchema = z.object({
 	NEON_AUTH_JWKS_URL: z.string({ message: "NEON_AUTH_JWKS_URL is missing" }).min(1, "NEON_AUTH_JWKS_URL must not be empty")
 });
 const dataApiEnvSchema = z.object({ NEON_DATA_API_URL: z.string({ message: "NEON_DATA_API_URL is missing" }).min(1, "NEON_DATA_API_URL must not be empty") });
+const realtimeEnvSchema = z.object({
+	NEON_REALTIME_URL: z.string({ message: "NEON_REALTIME_URL is missing" }).min(1, "NEON_REALTIME_URL must not be empty"),
+	NEON_REALTIME_SECRET: z.string({ message: "NEON_REALTIME_SECRET is missing" }).min(1, "NEON_REALTIME_SECRET must not be empty")
+});
 const storageEnvSchema = z.object({
 	AWS_ACCESS_KEY_ID: z.string({ message: "AWS_ACCESS_KEY_ID is missing" }).min(1, "AWS_ACCESS_KEY_ID must not be empty"),
 	AWS_SECRET_ACCESS_KEY: z.string({ message: "AWS_SECRET_ACCESS_KEY is missing" }).min(1, "AWS_SECRET_ACCESS_KEY must not be empty"),
@@ -85,6 +89,17 @@ function parseEnv(config, scopeOrKeys) {
 		if (dataApi.success) result.dataApi = { url: dataApi.data.NEON_DATA_API_URL };
 		else for (const issue of dataApi.error.issues) issues.push(issue.message);
 	}
+	if (config.preview?.realtime !== void 0 && config.preview.realtime !== false) {
+		const realtime = realtimeEnvSchema.safeParse({
+			NEON_REALTIME_URL: source.NEON_REALTIME_URL,
+			NEON_REALTIME_SECRET: source.NEON_REALTIME_SECRET
+		});
+		if (realtime.success) result.realtime = {
+			url: realtime.data.NEON_REALTIME_URL,
+			secret: realtime.data.NEON_REALTIME_SECRET
+		};
+		else for (const issue of realtime.error.issues) issues.push(issue.message);
+	}
 	if (configWantsStorage(config)) {
 		const storage = storageEnvSchema.safeParse({
 			AWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,
@@ -190,6 +205,8 @@ const FILTERABLE_ENV_KEYS = {
 	NEON_AUTH_BASE_URL: ["auth", "baseUrl"],
 	NEON_AUTH_JWKS_URL: ["auth", "jwksUrl"],
 	NEON_DATA_API_URL: ["dataApi", "url"],
+	NEON_REALTIME_URL: ["realtime", "url"],
+	NEON_REALTIME_SECRET: ["realtime", "secret"],
 	AWS_ACCESS_KEY_ID: ["storage", "accessKeyId"],
 	AWS_SECRET_ACCESS_KEY: ["storage", "secretAccessKey"],
 	AWS_ENDPOINT_URL_S3: ["storage", "endpoint"],

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/lib/parse-env.ts"],"sourcesContent":["/**\n * `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars\n * already injected into `process.env`, validate them against the policy, and return them in the\n * same namespaced shape.\n *\n * Lives in this package rather than in `@neon-internals/env-core` because nothing else needs\n * it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping\n * it here also keeps `zod` out of that package, and so out of every consumer that bundles it.\n */\n\nimport {\n\tauthoredAiGateway,\n\tauthoredBuckets,\n\tauthoredFunctions,\n\ttype Config,\n\tErrorCode,\n\tPlatformError,\n\ttype ServiceToggleInput,\n} from \"@neon/config/v1\";\nimport {\n\ttype FilteredNeonEnv,\n\tfunctionBaseUrlKey,\n\tisFunctionBaseUrlKey,\n\tNEON_ENV_VAR_KEYS,\n\ttype NeonAiGatewayEnv,\n\ttype NeonAuthEnv,\n\ttype NeonBranchEnv,\n\ttype NeonDataApiEnv,\n\ttype NeonEnv,\n\ttype NeonFunctionUrlEnv,\n\ttype NeonPostgresEnv,\n\ttype NeonStorageEnv,\n\tparseFunctionBaseUrlKey,\n\ttype SelectableEnvKey,\n} from \"@neon-internals/env-core/env\";\nimport { z } from \"zod\";\n\n/** The static `functions` record of a config (GA or deprecated `preview.functions`). */\ntype GaFunctionsOf<C extends Config> = [NonNullable<C[\"functions\"]>] extends [\n\tnever,\n]\n\t? Record<never, never>\n\t: string extends keyof NonNullable<C[\"functions\"]>\n\t\t? Record<never, never>\n\t\t: NonNullable<C[\"functions\"]>;\n\ntype PreviewFunctionsHome<C extends Config> = [\n\tNonNullable<C[\"preview\"]>,\n] extends [never]\n\t? Record<never, never>\n\t: NonNullable<C[\"preview\"]> extends { functions: infer F }\n\t\t? F\n\t\t: Record<never, never>;\n\ntype PreviewFunctionsOf<C extends Config> = [keyof GaFunctionsOf<C>] extends [\n\tnever,\n]\n\t? PreviewFunctionsHome<C>\n\t: [keyof PreviewFunctionsHome<C>] extends [never]\n\t\t? GaFunctionsOf<C>\n\t\t: GaFunctionsOf<C> & PreviewFunctionsHome<C>;\n\n/** The declared function slugs of a config (record keys), as a string union. */\nexport type FunctionSlugOf<C extends Config> = Extract<\n\tkeyof PreviewFunctionsOf<C>,\n\tstring\n>;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when\n * the policy declares no functions at all. Without it the argument's expected type is the bare\n * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '\"x\"' is not\n * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the\n * editor offers it as the single completion, so the empty completion list is explained rather\n * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.\n */\n// Exported (type-only) for the type tests in `env.test-d.ts`; intentionally not re-exported\n// from `index.ts`, so it stays an internal implementation detail.\nexport type NoFunctionScopeHint =\n\t\"this policy declares no `functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env\";\n\n/**\n * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug\n * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no\n * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes\n * the returned `function` namespace exact — it stays the one function's env keys instead of\n * widening to every declared function's.\n */\ntype FunctionScopeField<C extends Config, S extends string> = [\n\tFunctionSlugOf<C>,\n] extends [never]\n\t? NoFunctionScopeHint\n\t: S;\n\n/** The declared env-var keys of one function `S`, as a string union. */\ntype FunctionEnvKeysOf<\n\tC extends Config,\n\tS extends string,\n> = S extends keyof PreviewFunctionsOf<C>\n\t? NonNullable<PreviewFunctionsOf<C>[S]> extends { env: infer E }\n\t\t? Extract<keyof E, string>\n\t\t: never\n\t: never;\n\n/**\n * The extra `function` namespace added to `parseEnv`'s result when called with a function\n * slug scope: the declared env-var keys for that function, each resolved to a `string`.\n */\nexport type NeonFunctionEnv<C extends Config, S extends string> = {\n\tfunction: Record<FunctionEnvKeysOf<C, S>, string>;\n};\n\n// ───────────────────────── parseEnv ─────────────────────────\n\n/**\n * Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from\n * `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.\n *\n * `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include\n * URL-illegal characters in the password (rare but legal in Neon's connection-string\n * format) fail the WHATWG `URL` parse, so we settle for \"non-empty string\".\n */\nconst postgresEnvSchema = z.object({\n\tDATABASE_URL: z\n\t\t.string({ message: \"DATABASE_URL is missing\" })\n\t\t.min(1, \"DATABASE_URL must not be empty\"),\n\tDATABASE_URL_UNPOOLED: z\n\t\t.string({ message: \"DATABASE_URL_UNPOOLED is missing\" })\n\t\t.min(1, \"DATABASE_URL_UNPOOLED must not be empty\"),\n});\n\nconst authEnvSchema = z.object({\n\tNEON_AUTH_BASE_URL: z\n\t\t.string({ message: \"NEON_AUTH_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_BASE_URL must not be empty\"),\n\tNEON_AUTH_JWKS_URL: z\n\t\t.string({ message: \"NEON_AUTH_JWKS_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_JWKS_URL must not be empty\"),\n});\n\nconst dataApiEnvSchema = z.object({\n\tNEON_DATA_API_URL: z\n\t\t.string({ message: \"NEON_DATA_API_URL is missing\" })\n\t\t.min(1, \"NEON_DATA_API_URL must not be empty\"),\n});\n\nconst storageEnvSchema = z.object({\n\tAWS_ACCESS_KEY_ID: z\n\t\t.string({ message: \"AWS_ACCESS_KEY_ID is missing\" })\n\t\t.min(1, \"AWS_ACCESS_KEY_ID must not be empty\"),\n\tAWS_SECRET_ACCESS_KEY: z\n\t\t.string({ message: \"AWS_SECRET_ACCESS_KEY is missing\" })\n\t\t.min(1, \"AWS_SECRET_ACCESS_KEY must not be empty\"),\n\tAWS_ENDPOINT_URL_S3: z\n\t\t.string({ message: \"AWS_ENDPOINT_URL_S3 is missing\" })\n\t\t.min(1, \"AWS_ENDPOINT_URL_S3 must not be empty\"),\n\tAWS_REGION: z\n\t\t.string({ message: \"AWS_REGION is missing\" })\n\t\t.min(1, \"AWS_REGION must not be empty\"),\n});\n\nconst aiGatewayEnvSchema = z.object({\n\tNEON_AI_GATEWAY_TOKEN: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_TOKEN is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_TOKEN must not be empty\"),\n\tNEON_AI_GATEWAY_BASE_URL: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_BASE_URL must not be empty\"),\n});\n\n/** Whether a **static** policy declares object storage (`buckets`). No network. */\nfunction configWantsStorage(config: Config): boolean {\n\treturn Object.keys(authoredBuckets(config) ?? {}).length > 0;\n}\n\n/** Whether a **static** policy enables the AI Gateway (`aiGateway`). No network. */\nfunction configWantsAiGateway(config: Config): boolean {\n\treturn isServiceEnabledInput(authoredAiGateway(config));\n}\n\n/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */\nfunction isServiceEnabledInput(\n\ttoggle: ServiceToggleInput | undefined,\n): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/**\n * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates\n * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the\n * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed\n * `process.env.DATABASE_URL` lookups.\n *\n * Designed for the **\"env-vars-already-injected\"** path:\n * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.\n * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.\n * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.\n *\n * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now\n * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without\n * evaluating the per-branch closure.\n *\n * The second argument is a **scope** or a **key filter**:\n * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the\n *   full `{ postgres, auth?, dataApi?, … }` the policy enables.\n * - a **function slug** (a key of `config.functions`) — *function* scope: you are\n *   running inside that function. Returns the same branch secrets **plus** a typed\n *   `function` namespace with the function's declared env-var keys. The slug autocompletes\n *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.\n * - an **array of OS-level env-var keys** (e.g. `[\"DATABASE_URL\", \"NEON_AUTH_BASE_URL\"]`) —\n *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced\n *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only\n *   pick vars the policy actually enables. Use this when a process needs just a subset (a\n *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't\n *   want `parseEnv` to throw over vars you never use.\n *\n * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env\n * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.\n *\n * ```ts\n * import config from \"../neon\";\n * import { parseEnv } from \"@neon/env\";\n *\n * // External (app / build):\n * const env = parseEnv(config);\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n *\n * // Inside the \"hello\" function:\n * const env = parseEnv(config, \"hello\");\n * env.function.resendApiKey; // typed from hello's declared env keys\n *\n * // Filtered: only enforce + return the pooled URL.\n * const { postgres } = parseEnv(config, [\"DATABASE_URL\"]);\n * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent\n * ```\n */\nexport function parseEnv<const C extends Config>(config: C): NeonEnv<C>;\n// Overload order is load-bearing for **editor autocomplete**, not for type checking: when the\n// argument is a half-typed string literal the call resolves against no signature, and the\n// editor takes its string-literal completions from the first candidate overload. With the\n// `keys` overload listed first, the expected type of `parseEnv(config, \"…\")` is read as\n// `readonly K[]` — an array has no literal completions, so typing a function slug offered\n// nothing. Keep the slug overload ahead of the array one: `env.completions.test.ts` asserts the\n// completions through the language service, and `env.test-d.ts` locks the order itself (the\n// last overload is observable as `Parameters<typeof parseEnv>`), so `tsc` fails on a reorder.\nexport function parseEnv<\n\tconst C extends Config,\n\tconst S extends FunctionSlugOf<C>,\n>(\n\tconfig: C,\n\tscope: FunctionScopeField<C, S>,\n): NeonEnv<C> & NeonFunctionEnv<C, S>;\nexport function parseEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;\nexport function parseEnv(\n\tconfig: Config,\n\tscopeOrKeys?: string | readonly string[],\n): unknown {\n\tconst source = process.env;\n\tif (Array.isArray(scopeOrKeys)) {\n\t\treturn parseFilteredEnv(source, scopeOrKeys);\n\t}\n\t// `Array.isArray` doesn't narrow a `readonly string[]` out of the union, so re-derive the\n\t// function-slug scope from the remaining `string` shape explicitly.\n\tconst scope = typeof scopeOrKeys === \"string\" ? scopeOrKeys : undefined;\n\tconst issues: string[] = [];\n\tconst result: Record<string, unknown> = {};\n\n\tconst pg = postgresEnvSchema.safeParse({\n\t\tDATABASE_URL: source.DATABASE_URL,\n\t\tDATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED,\n\t});\n\tif (pg.success) {\n\t\tresult.postgres = {\n\t\t\tdatabaseUrl: pg.data.DATABASE_URL,\n\t\t\tdatabaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED,\n\t\t} satisfies NeonPostgresEnv;\n\t} else {\n\t\tfor (const issue of pg.error.issues) issues.push(issue.message);\n\t}\n\n\t// Branch identity is optional: the Functions runtime injects `NEON_BRANCH` on every\n\t// branch by default and `neon dev` / `neon-env run` / `env pull` emit it too, but older\n\t// runtimes and platform integrations may not, so a missing value is not an error — we\n\t// just omit the namespace rather than failing the whole parse.\n\tconst branchName = source[NEON_ENV_VAR_KEYS.branch.name];\n\tif (branchName !== undefined && branchName !== \"\") {\n\t\tresult.branch = { name: branchName } satisfies NeonBranchEnv;\n\t}\n\n\tif (isServiceEnabledInput(config.auth)) {\n\t\tconst auth = authEnvSchema.safeParse({\n\t\t\tNEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,\n\t\t\tNEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL,\n\t\t});\n\t\tif (auth.success) {\n\t\t\tresult.auth = {\n\t\t\t\tbaseUrl: auth.data.NEON_AUTH_BASE_URL,\n\t\t\t\tjwksUrl: auth.data.NEON_AUTH_JWKS_URL,\n\t\t\t} satisfies NeonAuthEnv;\n\t\t} else {\n\t\t\tfor (const issue of auth.error.issues) issues.push(issue.message);\n\t\t}\n\t}\n\n\tif (isServiceEnabledInput(config.dataApi)) {\n\t\tconst dataApi = dataApiEnvSchema.safeParse({\n\t\t\tNEON_DATA_API_URL: source.NEON_DATA_API_URL,\n\t\t});\n\t\tif (dataApi.success) {\n\t\t\tresult.dataApi = {\n\t\t\t\turl: dataApi.data.NEON_DATA_API_URL,\n\t\t\t} satisfies NeonDataApiEnv;\n\t\t} else {\n\t\t\tfor (const issue of dataApi.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsStorage(config)) {\n\t\tconst storage = storageEnvSchema.safeParse({\n\t\t\tAWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,\n\t\t\tAWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,\n\t\t\tAWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,\n\t\t\tAWS_REGION: source.AWS_REGION,\n\t\t});\n\t\tif (storage.success) {\n\t\t\tresult.storage = {\n\t\t\t\taccessKeyId: storage.data.AWS_ACCESS_KEY_ID,\n\t\t\t\tsecretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,\n\t\t\t\tendpoint: storage.data.AWS_ENDPOINT_URL_S3,\n\t\t\t\tregion: storage.data.AWS_REGION,\n\t\t\t} satisfies NeonStorageEnv;\n\t\t} else {\n\t\t\tfor (const issue of storage.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsAiGateway(config)) {\n\t\tconst aiGateway = aiGatewayEnvSchema.safeParse({\n\t\t\tNEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,\n\t\t\tNEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL,\n\t\t});\n\t\tif (aiGateway.success) {\n\t\t\tresult.aiGateway = {\n\t\t\t\tapiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,\n\t\t\t\tbaseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL,\n\t\t\t} satisfies NeonAiGatewayEnv;\n\t\t} else {\n\t\t\tfor (const issue of aiGateway.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tconst declaredFunctionSlugs = Object.keys(\n\t\tauthoredFunctions(config) ?? {},\n\t).sort();\n\tif (declaredFunctionSlugs.length > 0) {\n\t\tconst functions: Record<string, NeonFunctionUrlEnv> = {};\n\t\tfor (const slug of declaredFunctionSlugs) {\n\t\t\tconst key = functionBaseUrlKey(slug);\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (parsed.ok) {\n\t\t\t\tfunctions[slug] = { baseUrl: parsed.value };\n\t\t\t} else {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t}\n\t\t}\n\t\tif (Object.keys(functions).length === declaredFunctionSlugs.length) {\n\t\t\tresult.functions = functions;\n\t\t}\n\t}\n\n\tif (scope !== undefined) {\n\t\tconst fn = authoredFunctions(config)?.[scope];\n\t\tif (!fn) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.EnvNotInjected,\n\t\t\t\t[\n\t\t\t\t\t`parseEnv: no function \"${scope}\" is declared in this policy's functions.`,\n\t\t\t\t\t\"Pass a declared function slug (or omit the scope to read external env).\",\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t{ details: { scope } },\n\t\t\t);\n\t\t}\n\t\tconst envOut: Record<string, string> = {};\n\t\tfor (const key of Object.keys(fn.env ?? {})) {\n\t\t\tconst value = source[key];\n\t\t\t// Only a truly *unset* var is \"not injected\". Function env values carry no\n\t\t\t// non-empty constraint (unlike DATABASE_URL / NEON_AUTH_BASE_URL), so a\n\t\t\t// deliberately empty value is a present, valid value and is passed through.\n\t\t\tif (value === undefined) {\n\t\t\t\tissues.push(`${key} is missing (function \"${scope}\")`);\n\t\t\t} else {\n\t\t\t\tenvOut[key] = value;\n\t\t\t}\n\t\t}\n\t\tresult.function = envOut;\n\t}\n\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\n\treturn result;\n}\n\nfunction isFunctionBaseUrlIssue(issue: string): boolean {\n\treturn /^NEON_FUNCTION_[A-Z0-9]+_BASE_URL (is missing|must not be empty|must be a URL)$/.test(\n\t\tissue,\n\t);\n}\n\nfunction readFunctionBaseUrl(\n\tkey: string,\n\tvalue: string | undefined,\n): { ok: true; value: string } | { ok: false; issue: string } {\n\tif (value === undefined) {\n\t\treturn { ok: false, issue: `${key} is missing` };\n\t}\n\tif (value === \"\") {\n\t\treturn { ok: false, issue: `${key} must not be empty` };\n\t}\n\ttry {\n\t\tnew URL(value);\n\t} catch {\n\t\treturn { ok: false, issue: `${key} must be a URL` };\n\t}\n\treturn { ok: true, value };\n}\n\nfunction parseEnvInjectHint(issues: readonly string[]): string[] {\n\tif (issues.length > 0 && issues.every(isFunctionBaseUrlIssue)) {\n\t\treturn [\n\t\t\t\"Inject them via `neon env pull` or `neon-env run` (production URL), or `neon dev` (`http://localhost:<port>`).\",\n\t\t];\n\t}\n\tconst lines = [\n\t\t\"Inject them via one of:\",\n\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t];\n\tif (issues.some((issue) => issue.includes('(function \"'))) {\n\t\tlines.push(\n\t\t\t\"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.\",\n\t\t);\n\t}\n\tif (issues.some(isFunctionBaseUrlIssue)) {\n\t\tlines.push(\n\t\t\t\"  - for NEON_FUNCTION_*_BASE_URL: `neon env pull` or `neon dev`.\",\n\t\t);\n\t}\n\treturn lines;\n}\n\n/**\n * Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`\n * in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /\n * {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only\n * aliases).\n */\nconst FILTERABLE_ENV_KEYS: Record<string, readonly [string, string]> = {\n\tDATABASE_URL: [\"postgres\", \"databaseUrl\"],\n\tDATABASE_URL_UNPOOLED: [\"postgres\", \"databaseUrlUnpooled\"],\n\tNEON_BRANCH: [\"branch\", \"name\"],\n\tNEON_AUTH_BASE_URL: [\"auth\", \"baseUrl\"],\n\tNEON_AUTH_JWKS_URL: [\"auth\", \"jwksUrl\"],\n\tNEON_DATA_API_URL: [\"dataApi\", \"url\"],\n\tAWS_ACCESS_KEY_ID: [\"storage\", \"accessKeyId\"],\n\tAWS_SECRET_ACCESS_KEY: [\"storage\", \"secretAccessKey\"],\n\tAWS_ENDPOINT_URL_S3: [\"storage\", \"endpoint\"],\n\tAWS_REGION: [\"storage\", \"region\"],\n\tNEON_AI_GATEWAY_TOKEN: [\"aiGateway\", \"apiKey\"],\n\tNEON_AI_GATEWAY_BASE_URL: [\"aiGateway\", \"baseUrl\"],\n};\n\n/**\n * Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly\n * selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike\n * the full reader it never consults the policy — the selection alone decides what's required —\n * so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without\n * throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.\n */\nfunction parseFilteredEnv(\n\tsource: NodeJS.ProcessEnv,\n\tkeys: readonly string[],\n): Record<string, unknown> {\n\tconst issues: string[] = [];\n\tconst result: Record<string, Record<string, unknown>> = {};\n\tconst functionUrls: Record<string, NeonFunctionUrlEnv> = {};\n\tfor (const key of keys) {\n\t\tif (isFunctionBaseUrlKey(key)) {\n\t\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\t\tif (slug === null) continue;\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (!parsed.ok) {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfunctionUrls[slug] = { baseUrl: parsed.value };\n\t\t\tcontinue;\n\t\t}\n\t\t// Unknown keys are blocked at the type level; a runtime caller bypassing the types\n\t\t// gets a clear error rather than a silently-dropped selection.\n\t\tif (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {\n\t\t\tissues.push(`${key} is not a selectable Neon env variable`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst value = source[key];\n\t\tif (value === undefined) {\n\t\t\tissues.push(`${key} is missing`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (value === \"\") {\n\t\t\tissues.push(`${key} must not be empty`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst [namespace, property] = FILTERABLE_ENV_KEYS[key];\n\t\tconst bucket = result[namespace] ?? {};\n\t\tbucket[property] = value;\n\t\tresult[namespace] = bucket;\n\t}\n\tif (Object.keys(functionUrls).length > 0) {\n\t\tresult.functions = functionUrls;\n\t}\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0HA,MAAM,oBAAoB,EAAE,OAAO;CAClC,cAAc,EACZ,OAAO,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAC9C,IAAI,GAAG,gCAAgC;CACzC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;AACnD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC9B,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;CAC/C,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;AAChD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC,EAC/C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,qBAAqB,EACnB,OAAO,EAAE,SAAS,iCAAiC,CAAC,CAAC,CACrD,IAAI,GAAG,uCAAuC;CAChD,YAAY,EACV,OAAO,EAAE,SAAS,wBAAwB,CAAC,CAAC,CAC5C,IAAI,GAAG,8BAA8B;AACxC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CACnC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,0BAA0B,EACxB,OAAO,EAAE,SAAS,sCAAsC,CAAC,CAAC,CAC1D,IAAI,GAAG,4CAA4C;AACtD,CAAC;;AAGD,SAAS,mBAAmB,QAAyB;CACpD,OAAO,OAAO,KAAK,gBAAgB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,qBAAqB,QAAyB;CACtD,OAAO,sBAAsB,kBAAkB,MAAM,CAAC;AACvD;;AAGA,SAAS,sBACR,QACU;CACV,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;AAuEA,SAAgB,SACf,QACA,aACU;CACV,MAAM,SAAS,QAAQ;CACvB,IAAI,MAAM,QAAQ,WAAW,GAC5B,OAAO,iBAAiB,QAAQ,WAAW;CAI5C,MAAM,QAAQ,OAAO,gBAAgB,WAAW,cAAc,KAAA;CAC9D,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkC,CAAC;CAEzC,MAAM,KAAK,kBAAkB,UAAU;EACtC,cAAc,OAAO;EACrB,uBAAuB,OAAO;CAC/B,CAAC;CACD,IAAI,GAAG,SACN,OAAO,WAAW;EACjB,aAAa,GAAG,KAAK;EACrB,qBAAqB,GAAG,KAAK;CAC9B;MAEA,KAAK,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAO/D,MAAM,aAAa,OAAO,kBAAkB,OAAO;CACnD,IAAI,eAAe,KAAA,KAAa,eAAe,IAC9C,OAAO,SAAS,EAAE,MAAM,WAAW;CAGpC,IAAI,sBAAsB,OAAO,IAAI,GAAG;EACvC,MAAM,OAAO,cAAc,UAAU;GACpC,oBAAoB,OAAO;GAC3B,oBAAoB,OAAO;EAC5B,CAAC;EACD,IAAI,KAAK,SACR,OAAO,OAAO;GACb,SAAS,KAAK,KAAK;GACnB,SAAS,KAAK,KAAK;EACpB;OAEA,KAAK,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAElE;CAEA,IAAI,sBAAsB,OAAO,OAAO,GAAG;EAC1C,MAAM,UAAU,iBAAiB,UAAU,EAC1C,mBAAmB,OAAO,kBAC3B,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU,EAChB,KAAK,QAAQ,KAAK,kBACnB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,mBAAmB,MAAM,GAAG;EAC/B,MAAM,UAAU,iBAAiB,UAAU;GAC1C,mBAAmB,OAAO;GAC1B,uBAAuB,OAAO;GAC9B,qBAAqB,OAAO;GAC5B,YAAY,OAAO;EACpB,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU;GAChB,aAAa,QAAQ,KAAK;GAC1B,iBAAiB,QAAQ,KAAK;GAC9B,UAAU,QAAQ,KAAK;GACvB,QAAQ,QAAQ,KAAK;EACtB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,qBAAqB,MAAM,GAAG;EACjC,MAAM,YAAY,mBAAmB,UAAU;GAC9C,uBAAuB,OAAO;GAC9B,0BAA0B,OAAO;EAClC,CAAC;EACD,IAAI,UAAU,SACb,OAAO,YAAY;GAClB,QAAQ,UAAU,KAAK;GACvB,SAAS,UAAU,KAAK;EACzB;OAEA,KAAK,MAAM,SAAS,UAAU,MAAM,QACnC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,MAAM,wBAAwB,OAAO,KACpC,kBAAkB,MAAM,KAAK,CAAC,CAC/B,CAAC,CAAC,KAAK;CACP,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,YAAgD,CAAC;EACvD,KAAK,MAAM,QAAQ,uBAAuB;GACzC,MAAM,MAAM,mBAAmB,IAAI;GACnC,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,OAAO,IACV,UAAU,QAAQ,EAAE,SAAS,OAAO,MAAM;QAE1C,OAAO,KAAK,OAAO,KAAK;EAE1B;EACA,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,sBAAsB,QAC3D,OAAO,YAAY;CAErB;CAEA,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,KAAK,kBAAkB,MAAM,CAAC,GAAG;EACvC,IAAI,CAAC,IACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,0BAA0B,MAAM,4CAChC,yEACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;EAED,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG;GAC5C,MAAM,QAAQ,OAAO;GAIrB,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,GAAG,IAAI,yBAAyB,MAAM,GAAG;QAErD,OAAO,OAAO;EAEhB;EACA,OAAO,WAAW;CACnB;CAEA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAGD,OAAO;AACR;AAEA,SAAS,uBAAuB,OAAwB;CACvD,OAAO,kFAAkF,KACxF,KACD;AACD;AAEA,SAAS,oBACR,KACA,OAC6D;CAC7D,IAAI,UAAU,KAAA,GACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAa;CAEhD,IAAI,UAAU,IACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAoB;CAEvD,IAAI;EACH,IAAI,IAAI,KAAK;CACd,QAAQ;EACP,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,IAAI;EAAgB;CACnD;CACA,OAAO;EAAE,IAAI;EAAM;CAAM;AAC1B;AAEA,SAAS,mBAAmB,QAAqC;CAChE,IAAI,OAAO,SAAS,KAAK,OAAO,MAAM,sBAAsB,GAC3D,OAAO,CACN,gHACD;CAED,MAAM,QAAQ;EACb;EACA;EACA;CACD;CACA,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,cAAa,CAAC,GACvD,MAAM,KACL,gHACD;CAED,IAAI,OAAO,KAAK,sBAAsB,GACrC,MAAM,KACL,kEACD;CAED,OAAO;AACR;;;;;;;AAQA,MAAM,sBAAiE;CACtE,cAAc,CAAC,YAAY,aAAa;CACxC,uBAAuB,CAAC,YAAY,qBAAqB;CACzD,aAAa,CAAC,UAAU,MAAM;CAC9B,oBAAoB,CAAC,QAAQ,SAAS;CACtC,oBAAoB,CAAC,QAAQ,SAAS;CACtC,mBAAmB,CAAC,WAAW,KAAK;CACpC,mBAAmB,CAAC,WAAW,aAAa;CAC5C,uBAAuB,CAAC,WAAW,iBAAiB;CACpD,qBAAqB,CAAC,WAAW,UAAU;CAC3C,YAAY,CAAC,WAAW,QAAQ;CAChC,uBAAuB,CAAC,aAAa,QAAQ;CAC7C,0BAA0B,CAAC,aAAa,SAAS;AAClD;;;;;;;;AASA,SAAS,iBACR,QACA,MAC0B;CAC1B,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkD,CAAC;CACzD,MAAM,eAAmD,CAAC;CAC1D,KAAK,MAAM,OAAO,MAAM;EACvB,IAAI,qBAAqB,GAAG,GAAG;GAC9B,MAAM,OAAO,wBAAwB,GAAG;GACxC,IAAI,SAAS,MAAM;GACnB,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,CAAC,OAAO,IAAI;IACf,OAAO,KAAK,OAAO,KAAK;IACxB;GACD;GACA,aAAa,QAAQ,EAAE,SAAS,OAAO,MAAM;GAC7C;EACD;EAGA,IAAI,CAAC,OAAO,OAAO,qBAAqB,GAAG,GAAG;GAC7C,OAAO,KAAK,GAAG,IAAI,uCAAuC;GAC1D;EACD;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GAAW;GACxB,OAAO,KAAK,GAAG,IAAI,YAAY;GAC/B;EACD;EACA,IAAI,UAAU,IAAI;GACjB,OAAO,KAAK,GAAG,IAAI,mBAAmB;GACtC;EACD;EACA,MAAM,CAAC,WAAW,YAAY,oBAAoB;EAClD,MAAM,SAAS,OAAO,cAAc,CAAC;EACrC,OAAO,YAAY;EACnB,OAAO,aAAa;CACrB;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GACtC,OAAO,YAAY;CAEpB,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAED,OAAO;AACR"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/lib/parse-env.ts"],"sourcesContent":["/**\n * `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars\n * already injected into `process.env`, validate them against the policy, and return them in the\n * same namespaced shape.\n *\n * Lives in this package rather than in `@neon-internals/env-core` because nothing else needs\n * it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping\n * it here also keeps `zod` out of that package, and so out of every consumer that bundles it.\n */\n\nimport {\n\tauthoredAiGateway,\n\tauthoredBuckets,\n\tauthoredFunctions,\n\ttype Config,\n\tErrorCode,\n\tPlatformError,\n\ttype ServiceToggleInput,\n} from \"@neon/config/v1\";\nimport {\n\ttype FilteredNeonEnv,\n\tfunctionBaseUrlKey,\n\tisFunctionBaseUrlKey,\n\tNEON_ENV_VAR_KEYS,\n\ttype NeonAiGatewayEnv,\n\ttype NeonAuthEnv,\n\ttype NeonBranchEnv,\n\ttype NeonDataApiEnv,\n\ttype NeonEnv,\n\ttype NeonFunctionUrlEnv,\n\ttype NeonPostgresEnv,\n\ttype NeonRealtimeEnv,\n\ttype NeonStorageEnv,\n\tparseFunctionBaseUrlKey,\n\ttype SelectableEnvKey,\n} from \"@neon-internals/env-core/env\";\nimport { z } from \"zod\";\n\n/** The static `functions` record of a config (GA or deprecated `preview.functions`). */\ntype GaFunctionsOf<C extends Config> = [NonNullable<C[\"functions\"]>] extends [\n\tnever,\n]\n\t? Record<never, never>\n\t: string extends keyof NonNullable<C[\"functions\"]>\n\t\t? Record<never, never>\n\t\t: NonNullable<C[\"functions\"]>;\n\ntype PreviewFunctionsHome<C extends Config> = [\n\tNonNullable<C[\"preview\"]>,\n] extends [never]\n\t? Record<never, never>\n\t: NonNullable<C[\"preview\"]> extends { functions: infer F }\n\t\t? F\n\t\t: Record<never, never>;\n\ntype PreviewFunctionsOf<C extends Config> = [keyof GaFunctionsOf<C>] extends [\n\tnever,\n]\n\t? PreviewFunctionsHome<C>\n\t: [keyof PreviewFunctionsHome<C>] extends [never]\n\t\t? GaFunctionsOf<C>\n\t\t: GaFunctionsOf<C> & PreviewFunctionsHome<C>;\n\n/** The declared function slugs of a config (record keys), as a string union. */\nexport type FunctionSlugOf<C extends Config> = Extract<\n\tkeyof PreviewFunctionsOf<C>,\n\tstring\n>;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when\n * the policy declares no functions at all. Without it the argument's expected type is the bare\n * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '\"x\"' is not\n * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the\n * editor offers it as the single completion, so the empty completion list is explained rather\n * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.\n */\n// Exported (type-only) for the type tests in `env.test-d.ts`; intentionally not re-exported\n// from `index.ts`, so it stays an internal implementation detail.\nexport type NoFunctionScopeHint =\n\t\"this policy declares no `functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env\";\n\n/**\n * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug\n * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no\n * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes\n * the returned `function` namespace exact — it stays the one function's env keys instead of\n * widening to every declared function's.\n */\ntype FunctionScopeField<C extends Config, S extends string> = [\n\tFunctionSlugOf<C>,\n] extends [never]\n\t? NoFunctionScopeHint\n\t: S;\n\n/** The declared env-var keys of one function `S`, as a string union. */\ntype FunctionEnvKeysOf<\n\tC extends Config,\n\tS extends string,\n> = S extends keyof PreviewFunctionsOf<C>\n\t? NonNullable<PreviewFunctionsOf<C>[S]> extends { env: infer E }\n\t\t? Extract<keyof E, string>\n\t\t: never\n\t: never;\n\n/**\n * The extra `function` namespace added to `parseEnv`'s result when called with a function\n * slug scope: the declared env-var keys for that function, each resolved to a `string`.\n */\nexport type NeonFunctionEnv<C extends Config, S extends string> = {\n\tfunction: Record<FunctionEnvKeysOf<C, S>, string>;\n};\n\n// ───────────────────────── parseEnv ─────────────────────────\n\n/**\n * Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from\n * `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.\n *\n * `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include\n * URL-illegal characters in the password (rare but legal in Neon's connection-string\n * format) fail the WHATWG `URL` parse, so we settle for \"non-empty string\".\n */\nconst postgresEnvSchema = z.object({\n\tDATABASE_URL: z\n\t\t.string({ message: \"DATABASE_URL is missing\" })\n\t\t.min(1, \"DATABASE_URL must not be empty\"),\n\tDATABASE_URL_UNPOOLED: z\n\t\t.string({ message: \"DATABASE_URL_UNPOOLED is missing\" })\n\t\t.min(1, \"DATABASE_URL_UNPOOLED must not be empty\"),\n});\n\nconst authEnvSchema = z.object({\n\tNEON_AUTH_BASE_URL: z\n\t\t.string({ message: \"NEON_AUTH_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_BASE_URL must not be empty\"),\n\tNEON_AUTH_JWKS_URL: z\n\t\t.string({ message: \"NEON_AUTH_JWKS_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_JWKS_URL must not be empty\"),\n});\n\nconst dataApiEnvSchema = z.object({\n\tNEON_DATA_API_URL: z\n\t\t.string({ message: \"NEON_DATA_API_URL is missing\" })\n\t\t.min(1, \"NEON_DATA_API_URL must not be empty\"),\n});\n\nconst realtimeEnvSchema = z.object({\n\tNEON_REALTIME_URL: z\n\t\t.string({ message: \"NEON_REALTIME_URL is missing\" })\n\t\t.min(1, \"NEON_REALTIME_URL must not be empty\"),\n\tNEON_REALTIME_SECRET: z\n\t\t.string({ message: \"NEON_REALTIME_SECRET is missing\" })\n\t\t.min(1, \"NEON_REALTIME_SECRET must not be empty\"),\n});\n\nconst storageEnvSchema = z.object({\n\tAWS_ACCESS_KEY_ID: z\n\t\t.string({ message: \"AWS_ACCESS_KEY_ID is missing\" })\n\t\t.min(1, \"AWS_ACCESS_KEY_ID must not be empty\"),\n\tAWS_SECRET_ACCESS_KEY: z\n\t\t.string({ message: \"AWS_SECRET_ACCESS_KEY is missing\" })\n\t\t.min(1, \"AWS_SECRET_ACCESS_KEY must not be empty\"),\n\tAWS_ENDPOINT_URL_S3: z\n\t\t.string({ message: \"AWS_ENDPOINT_URL_S3 is missing\" })\n\t\t.min(1, \"AWS_ENDPOINT_URL_S3 must not be empty\"),\n\tAWS_REGION: z\n\t\t.string({ message: \"AWS_REGION is missing\" })\n\t\t.min(1, \"AWS_REGION must not be empty\"),\n});\n\nconst aiGatewayEnvSchema = z.object({\n\tNEON_AI_GATEWAY_TOKEN: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_TOKEN is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_TOKEN must not be empty\"),\n\tNEON_AI_GATEWAY_BASE_URL: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_BASE_URL must not be empty\"),\n});\n\n/** Whether a **static** policy declares object storage (`buckets`). No network. */\nfunction configWantsStorage(config: Config): boolean {\n\treturn Object.keys(authoredBuckets(config) ?? {}).length > 0;\n}\n\n/** Whether a **static** policy enables the AI Gateway (`aiGateway`). No network. */\nfunction configWantsAiGateway(config: Config): boolean {\n\treturn isServiceEnabledInput(authoredAiGateway(config));\n}\n\n/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */\nfunction isServiceEnabledInput(\n\ttoggle: ServiceToggleInput | undefined,\n): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/**\n * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates\n * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the\n * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed\n * `process.env.DATABASE_URL` lookups.\n *\n * Designed for the **\"env-vars-already-injected\"** path:\n * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.\n * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.\n * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.\n *\n * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now\n * static (`config.auth` / `config.dataApi` / `config.preview.realtime`), so it reads those\n * directly without evaluating the per-branch closure.\n *\n * The second argument is a **scope** or a **key filter**:\n * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the\n *   full `{ postgres, auth?, dataApi?, … }` the policy enables.\n * - a **function slug** (a key of `config.functions`) — *function* scope: you are\n *   running inside that function. Returns the same branch secrets **plus** a typed\n *   `function` namespace with the function's declared env-var keys. The slug autocompletes\n *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.\n * - an **array of OS-level env-var keys** (e.g. `[\"DATABASE_URL\", \"NEON_AUTH_BASE_URL\"]`) —\n *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced\n *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only\n *   pick vars the policy actually enables. Use this when a process needs just a subset (a\n *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't\n *   want `parseEnv` to throw over vars you never use.\n *\n * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env\n * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.\n *\n * ```ts\n * import config from \"../neon\";\n * import { parseEnv } from \"@neon/env\";\n *\n * // External (app / build):\n * const env = parseEnv(config);\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n *\n * // Inside the \"hello\" function:\n * const env = parseEnv(config, \"hello\");\n * env.function.resendApiKey; // typed from hello's declared env keys\n *\n * // Filtered: only enforce + return the pooled URL.\n * const { postgres } = parseEnv(config, [\"DATABASE_URL\"]);\n * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent\n * ```\n */\nexport function parseEnv<const C extends Config>(config: C): NeonEnv<C>;\n// Overload order is load-bearing for **editor autocomplete**, not for type checking: when the\n// argument is a half-typed string literal the call resolves against no signature, and the\n// editor takes its string-literal completions from the first candidate overload. With the\n// `keys` overload listed first, the expected type of `parseEnv(config, \"…\")` is read as\n// `readonly K[]` — an array has no literal completions, so typing a function slug offered\n// nothing. Keep the slug overload ahead of the array one: `env.completions.test.ts` asserts the\n// completions through the language service, and `env.test-d.ts` locks the order itself (the\n// last overload is observable as `Parameters<typeof parseEnv>`), so `tsc` fails on a reorder.\nexport function parseEnv<\n\tconst C extends Config,\n\tconst S extends FunctionSlugOf<C>,\n>(\n\tconfig: C,\n\tscope: FunctionScopeField<C, S>,\n): NeonEnv<C> & NeonFunctionEnv<C, S>;\nexport function parseEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;\nexport function parseEnv(\n\tconfig: Config,\n\tscopeOrKeys?: string | readonly string[],\n): unknown {\n\tconst source = process.env;\n\tif (Array.isArray(scopeOrKeys)) {\n\t\treturn parseFilteredEnv(source, scopeOrKeys);\n\t}\n\t// `Array.isArray` doesn't narrow a `readonly string[]` out of the union, so re-derive the\n\t// function-slug scope from the remaining `string` shape explicitly.\n\tconst scope = typeof scopeOrKeys === \"string\" ? scopeOrKeys : undefined;\n\tconst issues: string[] = [];\n\tconst result: Record<string, unknown> = {};\n\n\tconst pg = postgresEnvSchema.safeParse({\n\t\tDATABASE_URL: source.DATABASE_URL,\n\t\tDATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED,\n\t});\n\tif (pg.success) {\n\t\tresult.postgres = {\n\t\t\tdatabaseUrl: pg.data.DATABASE_URL,\n\t\t\tdatabaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED,\n\t\t} satisfies NeonPostgresEnv;\n\t} else {\n\t\tfor (const issue of pg.error.issues) issues.push(issue.message);\n\t}\n\n\t// Branch identity is optional: the Functions runtime injects `NEON_BRANCH` on every\n\t// branch by default and `neon dev` / `neon-env run` / `env pull` emit it too, but older\n\t// runtimes and platform integrations may not, so a missing value is not an error — we\n\t// just omit the namespace rather than failing the whole parse.\n\tconst branchName = source[NEON_ENV_VAR_KEYS.branch.name];\n\tif (branchName !== undefined && branchName !== \"\") {\n\t\tresult.branch = { name: branchName } satisfies NeonBranchEnv;\n\t}\n\n\tif (isServiceEnabledInput(config.auth)) {\n\t\tconst auth = authEnvSchema.safeParse({\n\t\t\tNEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,\n\t\t\tNEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL,\n\t\t});\n\t\tif (auth.success) {\n\t\t\tresult.auth = {\n\t\t\t\tbaseUrl: auth.data.NEON_AUTH_BASE_URL,\n\t\t\t\tjwksUrl: auth.data.NEON_AUTH_JWKS_URL,\n\t\t\t} satisfies NeonAuthEnv;\n\t\t} else {\n\t\t\tfor (const issue of auth.error.issues) issues.push(issue.message);\n\t\t}\n\t}\n\n\tif (isServiceEnabledInput(config.dataApi)) {\n\t\tconst dataApi = dataApiEnvSchema.safeParse({\n\t\t\tNEON_DATA_API_URL: source.NEON_DATA_API_URL,\n\t\t});\n\t\tif (dataApi.success) {\n\t\t\tresult.dataApi = {\n\t\t\t\turl: dataApi.data.NEON_DATA_API_URL,\n\t\t\t} satisfies NeonDataApiEnv;\n\t\t} else {\n\t\t\tfor (const issue of dataApi.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (\n\t\tconfig.preview?.realtime !== undefined &&\n\t\tconfig.preview.realtime !== false\n\t) {\n\t\tconst realtime = realtimeEnvSchema.safeParse({\n\t\t\tNEON_REALTIME_URL: source.NEON_REALTIME_URL,\n\t\t\tNEON_REALTIME_SECRET: source.NEON_REALTIME_SECRET,\n\t\t});\n\t\tif (realtime.success) {\n\t\t\tresult.realtime = {\n\t\t\t\turl: realtime.data.NEON_REALTIME_URL,\n\t\t\t\tsecret: realtime.data.NEON_REALTIME_SECRET,\n\t\t\t} satisfies NeonRealtimeEnv;\n\t\t} else {\n\t\t\tfor (const issue of realtime.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsStorage(config)) {\n\t\tconst storage = storageEnvSchema.safeParse({\n\t\t\tAWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,\n\t\t\tAWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,\n\t\t\tAWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,\n\t\t\tAWS_REGION: source.AWS_REGION,\n\t\t});\n\t\tif (storage.success) {\n\t\t\tresult.storage = {\n\t\t\t\taccessKeyId: storage.data.AWS_ACCESS_KEY_ID,\n\t\t\t\tsecretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,\n\t\t\t\tendpoint: storage.data.AWS_ENDPOINT_URL_S3,\n\t\t\t\tregion: storage.data.AWS_REGION,\n\t\t\t} satisfies NeonStorageEnv;\n\t\t} else {\n\t\t\tfor (const issue of storage.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsAiGateway(config)) {\n\t\tconst aiGateway = aiGatewayEnvSchema.safeParse({\n\t\t\tNEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,\n\t\t\tNEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL,\n\t\t});\n\t\tif (aiGateway.success) {\n\t\t\tresult.aiGateway = {\n\t\t\t\tapiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,\n\t\t\t\tbaseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL,\n\t\t\t} satisfies NeonAiGatewayEnv;\n\t\t} else {\n\t\t\tfor (const issue of aiGateway.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tconst declaredFunctionSlugs = Object.keys(\n\t\tauthoredFunctions(config) ?? {},\n\t).sort();\n\tif (declaredFunctionSlugs.length > 0) {\n\t\tconst functions: Record<string, NeonFunctionUrlEnv> = {};\n\t\tfor (const slug of declaredFunctionSlugs) {\n\t\t\tconst key = functionBaseUrlKey(slug);\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (parsed.ok) {\n\t\t\t\tfunctions[slug] = { baseUrl: parsed.value };\n\t\t\t} else {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t}\n\t\t}\n\t\tif (Object.keys(functions).length === declaredFunctionSlugs.length) {\n\t\t\tresult.functions = functions;\n\t\t}\n\t}\n\n\tif (scope !== undefined) {\n\t\tconst fn = authoredFunctions(config)?.[scope];\n\t\tif (!fn) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.EnvNotInjected,\n\t\t\t\t[\n\t\t\t\t\t`parseEnv: no function \"${scope}\" is declared in this policy's functions.`,\n\t\t\t\t\t\"Pass a declared function slug (or omit the scope to read external env).\",\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t{ details: { scope } },\n\t\t\t);\n\t\t}\n\t\tconst envOut: Record<string, string> = {};\n\t\tfor (const key of Object.keys(fn.env ?? {})) {\n\t\t\tconst value = source[key];\n\t\t\t// Only a truly *unset* var is \"not injected\". Function env values carry no\n\t\t\t// non-empty constraint (unlike DATABASE_URL / NEON_AUTH_BASE_URL), so a\n\t\t\t// deliberately empty value is a present, valid value and is passed through.\n\t\t\tif (value === undefined) {\n\t\t\t\tissues.push(`${key} is missing (function \"${scope}\")`);\n\t\t\t} else {\n\t\t\t\tenvOut[key] = value;\n\t\t\t}\n\t\t}\n\t\tresult.function = envOut;\n\t}\n\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\n\treturn result;\n}\n\nfunction isFunctionBaseUrlIssue(issue: string): boolean {\n\treturn /^NEON_FUNCTION_[A-Z0-9]+_BASE_URL (is missing|must not be empty|must be a URL)$/.test(\n\t\tissue,\n\t);\n}\n\nfunction readFunctionBaseUrl(\n\tkey: string,\n\tvalue: string | undefined,\n): { ok: true; value: string } | { ok: false; issue: string } {\n\tif (value === undefined) {\n\t\treturn { ok: false, issue: `${key} is missing` };\n\t}\n\tif (value === \"\") {\n\t\treturn { ok: false, issue: `${key} must not be empty` };\n\t}\n\ttry {\n\t\tnew URL(value);\n\t} catch {\n\t\treturn { ok: false, issue: `${key} must be a URL` };\n\t}\n\treturn { ok: true, value };\n}\n\nfunction parseEnvInjectHint(issues: readonly string[]): string[] {\n\tif (issues.length > 0 && issues.every(isFunctionBaseUrlIssue)) {\n\t\treturn [\n\t\t\t\"Inject them via `neon env pull` or `neon-env run` (production URL), or `neon dev` (`http://localhost:<port>`).\",\n\t\t];\n\t}\n\tconst lines = [\n\t\t\"Inject them via one of:\",\n\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t];\n\tif (issues.some((issue) => issue.includes('(function \"'))) {\n\t\tlines.push(\n\t\t\t\"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.\",\n\t\t);\n\t}\n\tif (issues.some(isFunctionBaseUrlIssue)) {\n\t\tlines.push(\n\t\t\t\"  - for NEON_FUNCTION_*_BASE_URL: `neon env pull` or `neon dev`.\",\n\t\t);\n\t}\n\treturn lines;\n}\n\n/**\n * Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`\n * in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /\n * {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only\n * aliases).\n */\nconst FILTERABLE_ENV_KEYS: Record<string, readonly [string, string]> = {\n\tDATABASE_URL: [\"postgres\", \"databaseUrl\"],\n\tDATABASE_URL_UNPOOLED: [\"postgres\", \"databaseUrlUnpooled\"],\n\tNEON_BRANCH: [\"branch\", \"name\"],\n\tNEON_AUTH_BASE_URL: [\"auth\", \"baseUrl\"],\n\tNEON_AUTH_JWKS_URL: [\"auth\", \"jwksUrl\"],\n\tNEON_DATA_API_URL: [\"dataApi\", \"url\"],\n\tNEON_REALTIME_URL: [\"realtime\", \"url\"],\n\tNEON_REALTIME_SECRET: [\"realtime\", \"secret\"],\n\tAWS_ACCESS_KEY_ID: [\"storage\", \"accessKeyId\"],\n\tAWS_SECRET_ACCESS_KEY: [\"storage\", \"secretAccessKey\"],\n\tAWS_ENDPOINT_URL_S3: [\"storage\", \"endpoint\"],\n\tAWS_REGION: [\"storage\", \"region\"],\n\tNEON_AI_GATEWAY_TOKEN: [\"aiGateway\", \"apiKey\"],\n\tNEON_AI_GATEWAY_BASE_URL: [\"aiGateway\", \"baseUrl\"],\n};\n\n/**\n * Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly\n * selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike\n * the full reader it never consults the policy — the selection alone decides what's required —\n * so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without\n * throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.\n */\nfunction parseFilteredEnv(\n\tsource: NodeJS.ProcessEnv,\n\tkeys: readonly string[],\n): Record<string, unknown> {\n\tconst issues: string[] = [];\n\tconst result: Record<string, Record<string, unknown>> = {};\n\tconst functionUrls: Record<string, NeonFunctionUrlEnv> = {};\n\tfor (const key of keys) {\n\t\tif (isFunctionBaseUrlKey(key)) {\n\t\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\t\tif (slug === null) continue;\n\t\t\tconst parsed = readFunctionBaseUrl(key, source[key]);\n\t\t\tif (!parsed.ok) {\n\t\t\t\tissues.push(parsed.issue);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfunctionUrls[slug] = { baseUrl: parsed.value };\n\t\t\tcontinue;\n\t\t}\n\t\t// Unknown keys are blocked at the type level; a runtime caller bypassing the types\n\t\t// gets a clear error rather than a silently-dropped selection.\n\t\tif (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {\n\t\t\tissues.push(`${key} is not a selectable Neon env variable`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst value = source[key];\n\t\tif (value === undefined) {\n\t\t\tissues.push(`${key} is missing`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (value === \"\") {\n\t\t\tissues.push(`${key} must not be empty`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst [namespace, property] = FILTERABLE_ENV_KEYS[key];\n\t\tconst bucket = result[namespace] ?? {};\n\t\tbucket[property] = value;\n\t\tresult[namespace] = bucket;\n\t}\n\tif (Object.keys(functionUrls).length > 0) {\n\t\tresult.functions = functionUrls;\n\t}\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t...parseEnvInjectHint(issues),\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA2HA,MAAM,oBAAoB,EAAE,OAAO;CAClC,cAAc,EACZ,OAAO,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAC9C,IAAI,GAAG,gCAAgC;CACzC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;AACnD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC9B,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;CAC/C,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;AAChD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC,EAC/C,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;CAClC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,sBAAsB,EACpB,OAAO,EAAE,SAAS,kCAAkC,CAAC,CAAC,CACtD,IAAI,GAAG,wCAAwC;AAClD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,qBAAqB,EACnB,OAAO,EAAE,SAAS,iCAAiC,CAAC,CAAC,CACrD,IAAI,GAAG,uCAAuC;CAChD,YAAY,EACV,OAAO,EAAE,SAAS,wBAAwB,CAAC,CAAC,CAC5C,IAAI,GAAG,8BAA8B;AACxC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CACnC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,0BAA0B,EACxB,OAAO,EAAE,SAAS,sCAAsC,CAAC,CAAC,CAC1D,IAAI,GAAG,4CAA4C;AACtD,CAAC;;AAGD,SAAS,mBAAmB,QAAyB;CACpD,OAAO,OAAO,KAAK,gBAAgB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,qBAAqB,QAAyB;CACtD,OAAO,sBAAsB,kBAAkB,MAAM,CAAC;AACvD;;AAGA,SAAS,sBACR,QACU;CACV,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;AAuEA,SAAgB,SACf,QACA,aACU;CACV,MAAM,SAAS,QAAQ;CACvB,IAAI,MAAM,QAAQ,WAAW,GAC5B,OAAO,iBAAiB,QAAQ,WAAW;CAI5C,MAAM,QAAQ,OAAO,gBAAgB,WAAW,cAAc,KAAA;CAC9D,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkC,CAAC;CAEzC,MAAM,KAAK,kBAAkB,UAAU;EACtC,cAAc,OAAO;EACrB,uBAAuB,OAAO;CAC/B,CAAC;CACD,IAAI,GAAG,SACN,OAAO,WAAW;EACjB,aAAa,GAAG,KAAK;EACrB,qBAAqB,GAAG,KAAK;CAC9B;MAEA,KAAK,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAO/D,MAAM,aAAa,OAAO,kBAAkB,OAAO;CACnD,IAAI,eAAe,KAAA,KAAa,eAAe,IAC9C,OAAO,SAAS,EAAE,MAAM,WAAW;CAGpC,IAAI,sBAAsB,OAAO,IAAI,GAAG;EACvC,MAAM,OAAO,cAAc,UAAU;GACpC,oBAAoB,OAAO;GAC3B,oBAAoB,OAAO;EAC5B,CAAC;EACD,IAAI,KAAK,SACR,OAAO,OAAO;GACb,SAAS,KAAK,KAAK;GACnB,SAAS,KAAK,KAAK;EACpB;OAEA,KAAK,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAElE;CAEA,IAAI,sBAAsB,OAAO,OAAO,GAAG;EAC1C,MAAM,UAAU,iBAAiB,UAAU,EAC1C,mBAAmB,OAAO,kBAC3B,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU,EAChB,KAAK,QAAQ,KAAK,kBACnB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IACC,OAAO,SAAS,aAAa,KAAA,KAC7B,OAAO,QAAQ,aAAa,OAC3B;EACD,MAAM,WAAW,kBAAkB,UAAU;GAC5C,mBAAmB,OAAO;GAC1B,sBAAsB,OAAO;EAC9B,CAAC;EACD,IAAI,SAAS,SACZ,OAAO,WAAW;GACjB,KAAK,SAAS,KAAK;GACnB,QAAQ,SAAS,KAAK;EACvB;OAEA,KAAK,MAAM,SAAS,SAAS,MAAM,QAClC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,mBAAmB,MAAM,GAAG;EAC/B,MAAM,UAAU,iBAAiB,UAAU;GAC1C,mBAAmB,OAAO;GAC1B,uBAAuB,OAAO;GAC9B,qBAAqB,OAAO;GAC5B,YAAY,OAAO;EACpB,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU;GAChB,aAAa,QAAQ,KAAK;GAC1B,iBAAiB,QAAQ,KAAK;GAC9B,UAAU,QAAQ,KAAK;GACvB,QAAQ,QAAQ,KAAK;EACtB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,qBAAqB,MAAM,GAAG;EACjC,MAAM,YAAY,mBAAmB,UAAU;GAC9C,uBAAuB,OAAO;GAC9B,0BAA0B,OAAO;EAClC,CAAC;EACD,IAAI,UAAU,SACb,OAAO,YAAY;GAClB,QAAQ,UAAU,KAAK;GACvB,SAAS,UAAU,KAAK;EACzB;OAEA,KAAK,MAAM,SAAS,UAAU,MAAM,QACnC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,MAAM,wBAAwB,OAAO,KACpC,kBAAkB,MAAM,KAAK,CAAC,CAC/B,CAAC,CAAC,KAAK;CACP,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,YAAgD,CAAC;EACvD,KAAK,MAAM,QAAQ,uBAAuB;GACzC,MAAM,MAAM,mBAAmB,IAAI;GACnC,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,OAAO,IACV,UAAU,QAAQ,EAAE,SAAS,OAAO,MAAM;QAE1C,OAAO,KAAK,OAAO,KAAK;EAE1B;EACA,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,WAAW,sBAAsB,QAC3D,OAAO,YAAY;CAErB;CAEA,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,KAAK,kBAAkB,MAAM,CAAC,GAAG;EACvC,IAAI,CAAC,IACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,0BAA0B,MAAM,4CAChC,yEACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;EAED,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG;GAC5C,MAAM,QAAQ,OAAO;GAIrB,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,GAAG,IAAI,yBAAyB,MAAM,GAAG;QAErD,OAAO,OAAO;EAEhB;EACA,OAAO,WAAW;CACnB;CAEA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAGD,OAAO;AACR;AAEA,SAAS,uBAAuB,OAAwB;CACvD,OAAO,kFAAkF,KACxF,KACD;AACD;AAEA,SAAS,oBACR,KACA,OAC6D;CAC7D,IAAI,UAAU,KAAA,GACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAa;CAEhD,IAAI,UAAU,IACb,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI;CAAoB;CAEvD,IAAI;EACH,IAAI,IAAI,KAAK;CACd,QAAQ;EACP,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,IAAI;EAAgB;CACnD;CACA,OAAO;EAAE,IAAI;EAAM;CAAM;AAC1B;AAEA,SAAS,mBAAmB,QAAqC;CAChE,IAAI,OAAO,SAAS,KAAK,OAAO,MAAM,sBAAsB,GAC3D,OAAO,CACN,gHACD;CAED,MAAM,QAAQ;EACb;EACA;EACA;CACD;CACA,IAAI,OAAO,MAAM,UAAU,MAAM,SAAS,cAAa,CAAC,GACvD,MAAM,KACL,gHACD;CAED,IAAI,OAAO,KAAK,sBAAsB,GACrC,MAAM,KACL,kEACD;CAED,OAAO;AACR;;;;;;;AAQA,MAAM,sBAAiE;CACtE,cAAc,CAAC,YAAY,aAAa;CACxC,uBAAuB,CAAC,YAAY,qBAAqB;CACzD,aAAa,CAAC,UAAU,MAAM;CAC9B,oBAAoB,CAAC,QAAQ,SAAS;CACtC,oBAAoB,CAAC,QAAQ,SAAS;CACtC,mBAAmB,CAAC,WAAW,KAAK;CACpC,mBAAmB,CAAC,YAAY,KAAK;CACrC,sBAAsB,CAAC,YAAY,QAAQ;CAC3C,mBAAmB,CAAC,WAAW,aAAa;CAC5C,uBAAuB,CAAC,WAAW,iBAAiB;CACpD,qBAAqB,CAAC,WAAW,UAAU;CAC3C,YAAY,CAAC,WAAW,QAAQ;CAChC,uBAAuB,CAAC,aAAa,QAAQ;CAC7C,0BAA0B,CAAC,aAAa,SAAS;AAClD;;;;;;;;AASA,SAAS,iBACR,QACA,MAC0B;CAC1B,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkD,CAAC;CACzD,MAAM,eAAmD,CAAC;CAC1D,KAAK,MAAM,OAAO,MAAM;EACvB,IAAI,qBAAqB,GAAG,GAAG;GAC9B,MAAM,OAAO,wBAAwB,GAAG;GACxC,IAAI,SAAS,MAAM;GACnB,MAAM,SAAS,oBAAoB,KAAK,OAAO,IAAI;GACnD,IAAI,CAAC,OAAO,IAAI;IACf,OAAO,KAAK,OAAO,KAAK;IACxB;GACD;GACA,aAAa,QAAQ,EAAE,SAAS,OAAO,MAAM;GAC7C;EACD;EAGA,IAAI,CAAC,OAAO,OAAO,qBAAqB,GAAG,GAAG;GAC7C,OAAO,KAAK,GAAG,IAAI,uCAAuC;GAC1D;EACD;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GAAW;GACxB,OAAO,KAAK,GAAG,IAAI,YAAY;GAC/B;EACD;EACA,IAAI,UAAU,IAAI;GACjB,OAAO,KAAK,GAAG,IAAI,mBAAmB;GACtC;EACD;EACA,MAAM,CAAC,WAAW,YAAY,oBAAoB;EAClD,MAAM,SAAS,OAAO,cAAc,CAAC;EACrC,OAAO,YAAY;EACnB,OAAO,aAAa;CACrB;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GACtC,OAAO,YAAY;CAEpB,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B,GAAG,mBAAmB,MAAM;EAC5B;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAED,OAAO;AACR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neon/env",
-  "version": "1.5.3",
+  "version": "1.6.1",
   "description": "Resolve and inject Neon connection strings for the branch selected by your neon.ts policy. fetchEnv / parseEnv plus a `neon-env` CLI with `run` and `export`.",
   "keywords": [
     "neon",
@@ -45,15 +45,15 @@
     "tsdown": "^0.14.1",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.29",
+    "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.32",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/sdk": "7.0.1",
-    "@neon-internals/cli-core": "0.0.0"
+    "@neon/sdk": "7.2.0"
   },
   "dependencies": {
     "zod": "^4.4.3",
     "yargs": "^18.0.0",
-    "@neon/config": "1.8.6"
+    "@neon/config": "1.9.1"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"