@neon/env 1.6.14 → 2.0.0

package/dist/env.js

@@ -1,4 +1,4 @@
-import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
+import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, resolveConfig } from "@neon/config/v1";
 // ../../internals/env-core/dist/roles.js
 /**
 * Neon's default branch owner role, created with every project. This is the role a
@@ -52,13 +52,27 @@ function defaultConnectionRole(roleNames) {
 * user added a second database next to `neondb`) auto-picks without asking.
 */
 const NEON_DEFAULT_DATABASE = "neondb";
+/**
+* Set only by `neon dev`: a JSON object mapping each function it serves to its localhost port,
+* which `functionBaseUrl` prefers over the deployed hostname.
+*/
+const NEON_DEV_FUNCTION_PORTS = "NEON_DEV_FUNCTION_PORTS";
 const NEON_ENV_VAR_KEYS = {
 	/**
 	* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
 	* Neon Functions runtime on every branch (including the default) by default. `env pull` /
 	* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.
 	*/
-	branch: { name: "NEON_BRANCH" },
+	branch: {
+		name: "NEON_BRANCH",
+		id: "NEON_BRANCH_ID",
+		/**
+		* Shared by every function on the branch, with a leading dot
+		* (`.compute.c-2.us-east-2.aws.neon.tech`). A function's host is
+		* `<NEON_BRANCH_ID>-<slug><NEON_FUNCTION_HOST_SUFFIX>`.
+		*/
+		functionHostSuffix: "NEON_FUNCTION_HOST_SUFFIX"
+	},
 	postgres: {
 		databaseUrl: "DATABASE_URL",
 		databaseUrlUnpooled: "DATABASE_URL_UNPOOLED"
@@ -95,19 +109,6 @@ const NEON_ENV_VAR_KEYS = {
 		baseUrl: "NEON_AI_GATEWAY_BASE_URL"
 	}
 };
-const FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;
-const FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;
-function functionBaseUrlKey(slug) {
-	if (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);
-	return `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;
-}
-function parseFunctionBaseUrlKey(key) {
-	const match = FUNCTION_BASE_URL_KEY.exec(key);
-	return match ? match[1].toLowerCase() : null;
-}
-function isFunctionBaseUrlKey(key) {
-	return parseFunctionBaseUrlKey(key) !== null;
-}
 async function fetchEnv(config, options) {
 	if (options.keys) assertStorageCredentialKeyPair(options.keys);
 	return fetchEnvKeys(config, options, options.keys ?? null);
@@ -217,24 +218,13 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 	const wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);
 	const wantsRealtime = desired.realtimePolicy === "enabled" && (wants(K.realtime.url) || wants(K.realtime.secret));
 	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
-	const functionUrlMode = options.functionUrls ?? "policy";
-	const declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);
-	const selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);
-	const constructSlugs = functionUrlSlugsToConstruct({
-		functionUrlMode,
-		selection,
-		declaredSlugs,
-		selectedFunctionKeys,
-		wants
-	});
-	const wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;
+	const wantsFunctionHostSuffix = wants(K.branch.functionHostSuffix) && (selection !== null || options.functionHostSuffix === "always" || (desired.preview?.functions.length ?? 0) > 0);
 	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
 	const wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));
-	const functionsRead = functionUrlMode === "all-live" && wantsAnyFunctionUrl && options.listedFunctions === void 0 ? listFunctionInvocationUrls(api, projectId, branch.id) : null;
-	functionsRead?.catch(() => void 0);
-	const storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;
-	const needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;
+	const needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl);
 	const needsConnectionTarget = wantsPooled || needsUnpooled;
+	const storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;
+	const endpointsRead = wantsFunctionHostSuffix && !needsConnectionTarget ? started(() => api.listEndpoints(projectId)) : null;
 	const needsDatabase = needsConnectionTarget || wantsDataApi;
 	const [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);
 	const databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;
@@ -260,7 +250,16 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 	if (wantsPooled) postgres.databaseUrl = requiredValue(pooled, "pooled connection URI response").uri;
 	if (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, "direct connection URI response").uri;
 	if (Object.keys(postgres).length > 0) result.postgres = postgres;
-	if (wants(K.branch.name)) result.branch = { name: branch.name };
+	if (wants(K.branch.name) || wants(K.branch.id) || wantsFunctionHostSuffix) {
+		const branchEnv = {};
+		if (wants(K.branch.name)) branchEnv.name = branch.name;
+		if (wants(K.branch.id)) branchEnv.id = branch.id;
+		if (wantsFunctionHostSuffix) {
+			const connectionUri = unpooled?.uri ?? pooled?.uri;
+			branchEnv.functionHostSuffix = functionHostSuffix(connectionUri !== void 0 ? new URL(connectionUri).hostname : branchComputeHost(await requiredValue(endpointsRead, "branch endpoint list"), branch));
+		}
+		result.branch = branchEnv;
+	}
 	if (wantsAuth) {
 		if (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false."].join(" "), { details: {
 			projectId,
@@ -333,66 +332,7 @@ async function fetchEnvKeysState(config, options, keys, policy) {
 			result.aiGateway = gateway;
 		}
 	}
-	const functions = {};
-	let functionUrlsUnavailable = false;
-	if (functionUrlMode === "all-live" && wantsAnyFunctionUrl) {
-		const listed = options.listedFunctions === void 0 ? await requiredValue(functionsRead, "function listing") : listedFromSnapshots(options.listedFunctions);
-		if (listed.status === "unavailable") {
-			if (selection === null) functionUrlsUnavailable = true;
-		} else for (const fn of listed.functions) {
-			if (!wants(functionBaseUrlKey(fn.slug))) continue;
-			functions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };
-		}
-	}
-	const missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);
-	if (missingConstructSlugs.length > 0) {
-		const uri = requiredValue(unpooled, "direct connection URI for function invocation URLs").uri;
-		for (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };
-	}
-	assertSelectedFunctionUrls(selectedFunctionKeys, functions);
-	if (Object.keys(functions).length > 0) result.functions = functions;
-	return {
-		env: result,
-		functionUrlsUnavailable
-	};
-}
-function functionUrlSlugsToConstruct(args) {
-	const slugs = [];
-	if (args.functionUrlMode === "policy" && args.selection === null) {
-		for (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);
-		return slugs;
-	}
-	for (const key of args.selectedFunctionKeys) {
-		const slug = parseFunctionBaseUrlKey(key);
-		if (slug !== null) slugs.push(slug);
-	}
-	return slugs;
-}
-function listedFromSnapshots(snapshots) {
-	return {
-		status: "ok",
-		functions: snapshots.filter((fn) => fn.invocationUrl !== "").map((fn) => ({
-			slug: fn.slug,
-			invocationUrl: fn.invocationUrl
-		})).sort((left, right) => left.slug.localeCompare(right.slug))
-	};
-}
-function assertSelectedFunctionUrls(keys, functions) {
-	for (const key of keys) {
-		const slug = parseFunctionBaseUrlKey(key);
-		if (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);
-	}
-}
-async function listFunctionInvocationUrls(api, projectId, branchId) {
-	try {
-		return listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));
-	} catch (error) {
-		if (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {
-			status: "unavailable",
-			error
-		};
-		throw error;
-	}
+	return { env: result };
 }
 /**
 * Resolve the target branch and evaluate the policy against it — the first thing any
@@ -457,6 +397,8 @@ function policyEnvKeys(desired) {
 		K.postgres.databaseUrl,
 		K.postgres.databaseUrlUnpooled,
 		K.branch.name,
+		K.branch.id,
+		...(desired.preview?.functions.length ?? 0) > 0 ? [K.branch.functionHostSuffix] : [],
 		...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],
 		...desired.dataApiEnabled ? [K.dataApi.url] : [],
 		...desired.realtimePolicy === "enabled" ? [K.realtime.url, K.realtime.secret] : [],
@@ -571,24 +513,20 @@ function aiGatewayHost(branchId, connectionUri) {
 	return `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;
 }
 /**
-* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`
-* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).
+* `NEON_FUNCTION_HOST_SUFFIX` from a compute host: the endpoint label is replaced by
+* `compute`, as the Functions runtime does (`.compute.c-2.us-east-2.aws.neon.tech`).
 */
-function asEnvBaseUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);
-	return parsed.origin;
-}
-/** Derived from the connection URI so undeployed functions have a cell-routed URL. */
-function functionInvocationUrl(branchId, slug, connectionUri) {
-	const suffix = connectionHostSuffix(connectionUri);
-	if (suffix === "") throw new Error(`fetchEnv: cannot derive the invocation URL for function "${slug}": the direct connection URI has no host suffix.`);
-	return `https://${branchId}-${slug}.compute.${suffix}`;
+function functionHostSuffix(computeHost) {
+	const suffix = computeHost.split(".").slice(1).join(".");
+	if (suffix === "") throw new Error(`fetchEnv: cannot derive NEON_FUNCTION_HOST_SUFFIX from compute host ${JSON.stringify(computeHost)}.`);
+	return `.compute.${suffix}`;
+}
+/** The branch's read-write compute host, else its first compute host. */
+function branchComputeHost(endpoints, branch) {
+	const own = endpoints.filter((endpoint) => endpoint.branchId === branch.id);
+	const endpoint = own.find((candidate) => candidate.type === "read_write") ?? own[0];
+	if (!endpoint?.host) throw new PlatformError(ErrorCode.NotFound, `fetchEnv: branch ${branch.name} (${branch.id}) has no compute endpoint, so NEON_FUNCTION_HOST_SUFFIX cannot be derived. Add a compute to the branch, then re-run.`, { details: { branchId: branch.id } });
+	return endpoint.host;
 }
 /** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */
 function aiGatewayBaseUrl(branchId, connectionUri) {
@@ -669,6 +607,8 @@ function toEntries(env) {
 	put(K.postgres.databaseUrl, env.postgres?.databaseUrl);
 	put(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);
 	put(K.branch.name, env.branch?.name);
+	put(K.branch.id, env.branch?.id);
+	put(K.branch.functionHostSuffix, env.branch?.functionHostSuffix);
 	put(K.auth.baseUrl, env.auth?.baseUrl);
 	put(K.auth.jwksUrl, env.auth?.jwksUrl);
 	put(K.dataApi.url, env.dataApi?.url);
@@ -680,9 +620,8 @@ function toEntries(env) {
 	put(K.storage.region, env.storage?.region);
 	put(K.aiGateway.apiKey, env.aiGateway?.apiKey);
 	put(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);
-	if (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);
 	return out;
 }
-export { defaultAiGatewayCredential as a, fetchEnvKeysState as c, isLiveCredential as d, parseFunctionBaseUrlKey as f, toEntries as h, credentialName as i, functionBaseUrlKey as l, resolveBranchPolicy as m, createApiFromOptions as n, defaultStorageCredential as o, policyEnvKeys as p, credentialEnvKeys as r, fetchEnv as s, NEON_ENV_VAR_KEYS as t, isFunctionBaseUrlKey as u };
+export { credentialName as a, fetchEnv as c, policyEnvKeys as d, resolveBranchPolicy as f, credentialEnvKeys as i, fetchEnvKeysState as l, NEON_ENV_VAR_KEYS as n, defaultAiGatewayCredential as o, toEntries as p, createApiFromOptions as r, defaultStorageCredential as s, NEON_DEV_FUNCTION_PORTS as t, isLiveCredential as u };
 
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/roles.js","../../../internals/env-core/dist/env.js"],"sourcesContent":["// src/roles.ts\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\n/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */\nfunction defaultConnectionRole(roleNames) {\n\tif (roleNames.length === 1) return roleNames[0];\n\tif (roleNames.includes(\"neondb_owner\")) return NEON_DEFAULT_OWNER_ROLE;\n\tconst appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));\n\treturn appRoles.length === 1 ? appRoles[0] : void 0;\n}\nexport { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole };\n\n//# sourceMappingURL=roles.js.map","import { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole } from \"./roles.js\";\nimport { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from \"@neon/config/v1\";\n// src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema} / {@link realtimeEnvSchema}.\n*/\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: { name: \"NEON_BRANCH\" },\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\trealtime: {\n\t\turl: \"NEON_REALTIME_URL\",\n\t\tsecret: \"NEON_REALTIME_SECRET\"\n\t},\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nconst FUNCTION_SLUG = /^[a-z0-9]{1,20}$/;\nconst FUNCTION_BASE_URL_KEY = /^NEON_FUNCTION_([A-Z0-9]{1,20})_BASE_URL$/;\nfunction functionBaseUrlKey(slug) {\n\tif (!FUNCTION_SLUG.test(slug)) throw new Error(`functionBaseUrlKey: ${JSON.stringify(slug)} is not a function slug ([a-z0-9]{1,20}).`);\n\treturn `NEON_FUNCTION_${slug.toUpperCase()}_BASE_URL`;\n}\nfunction parseFunctionBaseUrlKey(key) {\n\tconst match = FUNCTION_BASE_URL_KEY.exec(key);\n\treturn match ? match[1].toLowerCase() : null;\n}\nfunction isFunctionBaseUrlKey(key) {\n\treturn parseFunctionBaseUrlKey(key) !== null;\n}\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/**\n* Starts a read now and keeps an unread rejection from crashing the process; the caller\n* awaits it (and sees the error) when its turn comes. The read is called synchronously and\n* its own promise returned, so errors surface in the same order as a direct call; a\n* synchronous throw becomes the returned rejection.\n*/\nfunction started(read) {\n\tlet promise;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => void 0);\n\treturn promise;\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\nconst REALTIME_POLL_INTERVAL_MS = 1e3;\n/**\n* Wait for asynchronous Realtime provisioning/rotation before reading its secret. The\n* secret endpoint deliberately returns 404 until provisioning finishes, and during a\n* rotation it can still expose the previous key while `pending` is true.\n*/\nasync function resolveRealtimeEnv(args) {\n\tconst getRealtime = args.api.getProjectBranchRealtime;\n\tif (!getRealtime) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve Realtime: this NeonApi adapter does not implement getProjectBranchRealtime.\");\n\tconst getSecret = args.api.getProjectBranchRealtimeSecret;\n\tlet resolvedEnv;\n\twhile (resolvedEnv === void 0) {\n\t\tconst snapshot = await getRealtime.call(args.api, args.projectId, args.branch.id);\n\t\tif (!snapshot.pending) {\n\t\t\tif (!snapshot.enabled) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables realtime but Realtime is disabled on branch ${args.branch.name} (${args.branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon deploy`) and re-run fetchEnv. Or set realtime to false or omit it.\"].join(\" \"), { details: {\n\t\t\t\tprojectId: args.projectId,\n\t\t\t\tbranchId: args.branch.id\n\t\t\t} });\n\t\t\tlet secret;\n\t\t\tif (args.wantsSecret) {\n\t\t\t\tif (!getSecret) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve NEON_REALTIME_SECRET: this NeonApi adapter does not implement getProjectBranchRealtimeSecret.\");\n\t\t\t\tsecret = await getSecret.call(args.api, args.projectId, args.branch.id);\n\t\t\t}\n\t\t\tif (!secret?.pending) resolvedEnv = {\n\t\t\t\t...args.wantsUrl ? { url: realtimeWebSocketUrl(requiredRealtimeInvocationUrl(snapshot, args.branch)) } : {},\n\t\t\t\t...secret ? { secret: secret.secret } : {}\n\t\t\t};\n\t\t}\n\t\tif (resolvedEnv === void 0) await new Promise((resolve) => setTimeout(resolve, REALTIME_POLL_INTERVAL_MS));\n\t}\n\treturn resolvedEnv;\n}\nfunction requiredRealtimeInvocationUrl(snapshot, branch) {\n\tif (snapshot.invocationUrl !== void 0 && snapshot.invocationUrl !== \"\") return snapshot.invocationUrl;\n\tthrow new PlatformError(ErrorCode.ServerError, `Realtime is enabled on branch ${branch.name} (${branch.id}), but the Neon API returned no invocation URL.`, { details: { branchId: branch.id } });\n}\n/** Normalize the control-plane invocation URL to the WebSocket URL the client SDK needs. */\nfunction realtimeWebSocketUrl(value) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new PlatformError(ErrorCode.ServerError, `Realtime invocation URL is invalid: ${JSON.stringify(value)}.`);\n\t}\n\tif (parsed.protocol === \"https:\") parsed.protocol = \"wss:\";\n\telse if (parsed.protocol === \"http:\") parsed.protocol = \"ws:\";\n\telse if (parsed.protocol !== \"wss:\" && parsed.protocol !== \"ws:\") throw new PlatformError(ErrorCode.ServerError, `Realtime invocation URL must use http(s) or ws(s): ${JSON.stringify(value)}.`);\n\treturn parsed.toString();\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\n/**\n* `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n* the caller already has it.\n*/\nasync function fetchEnvKeysState(config, options, keys, policy) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = policy ?? await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst wantsRealtime = desired.realtimePolicy === \"enabled\" && (wants(K.realtime.url) || wants(K.realtime.secret));\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst functionUrlMode = options.functionUrls ?? \"policy\";\n\tconst declaredSlugs = (desired.preview?.functions ?? []).map((fn) => fn.slug);\n\tconst selectedFunctionKeys = selection === null ? [] : [...selection].filter(isFunctionBaseUrlKey);\n\tconst constructSlugs = functionUrlSlugsToConstruct({\n\t\tfunctionUrlMode,\n\t\tselection,\n\t\tdeclaredSlugs,\n\t\tselectedFunctionKeys,\n\t\twants\n\t});\n\tconst wantsAnyFunctionUrl = selection === null || selectedFunctionKeys.length > 0;\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst functionsRead = functionUrlMode === \"all-live\" && wantsAnyFunctionUrl && options.listedFunctions === void 0 ? listFunctionInvocationUrls(api, projectId, branch.id) : null;\n\tfunctionsRead?.catch(() => void 0);\n\tconst storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl) || constructSlugs.length > 0;\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name)) result.branch = { name: branch.name };\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tif (wantsRealtime) {\n\t\tconst realtime = await resolveRealtimeEnv({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranch,\n\t\t\twantsUrl: wants(K.realtime.url),\n\t\t\twantsSecret: wants(K.realtime.secret)\n\t\t});\n\t\tconst realtimeEnv = {};\n\t\tif (wants(K.realtime.url)) realtimeEnv.url = requiredValue(realtime.url, \"WebSocket URL for enabled Realtime\");\n\t\tif (wants(K.realtime.secret)) realtimeEnv.secret = requiredValue(realtime.secret, \"shared secret for enabled Realtime\");\n\t\tresult.realtime = realtimeEnv;\n\t}\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await requiredValue(storageRead, \"storage read\");\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\tconst functions = {};\n\tlet functionUrlsUnavailable = false;\n\tif (functionUrlMode === \"all-live\" && wantsAnyFunctionUrl) {\n\t\tconst listed = options.listedFunctions === void 0 ? await requiredValue(functionsRead, \"function listing\") : listedFromSnapshots(options.listedFunctions);\n\t\tif (listed.status === \"unavailable\") {\n\t\t\tif (selection === null) functionUrlsUnavailable = true;\n\t\t} else for (const fn of listed.functions) {\n\t\t\tif (!wants(functionBaseUrlKey(fn.slug))) continue;\n\t\t\tfunctions[fn.slug] = { baseUrl: asEnvBaseUrl(fn.invocationUrl) };\n\t\t}\n\t}\n\tconst missingConstructSlugs = constructSlugs.filter((slug) => functions[slug] === void 0);\n\tif (missingConstructSlugs.length > 0) {\n\t\tconst uri = requiredValue(unpooled, \"direct connection URI for function invocation URLs\").uri;\n\t\tfor (const slug of missingConstructSlugs) functions[slug] = { baseUrl: functionInvocationUrl(branch.id, slug, uri) };\n\t}\n\tassertSelectedFunctionUrls(selectedFunctionKeys, functions);\n\tif (Object.keys(functions).length > 0) result.functions = functions;\n\treturn {\n\t\tenv: result,\n\t\tfunctionUrlsUnavailable\n\t};\n}\nfunction functionUrlSlugsToConstruct(args) {\n\tconst slugs = [];\n\tif (args.functionUrlMode === \"policy\" && args.selection === null) {\n\t\tfor (const slug of args.declaredSlugs) if (args.wants(functionBaseUrlKey(slug))) slugs.push(slug);\n\t\treturn slugs;\n\t}\n\tfor (const key of args.selectedFunctionKeys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug !== null) slugs.push(slug);\n\t}\n\treturn slugs;\n}\nfunction listedFromSnapshots(snapshots) {\n\treturn {\n\t\tstatus: \"ok\",\n\t\tfunctions: snapshots.filter((fn) => fn.invocationUrl !== \"\").map((fn) => ({\n\t\t\tslug: fn.slug,\n\t\t\tinvocationUrl: fn.invocationUrl\n\t\t})).sort((left, right) => left.slug.localeCompare(right.slug))\n\t};\n}\nfunction assertSelectedFunctionUrls(keys, functions) {\n\tfor (const key of keys) {\n\t\tconst slug = parseFunctionBaseUrlKey(key);\n\t\tif (slug === null || functions[slug] === void 0) throw new Error(`fetchEnv: missing ${key}.`);\n\t}\n}\nasync function listFunctionInvocationUrls(api, projectId, branchId) {\n\ttry {\n\t\treturn listedFromSnapshots(await api.listBranchFunctions(projectId, branchId));\n\t} catch (error) {\n\t\tif (isPlatformError(error) && error.code === ErrorCode.FeatureUnavailable) return {\n\t\t\tstatus: \"unavailable\",\n\t\t\terror\n\t\t};\n\t\tthrow error;\n\t}\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api, resolved) {\n\tconst branch = resolved ?? await listAndResolveBranch(options, api);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\nasync function listAndResolveBranch(options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\treturn resolveBranch(branchRef, branches);\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...desired.realtimePolicy === \"enabled\" ? [K.realtime.url, K.realtime.secret] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tconst storageReveal = needsStorage && storageDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId)) : null;\n\tconst gatewayReveal = needsGateway && gatewayDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)) : null;\n\tif (storageReveal) {\n\t\tconst revealed = await storageReveal;\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (gatewayReveal) secrets.apiToken = (await gatewayReveal).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* The API's `invocation_url` ends with `/` so paths concatenate onto it. Neon `*_BASE_URL`\n* vars are origin-only (`NEON_AUTH_BASE_URL`, `NEON_AI_GATEWAY_BASE_URL`).\n*/\nfunction asEnvBaseUrl(url) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(url);\n\t} catch {\n\t\tthrow new Error(`fetchEnv: function invocation URL is not a URL: ${JSON.stringify(url)}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") throw new Error(`fetchEnv: function invocation URL must be http(s): ${JSON.stringify(url)}`);\n\treturn parsed.origin;\n}\n/** Derived from the connection URI so undeployed functions have a cell-routed URL. */\nfunction functionInvocationUrl(branchId, slug, connectionUri) {\n\tconst suffix = connectionHostSuffix(connectionUri);\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive the invocation URL for function \"${slug}\": the direct connection URI has no host suffix.`);\n\treturn `https://${branchId}-${slug}.compute.${suffix}`;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst picked = defaultConnectionRole(roles.map((r) => r.name));\n\tif (picked) return picked;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.realtime.url, env.realtime?.url);\n\tput(K.realtime.secret, env.realtime?.secret);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\tif (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);\n\treturn out;\n}\nexport { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, functionBaseUrlKey, isFunctionBaseUrlKey, isLiveCredential, parseFunctionBaseUrlKey, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;AAKA,MAAM,0BAA0B;;;;;;;;AAQhC,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;;AAED,SAAS,sBAAsB,WAAW;CACzC,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU;CAC7C,IAAI,UAAU,SAAS,cAAc,GAAG,OAAO;CAC/C,MAAM,WAAW,UAAU,QAAQ,SAAS,CAAC,wBAAwB,IAAI,IAAI,CAAC;CAC9E,OAAO,SAAS,WAAW,IAAI,SAAS,KAAK,KAAK;AACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKA,MAAM,wBAAwB;AAC9B,MAAM,oBAAoB;;;;;;CAMzB,QAAQ,EAAE,MAAM,cAAc;CAC9B,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;CACpC,UAAU;EACT,KAAK;EACL,QAAQ;CACT;;;;;;CAMA,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,MAAM,gBAAgB;AACtB,MAAM,wBAAwB;AAC9B,SAAS,mBAAmB,MAAM;CACjC,IAAI,CAAC,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,IAAI,EAAE,0CAA0C;CACrI,OAAO,iBAAiB,KAAK,YAAY,EAAE;AAC5C;AACA,SAAS,wBAAwB,KAAK;CACrC,MAAM,QAAQ,sBAAsB,KAAK,GAAG;CAC5C,OAAO,QAAQ,MAAM,EAAE,CAAC,YAAY,IAAI;AACzC;AACA,SAAS,qBAAqB,KAAK;CAClC,OAAO,wBAAwB,GAAG,MAAM;AACzC;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;;;;;;AAOA,SAAS,QAAQ,MAAM;CACtB,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAK,CAAC;CAC1B,OAAO;AACR;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;AACA,MAAM,4BAA4B;;;;;;AAMlC,eAAe,mBAAmB,MAAM;CACvC,MAAM,cAAc,KAAK,IAAI;CAC7B,IAAI,CAAC,aAAa,MAAM,IAAI,cAAc,UAAU,oBAAoB,qGAAqG;CAC7K,MAAM,YAAY,KAAK,IAAI;CAC3B,IAAI;CACJ,OAAO,gBAAgB,KAAK,GAAG;EAC9B,MAAM,WAAW,MAAM,YAAY,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;EAChF,IAAI,CAAC,SAAS,SAAS;GACtB,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,+EAA+E,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,GAAG,KAAK,yIAAyI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC5V,WAAW,KAAK;IAChB,UAAU,KAAK,OAAO;GACvB,EAAE,CAAC;GACH,IAAI;GACJ,IAAI,KAAK,aAAa;IACrB,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,oBAAoB,uHAAuH;IAC7L,SAAS,MAAM,UAAU,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;GACvE;GACA,IAAI,CAAC,QAAQ,SAAS,cAAc;IACnC,GAAG,KAAK,WAAW,EAAE,KAAK,qBAAqB,8BAA8B,UAAU,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;IAC1G,GAAG,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;GAC1C;EACD;EACA,IAAI,gBAAgB,KAAK,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,yBAAyB,CAAC;CAC1G;CACA,OAAO;AACR;AACA,SAAS,8BAA8B,UAAU,QAAQ;CACxD,IAAI,SAAS,kBAAkB,KAAK,KAAK,SAAS,kBAAkB,IAAI,OAAO,SAAS;CACxF,MAAM,IAAI,cAAc,UAAU,aAAa,iCAAiC,OAAO,KAAK,IAAI,OAAO,GAAG,kDAAkD,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;AACjM;;AAEA,SAAS,qBAAqB,OAAO;CACpC,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,KAAK;CACvB,QAAQ;EACP,MAAM,IAAI,cAAc,UAAU,aAAa,uCAAuC,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/G;CACA,IAAI,OAAO,aAAa,UAAU,OAAO,WAAW;MAC/C,IAAI,OAAO,aAAa,SAAS,OAAO,WAAW;MACnD,IAAI,OAAO,aAAa,UAAU,OAAO,aAAa,OAAO,MAAM,IAAI,cAAc,UAAU,aAAa,sDAAsD,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/L,OAAO,OAAO,SAAS;AACxB;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;;;;;AAKA,eAAe,kBAAkB,QAAQ,SAAS,MAAM,QAAQ;CAC/D,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,UAAU,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CACpF,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,gBAAgB,QAAQ,mBAAmB,cAAc,MAAM,EAAE,SAAS,GAAG,KAAK,MAAM,EAAE,SAAS,MAAM;CAC/G,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,kBAAkB,QAAQ,gBAAgB;CAChD,MAAM,iBAAiB,QAAQ,SAAS,aAAa,CAAC,EAAA,CAAG,KAAK,OAAO,GAAG,IAAI;CAC5E,MAAM,uBAAuB,cAAc,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,oBAAoB;CACjG,MAAM,iBAAiB,4BAA4B;EAClD;EACA;EACA;EACA;EACA;CACD,CAAC;CACD,MAAM,sBAAsB,cAAc,QAAQ,qBAAqB,SAAS;CAChF,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,gBAAgB,oBAAoB,cAAc,uBAAuB,QAAQ,oBAAoB,KAAK,IAAI,2BAA2B,KAAK,WAAW,OAAO,EAAE,IAAI;CAC5K,eAAe,YAAY,KAAK,CAAC;CACjC,MAAM,cAAc,eAAe,cAAc,IAAI,wBAAwB,WAAW,OAAO,EAAE,CAAC,IAAI;CACtG,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO,KAAK,eAAe,SAAS;CAC/G,MAAM,wBAAwB,eAAe;CAC7C,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAC9D,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM,mBAAmB;GACzC;GACA;GACA;GACA,UAAU,MAAM,EAAE,SAAS,GAAG;GAC9B,aAAa,MAAM,EAAE,SAAS,MAAM;EACrC,CAAC;EACD,MAAM,cAAc,CAAC;EACrB,IAAI,MAAM,EAAE,SAAS,GAAG,GAAG,YAAY,MAAM,cAAc,SAAS,KAAK,oCAAoC;EAC7G,IAAI,MAAM,EAAE,SAAS,MAAM,GAAG,YAAY,SAAS,cAAc,SAAS,QAAQ,oCAAoC;EACtH,OAAO,WAAW;CACnB;CACA,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,cAAc,aAAa,cAAc;GACzD,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,kGAAkG,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,4HAA4H,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/U;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,MAAM,YAAY,CAAC;CACnB,IAAI,0BAA0B;CAC9B,IAAI,oBAAoB,cAAc,qBAAqB;EAC1D,MAAM,SAAS,QAAQ,oBAAoB,KAAK,IAAI,MAAM,cAAc,eAAe,kBAAkB,IAAI,oBAAoB,QAAQ,eAAe;EACxJ,IAAI,OAAO,WAAW,eACjB;OAAA,cAAc,MAAM,0BAA0B;EAAA,OAC5C,KAAK,MAAM,MAAM,OAAO,WAAW;GACzC,IAAI,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG;GACzC,UAAU,GAAG,QAAQ,EAAE,SAAS,aAAa,GAAG,aAAa,EAAE;EAChE;CACD;CACA,MAAM,wBAAwB,eAAe,QAAQ,SAAS,UAAU,UAAU,KAAK,CAAC;CACxF,IAAI,sBAAsB,SAAS,GAAG;EACrC,MAAM,MAAM,cAAc,UAAU,oDAAoD,CAAC,CAAC;EAC1F,KAAK,MAAM,QAAQ,uBAAuB,UAAU,QAAQ,EAAE,SAAS,sBAAsB,OAAO,IAAI,MAAM,GAAG,EAAE;CACpH;CACA,2BAA2B,sBAAsB,SAAS;CAC1D,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,GAAG,OAAO,YAAY;CAC1D,OAAO;EACN,KAAK;EACL;CACD;AACD;AACA,SAAS,4BAA4B,MAAM;CAC1C,MAAM,QAAQ,CAAC;CACf,IAAI,KAAK,oBAAoB,YAAY,KAAK,cAAc,MAAM;EACjE,KAAK,MAAM,QAAQ,KAAK,eAAe,IAAI,KAAK,MAAM,mBAAmB,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI;EAChG,OAAO;CACR;CACA,KAAK,MAAM,OAAO,KAAK,sBAAsB;EAC5C,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,MAAM,MAAM,KAAK,IAAI;CACnC;CACA,OAAO;AACR;AACA,SAAS,oBAAoB,WAAW;CACvC,OAAO;EACN,QAAQ;EACR,WAAW,UAAU,QAAQ,OAAO,GAAG,kBAAkB,EAAE,CAAC,CAAC,KAAK,QAAQ;GACzE,MAAM,GAAG;GACT,eAAe,GAAG;EACnB,EAAE,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;CAC9D;AACD;AACA,SAAS,2BAA2B,MAAM,WAAW;CACpD,KAAK,MAAM,OAAO,MAAM;EACvB,MAAM,OAAO,wBAAwB,GAAG;EACxC,IAAI,SAAS,QAAQ,UAAU,UAAU,KAAK,GAAG,MAAM,IAAI,MAAM,qBAAqB,IAAI,EAAE;CAC7F;AACD;AACA,eAAe,2BAA2B,KAAK,WAAW,UAAU;CACnE,IAAI;EACH,OAAO,oBAAoB,MAAM,IAAI,oBAAoB,WAAW,QAAQ,CAAC;CAC9E,SAAS,OAAO;EACf,IAAI,gBAAgB,KAAK,KAAK,MAAM,SAAS,UAAU,oBAAoB,OAAO;GACjF,QAAQ;GACR;EACD;EACA,MAAM;CACP;AACD;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK,UAAU;CAClE,MAAM,SAAS,YAAY,MAAM,qBAAqB,SAAS,GAAG;CAClE,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;AACA,eAAe,qBAAqB,SAAS,KAAK;CACjD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,OAAO,cAAc,WAAW,QAAQ;AACzC;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,GAAG,QAAQ,mBAAmB,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,CAAC;EACjF,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM;EACvB,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,eAAe,QAAQ,YAAY,MAAM,cAAA,CAAe;CAC5D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,aAAa,KAAK;CAC1B,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,GAAG;CACrB,QAAQ;EACP,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,GAAG,GAAG;CACzF;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,sDAAsD,KAAK,UAAU,GAAG,GAAG;CAC5J,OAAO,OAAO;AACf;;AAEA,SAAS,sBAAsB,UAAU,MAAM,eAAe;CAC7D,MAAM,SAAS,qBAAqB,aAAa;CACjD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,4DAA4D,KAAK,iDAAiD;CACrJ,OAAO,WAAW,SAAS,GAAG,KAAK,WAAW;AAC/C;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,MAAM,SAAS,sBAAsB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,IAAI,QAAQ,OAAO;CACnB,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,SAAS,KAAK,IAAI,UAAU,GAAG;CACrC,IAAI,EAAE,SAAS,QAAQ,IAAI,UAAU,MAAM;CAC3C,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,IAAI,IAAI,WAAW,KAAK,MAAM,QAAQ,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,mBAAmB,IAAI,GAAG,IAAI,UAAU,KAAK,EAAE,OAAO;CACnI,OAAO;AACR"}
+{"version":3,"file":"env.js","names":[],"sources":["../../../internals/env-core/dist/roles.js","../../../internals/env-core/dist/env.js"],"sourcesContent":["// src/roles.ts\n/**\n* Neon's default branch owner role, created with every project. This is the role a\n* `DATABASE_URL` should connect as.\n*/\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n/**\n* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n* Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n* branch routinely reports more than one role.\n*/\nconst NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\"\n]);\n/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */\nfunction defaultConnectionRole(roleNames) {\n\tif (roleNames.length === 1) return roleNames[0];\n\tif (roleNames.includes(\"neondb_owner\")) return NEON_DEFAULT_OWNER_ROLE;\n\tconst appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));\n\treturn appRoles.length === 1 ? appRoles[0] : void 0;\n}\nexport { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole };\n\n//# sourceMappingURL=roles.js.map","import { NEON_DEFAULT_OWNER_ROLE, defaultConnectionRole } from \"./roles.js\";\nimport { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, resolveConfig } from \"@neon/config/v1\";\n// src/env.ts\n/**\n* The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n* OS-level `{ KEY: value }` pairs.\n*\n* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /\n* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.\n* See `README.md` for why it is not published.\n*\n* The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n* has no consumer outside `@neon/env`, so it stays in that package and imports this.\n*/\n/**\n* Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n* for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n* that talks to `process.env`).\n*\n* Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n* camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n* by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n* {@link dataApiEnvSchema} / {@link realtimeEnvSchema}.\n*/\n/**\n* Neon's default database, created with every project. When a branch has several databases\n* and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n* user added a second database next to `neondb`) auto-picks without asking.\n*/\nconst NEON_DEFAULT_DATABASE = \"neondb\";\n/**\n* Set only by `neon dev`: a JSON object mapping each function it serves to its localhost port,\n* which `functionBaseUrl` prefers over the deployed hostname.\n*/\nconst NEON_DEV_FUNCTION_PORTS = \"NEON_DEV_FUNCTION_PORTS\";\nconst NEON_ENV_VAR_KEYS = {\n\t/**\n\t* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t* Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t* `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t*/\n\tbranch: {\n\t\tname: \"NEON_BRANCH\",\n\t\tid: \"NEON_BRANCH_ID\",\n\t\t/**\n\t\t* Shared by every function on the branch, with a leading dot\n\t\t* (`.compute.c-2.us-east-2.aws.neon.tech`). A function's host is\n\t\t* `<NEON_BRANCH_ID>-<slug><NEON_FUNCTION_HOST_SUFFIX>`.\n\t\t*/\n\t\tfunctionHostSuffix: \"NEON_FUNCTION_HOST_SUFFIX\"\n\t},\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\"\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\"\n\t},\n\tdataApi: { url: \"NEON_DATA_API_URL\" },\n\trealtime: {\n\t\turl: \"NEON_REALTIME_URL\",\n\t\tsecret: \"NEON_REALTIME_SECRET\"\n\t},\n\t/**\n\t* Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t* a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t* `region` is injected under the SDK-standard `AWS_REGION`.\n\t*/\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\"\n\t},\n\t/**\n\t* AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t* runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t* and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t* `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t* dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t*/\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\"\n\t}\n};\nasync function fetchEnv(config, options) {\n\tif (options.keys) assertStorageCredentialKeyPair(options.keys);\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\nfunction assertStorageCredentialKeyPair(keys) {\n\tif (keys.includes(NEON_ENV_VAR_KEYS.storage.accessKeyId) === keys.includes(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) return;\n\tthrow new TypeError(\"fetchEnv: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together. Pass both in `keys`, or omit both.\");\n}\n/**\n* Starts a read now and keeps an unread rejection from crashing the process; the caller\n* awaits it (and sees the error) when its turn comes. The read is called synchronously and\n* its own promise returned, so errors surface in the same order as a direct call; a\n* synchronous throw becomes the returned rejection.\n*/\nfunction started(read) {\n\tlet promise;\n\ttry {\n\t\tpromise = read();\n\t} catch (error) {\n\t\tpromise = Promise.reject(error);\n\t}\n\tpromise.catch(() => void 0);\n\treturn promise;\n}\n/** Fail loudly when selected-key dependency planning and execution disagree. */\nfunction requiredValue(value, description) {\n\tif (value === null) throw new Error(`fetchEnv: missing ${description}.`);\n\treturn value;\n}\nconst REALTIME_POLL_INTERVAL_MS = 1e3;\n/**\n* Wait for asynchronous Realtime provisioning/rotation before reading its secret. The\n* secret endpoint deliberately returns 404 until provisioning finishes, and during a\n* rotation it can still expose the previous key while `pending` is true.\n*/\nasync function resolveRealtimeEnv(args) {\n\tconst getRealtime = args.api.getProjectBranchRealtime;\n\tif (!getRealtime) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve Realtime: this NeonApi adapter does not implement getProjectBranchRealtime.\");\n\tconst getSecret = args.api.getProjectBranchRealtimeSecret;\n\tlet resolvedEnv;\n\twhile (resolvedEnv === void 0) {\n\t\tconst snapshot = await getRealtime.call(args.api, args.projectId, args.branch.id);\n\t\tif (!snapshot.pending) {\n\t\t\tif (!snapshot.enabled) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables realtime but Realtime is disabled on branch ${args.branch.name} (${args.branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon deploy`) and re-run fetchEnv. Or set realtime to false or omit it.\"].join(\" \"), { details: {\n\t\t\t\tprojectId: args.projectId,\n\t\t\t\tbranchId: args.branch.id\n\t\t\t} });\n\t\t\tlet secret;\n\t\t\tif (args.wantsSecret) {\n\t\t\t\tif (!getSecret) throw new PlatformError(ErrorCode.FeatureUnavailable, \"fetchEnv cannot resolve NEON_REALTIME_SECRET: this NeonApi adapter does not implement getProjectBranchRealtimeSecret.\");\n\t\t\t\tsecret = await getSecret.call(args.api, args.projectId, args.branch.id);\n\t\t\t}\n\t\t\tif (!secret?.pending) resolvedEnv = {\n\t\t\t\t...args.wantsUrl ? { url: realtimeWebSocketUrl(requiredRealtimeInvocationUrl(snapshot, args.branch)) } : {},\n\t\t\t\t...secret ? { secret: secret.secret } : {}\n\t\t\t};\n\t\t}\n\t\tif (resolvedEnv === void 0) await new Promise((resolve) => setTimeout(resolve, REALTIME_POLL_INTERVAL_MS));\n\t}\n\treturn resolvedEnv;\n}\nfunction requiredRealtimeInvocationUrl(snapshot, branch) {\n\tif (snapshot.invocationUrl !== void 0 && snapshot.invocationUrl !== \"\") return snapshot.invocationUrl;\n\tthrow new PlatformError(ErrorCode.ServerError, `Realtime is enabled on branch ${branch.name} (${branch.id}), but the Neon API returned no invocation URL.`, { details: { branchId: branch.id } });\n}\n/** Normalize the control-plane invocation URL to the WebSocket URL the client SDK needs. */\nfunction realtimeWebSocketUrl(value) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new PlatformError(ErrorCode.ServerError, `Realtime invocation URL is invalid: ${JSON.stringify(value)}.`);\n\t}\n\tif (parsed.protocol === \"https:\") parsed.protocol = \"wss:\";\n\telse if (parsed.protocol === \"http:\") parsed.protocol = \"ws:\";\n\telse if (parsed.protocol !== \"wss:\" && parsed.protocol !== \"ws:\") throw new PlatformError(ErrorCode.ServerError, `Realtime invocation URL must use http(s) or ws(s): ${JSON.stringify(value)}.`);\n\treturn parsed.toString();\n}\n/**\n* The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n* narrowing. Exists for callers that compute the selection at runtime — notably\n* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n* branch — since the public overload's `keys` is bound to a literal union those callers cannot\n* produce without asserting.\n*\n* `keys === null` selects everything the policy enables.\n*/\nasync function fetchEnvKeys(config, options, keys) {\n\treturn (await fetchEnvKeysState(config, options, keys)).env;\n}\n/**\n* `policy` is the {@link resolveBranchPolicy} result for this same `config` and branch, when\n* the caller already has it.\n*/\nasync function fetchEnvKeysState(config, options, keys, policy) {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = policy ?? await resolveBranchPolicy(config, options, api);\n\tconst selection = keys ? new Set(keys) : null;\n\tconst omitted = new Set(options.omitKeys ?? []);\n\tconst wants = (key) => !omitted.has(key) && (selection === null || selection.has(key));\n\tconst result = {};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsPooled = wants(K.postgres.databaseUrl);\n\tconst wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);\n\tconst wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\tconst wantsRealtime = desired.realtimePolicy === \"enabled\" && (wants(K.realtime.url) || wants(K.realtime.secret));\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst wantsFunctionHostSuffix = wants(K.branch.functionHostSuffix) && (selection !== null || options.functionHostSuffix === \"always\" || (desired.preview?.functions.length ?? 0) > 0);\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));\n\tconst needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl);\n\tconst needsConnectionTarget = wantsPooled || needsUnpooled;\n\tconst storageRead = wantsStorage ? started(() => api.getProjectBranchStorage(projectId, branch.id)) : null;\n\tconst endpointsRead = wantsFunctionHostSuffix && !needsConnectionTarget ? started(() => api.listEndpoints(projectId)) : null;\n\tconst needsDatabase = needsConnectionTarget || wantsDataApi;\n\tconst [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);\n\tconst databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;\n\tconst connectionTarget = needsConnectionTarget ? {\n\t\troleName: pickRoleName(roles, branch, options.roleName),\n\t\tdatabaseName: requiredValue(databaseName, \"database for a selected connection URI\")\n\t} : null;\n\tconst getConnectionUri = (pooled) => {\n\t\tconst target = requiredValue(connectionTarget, \"role and database for a selected connection URI\");\n\t\treturn api.getConnectionUri(projectId, {\n\t\t\tbranchId: branch.id,\n\t\t\t...target,\n\t\t\tpooled\n\t\t});\n\t};\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([\n\t\twantsPooled ? getConnectionUri(true) : Promise.resolve(null),\n\t\tneedsUnpooled ? getConnectionUri(false) : Promise.resolve(null),\n\t\twantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),\n\t\twantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, \"database for the selected Data API URL\")) : Promise.resolve(null)\n\t]);\n\tconst postgres = {};\n\tif (wantsPooled) postgres.databaseUrl = requiredValue(pooled, \"pooled connection URI response\").uri;\n\tif (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, \"direct connection URI response\").uri;\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\tif (wants(K.branch.name) || wants(K.branch.id) || wantsFunctionHostSuffix) {\n\t\tconst branchEnv = {};\n\t\tif (wants(K.branch.name)) branchEnv.name = branch.name;\n\t\tif (wants(K.branch.id)) branchEnv.id = branch.id;\n\t\tif (wantsFunctionHostSuffix) {\n\t\t\tconst connectionUri = unpooled?.uri ?? pooled?.uri;\n\t\t\tbranchEnv.functionHostSuffix = functionHostSuffix(connectionUri !== void 0 ? new URL(connectionUri).hostname : branchComputeHost(await requiredValue(endpointsRead, \"branch endpoint list\"), branch));\n\t\t}\n\t\tresult.branch = branchEnv;\n\t}\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\"].join(\" \"), { details: {\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id\n\t\t} });\n\t\tconst auth = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tconst selectedDatabase = requiredValue(databaseName, \"database for the selected Data API URL\");\n\t\t\tthrow new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, \"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName: selectedDatabase\n\t\t\t} });\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url };\n\t}\n\tif (wantsRealtime) {\n\t\tconst realtime = await resolveRealtimeEnv({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranch,\n\t\t\twantsUrl: wants(K.realtime.url),\n\t\t\twantsSecret: wants(K.realtime.secret)\n\t\t});\n\t\tconst realtimeEnv = {};\n\t\tif (wants(K.realtime.url)) realtimeEnv.url = requiredValue(realtime.url, \"WebSocket URL for enabled Realtime\");\n\t\tif (wants(K.realtime.secret)) realtimeEnv.secret = requiredValue(realtime.secret, \"shared secret for enabled Realtime\");\n\t\tresult.realtime = realtimeEnv;\n\t}\n\tconst wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\tconst wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));\n\tconst wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);\n\tconst wantsCredential = wantsStorageCredential || wantsGatewayCredential;\n\tif (wantsStorage || wantsGateway) {\n\t\tlet storage = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await requiredValue(storageRead, \"storage read\");\n\t\t\tif (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, \"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove buckets.\"].join(\" \"), { details: {\n\t\t\t\tprojectId,\n\t\t\t\tbranchId: branch.id\n\t\t\t} });\n\t\t}\n\t\tconst secrets = wantsCredential ? await resolveBranchCredentialSecrets({\n\t\t\tapi,\n\t\t\tprojectId,\n\t\t\tbranchId: branch.id,\n\t\t\tbranchName: branch.name,\n\t\t\tscopes: previewCredentialScopes(desired.preview, {\n\t\t\t\tstorage: wantsStorageCredential,\n\t\t\t\taiGateway: wantsGatewayCredential\n\t\t\t})\n\t\t}) : null;\n\t\tif (storage) {\n\t\t\tconst storageEnv = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\tif (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;\n\t\t\tif (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, \"direct connection URI for the selected AI Gateway base URL\").uri);\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\treturn { env: result };\n}\n/**\n* Resolve the target branch and evaluate the policy against it — the first thing any\n* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n* so the two agree on which branch they're talking about and what it has enabled.\n*/\nasync function resolveBranchPolicy(config, options, api, resolved) {\n\tconst branch = resolved ?? await listAndResolveBranch(options, api);\n\treturn {\n\t\tbranch,\n\t\tdesired: resolveConfig(config, {\n\t\t\tname: branch.name,\n\t\t\tid: branch.id,\n\t\t\texists: true,\n\t\t\t...branch.parentId ? { parentId: branch.parentId } : {},\n\t\t\tisDefault: branch.isDefault,\n\t\t\tisProtected: branch.protected,\n\t\t\t...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}\n\t\t})\n\t};\n}\nasync function listAndResolveBranch(options, api) {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, \"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\"].join(\" \"), { details: { projectId } });\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, [\"fetchEnv: no branch provided.\", \"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\"].join(\" \"), { details: { projectId } });\n\treturn resolveBranch(branchRef, branches);\n}\n/**\n* Scopes a minted fallback credential should carry. Only object storage and the AI Gateway\n* *require* secrets; functions never force a credential. `functions:invoke` rides along only\n* when this path still has to mint (defaults already cover storage and the gateway).\n*/\nfunction previewCredentialScopes(preview, selected) {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0 && (selected?.storage ?? true);\n\tconst aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0\n\t});\n}\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nfunction credentialName(branchName) {\n\treturn `neon-env ${branchName}`;\n}\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nfunction credentialEnvKeys(flags) {\n\treturn [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];\n}\n/**\n* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n* re-deriving which vars a policy implies.\n*/\nfunction policyEnvKeys(desired) {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\tK.branch.id,\n\t\t...(desired.preview?.functions.length ?? 0) > 0 ? [K.branch.functionHostSuffix] : [],\n\t\t...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],\n\t\t...desired.dataApiEnabled ? [K.dataApi.url] : [],\n\t\t...desired.realtimePolicy === \"enabled\" ? [K.realtime.url, K.realtime.secret] : [],\n\t\t...(desired.preview?.buckets.length ?? 0) > 0 ? [\n\t\t\tK.storage.accessKeyId,\n\t\t\tK.storage.secretAccessKey,\n\t\t\tK.storage.endpoint,\n\t\t\tK.storage.region\n\t\t] : [],\n\t\t...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []\n\t];\n}\n/** Exact `name` values the credentials list endpoint returns for the platform defaults. */\nconst DEFAULT_AI_GATEWAY_CREDENTIAL_NAME = \"Default AI gateway credential\";\nconst DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME = \"Default object storage credential\";\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta, now) {\n\tif (meta.revokedAt !== void 0) return false;\n\tif (meta.expiresAt === void 0) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\nfunction defaultStorageCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_OBJECT_STORAGE_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\nfunction defaultAiGatewayCredential(live, now) {\n\treturn live.find((meta) => meta.name === DEFAULT_AI_GATEWAY_CREDENTIAL_NAME && isLiveCredential(meta, now)) ?? null;\n}\n/**\n* Resolve secrets for object storage / the AI Gateway.\n*\n* Regions that expose those products already have platform defaults on every branch.\n* Reveal those by exact name instead of minting a combined `neon-env ${branch}` credential.\n* Mint only the half (or both) that has no default — regions without the credentials\n* endpoint still fail at list, same as before.\n*\n* A caller that already holds secrets for those defaults should leave the secret keys out\n* of `keys` (see {@link fetchEnvReusingSecrets}) instead of revealing them again.\n*/\nasync function resolveBranchCredentialSecrets(args) {\n\tconst needsStorage = args.scopes.includes(\"storage:read\") || args.scopes.includes(\"storage:write\");\n\tconst needsGateway = args.scopes.includes(\"ai_gateway:invoke\");\n\tconst live = await args.api.listCredentials(args.projectId, args.branchId);\n\tconst now = Date.now();\n\tconst storageDefault = defaultStorageCredential(live, now);\n\tconst gatewayDefault = defaultAiGatewayCredential(live, now);\n\tconst secrets = {\n\t\taccessKeyId: \"\",\n\t\tsecretAccessKey: \"\",\n\t\tapiToken: \"\"\n\t};\n\tconst storageReveal = needsStorage && storageDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, storageDefault.tokenId)) : null;\n\tconst gatewayReveal = needsGateway && gatewayDefault ? started(() => args.api.revealCredential(args.projectId, args.branchId, gatewayDefault.tokenId)) : null;\n\tif (storageReveal) {\n\t\tconst revealed = await storageReveal;\n\t\tsecrets.accessKeyId = revealed.tokenId;\n\t\tsecrets.secretAccessKey = revealed.s3SecretAccessKey;\n\t}\n\tif (gatewayReveal) secrets.apiToken = (await gatewayReveal).apiToken;\n\tconst missingStorage = needsStorage && storageDefault === null;\n\tconst missingGateway = needsGateway && gatewayDefault === null;\n\tif (missingStorage || missingGateway) {\n\t\tconst minted = await mintBranchCredential({\n\t\t\t...args,\n\t\t\tscopes: deriveCredentialScopes({\n\t\t\t\tstorage: missingStorage,\n\t\t\t\taiGateway: missingGateway,\n\t\t\t\tfunctions: args.scopes.includes(\"functions:invoke\")\n\t\t\t})\n\t\t});\n\t\tif (missingStorage) {\n\t\t\tsecrets.accessKeyId = minted.accessKeyId;\n\t\t\tsecrets.secretAccessKey = minted.secretAccessKey;\n\t\t}\n\t\tif (missingGateway) secrets.apiToken = minted.apiToken;\n\t}\n\treturn secrets;\n}\nasync function mintBranchCredential(args) {\n\tconst minted = await args.api.createCredential(args.projectId, args.branchId, {\n\t\tscopes: args.scopes,\n\t\tprincipalType: \"user\",\n\t\tname: credentialName(args.branchName)\n\t});\n\treturn {\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken\n\t};\n}\n/**\n* The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n* control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n* by dropping only the endpoint label (the first segment) and keeping everything after it,\n* including any infra cell prefix (`c-N.`): a connection host of\n* `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n* `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n* the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n*\n* Function invocation URLs use the same suffix: `<branchId>-<slug>.compute.<suffix>`.\n*/\nfunction connectionHostSuffix(connectionUri) {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\treturn connectionHost.split(\".\").slice(1).join(\".\");\n}\nfunction aiGatewayHost(branchId, connectionUri) {\n\treturn `${branchId}-api.ai.${connectionHostSuffix(connectionUri)}`;\n}\n/**\n* `NEON_FUNCTION_HOST_SUFFIX` from a compute host: the endpoint label is replaced by\n* `compute`, as the Functions runtime does (`.compute.c-2.us-east-2.aws.neon.tech`).\n*/\nfunction functionHostSuffix(computeHost) {\n\tconst suffix = computeHost.split(\".\").slice(1).join(\".\");\n\tif (suffix === \"\") throw new Error(`fetchEnv: cannot derive NEON_FUNCTION_HOST_SUFFIX from compute host ${JSON.stringify(computeHost)}.`);\n\treturn `.compute.${suffix}`;\n}\n/** The branch's read-write compute host, else its first compute host. */\nfunction branchComputeHost(endpoints, branch) {\n\tconst own = endpoints.filter((endpoint) => endpoint.branchId === branch.id);\n\tconst endpoint = own.find((candidate) => candidate.type === \"read_write\") ?? own[0];\n\tif (!endpoint?.host) throw new PlatformError(ErrorCode.NotFound, `fetchEnv: branch ${branch.name} (${branch.id}) has no compute endpoint, so NEON_FUNCTION_HOST_SUFFIX cannot be derived. Add a compute to the branch, then re-run.`, { details: { branchId: branch.id } });\n\treturn endpoint.host;\n}\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId, connectionUri) {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\nfunction createApiFromOptions(options) {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...options.apiKey ? { apiKey: options.apiKey } : {},\n\t\t...options.apiHost ? { apiHost: options.apiHost } : {}\n\t});\n}\n/**\n* Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n* (exact `br-…`), then by name; both are unique within a project, so the lookup is\n* unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n* and explicit `br-…` ids both work.\n*/\nfunction resolveBranch(branch, branches) {\n\tconst match = branches.find((b) => b.id === branch) ?? branches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`, `Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranch,\n\t\tavailable: branches.map((b) => `${b.name} (${b.id})`)\n\t} });\n}\nfunction pickRoleName(roles, branch, requested) {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\troleName: requested,\n\t\t\tavailableRoles: roles.map((r) => r.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, \"Create one via the Neon console or pass `roleName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst picked = defaultConnectionRole(roles.map((r) => r.name));\n\tif (picked) return picked;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`, `Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableRoles: roles.map((r) => r.name)\n\t} });\n}\nfunction pickDatabaseName(databases, branch, requested) {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`, `Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`].join(\" \"), { details: {\n\t\t\tbranchId: branch.id,\n\t\t\tdatabaseName: requested,\n\t\t\tavailableDatabases: databases.map((d) => d.name)\n\t\t} });\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`, \"Create one via the Neon console or pass `databaseName` explicitly.\"].join(\" \"), { details: { branchId: branch.id } });\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\tif (databases.length === 1) return databases[0].name;\n\tthrow new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`, `Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`].join(\" \"), { details: {\n\t\tbranchId: branch.id,\n\t\tavailableDatabases: databases.map((d) => d.name)\n\t} });\n}\n/**\n* Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n* for cross-process transport. Named after the web-platform `.entries()` convention\n* (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n* iterator of tuples since that's the shape env injection needs (wrap with\n* `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n* to inject the vars into a subprocess's `process.env`.\n*\n* Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n* conditional namespaces are present.\n*/\nfunction toEntries(env) {\n\tconst out = {};\n\tconst put = (key, value) => {\n\t\tif (value !== void 0) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.branch.id, env.branch?.id);\n\tput(K.branch.functionHostSuffix, env.branch?.functionHostSuffix);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.realtime.url, env.realtime?.url);\n\tput(K.realtime.secret, env.realtime?.secret);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\treturn out;\n}\nexport { NEON_DEV_FUNCTION_PORTS, NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, defaultAiGatewayCredential, defaultStorageCredential, fetchEnv, fetchEnvKeys, fetchEnvKeysState, isLiveCredential, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n\n//# sourceMappingURL=env.js.map"],"mappings":";;;;;;AAKA,MAAM,0BAA0B;;;;;;;;AAQhC,MAAM,0CAA0C,IAAI,IAAI;CACvD;CACA;CACA;AACD,CAAC;;AAED,SAAS,sBAAsB,WAAW;CACzC,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU;CAC7C,IAAI,UAAU,SAAS,cAAc,GAAG,OAAO;CAC/C,MAAM,WAAW,UAAU,QAAQ,SAAS,CAAC,wBAAwB,IAAI,IAAI,CAAC;CAC9E,OAAO,SAAS,WAAW,IAAI,SAAS,KAAK,KAAK;AACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKA,MAAM,wBAAwB;;;;;AAK9B,MAAM,0BAA0B;AAChC,MAAM,oBAAoB;;;;;;CAMzB,QAAQ;EACP,MAAM;EACN,IAAI;;;;;;EAMJ,oBAAoB;CACrB;CACA,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EAAE,KAAK,oBAAoB;CACpC,UAAU;EACT,KAAK;EACL,QAAQ;CACT;;;;;;CAMA,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AACA,eAAe,SAAS,QAAQ,SAAS;CACxC,IAAI,QAAQ,MAAM,+BAA+B,QAAQ,IAAI;CAC7D,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;AACA,SAAS,+BAA+B,MAAM;CAC7C,IAAI,KAAK,SAAS,kBAAkB,QAAQ,WAAW,MAAM,KAAK,SAAS,kBAAkB,QAAQ,eAAe,GAAG;CACvH,MAAM,IAAI,UAAU,qHAAqH;AAC1I;;;;;;;AAOA,SAAS,QAAQ,MAAM;CACtB,IAAI;CACJ,IAAI;EACH,UAAU,KAAK;CAChB,SAAS,OAAO;EACf,UAAU,QAAQ,OAAO,KAAK;CAC/B;CACA,QAAQ,YAAY,KAAK,CAAC;CAC1B,OAAO;AACR;;AAEA,SAAS,cAAc,OAAO,aAAa;CAC1C,IAAI,UAAU,MAAM,MAAM,IAAI,MAAM,qBAAqB,YAAY,EAAE;CACvE,OAAO;AACR;AACA,MAAM,4BAA4B;;;;;;AAMlC,eAAe,mBAAmB,MAAM;CACvC,MAAM,cAAc,KAAK,IAAI;CAC7B,IAAI,CAAC,aAAa,MAAM,IAAI,cAAc,UAAU,oBAAoB,qGAAqG;CAC7K,MAAM,YAAY,KAAK,IAAI;CAC3B,IAAI;CACJ,OAAO,gBAAgB,KAAK,GAAG;EAC9B,MAAM,WAAW,MAAM,YAAY,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;EAChF,IAAI,CAAC,SAAS,SAAS;GACtB,IAAI,CAAC,SAAS,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,+EAA+E,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,GAAG,KAAK,yIAAyI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC5V,WAAW,KAAK;IAChB,UAAU,KAAK,OAAO;GACvB,EAAE,CAAC;GACH,IAAI;GACJ,IAAI,KAAK,aAAa;IACrB,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,oBAAoB,uHAAuH;IAC7L,SAAS,MAAM,UAAU,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,OAAO,EAAE;GACvE;GACA,IAAI,CAAC,QAAQ,SAAS,cAAc;IACnC,GAAG,KAAK,WAAW,EAAE,KAAK,qBAAqB,8BAA8B,UAAU,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;IAC1G,GAAG,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;GAC1C;EACD;EACA,IAAI,gBAAgB,KAAK,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,yBAAyB,CAAC;CAC1G;CACA,OAAO;AACR;AACA,SAAS,8BAA8B,UAAU,QAAQ;CACxD,IAAI,SAAS,kBAAkB,KAAK,KAAK,SAAS,kBAAkB,IAAI,OAAO,SAAS;CACxF,MAAM,IAAI,cAAc,UAAU,aAAa,iCAAiC,OAAO,KAAK,IAAI,OAAO,GAAG,kDAAkD,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;AACjM;;AAEA,SAAS,qBAAqB,OAAO;CACpC,IAAI;CACJ,IAAI;EACH,SAAS,IAAI,IAAI,KAAK;CACvB,QAAQ;EACP,MAAM,IAAI,cAAc,UAAU,aAAa,uCAAuC,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/G;CACA,IAAI,OAAO,aAAa,UAAU,OAAO,WAAW;MAC/C,IAAI,OAAO,aAAa,SAAS,OAAO,WAAW;MACnD,IAAI,OAAO,aAAa,UAAU,OAAO,aAAa,OAAO,MAAM,IAAI,cAAc,UAAU,aAAa,sDAAsD,KAAK,UAAU,KAAK,EAAE,EAAE;CAC/L,OAAO,OAAO,SAAS;AACxB;;;;;;;;;;AAUA,eAAe,aAAa,QAAQ,SAAS,MAAM;CAClD,QAAQ,MAAM,kBAAkB,QAAQ,SAAS,IAAI,EAAA,CAAG;AACzD;;;;;AAKA,eAAe,kBAAkB,QAAQ,SAAS,MAAM,QAAQ;CAC/D,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,UAAU,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CACpF,MAAM,YAAY,OAAO,IAAI,IAAI,IAAI,IAAI;CACzC,MAAM,UAAU,IAAI,IAAI,QAAQ,YAAY,CAAC,CAAC;CAC9C,MAAM,SAAS,QAAQ,CAAC,QAAQ,IAAI,GAAG,MAAM,cAAc,QAAQ,UAAU,IAAI,GAAG;CACpF,MAAM,SAAS,CAAC;CAChB,MAAM,IAAI;CACV,MAAM,cAAc,MAAM,EAAE,SAAS,WAAW;CAChD,MAAM,gBAAgB,MAAM,EAAE,SAAS,mBAAmB;CAC1D,MAAM,YAAY,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACvF,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAClE,MAAM,gBAAgB,QAAQ,mBAAmB,cAAc,MAAM,EAAE,SAAS,GAAG,KAAK,MAAM,EAAE,SAAS,MAAM;CAC/G,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,0BAA0B,MAAM,EAAE,OAAO,kBAAkB,MAAM,cAAc,QAAQ,QAAQ,uBAAuB,aAAa,QAAQ,SAAS,UAAU,UAAU,KAAK;CACnL,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,eAAe,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe,KAAK,MAAM,EAAE,QAAQ,QAAQ,KAAK,MAAM,EAAE,QAAQ,MAAM;CAC/J,MAAM,gBAAgB,iBAAiB,kBAAkB,MAAM,EAAE,UAAU,OAAO;CAClF,MAAM,wBAAwB,eAAe;CAC7C,MAAM,cAAc,eAAe,cAAc,IAAI,wBAAwB,WAAW,OAAO,EAAE,CAAC,IAAI;CACtG,MAAM,gBAAgB,2BAA2B,CAAC,wBAAwB,cAAc,IAAI,cAAc,SAAS,CAAC,IAAI;CACxH,MAAM,gBAAgB,yBAAyB;CAC/C,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAAC,wBAAwB,IAAI,gBAAgB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,oBAAoB,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC3N,MAAM,eAAe,gBAAgB,iBAAiB,WAAW,QAAQ,QAAQ,YAAY,IAAI;CACjG,MAAM,mBAAmB,wBAAwB;EAChD,UAAU,aAAa,OAAO,QAAQ,QAAQ,QAAQ;EACtD,cAAc,cAAc,cAAc,wCAAwC;CACnF,IAAI;CACJ,MAAM,oBAAoB,WAAW;EACpC,MAAM,SAAS,cAAc,kBAAkB,iDAAiD;EAChG,OAAO,IAAI,iBAAiB,WAAW;GACtC,UAAU,OAAO;GACjB,GAAG;GACH;EACD,CAAC;CACF;CACA,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IAAI;EAC3E,cAAc,iBAAiB,IAAI,IAAI,QAAQ,QAAQ,IAAI;EAC3D,gBAAgB,iBAAiB,KAAK,IAAI,QAAQ,QAAQ,IAAI;EAC9D,YAAY,IAAI,YAAY,WAAW,OAAO,EAAE,IAAI,QAAQ,QAAQ,IAAI;EACxE,eAAe,IAAI,eAAe,WAAW,OAAO,IAAI,cAAc,cAAc,wCAAwC,CAAC,IAAI,QAAQ,QAAQ,IAAI;CACtJ,CAAC;CACD,MAAM,WAAW,CAAC;CAClB,IAAI,aAAa,SAAS,cAAc,cAAc,QAAQ,gCAAgC,CAAC,CAAC;CAChG,IAAI,eAAe,SAAS,sBAAsB,cAAc,UAAU,gCAAgC,CAAC,CAAC;CAC5G,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CACxD,IAAI,MAAM,EAAE,OAAO,IAAI,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,yBAAyB;EAC1E,MAAM,YAAY,CAAC;EACnB,IAAI,MAAM,EAAE,OAAO,IAAI,GAAG,UAAU,OAAO,OAAO;EAClD,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,KAAK,OAAO;EAC9C,IAAI,yBAAyB;GAC5B,MAAM,gBAAgB,UAAU,OAAO,QAAQ;GAC/C,UAAU,qBAAqB,mBAAmB,kBAAkB,KAAK,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,WAAW,kBAAkB,MAAM,cAAc,eAAe,sBAAsB,GAAG,MAAM,CAAC;EACrM;EACA,OAAO,SAAS;CACjB;CACA,IAAI,WAAW;EACd,IAAI,CAAC,cAAc,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,qJAAqJ,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACrW;GACA,UAAU,OAAO;EAClB,EAAE,CAAC;EACH,MAAM,OAAO,CAAC;EACd,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CACA,IAAI,cAAc;EACjB,IAAI,CAAC,iBAAiB;GACrB,MAAM,mBAAmB,cAAc,cAAc,wCAAwC;GAC7F,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,iBAAiB,IAAI,wIAAwI,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IACpW;IACA,UAAU,OAAO;IACjB,cAAc;GACf,EAAE,CAAC;EACJ;EACA,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CACA,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM,mBAAmB;GACzC;GACA;GACA;GACA,UAAU,MAAM,EAAE,SAAS,GAAG;GAC9B,aAAa,MAAM,EAAE,SAAS,MAAM;EACrC,CAAC;EACD,MAAM,cAAc,CAAC;EACrB,IAAI,MAAM,EAAE,SAAS,GAAG,GAAG,YAAY,MAAM,cAAc,SAAS,KAAK,oCAAoC;EAC7G,IAAI,MAAM,EAAE,SAAS,MAAM,GAAG,YAAY,SAAS,cAAc,SAAS,QAAQ,oCAAoC;EACtH,OAAO,WAAW;CACnB;CACA,MAAM,eAAe,mBAAmB,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAC9F,MAAM,yBAAyB,mBAAmB,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,EAAE,QAAQ,eAAe;CACjH,MAAM,yBAAyB,kBAAkB,MAAM,EAAE,UAAU,MAAM;CACzE,MAAM,kBAAkB,0BAA0B;CAClD,IAAI,gBAAgB,cAAc;EACjC,IAAI,UAAU;EACd,IAAI,cAAc;GACjB,UAAU,MAAM,cAAc,aAAa,cAAc;GACzD,IAAI,CAAC,SAAS,MAAM,IAAI,cAAc,UAAU,UAAU,CAAC,kGAAkG,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,4HAA4H,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;IAC/U;IACA,UAAU,OAAO;GAClB,EAAE,CAAC;EACJ;EACA,MAAM,UAAU,kBAAkB,MAAM,+BAA+B;GACtE;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,SAAS;IAChD,SAAS;IACT,WAAW;GACZ,CAAC;EACF,CAAC,IAAI;EACL,IAAI,SAAS;GACZ,MAAM,aAAa,CAAC;GACpB,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GAAG,WAAW,cAAc,QAAQ;GAC9E,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAAG,WAAW,kBAAkB,QAAQ;GACtF,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW,WAAW,QAAQ;GAC7D,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAU,CAAC;GACjB,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GAAG,QAAQ,SAAS,QAAQ;GACnE,IAAI,MAAM,EAAE,UAAU,OAAO,GAAG,QAAQ,UAAU,iBAAiB,OAAO,IAAI,cAAc,UAAU,4DAA4D,CAAC,CAAC,GAAG;GACvK,OAAO,YAAY;EACpB;CACD;CACA,OAAO,EAAE,KAAK,OAAO;AACtB;;;;;;AAMA,eAAe,oBAAoB,QAAQ,SAAS,KAAK,UAAU;CAClE,MAAM,SAAS,YAAY,MAAM,qBAAqB,SAAS,GAAG;CAClE,OAAO;EACN;EACA,SAAS,cAAc,QAAQ;GAC9B,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAG,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACtD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAG,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC1D,CAAC;CACF;AACD;AACA,eAAe,qBAAqB,SAAS,KAAK;CACjD,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,qBAAqB,UAAU,oBAAoB,wFAAwF,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAChQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WAAW,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,iCAAiC,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;CAC3M,OAAO,cAAc,WAAW,QAAQ;AACzC;;;;;;AAMA,SAAS,wBAAwB,SAAS,UAAU;CACnD,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS,MAAM,UAAU,WAAW;CACpE,MAAM,YAAY,QAAQ,qBAAqB,UAAU,aAAa;CACtE,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAEA,SAAS,eAAe,YAAY;CACnC,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,OAAO;CACjC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,aAAa,kBAAkB,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAAC;AACnL;;;;;;AAMA,SAAS,cAAc,SAAS;CAC/B,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,EAAE,OAAO;EACT,IAAI,QAAQ,SAAS,UAAU,UAAU,KAAK,IAAI,CAAC,EAAE,OAAO,kBAAkB,IAAI,CAAC;EACnF,GAAG,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC7D,GAAG,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAC/C,GAAG,QAAQ,mBAAmB,YAAY,CAAC,EAAE,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,CAAC;EACjF,IAAI,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAAI;GAC/C,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IAAI,CAAC;EACL,GAAG,QAAQ,SAAS,mBAAmB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IAAI,CAAC;CACrF;AACD;;AAEA,MAAM,qCAAqC;AAC3C,MAAM,yCAAyC;;AAE/C,SAAS,iBAAiB,MAAM,KAAK;CACpC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,IAAI,KAAK,cAAc,KAAK,GAAG,OAAO;CACtC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;AACA,SAAS,yBAAyB,MAAM,KAAK;CAC5C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,0CAA0C,iBAAiB,MAAM,GAAG,CAAC,KAAK;AACpH;AACA,SAAS,2BAA2B,MAAM,KAAK;CAC9C,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,sCAAsC,iBAAiB,MAAM,GAAG,CAAC,KAAK;AAChH;;;;;;;;;;;;AAYA,eAAe,+BAA+B,MAAM;CACnD,MAAM,eAAe,KAAK,OAAO,SAAS,cAAc,KAAK,KAAK,OAAO,SAAS,eAAe;CACjG,MAAM,eAAe,KAAK,OAAO,SAAS,mBAAmB;CAC7D,MAAM,OAAO,MAAM,KAAK,IAAI,gBAAgB,KAAK,WAAW,KAAK,QAAQ;CACzE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,iBAAiB,yBAAyB,MAAM,GAAG;CACzD,MAAM,iBAAiB,2BAA2B,MAAM,GAAG;CAC3D,MAAM,UAAU;EACf,aAAa;EACb,iBAAiB;EACjB,UAAU;CACX;CACA,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,MAAM,gBAAgB,gBAAgB,iBAAiB,cAAc,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU,eAAe,OAAO,CAAC,IAAI;CACzJ,IAAI,eAAe;EAClB,MAAM,WAAW,MAAM;EACvB,QAAQ,cAAc,SAAS;EAC/B,QAAQ,kBAAkB,SAAS;CACpC;CACA,IAAI,eAAe,QAAQ,YAAY,MAAM,cAAA,CAAe;CAC5D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,MAAM,iBAAiB,gBAAgB,mBAAmB;CAC1D,IAAI,kBAAkB,gBAAgB;EACrC,MAAM,SAAS,MAAM,qBAAqB;GACzC,GAAG;GACH,QAAQ,uBAAuB;IAC9B,SAAS;IACT,WAAW;IACX,WAAW,KAAK,OAAO,SAAS,kBAAkB;GACnD,CAAC;EACF,CAAC;EACD,IAAI,gBAAgB;GACnB,QAAQ,cAAc,OAAO;GAC7B,QAAQ,kBAAkB,OAAO;EAClC;EACA,IAAI,gBAAgB,QAAQ,WAAW,OAAO;CAC/C;CACA,OAAO;AACR;AACA,eAAe,qBAAqB,MAAM;CACzC,MAAM,SAAS,MAAM,KAAK,IAAI,iBAAiB,KAAK,WAAW,KAAK,UAAU;EAC7E,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CAAC;CACD,OAAO;EACN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;;;AAYA,SAAS,qBAAqB,eAAe;CAC5C,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CACA,OAAO,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;AACnD;AACA,SAAS,cAAc,UAAU,eAAe;CAC/C,OAAO,GAAG,SAAS,UAAU,qBAAqB,aAAa;AAChE;;;;;AAKA,SAAS,mBAAmB,aAAa;CACxC,MAAM,SAAS,YAAY,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;CACvD,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,uEAAuE,KAAK,UAAU,WAAW,EAAE,EAAE;CACxI,OAAO,YAAY;AACpB;;AAEA,SAAS,kBAAkB,WAAW,QAAQ;CAC7C,MAAM,MAAM,UAAU,QAAQ,aAAa,SAAS,aAAa,OAAO,EAAE;CAC1E,MAAM,WAAW,IAAI,MAAM,cAAc,UAAU,SAAS,YAAY,KAAK,IAAI;CACjF,IAAI,CAAC,UAAU,MAAM,MAAM,IAAI,cAAc,UAAU,UAAU,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,uHAAuH,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC1Q,OAAO,SAAS;AACjB;;AAEA,SAAS,iBAAiB,UAAU,eAAe;CAClD,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AACA,SAAS,qBAAqB,SAAS;CACtC,OAAO,yBAAyB,YAAY;EAC3C,GAAG,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EAClD,GAAG,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACtD,CAAC;AACF;;;;;;;AAOA,SAAS,cAAc,QAAQ,UAAU;CACxC,MAAM,QAAQ,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KAAK,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CAC7F,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAAiD,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACpP;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EAAE,CAAC;AACJ;AACA,SAAS,aAAa,OAAO,QAAQ,WAAW;CAC/C,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAAkB,gEAAgE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CAC5P,MAAM,SAAS,sBAAsB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,IAAI,QAAQ,OAAO;CACnB,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBAAuB,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACzS,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EAAE,CAAC;AACJ;AACA,SAAS,iBAAiB,WAAW,QAAQ,WAAW;CACvD,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAAK,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;GACjS,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EAAE,CAAC;EACH,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GAAG,MAAM,IAAI,cAAc,UAAU,gBAAgB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAAsB,oEAAoE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CAAC;CACxQ,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAChD,MAAM,IAAI,cAAc,UAAU,qBAAqB,CAAC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAAuB,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG,EAAE,SAAS;EACza,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EAAE,CAAC;AACJ;;;;;;;;;;;;AAYA,SAAS,UAAU,KAAK;CACvB,MAAM,MAAM,CAAC;CACb,MAAM,OAAO,KAAK,UAAU;EAC3B,IAAI,UAAU,KAAK,GAAG,IAAI,OAAO;CAClC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,OAAO,IAAI,IAAI,QAAQ,EAAE;CAC/B,IAAI,EAAE,OAAO,oBAAoB,IAAI,QAAQ,kBAAkB;CAC/D,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,SAAS,KAAK,IAAI,UAAU,GAAG;CACrC,IAAI,EAAE,SAAS,QAAQ,IAAI,UAAU,MAAM;CAC3C,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CACzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,OAAO;AACR"}