@neondatabase/config 1.10.0 → 1.10.2

package/dist/lib/define-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-config.d.ts","names":["BranchTarget","BranchTuningFn","BucketDef","Config","DataApiInput","ExperimentalInput","FunctionDef","FunctionTriggerDef","PreviewInput","ResolvedBranchConfig","ServiceEnabled","ServiceToggleInput","DataApiUsesNeonAuth","DataApi","NeonAuthRequiredHint","DataApiField","Auth","PreviewAutocomplete","Preview","F","B","FunctionsAutocomplete","Functions","Record","BucketsAutocomplete","Buckets","defineConfig","AiGateway","resolveConfig","normalizeRegion","BranchTarget","BranchTuningFn","BucketDef","Config","DataApiInput","ExperimentalInput","FunctionDef","FunctionTriggerDef","PreviewInput","ResolvedBranchConfig","ServiceEnabled","ServiceToggleInput","DataApiUsesNeonAuth","DataApi","authProvider","NeonAuthRequiredHint","DataApiField","Auth","PreviewAutocomplete","Preview","functions","F","buckets","B","FunctionsAutocomplete","Functions","Record","BucketsAutocomplete","Buckets","defineConfig","input","auth","dataApi","aiGateway","AiGateway","triggers","preview","branch","experimental","resolveConfig","config","normalizeRegion","region"],"sources":["../../src/lib/define-config.ts"],"mappings":";;;;;;AAmCoB;AAcI;AACRa;AAAfH,KADIE,mBACJF,CAAAA,OAAAA,CAAAA,GAAAA,cAAAA,CAAeG,OAAfH,CAAAA,SAAAA,IAAAA,GAAAA,CACIG,OADJH,CAAAA,SAAAA,CAAAA;EACIG,YAAAA,EAAAA,UAAAA;AAAO,CAAA,CAAA,GAAA,KAAA,GAAA,IAAA,GAAA,KAAA;AAiBZ;AAqBA;AAAwB;AACHA;AAApBD;AACkBI;AAAfN;AACCG;AAAUT;AACVU;AACDD,KA1BQC,oBAAAA,GA0BRD,+QAAAA;AAAUT;AAAY;AAAC;AAoBH;AAAac;AACJC;AAAIb;AAEnCY;AAC8BE;AAAIlB;AAAS;AAAA;AAGnB;AACzBoB;AAAkBC;AACED;AAAYhB,KAlCrBS,YAkCqBT,CAAAA,IAAAA,EAAAA,OAAAA,CAAAA,GAjChCM,mBAiCgCN,CAjCZO,OAiCYP,CAAAA,SAAAA,IAAAA,GAhC7BI,cAgC6BJ,CAhCdU,IAgCcV,CAAAA,SAAAA,IAAAA,GA/B5BO,OA+B4BP,GA/BlBF,YA+BkBE,GA9B5BQ,oBA8B4BR,GA7B7BO,OA6B6BP,GA7BnBF,YA6BmBE;AAAW;AAAA;AAGpB;AACvBmB;AAAgBF;AACIE;AAAUvB;AAAS;AAsCxC;AAA4B;AACRS;AACGP;AACAI;AACiBF;AAAfiB;AACarB;AAAfqB;AACEZ;AAQjBK,KAlEHC,mBAkEGD,CAAAA,OAAAA,CAAAA,GAAAA,CAlE6BE,OAkE7BF,SAAAA;EAAOL,SAAAA,EAAAA,KAAAA,EAAAA;AAISK,CAAAA,GAAAA;EAAMH,SAAAA,EAAAA,WAAnBE,MArEsBI,CAqEtBJ,GArE0BT,WAqE1BS,EACEY;AAAYhB,CAAAA,GAAAA,OAAAA,CAAAA,GAAAA,CApEvBO,OAoEuBP,SAAAA;EACZW,OAAAA,EAAAA,KAAAA,EAAAA;AACIhB,CAAAA,GAAAA;EAAfiB,OAAAA,EAAAA,WACsBD,MAtEQF,CAsERE,GAtEYpB,SAsEZoB,EAAtBD;AACSI,CAAAA,GAAAA,OAAAA,CAAAA;AACMvB,KArEZmB,qBAqEYnB,CAAAA,SAAAA,CAAAA,GApEhBoB,SAoEgBpB,SApEEqB,MAoEFrB,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,GAAAA,WAAfqB,MAnEmBD,SAmEnBC,GAnE+BjB,WAmE/BiB,EACoBE,GAAAA,OAAAA;AAApBD,KAjEGA,mBAiEHA,CAAAA,OAAAA,CAAAA,GAhEDC,OAgECD,SAhEeD,MAgEfC,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,GAAAA,WACyBjB,MAhENkB,OAgEMlB,GAhEIL,SAgEJK,EAAfgB,GAAAA,OAAAA;AAIDL;AAAUV;AAAmCU;AAApBD;AACXC;AAASI;AAAxBrB;AAIMI;AACLW;AAAMH;AAASK;AAASI;AAAWG;AAASE;AAAnDxB;AAAM;AAmCV;AAA6B;AACpBA;AACAH;AACNS;AAAoB;AAmRvB;;;;;;;;;;;;;A,iBA7VgBiB,Y,oBACIf,kB,gDACGP,Y,gDACAI,Y,kDACEe,M,SAAejB,W,iDACjBiB,M,SAAerB,S,mDACbS,kB;E,OAQjBK,I,GAAOL,kB;E,UAIJI,Y,CAAaC,I,EAAMH,O;E,YACjBc,S,GAAYhB,kB;E,YACZW,S,GACXC,M,SAAejB,W,IACfe,qB,CAAsBC,S;E,UACbG,O,GACTF,M,SAAerB,S,IACfsB,mB,CAAoBC,O;E,WACVF,M,SAAehB,kB;E,UAIhBW,O,GAAUV,Y,GAAeS,mB,CAAoBC,O;E,SAC9CjB,c,CAAeiB,O,EAASI,S;E,eAIlBjB,iB;A,IACZF,M,CAAOa,I,EAAMH,O,EAASK,O,EAASI,S,EAAWG,O,EAASE,S;;;;;;;;A,iBAmCvCC,aAAAA,C,QACPzB,M,UACAH,Y,GACNS,oB;;;;;;A,iBAmRaoB,eAAAA,C"}
+{"version":3,"file":"define-config.d.ts","names":["BranchTarget","BranchTuningFn","BucketDef","Config","DataApiInput","ExperimentalInput","FunctionDef","FunctionTriggerDef","PreviewInput","ResolvedBranchConfig","ServiceEnabled","ServiceToggleInput","DataApiUsesNeonAuth","DataApi","NeonAuthRequiredHint","DataApiField","Auth","PreviewAutocomplete","Preview","F","B","FunctionsAutocomplete","Functions","Record","BucketsAutocomplete","Buckets","defineConfig","AiGateway","resolveConfig","normalizeRegion","BranchTarget","BranchTuningFn","BucketDef","Config","DataApiInput","ExperimentalInput","FunctionDef","FunctionTriggerDef","PreviewInput","ResolvedBranchConfig","ServiceEnabled","ServiceToggleInput","DataApiUsesNeonAuth","DataApi","authProvider","NeonAuthRequiredHint","DataApiField","Auth","PreviewAutocomplete","Preview","functions","F","buckets","B","FunctionsAutocomplete","Functions","Record","BucketsAutocomplete","Buckets","defineConfig","input","auth","dataApi","aiGateway","AiGateway","triggers","preview","branch","experimental","resolveConfig","config","normalizeRegion","region"],"sources":["../../src/lib/define-config.ts"],"mappings":";;;;;;AAoCoB;AAcI;AACRa;AAAfH,KADIE,mBACJF,CAAAA,OAAAA,CAAAA,GAAAA,cAAAA,CAAeG,OAAfH,CAAAA,SAAAA,IAAAA,GAAAA,CACIG,OADJH,CAAAA,SAAAA,CAAAA;EACIG,YAAAA,EAAAA,UAAAA;AAAO,CAAA,CAAA,GAAA,KAAA,GAAA,IAAA,GAAA,KAAA;AAiBZ;AAqBA;AAAwB;AACHA;AAApBD;AACkBI;AAAfN;AACCG;AAAUT;AACVU;AACDD,KA1BQC,oBAAAA,GA0BRD,+QAAAA;AAAUT;AAAY;AAAC;AAoBH;AAAac;AACJC;AAAIb;AAEnCY;AAC8BE;AAAIlB;AAAS;AAAA;AAGnB;AACzBoB;AAAkBC;AACED;AAAYhB,KAlCrBS,YAkCqBT,CAAAA,IAAAA,EAAAA,OAAAA,CAAAA,GAjChCM,mBAiCgCN,CAjCZO,OAiCYP,CAAAA,SAAAA,IAAAA,GAhC7BI,cAgC6BJ,CAhCdU,IAgCcV,CAAAA,SAAAA,IAAAA,GA/B5BO,OA+B4BP,GA/BlBF,YA+BkBE,GA9B5BQ,oBA8B4BR,GA7B7BO,OA6B6BP,GA7BnBF,YA6BmBE;AAAW;AAAA;AAGpB;AACvBmB;AAAgBF;AACIE;AAAUvB;AAAS;AAsCxC;AAA4B;AACRS;AACGP;AACAI;AACiBF;AAAfiB;AACarB;AAAfqB;AACEZ;AAQjBK,KAlEHC,mBAkEGD,CAAAA,OAAAA,CAAAA,GAAAA,CAlE6BE,OAkE7BF,SAAAA;EAAOL,SAAAA,EAAAA,KAAAA,EAAAA;AAISK,CAAAA,GAAAA;EAAMH,SAAAA,EAAAA,WAAnBE,MArEsBI,CAqEtBJ,GArE0BT,WAqE1BS,EACEY;AAAYhB,CAAAA,GAAAA,OAAAA,CAAAA,GAAAA,CApEvBO,OAoEuBP,SAAAA;EACZW,OAAAA,EAAAA,KAAAA,EAAAA;AACIhB,CAAAA,GAAAA;EAAfiB,OAAAA,EAAAA,WACsBD,MAtEQF,CAsERE,GAtEYpB,SAsEZoB,EAAtBD;AACSI,CAAAA,GAAAA,OAAAA,CAAAA;AACMvB,KArEZmB,qBAqEYnB,CAAAA,SAAAA,CAAAA,GApEhBoB,SAoEgBpB,SApEEqB,MAoEFrB,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,GAAAA,WAAfqB,MAnEmBD,SAmEnBC,GAnE+BjB,WAmE/BiB,EACoBE,GAAAA,OAAAA;AAApBD,KAjEGA,mBAiEHA,CAAAA,OAAAA,CAAAA,GAhEDC,OAgECD,SAhEeD,MAgEfC,CAAAA,MAAAA,EAAAA,OAAAA,CAAAA,GAAAA,WACyBjB,MAhENkB,OAgEMlB,GAhEIL,SAgEJK,EAAfgB,GAAAA,OAAAA;AAIDL;AAAUV;AAAmCU;AAApBD;AACXC;AAASI;AAAxBrB;AAIMI;AACLW;AAAMH;AAASK;AAASI;AAAWG;AAASE;AAAnDxB;AAAM;AAqCV;AAA6B;AACpBA;AACAH;AACNS;AAAoB;AAmRvB;;;;;;;;;;;;;A,iBA/VgBiB,Y,oBACIf,kB,gDACGP,Y,gDACAI,Y,kDACEe,M,SAAejB,W,iDACjBiB,M,SAAerB,S,mDACbS,kB;E,OAQjBK,I,GAAOL,kB;E,UAIJI,Y,CAAaC,I,EAAMH,O;E,YACjBc,S,GAAYhB,kB;E,YACZW,S,GACXC,M,SAAejB,W,IACfe,qB,CAAsBC,S;E,UACbG,O,GACTF,M,SAAerB,S,IACfsB,mB,CAAoBC,O;E,WACVF,M,SAAehB,kB;E,UAIhBW,O,GAAUV,Y,GAAeS,mB,CAAoBC,O;E,SAC9CjB,c,CAAeiB,O,EAASI,S;E,eAIlBjB,iB;A,IACZF,M,CAAOa,I,EAAMH,O,EAASK,O,EAASI,S,EAAWG,O,EAASE,S;;;;;;;;A,iBAqCvCC,aAAAA,C,QACPzB,M,UACAH,Y,GACNS,oB;;;;;;A,iBAmRaoB,eAAAA,C"}

package/dist/lib/define-config.js

@@ -2,7 +2,7 @@ import { ConfigValidationError } from "./errors.js";
 import { normalizeCustomDomain } from "./custom-domain.js";
 import { parseBranchTtl } from "./duration.js";
 import { normalizeExternalPackage } from "./external-packages.js";
-import { branchTuningSchema, configInputSchema, formatZodIssues } from "./schema.js";
+import { branchTuningSchema, configInputSchema, configInputUnknownKeyHints, formatZodIssues } from "./schema.js";
 import { authoredFunctionTuning, mergeAuthoredPreview } from "./authored-services.js";
 // src/lib/define-config.ts
 /** Default deploy parameters applied to functions that omit them in `neon.ts`. */
@@ -48,7 +48,7 @@ function defineConfig(input) {
 	if (typeof input === "function") throw new ConfigValidationError(["defineConfig now expects an object, not a function: `export default defineConfig({ auth: true, functions: { … }, branch: (branch) => ({ … }) })`.", "The static services set moved to the top level; per-branch logic moved into the `branch` closure."]);
 	if (input === null || typeof input !== "object") throw new ConfigValidationError(["defineConfig expects a configuration object: `export default defineConfig({ … })`."]);
 	const parsed = configInputSchema.safeParse(input);
-	if (!parsed.success) throw new ConfigValidationError(formatZodIssues(parsed.error));
+	if (!parsed.success) throw new ConfigValidationError(formatZodIssues(parsed.error, configInputUnknownKeyHints));
 	return Object.freeze({ ...input });
 }
 /**

package/dist/lib/define-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"define-config.js","names":[],"sources":["../../src/lib/define-config.ts"],"sourcesContent":["import {\n\tauthoredFunctionTuning,\n\tmergeAuthoredPreview,\n} from \"./authored-services.js\";\nimport { normalizeCustomDomain } from \"./custom-domain.js\";\nimport { parseBranchTtl } from \"./duration.js\";\nimport { ConfigValidationError } from \"./errors.js\";\nimport { normalizeExternalPackage } from \"./external-packages.js\";\nimport {\n\tbranchTuningSchema,\n\tconfigInputSchema,\n\tformatZodIssues,\n} from \"./schema.js\";\nimport type {\n\tBranchTarget,\n\tBranchTuning,\n\tBranchTuningFn,\n\tBucketDef,\n\tConfig,\n\tDataApiInput,\n\tDataApiSettings,\n\tExperimentalInput,\n\tFunctionDef,\n\tFunctionTriggerDef,\n\tFunctionTuning,\n\tPreviewInput,\n\tRealtimeConfig,\n\tRealtimeInput,\n\tResolvedBranchConfig,\n\tResolvedDataApiConfig,\n\tResolvedFunctionConfig,\n\tResolvedFunctionTrigger,\n\tResolvedPreviewConfig,\n\tServiceEnabled,\n\tServiceToggleInput,\n} from \"./types.js\";\n\n/** Default deploy parameters applied to functions that omit them in `neon.ts`. */\nconst DEFAULT_FUNCTION_RUNTIME = \"nodejs24\" as const;\n\nconst DEFAULT_FUNCTION_BUNDLER = \"esbuild\" as const;\n\nconst REGION_PREFIX = /^(aws|azure|gcp)-/;\n\n/**\n * Whether a `dataApi` toggle is **enabled and verified by Neon Auth** at the type level: it is\n * on (see {@link ServiceEnabled}) and not the explicit `authProvider: \"external\"` variant\n * (so the default / `\"neon\"` provider). This is the case that requires top-level Neon Auth.\n */\ntype DataApiUsesNeonAuth<DataApi> =\n\tServiceEnabled<DataApi> extends true\n\t\t? [DataApi] extends [{ authProvider: \"external\" }]\n\t\t\t? false\n\t\t\t: true\n\t\t: false;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `dataApi` when a Neon-Auth Data\n * API is declared without Neon Auth enabled (see {@link DataApiField}). TypeScript prints the\n * offending value against this string literal — `Type 'true' is not assignable to type\n * '…requires `auth: true`…'` — which points straight at the fix, instead of the opaque\n * `Type 'true' is not assignable to type 'never'` an intersection guard produces.\n *\n * It documents **both** fixes: enabling Neon Auth (`auth: true`), and running the Data API\n * *without* Neon Auth by verifying a third-party IdP (`authProvider: 'external'` + `jwksUrl`).\n */\n// Exported (type-only) for the type tests in `define-config.test-d.ts`; intentionally not\n// re-exported from `v1.ts` / `index.ts`, so it stays an internal implementation detail.\nexport type NeonAuthRequiredHint =\n\t\"`dataApi` with Neon Auth (the default `authProvider: 'neon'`) requires Neon Auth, so add `auth: true`. To enable the Data API WITHOUT Neon Auth, verify a third-party IdP instead: `dataApi: { authProvider: 'external', jwksUrl: 'https://your-idp/.well-known/jwks.json' }`\";\n\n/**\n * Static cross-field guard for {@link defineConfig}, expressed as the **type of the `dataApi`\n * field** rather than an intersected requirement on `auth`.\n *\n * - A Neon-Auth Data API (`authProvider: \"neon\"`, the default) with top-level `auth` enabled,\n *   or any external Data API: the field keeps its normal `DataApi & DataApiInput` type (the\n *   `& DataApiInput` preserves member autocomplete; the `const DataApi` still types the\n *   returned {@link Config}).\n * - A Neon-Auth Data API **without** `auth` enabled: the field's expected type collapses to\n *   the {@link NeonAuthRequiredHint} message, so the author sees the rule (and the two fixes)\n *   right on the `dataApi` value.\n *\n * The runtime `superRefine` in {@link configInputSchema} enforces the same invariant for\n * non-typed (plain-JS) callers, so the behavior is identical — only the type-level message\n * changes.\n */\n// Exported (type-only) for the type tests in `define-config.test-d.ts`; intentionally not\n// re-exported from `v1.ts` / `index.ts`, so it stays an internal implementation detail.\nexport type DataApiField<Auth, DataApi> =\n\tDataApiUsesNeonAuth<DataApi> extends true\n\t\t? ServiceEnabled<Auth> extends true\n\t\t\t? DataApi & DataApiInput\n\t\t\t: NeonAuthRequiredHint\n\t\t: DataApi & DataApiInput;\n\n/**\n * Autocomplete bridge for the nested `preview.functions` / `preview.buckets` slug objects.\n *\n * {@link PreviewInput} types those records with a string index signature\n * (`Record<string, FunctionDef>` / `Record<string, BucketDef>`). When `defineConfig` infers\n * `const Preview`, every authored slug becomes a **named** property on the inferred literal\n * (e.g. `{ hello: { name; source } }`), and a named property **shadows** the index signature\n * when the editor computes the contextual type of that slug's value — so the rest of\n * {@link FunctionDef} / {@link BucketDef} (`env`, `dev`, `access`, …) never surfaces as\n * completions inside `hello: { … }` / `uploads: { … }`.\n *\n * Re-declaring each inferred slug's value as `FunctionDef` / `BucketDef` (a *named* member, via\n * a mapped type over the already-inferred keys) puts those members back onto the contextual\n * type without going through an index signature, which restores autocomplete. Intersected with\n * `Preview & PreviewInput` it neither widens what is accepted (the values were already\n * `FunctionDef` / `BucketDef`) nor perturbs the inferred `const Preview` — so slug inference for\n * `BranchTuningFn<Preview>` and the returned {@link Config} is unchanged.\n */\ntype PreviewAutocomplete<Preview> = (Preview extends { functions: infer F }\n\t? { functions: { [Slug in keyof F]: FunctionDef } }\n\t: unknown) &\n\t(Preview extends { buckets: infer B }\n\t\t? { buckets: { [Name in keyof B]: BucketDef } }\n\t\t: unknown);\n\ntype FunctionsAutocomplete<Functions> =\n\tFunctions extends Record<string, unknown>\n\t\t? { [Slug in keyof Functions]: FunctionDef }\n\t\t: unknown;\n\ntype BucketsAutocomplete<Buckets> =\n\tBuckets extends Record<string, unknown>\n\t\t? { [Name in keyof Buckets]: BucketDef }\n\t\t: unknown;\n\n/**\n * Validate and freeze a Neon branch policy.\n *\n * Used at the top of `neon.ts`:\n * ```ts\n * import { defineConfig } from \"@neon/config/v1\";\n *\n * export default defineConfig({\n *   preview: {\n *     realtime: { allowedOrigins: [\"https://app.example.com\"] },\n *   },\n *   auth: true,\n *   functions: {\n *     hello: { name: \"Hello\", source: \"./functions/hello.ts\", dev: { port: 8787 } },\n *   },\n *   branch: (branch) => ({ protected: branch.name === \"main\" }),\n * });\n * ```\n *\n * The policy is split into a **static** existential set (`preview.realtime`, top-level `auth` /\n * `dataApi` / `aiGateway` / `functions` / `buckets` / `triggers`, plus the deprecated\n * aliases under `preview`) and a\n * **dynamic** per-branch `branch` closure. The static half determines which secrets exist —\n * so `NeonEnv<typeof config>` and `parseEnv` are exact — while the closure can only *tune*\n * a branch (lifecycle, compute, per-function deploy settings), never change what exists.\n *\n * The `branch` callback receives a read-only {@link BranchTarget} descriptor of the branch\n * being decided for (not a live handle); switch on its facts (`branch.name`,\n * `branch.isDefault`, `branch.exists`, …) and **return** the desired tuning. It runs in two\n * modes: against an existing branch (fields populated from Neon) and during pre-create\n * evaluation (`exists: false`, `id` undefined).\n *\n * Pure: no I/O, no side effects. The static parts are validated here; the closure's output\n * is validated every time it is evaluated so errors point at the concrete branch target.\n */\nexport function defineConfig<\n\tconst Auth extends ServiceToggleInput | undefined = undefined,\n\tconst DataApi extends DataApiInput | undefined = undefined,\n\tconst Preview extends PreviewInput | undefined = undefined,\n\tconst Functions extends Record<string, FunctionDef> | undefined = undefined,\n\tconst Buckets extends Record<string, BucketDef> | undefined = undefined,\n\tconst AiGateway extends ServiceToggleInput | undefined = undefined,\n>(input: {\n\t// Each field is intersected with its concrete interface (not just typed as the bare\n\t// generic). The generic alone — e.g. `preview?: Preview` — gives editors no members to\n\t// complete against in the object-literal position (they see `{} | undefined`), so you\n\t// lose hints for `aiGateway` / `functions` / `buckets`. `& PreviewInput` restores the\n\t// full shape for autocomplete while still inferring the `const` literal that types the\n\t// `branch` closure's slugs (BranchTuningFn<Preview>) and the returned Config.\n\tauth?: Auth & ServiceToggleInput;\n\t// The `dataApi` field carries the Neon-Auth cross-field guard at the type level (see\n\t// `DataApiField`): a Neon-Auth Data API without `auth` enabled surfaces a readable hint\n\t// as the field's expected type instead of collapsing the value to `never`.\n\tdataApi?: DataApiField<Auth, DataApi>;\n\taiGateway?: AiGateway & ServiceToggleInput;\n\tfunctions?: Functions &\n\t\tRecord<string, FunctionDef> &\n\t\tFunctionsAutocomplete<Functions>;\n\tbuckets?: Buckets &\n\t\tRecord<string, BucketDef> &\n\t\tBucketsAutocomplete<Buckets>;\n\ttriggers?: Record<string, FunctionTriggerDef>;\n\t// `& PreviewInput` restores top-level member hints (realtime/aiGateway/functions/buckets);\n\t// `& PreviewAutocomplete<Preview>` restores hints *inside* each function/bucket slug\n\t// object (see `PreviewAutocomplete`), which the bare index signature otherwise hides.\n\tpreview?: Preview & PreviewInput & PreviewAutocomplete<Preview>;\n\tbranch?: BranchTuningFn<Preview, Functions>;\n\t// Experimental (unstable) features — currently just lifecycle hooks. Static — carried\n\t// through onto the returned Config and read by the runtime at `checkout` / `deploy` time.\n\t// Never evaluated here.\n\texperimental?: ExperimentalInput;\n}): Config<Auth, DataApi, Preview, Functions, Buckets, AiGateway> {\n\tif (typeof input === \"function\") {\n\t\tthrow new ConfigValidationError([\n\t\t\t\"defineConfig now expects an object, not a function: `export default defineConfig({ auth: true, functions: { … }, branch: (branch) => ({ … }) })`.\",\n\t\t\t\"The static services set moved to the top level; per-branch logic moved into the `branch` closure.\",\n\t\t]);\n\t}\n\tif (input === null || typeof input !== \"object\") {\n\t\tthrow new ConfigValidationError([\n\t\t\t\"defineConfig expects a configuration object: `export default defineConfig({ … })`.\",\n\t\t]);\n\t}\n\n\tconst parsed = configInputSchema.safeParse(input);\n\tif (!parsed.success) {\n\t\tthrow new ConfigValidationError(formatZodIssues(parsed.error));\n\t}\n\n\treturn Object.freeze({ ...input }) as Config<\n\t\tAuth,\n\t\tDataApi,\n\t\tPreview,\n\t\tFunctions,\n\t\tBuckets,\n\t\tAiGateway\n\t>;\n}\n\n/**\n * Evaluate a branch policy for a specific branch target and return a normalized config.\n *\n * Merges the static existential set (services + functions/buckets) with the\n * per-branch tuning returned by the `branch` closure into the same {@link\n * ResolvedBranchConfig} the rest of the runtime (diff / push / fetchEnv) consumes.\n */\nexport function resolveConfig(\n\tconfig: Config,\n\tbranch: BranchTarget,\n): ResolvedBranchConfig {\n\tconst tuning = evaluateBranchTuning(config.branch, branch);\n\tconst realtimeInput = config.preview?.realtime;\n\n\tconst resolved: ResolvedBranchConfig = {\n\t\trealtimePolicy:\n\t\t\trealtimeInput === undefined\n\t\t\t\t? \"omitted\"\n\t\t\t\t: isRealtimeEnabled(realtimeInput)\n\t\t\t\t\t? \"enabled\"\n\t\t\t\t\t: \"disabled\",\n\t\tauthEnabled: isServiceEnabled(config.auth),\n\t\tdataApiEnabled: isDataApiEnabled(config.dataApi),\n\t\tdataApiPolicy:\n\t\t\tconfig.dataApi === undefined\n\t\t\t\t? \"omitted\"\n\t\t\t\t: isDataApiEnabled(config.dataApi)\n\t\t\t\t\t? \"enabled\"\n\t\t\t\t\t: \"disabled\",\n\t};\n\tconst realtime = resolveRealtime(realtimeInput);\n\tif (realtime) resolved.realtime = realtime;\n\tconst dataApi = resolveDataApi(config.dataApi);\n\tif (dataApi) resolved.dataApi = dataApi;\n\tif (tuning.parent !== undefined) resolved.parent = tuning.parent;\n\tif (tuning.ttl !== undefined) {\n\t\t// `branchTuningSchema` already validated `ttl` with the same `parseBranchTtl`, so\n\t\t// this only converts the validated value to seconds — it cannot fail here.\n\t\tconst parsedTtl = parseBranchTtl(tuning.ttl);\n\t\tif (!(\"error\" in parsedTtl)) resolved.ttlSeconds = parsedTtl.seconds;\n\t}\n\tif (tuning.protected !== undefined) resolved.protected = tuning.protected;\n\tif (tuning.postgres?.computeSettings) {\n\t\tresolved.postgres = {\n\t\t\tcomputeSettings: { ...tuning.postgres.computeSettings },\n\t\t};\n\t}\n\n\tconst preview = resolvePreviewConfig(\n\t\tmergeAuthoredPreview(config),\n\t\ttuning,\n\t\tbranch,\n\t);\n\tif (preview) resolved.preview = preview;\n\tconst triggers = resolveTriggers(config.triggers);\n\tif (triggers.length > 0) resolved.triggers = triggers;\n\n\treturn resolved;\n}\n\n/**\n * Run the `branch` closure (when present) for the target and validate its output. The\n * closure is optional — a fully static policy resolves with empty tuning.\n */\nfunction evaluateBranchTuning(\n\tbranchFn: BranchTuningFn | undefined,\n\ttarget: BranchTarget,\n): BranchTuning {\n\tif (!branchFn) return {};\n\tlet raw: unknown;\n\ttry {\n\t\traw = branchFn(Object.freeze({ ...target }));\n\t} catch (cause) {\n\t\tthrow new ConfigValidationError([\n\t\t\t`Branch policy threw while evaluating branch \"${target.name}\".`,\n\t\t\t(cause as Error)?.message ?? String(cause),\n\t\t]);\n\t}\n\tconst parsed = branchTuningSchema.safeParse(raw ?? {});\n\tif (!parsed.success) {\n\t\tthrow new ConfigValidationError(formatZodIssues(parsed.error));\n\t}\n\treturn parsed.data as BranchTuning;\n}\n\nfunction isServiceEnabled(toggle: ServiceToggleInput | undefined): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/** Whether a {@link RealtimeInput} is enabled (present object or `true`). */\nfunction isRealtimeEnabled(input: RealtimeInput | undefined): boolean {\n\tif (input === undefined) return false;\n\tif (typeof input === \"boolean\") return input;\n\treturn true;\n}\n\n/** Copy the options from an object-form {@link RealtimeInput}. */\nfunction resolveRealtime(\n\tinput: RealtimeInput | undefined,\n): RealtimeConfig | undefined {\n\tif (typeof input !== \"object\") return undefined;\n\treturn {\n\t\t...(input.allowedOrigins !== undefined\n\t\t\t? { allowedOrigins: [...input.allowedOrigins] }\n\t\t\t: {}),\n\t};\n}\n\n/** Whether a {@link DataApiInput} is enabled (present object/`true` unless `enabled: false`). */\nfunction isDataApiEnabled(input: DataApiInput | undefined): boolean {\n\tif (input === undefined) return false;\n\tif (typeof input === \"boolean\") return input;\n\treturn input.enabled !== false;\n}\n\n/**\n * Normalize a {@link DataApiInput} into a {@link ResolvedDataApiConfig}, or `undefined` when\n * the Data API is not enabled. `authProvider` defaults to `\"neon\"`; the external-IdP wiring\n * is carried through only for the `\"external\"` provider; `settings` is copied with its\n * `undefined` entries dropped so diffing only considers fields the policy actually set.\n */\nfunction resolveDataApi(\n\tinput: DataApiInput | undefined,\n): ResolvedDataApiConfig | undefined {\n\tif (!isDataApiEnabled(input)) return undefined;\n\tif (typeof input !== \"object\") {\n\t\t// Bare `true`: enabled with Neon Auth and all-default settings.\n\t\treturn { authProvider: \"neon\" };\n\t}\n\tconst authProvider = input.authProvider ?? \"neon\";\n\tconst resolved: ResolvedDataApiConfig = { authProvider };\n\tif (authProvider === \"external\") {\n\t\tif (input.jwksUrl !== undefined) resolved.jwksUrl = input.jwksUrl;\n\t\tif (input.providerName !== undefined)\n\t\t\tresolved.providerName = input.providerName;\n\t\tif (input.jwtAudience !== undefined)\n\t\t\tresolved.jwtAudience = input.jwtAudience;\n\t}\n\tconst settings = normalizeDataApiSettings(input.settings);\n\tif (settings) resolved.settings = settings;\n\treturn resolved;\n}\n\n/** Copy a {@link DataApiSettings}, dropping `undefined` entries; `undefined` when empty. */\nfunction normalizeDataApiSettings(\n\tsettings: DataApiSettings | undefined,\n): DataApiSettings | undefined {\n\tif (!settings) return undefined;\n\tconst out: DataApiSettings = {};\n\tfor (const [key, value] of Object.entries(settings)) {\n\t\tif (value !== undefined) {\n\t\t\t(out as Record<string, unknown>)[key] = value;\n\t\t}\n\t}\n\treturn Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize the static {@link PreviewInput} (merged with per-branch function tuning) into a\n * {@link ResolvedPreviewConfig}. Returns `undefined` when the policy declares no `preview`\n * block so the field can be omitted entirely. Function slugs / bucket names come from the\n * record keys.\n */\nfunction resolvePreviewConfig(\n\tpreview: PreviewInput | undefined,\n\ttuning: BranchTuning,\n\tbranch: BranchTarget,\n): ResolvedPreviewConfig | undefined {\n\tif (!preview) return undefined;\n\tconst fnTuning = authoredFunctionTuning(tuning);\n\tconst functions: ResolvedFunctionConfig[] = Object.entries(\n\t\tpreview.functions ?? {},\n\t).map(([slug, def]) =>\n\t\tresolveFunctionConfig(slug, def, fnTuning[slug] ?? {}, branch),\n\t);\n\tassertUniqueResolvedCustomDomains(functions);\n\tconst buckets = Object.entries(preview.buckets ?? {}).map(\n\t\t([name, def]) => ({\n\t\t\tname,\n\t\t\taccess: def.access ?? \"private\",\n\t\t}),\n\t);\n\treturn {\n\t\tfunctions,\n\t\tbuckets,\n\t\taiGatewayEnabled: isServiceEnabled(preview.aiGateway),\n\t};\n}\n\nfunction resolveFunctionConfig(\n\tslug: string,\n\tdef: FunctionDef,\n\ttuning: FunctionTuning,\n\tbranch: BranchTarget,\n): ResolvedFunctionConfig {\n\tconst customDomains = resolveFunctionCustomDomains(def, tuning, branch);\n\treturn {\n\t\tslug,\n\t\tname: def.name,\n\t\tsource: def.source,\n\t\tenv: { ...(def.env ?? {}) },\n\t\truntime: tuning.runtime ?? DEFAULT_FUNCTION_RUNTIME,\n\t\tbundler: def.bundler ?? DEFAULT_FUNCTION_BUNDLER,\n\t\t// Normalized only when declared, so a policy without it resolves unchanged and takes\n\t\t// the pre-existing bundling path. Both bundlers read it; `neon dev` mirrors it so a\n\t\t// local run leaves the same packages unbundled as a deploy.\n\t\t...(def.externalPackages\n\t\t\t? {\n\t\t\t\t\texternalPackages: def.externalPackages.map(\n\t\t\t\t\t\tnormalizeExternalPackage,\n\t\t\t\t\t),\n\t\t\t\t}\n\t\t\t: {}),\n\t\t// Passed through untouched (no defaults); only `neon dev` reads it.\n\t\t...(def.dev ? { dev: def.dev } : {}),\n\t\t...(customDomains !== undefined ? { customDomains } : {}),\n\t};\n}\n\nfunction resolveTriggers(\n\ttriggers: Record<string, FunctionTriggerDef> | undefined,\n): ResolvedFunctionTrigger[] {\n\tif (!triggers) return [];\n\treturn Object.entries(triggers).map(([name, trigger]) => {\n\t\tif (trigger.type === \"schedule\") {\n\t\t\treturn {\n\t\t\t\ttype: \"schedule\" as const,\n\t\t\t\tname,\n\t\t\t\tfunctionSlug: trigger.function,\n\t\t\t\tcron: trigger.cron,\n\t\t\t\tfunctionPath: trigger.functionPath ?? \"/\",\n\t\t\t\tenabled: trigger.enabled ?? true,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttype: \"storage_object_created\" as const,\n\t\t\tname,\n\t\t\tfunctionSlug: trigger.function,\n\t\t\tbucketName: trigger.bucket,\n\t\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\t\tfunctionPath: trigger.functionPath ?? \"/\",\n\t\t\tenabled: trigger.enabled ?? true,\n\t\t};\n\t});\n}\n\nfunction resolveFunctionCustomDomains(\n\tdef: FunctionDef,\n\ttuning: FunctionTuning,\n\tbranch: BranchTarget,\n): string[] | undefined {\n\tif (tuning.customDomains !== undefined) {\n\t\treturn tuning.customDomains.map(normalizeCustomDomain);\n\t}\n\t// Hostnames are globally unique, so a child checkout 409s if it inherits this list.\n\tif (def.customDomains !== undefined && branch.isDefault === true) {\n\t\treturn def.customDomains.map(normalizeCustomDomain);\n\t}\n\treturn undefined;\n}\n\nfunction assertUniqueResolvedCustomDomains(\n\tfunctions: ResolvedFunctionConfig[],\n): void {\n\tconst byDomain = new Map<string, string>();\n\tfor (const fn of functions) {\n\t\tfor (const domain of fn.customDomains ?? []) {\n\t\t\tconst prior = byDomain.get(domain);\n\t\t\tif (prior !== undefined) {\n\t\t\t\tthrow new ConfigValidationError([\n\t\t\t\t\t`custom domain \"${domain}\" is used by both function \"${prior}\" and \"${fn.slug}\"`,\n\t\t\t\t]);\n\t\t\t}\n\t\t\tbyDomain.set(domain, fn.slug);\n\t\t}\n\t}\n}\n\n/**\n * Normalize a region identifier to Neon's `<cloud>-<region>` format. When the user writes\n * `us-east-1` we assume `aws-us-east-1`. Pure helper used by both the validator and the\n * NeonApi adapter.\n */\nexport function normalizeRegion(region: string): string {\n\tif (REGION_PREFIX.test(region)) return region;\n\treturn `aws-${region}`;\n}\n"],"mappings":";;;;;;;;AAsCA,MAAM,2BAA2B;AAEjC,MAAM,2BAA2B;AAEjC,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4HtB,SAAgB,aAOd,OA6BgE;CACjE,IAAI,OAAO,UAAU,YACpB,MAAM,IAAI,sBAAsB,CAC/B,qJACA,mGACD,CAAC;CAEF,IAAI,UAAU,QAAQ,OAAO,UAAU,UACtC,MAAM,IAAI,sBAAsB,CAC/B,oFACD,CAAC;CAGF,MAAM,SAAS,kBAAkB,UAAU,KAAK;CAChD,IAAI,CAAC,OAAO,SACX,MAAM,IAAI,sBAAsB,gBAAgB,OAAO,KAAK,CAAC;CAG9D,OAAO,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;AAQlC;;;;;;;;AASA,SAAgB,cACf,QACA,QACuB;CACvB,MAAM,SAAS,qBAAqB,OAAO,QAAQ,MAAM;CACzD,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,WAAiC;EACtC,gBACC,kBAAkB,KAAA,IACf,YACA,kBAAkB,aAAa,IAC9B,YACA;EACL,aAAa,iBAAiB,OAAO,IAAI;EACzC,gBAAgB,iBAAiB,OAAO,OAAO;EAC/C,eACC,OAAO,YAAY,KAAA,IAChB,YACA,iBAAiB,OAAO,OAAO,IAC9B,YACA;CACN;CACA,MAAM,WAAW,gBAAgB,aAAa;CAC9C,IAAI,UAAU,SAAS,WAAW;CAClC,MAAM,UAAU,eAAe,OAAO,OAAO;CAC7C,IAAI,SAAS,SAAS,UAAU;CAChC,IAAI,OAAO,WAAW,KAAA,GAAW,SAAS,SAAS,OAAO;CAC1D,IAAI,OAAO,QAAQ,KAAA,GAAW;EAG7B,MAAM,YAAY,eAAe,OAAO,GAAG;EAC3C,IAAI,EAAE,WAAW,YAAY,SAAS,aAAa,UAAU;CAC9D;CACA,IAAI,OAAO,cAAc,KAAA,GAAW,SAAS,YAAY,OAAO;CAChE,IAAI,OAAO,UAAU,iBACpB,SAAS,WAAW,EACnB,iBAAiB,EAAE,GAAG,OAAO,SAAS,gBAAgB,EACvD;CAGD,MAAM,UAAU,qBACf,qBAAqB,MAAM,GAC3B,QACA,MACD;CACA,IAAI,SAAS,SAAS,UAAU;CAChC,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,SAAS,SAAS,GAAG,SAAS,WAAW;CAE7C,OAAO;AACR;;;;;AAMA,SAAS,qBACR,UACA,QACe;CACf,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;CACJ,IAAI;EACH,MAAM,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;CAC5C,SAAS,OAAO;EACf,MAAM,IAAI,sBAAsB,CAC/B,gDAAgD,OAAO,KAAK,KAC3D,OAAiB,WAAW,OAAO,KAAK,CAC1C,CAAC;CACF;CACA,MAAM,SAAS,mBAAmB,UAAU,OAAO,CAAC,CAAC;CACrD,IAAI,CAAC,OAAO,SACX,MAAM,IAAI,sBAAsB,gBAAgB,OAAO,KAAK,CAAC;CAE9D,OAAO,OAAO;AACf;AAEA,SAAS,iBAAiB,QAAiD;CAC1E,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;;AAGA,SAAS,kBAAkB,OAA2C;CACrE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,OAAO;AACR;;AAGA,SAAS,gBACR,OAC6B;CAC7B,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,OAAO,EACN,GAAI,MAAM,mBAAmB,KAAA,IAC1B,EAAE,gBAAgB,CAAC,GAAG,MAAM,cAAc,EAAE,IAC5C,CAAC,EACL;AACD;;AAGA,SAAS,iBAAiB,OAA0C;CACnE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,OAAO,MAAM,YAAY;AAC1B;;;;;;;AAQA,SAAS,eACR,OACoC;CACpC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAA;CACrC,IAAI,OAAO,UAAU,UAEpB,OAAO,EAAE,cAAc,OAAO;CAE/B,MAAM,eAAe,MAAM,gBAAgB;CAC3C,MAAM,WAAkC,EAAE,aAAa;CACvD,IAAI,iBAAiB,YAAY;EAChC,IAAI,MAAM,YAAY,KAAA,GAAW,SAAS,UAAU,MAAM;EAC1D,IAAI,MAAM,iBAAiB,KAAA,GAC1B,SAAS,eAAe,MAAM;EAC/B,IAAI,MAAM,gBAAgB,KAAA,GACzB,SAAS,cAAc,MAAM;CAC/B;CACA,MAAM,WAAW,yBAAyB,MAAM,QAAQ;CACxD,IAAI,UAAU,SAAS,WAAW;CAClC,OAAO;AACR;;AAGA,SAAS,yBACR,UAC8B;CAC9B,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAuB,CAAC;CAC9B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GACjD,IAAI,UAAU,KAAA,GACb,IAAiC,OAAO;CAG1C,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,MAAM,KAAA;AAC5C;;;;;;;AAQA,SAAS,qBACR,SACA,QACA,QACoC;CACpC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,WAAW,uBAAuB,MAAM;CAC9C,MAAM,YAAsC,OAAO,QAClD,QAAQ,aAAa,CAAC,CACvB,CAAC,CAAC,KAAK,CAAC,MAAM,SACb,sBAAsB,MAAM,KAAK,SAAS,SAAS,CAAC,GAAG,MAAM,CAC9D;CACA,kCAAkC,SAAS;CAO3C,OAAO;EACN;EACA,SARe,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,KACpD,CAAC,MAAM,UAAU;GACjB;GACA,QAAQ,IAAI,UAAU;EACvB,EAIM;EACN,kBAAkB,iBAAiB,QAAQ,SAAS;CACrD;AACD;AAEA,SAAS,sBACR,MACA,KACA,QACA,QACyB;CACzB,MAAM,gBAAgB,6BAA6B,KAAK,QAAQ,MAAM;CACtE,OAAO;EACN;EACA,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,KAAK,EAAE,GAAI,IAAI,OAAO,CAAC,EAAG;EAC1B,SAAS,OAAO,WAAW;EAC3B,SAAS,IAAI,WAAW;EAIxB,GAAI,IAAI,mBACL,EACA,kBAAkB,IAAI,iBAAiB,IACtC,wBACD,EACD,IACC,CAAC;EAEJ,GAAI,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC;EAClC,GAAI,kBAAkB,KAAA,IAAY,EAAE,cAAc,IAAI,CAAC;CACxD;AACD;AAEA,SAAS,gBACR,UAC4B;CAC5B,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa;EACxD,IAAI,QAAQ,SAAS,YACpB,OAAO;GACN,MAAM;GACN;GACA,cAAc,QAAQ;GACtB,MAAM,QAAQ;GACd,cAAc,QAAQ,gBAAgB;GACtC,SAAS,QAAQ,WAAW;EAC7B;EAED,OAAO;GACN,MAAM;GACN;GACA,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,cAAc,QAAQ,gBAAgB;GACtC,SAAS,QAAQ,WAAW;EAC7B;CACD,CAAC;AACF;AAEA,SAAS,6BACR,KACA,QACA,QACuB;CACvB,IAAI,OAAO,kBAAkB,KAAA,GAC5B,OAAO,OAAO,cAAc,IAAI,qBAAqB;CAGtD,IAAI,IAAI,kBAAkB,KAAA,KAAa,OAAO,cAAc,MAC3D,OAAO,IAAI,cAAc,IAAI,qBAAqB;AAGpD;AAEA,SAAS,kCACR,WACO;CACP,MAAM,2BAAW,IAAI,IAAoB;CACzC,KAAK,MAAM,MAAM,WAChB,KAAK,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG;EAC5C,MAAM,QAAQ,SAAS,IAAI,MAAM;EACjC,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,sBAAsB,CAC/B,kBAAkB,OAAO,8BAA8B,MAAM,SAAS,GAAG,KAAK,EAC/E,CAAC;EAEF,SAAS,IAAI,QAAQ,GAAG,IAAI;CAC7B;AAEF;;;;;;AAOA,SAAgB,gBAAgB,QAAwB;CACvD,IAAI,cAAc,KAAK,MAAM,GAAG,OAAO;CACvC,OAAO,OAAO;AACf"}
+{"version":3,"file":"define-config.js","names":[],"sources":["../../src/lib/define-config.ts"],"sourcesContent":["import {\n\tauthoredFunctionTuning,\n\tmergeAuthoredPreview,\n} from \"./authored-services.js\";\nimport { normalizeCustomDomain } from \"./custom-domain.js\";\nimport { parseBranchTtl } from \"./duration.js\";\nimport { ConfigValidationError } from \"./errors.js\";\nimport { normalizeExternalPackage } from \"./external-packages.js\";\nimport {\n\tbranchTuningSchema,\n\tconfigInputSchema,\n\tconfigInputUnknownKeyHints,\n\tformatZodIssues,\n} from \"./schema.js\";\nimport type {\n\tBranchTarget,\n\tBranchTuning,\n\tBranchTuningFn,\n\tBucketDef,\n\tConfig,\n\tDataApiInput,\n\tDataApiSettings,\n\tExperimentalInput,\n\tFunctionDef,\n\tFunctionTriggerDef,\n\tFunctionTuning,\n\tPreviewInput,\n\tRealtimeConfig,\n\tRealtimeInput,\n\tResolvedBranchConfig,\n\tResolvedDataApiConfig,\n\tResolvedFunctionConfig,\n\tResolvedFunctionTrigger,\n\tResolvedPreviewConfig,\n\tServiceEnabled,\n\tServiceToggleInput,\n} from \"./types.js\";\n\n/** Default deploy parameters applied to functions that omit them in `neon.ts`. */\nconst DEFAULT_FUNCTION_RUNTIME = \"nodejs24\" as const;\n\nconst DEFAULT_FUNCTION_BUNDLER = \"esbuild\" as const;\n\nconst REGION_PREFIX = /^(aws|azure|gcp)-/;\n\n/**\n * Whether a `dataApi` toggle is **enabled and verified by Neon Auth** at the type level: it is\n * on (see {@link ServiceEnabled}) and not the explicit `authProvider: \"external\"` variant\n * (so the default / `\"neon\"` provider). This is the case that requires top-level Neon Auth.\n */\ntype DataApiUsesNeonAuth<DataApi> =\n\tServiceEnabled<DataApi> extends true\n\t\t? [DataApi] extends [{ authProvider: \"external\" }]\n\t\t\t? false\n\t\t\t: true\n\t\t: false;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `dataApi` when a Neon-Auth Data\n * API is declared without Neon Auth enabled (see {@link DataApiField}). TypeScript prints the\n * offending value against this string literal — `Type 'true' is not assignable to type\n * '…requires `auth: true`…'` — which points straight at the fix, instead of the opaque\n * `Type 'true' is not assignable to type 'never'` an intersection guard produces.\n *\n * It documents **both** fixes: enabling Neon Auth (`auth: true`), and running the Data API\n * *without* Neon Auth by verifying a third-party IdP (`authProvider: 'external'` + `jwksUrl`).\n */\n// Exported (type-only) for the type tests in `define-config.test-d.ts`; intentionally not\n// re-exported from `v1.ts` / `index.ts`, so it stays an internal implementation detail.\nexport type NeonAuthRequiredHint =\n\t\"`dataApi` with Neon Auth (the default `authProvider: 'neon'`) requires Neon Auth, so add `auth: true`. To enable the Data API WITHOUT Neon Auth, verify a third-party IdP instead: `dataApi: { authProvider: 'external', jwksUrl: 'https://your-idp/.well-known/jwks.json' }`\";\n\n/**\n * Static cross-field guard for {@link defineConfig}, expressed as the **type of the `dataApi`\n * field** rather than an intersected requirement on `auth`.\n *\n * - A Neon-Auth Data API (`authProvider: \"neon\"`, the default) with top-level `auth` enabled,\n *   or any external Data API: the field keeps its normal `DataApi & DataApiInput` type (the\n *   `& DataApiInput` preserves member autocomplete; the `const DataApi` still types the\n *   returned {@link Config}).\n * - A Neon-Auth Data API **without** `auth` enabled: the field's expected type collapses to\n *   the {@link NeonAuthRequiredHint} message, so the author sees the rule (and the two fixes)\n *   right on the `dataApi` value.\n *\n * The runtime `superRefine` in {@link configInputSchema} enforces the same invariant for\n * non-typed (plain-JS) callers, so the behavior is identical — only the type-level message\n * changes.\n */\n// Exported (type-only) for the type tests in `define-config.test-d.ts`; intentionally not\n// re-exported from `v1.ts` / `index.ts`, so it stays an internal implementation detail.\nexport type DataApiField<Auth, DataApi> =\n\tDataApiUsesNeonAuth<DataApi> extends true\n\t\t? ServiceEnabled<Auth> extends true\n\t\t\t? DataApi & DataApiInput\n\t\t\t: NeonAuthRequiredHint\n\t\t: DataApi & DataApiInput;\n\n/**\n * Autocomplete bridge for the nested `preview.functions` / `preview.buckets` slug objects.\n *\n * {@link PreviewInput} types those records with a string index signature\n * (`Record<string, FunctionDef>` / `Record<string, BucketDef>`). When `defineConfig` infers\n * `const Preview`, every authored slug becomes a **named** property on the inferred literal\n * (e.g. `{ hello: { name; source } }`), and a named property **shadows** the index signature\n * when the editor computes the contextual type of that slug's value — so the rest of\n * {@link FunctionDef} / {@link BucketDef} (`env`, `dev`, `access`, …) never surfaces as\n * completions inside `hello: { … }` / `uploads: { … }`.\n *\n * Re-declaring each inferred slug's value as `FunctionDef` / `BucketDef` (a *named* member, via\n * a mapped type over the already-inferred keys) puts those members back onto the contextual\n * type without going through an index signature, which restores autocomplete. Intersected with\n * `Preview & PreviewInput` it neither widens what is accepted (the values were already\n * `FunctionDef` / `BucketDef`) nor perturbs the inferred `const Preview` — so slug inference for\n * `BranchTuningFn<Preview>` and the returned {@link Config} is unchanged.\n */\ntype PreviewAutocomplete<Preview> = (Preview extends { functions: infer F }\n\t? { functions: { [Slug in keyof F]: FunctionDef } }\n\t: unknown) &\n\t(Preview extends { buckets: infer B }\n\t\t? { buckets: { [Name in keyof B]: BucketDef } }\n\t\t: unknown);\n\ntype FunctionsAutocomplete<Functions> =\n\tFunctions extends Record<string, unknown>\n\t\t? { [Slug in keyof Functions]: FunctionDef }\n\t\t: unknown;\n\ntype BucketsAutocomplete<Buckets> =\n\tBuckets extends Record<string, unknown>\n\t\t? { [Name in keyof Buckets]: BucketDef }\n\t\t: unknown;\n\n/**\n * Validate and freeze a Neon branch policy.\n *\n * Used at the top of `neon.ts`:\n * ```ts\n * import { defineConfig } from \"@neon/config/v1\";\n *\n * export default defineConfig({\n *   preview: {\n *     realtime: { allowedOrigins: [\"https://app.example.com\"] },\n *   },\n *   auth: true,\n *   functions: {\n *     hello: { name: \"Hello\", source: \"./functions/hello.ts\", dev: { port: 8787 } },\n *   },\n *   branch: (branch) => ({ protected: branch.name === \"main\" }),\n * });\n * ```\n *\n * The policy is split into a **static** existential set (`preview.realtime`, top-level `auth` /\n * `dataApi` / `aiGateway` / `functions` / `buckets` / `triggers`, plus the deprecated\n * aliases under `preview`) and a\n * **dynamic** per-branch `branch` closure. The static half determines which secrets exist —\n * so `NeonEnv<typeof config>` and `parseEnv` are exact — while the closure can only *tune*\n * a branch (lifecycle, compute, per-function deploy settings), never change what exists.\n *\n * The `branch` callback receives a read-only {@link BranchTarget} descriptor of the branch\n * being decided for (not a live handle); switch on its facts (`branch.name`,\n * `branch.isDefault`, `branch.exists`, …) and **return** the desired tuning. It runs in two\n * modes: against an existing branch (fields populated from Neon) and during pre-create\n * evaluation (`exists: false`, `id` undefined).\n *\n * Pure: no I/O, no side effects. The static parts are validated here; the closure's output\n * is validated every time it is evaluated so errors point at the concrete branch target.\n */\nexport function defineConfig<\n\tconst Auth extends ServiceToggleInput | undefined = undefined,\n\tconst DataApi extends DataApiInput | undefined = undefined,\n\tconst Preview extends PreviewInput | undefined = undefined,\n\tconst Functions extends Record<string, FunctionDef> | undefined = undefined,\n\tconst Buckets extends Record<string, BucketDef> | undefined = undefined,\n\tconst AiGateway extends ServiceToggleInput | undefined = undefined,\n>(input: {\n\t// Each field is intersected with its concrete interface (not just typed as the bare\n\t// generic). The generic alone — e.g. `preview?: Preview` — gives editors no members to\n\t// complete against in the object-literal position (they see `{} | undefined`), so you\n\t// lose hints for `aiGateway` / `functions` / `buckets`. `& PreviewInput` restores the\n\t// full shape for autocomplete while still inferring the `const` literal that types the\n\t// `branch` closure's slugs (BranchTuningFn<Preview>) and the returned Config.\n\tauth?: Auth & ServiceToggleInput;\n\t// The `dataApi` field carries the Neon-Auth cross-field guard at the type level (see\n\t// `DataApiField`): a Neon-Auth Data API without `auth` enabled surfaces a readable hint\n\t// as the field's expected type instead of collapsing the value to `never`.\n\tdataApi?: DataApiField<Auth, DataApi>;\n\taiGateway?: AiGateway & ServiceToggleInput;\n\tfunctions?: Functions &\n\t\tRecord<string, FunctionDef> &\n\t\tFunctionsAutocomplete<Functions>;\n\tbuckets?: Buckets &\n\t\tRecord<string, BucketDef> &\n\t\tBucketsAutocomplete<Buckets>;\n\ttriggers?: Record<string, FunctionTriggerDef>;\n\t// `& PreviewInput` restores top-level member hints (realtime/aiGateway/functions/buckets);\n\t// `& PreviewAutocomplete<Preview>` restores hints *inside* each function/bucket slug\n\t// object (see `PreviewAutocomplete`), which the bare index signature otherwise hides.\n\tpreview?: Preview & PreviewInput & PreviewAutocomplete<Preview>;\n\tbranch?: BranchTuningFn<Preview, Functions>;\n\t// Experimental (unstable) features — currently just lifecycle hooks. Static — carried\n\t// through onto the returned Config and read by the runtime at `checkout` / `deploy` time.\n\t// Never evaluated here.\n\texperimental?: ExperimentalInput;\n}): Config<Auth, DataApi, Preview, Functions, Buckets, AiGateway> {\n\tif (typeof input === \"function\") {\n\t\tthrow new ConfigValidationError([\n\t\t\t\"defineConfig now expects an object, not a function: `export default defineConfig({ auth: true, functions: { … }, branch: (branch) => ({ … }) })`.\",\n\t\t\t\"The static services set moved to the top level; per-branch logic moved into the `branch` closure.\",\n\t\t]);\n\t}\n\tif (input === null || typeof input !== \"object\") {\n\t\tthrow new ConfigValidationError([\n\t\t\t\"defineConfig expects a configuration object: `export default defineConfig({ … })`.\",\n\t\t]);\n\t}\n\n\tconst parsed = configInputSchema.safeParse(input);\n\tif (!parsed.success) {\n\t\tthrow new ConfigValidationError(\n\t\t\tformatZodIssues(parsed.error, configInputUnknownKeyHints),\n\t\t);\n\t}\n\n\treturn Object.freeze({ ...input }) as Config<\n\t\tAuth,\n\t\tDataApi,\n\t\tPreview,\n\t\tFunctions,\n\t\tBuckets,\n\t\tAiGateway\n\t>;\n}\n\n/**\n * Evaluate a branch policy for a specific branch target and return a normalized config.\n *\n * Merges the static existential set (services + functions/buckets) with the\n * per-branch tuning returned by the `branch` closure into the same {@link\n * ResolvedBranchConfig} the rest of the runtime (diff / push / fetchEnv) consumes.\n */\nexport function resolveConfig(\n\tconfig: Config,\n\tbranch: BranchTarget,\n): ResolvedBranchConfig {\n\tconst tuning = evaluateBranchTuning(config.branch, branch);\n\tconst realtimeInput = config.preview?.realtime;\n\n\tconst resolved: ResolvedBranchConfig = {\n\t\trealtimePolicy:\n\t\t\trealtimeInput === undefined\n\t\t\t\t? \"omitted\"\n\t\t\t\t: isRealtimeEnabled(realtimeInput)\n\t\t\t\t\t? \"enabled\"\n\t\t\t\t\t: \"disabled\",\n\t\tauthEnabled: isServiceEnabled(config.auth),\n\t\tdataApiEnabled: isDataApiEnabled(config.dataApi),\n\t\tdataApiPolicy:\n\t\t\tconfig.dataApi === undefined\n\t\t\t\t? \"omitted\"\n\t\t\t\t: isDataApiEnabled(config.dataApi)\n\t\t\t\t\t? \"enabled\"\n\t\t\t\t\t: \"disabled\",\n\t};\n\tconst realtime = resolveRealtime(realtimeInput);\n\tif (realtime) resolved.realtime = realtime;\n\tconst dataApi = resolveDataApi(config.dataApi);\n\tif (dataApi) resolved.dataApi = dataApi;\n\tif (tuning.parent !== undefined) resolved.parent = tuning.parent;\n\tif (tuning.ttl !== undefined) {\n\t\t// `branchTuningSchema` already validated `ttl` with the same `parseBranchTtl`, so\n\t\t// this only converts the validated value to seconds — it cannot fail here.\n\t\tconst parsedTtl = parseBranchTtl(tuning.ttl);\n\t\tif (!(\"error\" in parsedTtl)) resolved.ttlSeconds = parsedTtl.seconds;\n\t}\n\tif (tuning.protected !== undefined) resolved.protected = tuning.protected;\n\tif (tuning.postgres?.computeSettings) {\n\t\tresolved.postgres = {\n\t\t\tcomputeSettings: { ...tuning.postgres.computeSettings },\n\t\t};\n\t}\n\n\tconst preview = resolvePreviewConfig(\n\t\tmergeAuthoredPreview(config),\n\t\ttuning,\n\t\tbranch,\n\t);\n\tif (preview) resolved.preview = preview;\n\tconst triggers = resolveTriggers(config.triggers);\n\tif (triggers.length > 0) resolved.triggers = triggers;\n\n\treturn resolved;\n}\n\n/**\n * Run the `branch` closure (when present) for the target and validate its output. The\n * closure is optional — a fully static policy resolves with empty tuning.\n */\nfunction evaluateBranchTuning(\n\tbranchFn: BranchTuningFn | undefined,\n\ttarget: BranchTarget,\n): BranchTuning {\n\tif (!branchFn) return {};\n\tlet raw: unknown;\n\ttry {\n\t\traw = branchFn(Object.freeze({ ...target }));\n\t} catch (cause) {\n\t\tthrow new ConfigValidationError([\n\t\t\t`Branch policy threw while evaluating branch \"${target.name}\".`,\n\t\t\t(cause as Error)?.message ?? String(cause),\n\t\t]);\n\t}\n\tconst parsed = branchTuningSchema.safeParse(raw ?? {});\n\tif (!parsed.success) {\n\t\tthrow new ConfigValidationError(formatZodIssues(parsed.error));\n\t}\n\treturn parsed.data as BranchTuning;\n}\n\nfunction isServiceEnabled(toggle: ServiceToggleInput | undefined): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/** Whether a {@link RealtimeInput} is enabled (present object or `true`). */\nfunction isRealtimeEnabled(input: RealtimeInput | undefined): boolean {\n\tif (input === undefined) return false;\n\tif (typeof input === \"boolean\") return input;\n\treturn true;\n}\n\n/** Copy the options from an object-form {@link RealtimeInput}. */\nfunction resolveRealtime(\n\tinput: RealtimeInput | undefined,\n): RealtimeConfig | undefined {\n\tif (typeof input !== \"object\") return undefined;\n\treturn {\n\t\t...(input.allowedOrigins !== undefined\n\t\t\t? { allowedOrigins: [...input.allowedOrigins] }\n\t\t\t: {}),\n\t};\n}\n\n/** Whether a {@link DataApiInput} is enabled (present object/`true` unless `enabled: false`). */\nfunction isDataApiEnabled(input: DataApiInput | undefined): boolean {\n\tif (input === undefined) return false;\n\tif (typeof input === \"boolean\") return input;\n\treturn input.enabled !== false;\n}\n\n/**\n * Normalize a {@link DataApiInput} into a {@link ResolvedDataApiConfig}, or `undefined` when\n * the Data API is not enabled. `authProvider` defaults to `\"neon\"`; the external-IdP wiring\n * is carried through only for the `\"external\"` provider; `settings` is copied with its\n * `undefined` entries dropped so diffing only considers fields the policy actually set.\n */\nfunction resolveDataApi(\n\tinput: DataApiInput | undefined,\n): ResolvedDataApiConfig | undefined {\n\tif (!isDataApiEnabled(input)) return undefined;\n\tif (typeof input !== \"object\") {\n\t\t// Bare `true`: enabled with Neon Auth and all-default settings.\n\t\treturn { authProvider: \"neon\" };\n\t}\n\tconst authProvider = input.authProvider ?? \"neon\";\n\tconst resolved: ResolvedDataApiConfig = { authProvider };\n\tif (authProvider === \"external\") {\n\t\tif (input.jwksUrl !== undefined) resolved.jwksUrl = input.jwksUrl;\n\t\tif (input.providerName !== undefined)\n\t\t\tresolved.providerName = input.providerName;\n\t\tif (input.jwtAudience !== undefined)\n\t\t\tresolved.jwtAudience = input.jwtAudience;\n\t}\n\tconst settings = normalizeDataApiSettings(input.settings);\n\tif (settings) resolved.settings = settings;\n\treturn resolved;\n}\n\n/** Copy a {@link DataApiSettings}, dropping `undefined` entries; `undefined` when empty. */\nfunction normalizeDataApiSettings(\n\tsettings: DataApiSettings | undefined,\n): DataApiSettings | undefined {\n\tif (!settings) return undefined;\n\tconst out: DataApiSettings = {};\n\tfor (const [key, value] of Object.entries(settings)) {\n\t\tif (value !== undefined) {\n\t\t\t(out as Record<string, unknown>)[key] = value;\n\t\t}\n\t}\n\treturn Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize the static {@link PreviewInput} (merged with per-branch function tuning) into a\n * {@link ResolvedPreviewConfig}. Returns `undefined` when the policy declares no `preview`\n * block so the field can be omitted entirely. Function slugs / bucket names come from the\n * record keys.\n */\nfunction resolvePreviewConfig(\n\tpreview: PreviewInput | undefined,\n\ttuning: BranchTuning,\n\tbranch: BranchTarget,\n): ResolvedPreviewConfig | undefined {\n\tif (!preview) return undefined;\n\tconst fnTuning = authoredFunctionTuning(tuning);\n\tconst functions: ResolvedFunctionConfig[] = Object.entries(\n\t\tpreview.functions ?? {},\n\t).map(([slug, def]) =>\n\t\tresolveFunctionConfig(slug, def, fnTuning[slug] ?? {}, branch),\n\t);\n\tassertUniqueResolvedCustomDomains(functions);\n\tconst buckets = Object.entries(preview.buckets ?? {}).map(\n\t\t([name, def]) => ({\n\t\t\tname,\n\t\t\taccess: def.access ?? \"private\",\n\t\t}),\n\t);\n\treturn {\n\t\tfunctions,\n\t\tbuckets,\n\t\taiGatewayEnabled: isServiceEnabled(preview.aiGateway),\n\t};\n}\n\nfunction resolveFunctionConfig(\n\tslug: string,\n\tdef: FunctionDef,\n\ttuning: FunctionTuning,\n\tbranch: BranchTarget,\n): ResolvedFunctionConfig {\n\tconst customDomains = resolveFunctionCustomDomains(def, tuning, branch);\n\treturn {\n\t\tslug,\n\t\tname: def.name,\n\t\tsource: def.source,\n\t\tenv: { ...(def.env ?? {}) },\n\t\truntime: tuning.runtime ?? DEFAULT_FUNCTION_RUNTIME,\n\t\tbundler: def.bundler ?? DEFAULT_FUNCTION_BUNDLER,\n\t\t// Normalized only when declared, so a policy without it resolves unchanged and takes\n\t\t// the pre-existing bundling path. Both bundlers read it; `neon dev` mirrors it so a\n\t\t// local run leaves the same packages unbundled as a deploy.\n\t\t...(def.externalPackages\n\t\t\t? {\n\t\t\t\t\texternalPackages: def.externalPackages.map(\n\t\t\t\t\t\tnormalizeExternalPackage,\n\t\t\t\t\t),\n\t\t\t\t}\n\t\t\t: {}),\n\t\t// Passed through untouched (no defaults); only `neon dev` reads it.\n\t\t...(def.dev ? { dev: def.dev } : {}),\n\t\t...(customDomains !== undefined ? { customDomains } : {}),\n\t};\n}\n\nfunction resolveTriggers(\n\ttriggers: Record<string, FunctionTriggerDef> | undefined,\n): ResolvedFunctionTrigger[] {\n\tif (!triggers) return [];\n\treturn Object.entries(triggers).map(([name, trigger]) => {\n\t\tif (trigger.type === \"schedule\") {\n\t\t\treturn {\n\t\t\t\ttype: \"schedule\" as const,\n\t\t\t\tname,\n\t\t\t\tfunctionSlug: trigger.function,\n\t\t\t\tcron: trigger.cron,\n\t\t\t\tfunctionPath: trigger.functionPath ?? \"/\",\n\t\t\t\tenabled: trigger.enabled ?? true,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttype: \"storage_object_created\" as const,\n\t\t\tname,\n\t\t\tfunctionSlug: trigger.function,\n\t\t\tbucketName: trigger.bucket,\n\t\t\t...(trigger.prefix !== undefined ? { prefix: trigger.prefix } : {}),\n\t\t\tfunctionPath: trigger.functionPath ?? \"/\",\n\t\t\tenabled: trigger.enabled ?? true,\n\t\t};\n\t});\n}\n\nfunction resolveFunctionCustomDomains(\n\tdef: FunctionDef,\n\ttuning: FunctionTuning,\n\tbranch: BranchTarget,\n): string[] | undefined {\n\tif (tuning.customDomains !== undefined) {\n\t\treturn tuning.customDomains.map(normalizeCustomDomain);\n\t}\n\t// Hostnames are globally unique, so a child checkout 409s if it inherits this list.\n\tif (def.customDomains !== undefined && branch.isDefault === true) {\n\t\treturn def.customDomains.map(normalizeCustomDomain);\n\t}\n\treturn undefined;\n}\n\nfunction assertUniqueResolvedCustomDomains(\n\tfunctions: ResolvedFunctionConfig[],\n): void {\n\tconst byDomain = new Map<string, string>();\n\tfor (const fn of functions) {\n\t\tfor (const domain of fn.customDomains ?? []) {\n\t\t\tconst prior = byDomain.get(domain);\n\t\t\tif (prior !== undefined) {\n\t\t\t\tthrow new ConfigValidationError([\n\t\t\t\t\t`custom domain \"${domain}\" is used by both function \"${prior}\" and \"${fn.slug}\"`,\n\t\t\t\t]);\n\t\t\t}\n\t\t\tbyDomain.set(domain, fn.slug);\n\t\t}\n\t}\n}\n\n/**\n * Normalize a region identifier to Neon's `<cloud>-<region>` format. When the user writes\n * `us-east-1` we assume `aws-us-east-1`. Pure helper used by both the validator and the\n * NeonApi adapter.\n */\nexport function normalizeRegion(region: string): string {\n\tif (REGION_PREFIX.test(region)) return region;\n\treturn `aws-${region}`;\n}\n"],"mappings":";;;;;;;;AAuCA,MAAM,2BAA2B;AAEjC,MAAM,2BAA2B;AAEjC,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4HtB,SAAgB,aAOd,OA6BgE;CACjE,IAAI,OAAO,UAAU,YACpB,MAAM,IAAI,sBAAsB,CAC/B,qJACA,mGACD,CAAC;CAEF,IAAI,UAAU,QAAQ,OAAO,UAAU,UACtC,MAAM,IAAI,sBAAsB,CAC/B,oFACD,CAAC;CAGF,MAAM,SAAS,kBAAkB,UAAU,KAAK;CAChD,IAAI,CAAC,OAAO,SACX,MAAM,IAAI,sBACT,gBAAgB,OAAO,OAAO,0BAA0B,CACzD;CAGD,OAAO,OAAO,OAAO,EAAE,GAAG,MAAM,CAAC;AAQlC;;;;;;;;AASA,SAAgB,cACf,QACA,QACuB;CACvB,MAAM,SAAS,qBAAqB,OAAO,QAAQ,MAAM;CACzD,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,WAAiC;EACtC,gBACC,kBAAkB,KAAA,IACf,YACA,kBAAkB,aAAa,IAC9B,YACA;EACL,aAAa,iBAAiB,OAAO,IAAI;EACzC,gBAAgB,iBAAiB,OAAO,OAAO;EAC/C,eACC,OAAO,YAAY,KAAA,IAChB,YACA,iBAAiB,OAAO,OAAO,IAC9B,YACA;CACN;CACA,MAAM,WAAW,gBAAgB,aAAa;CAC9C,IAAI,UAAU,SAAS,WAAW;CAClC,MAAM,UAAU,eAAe,OAAO,OAAO;CAC7C,IAAI,SAAS,SAAS,UAAU;CAChC,IAAI,OAAO,WAAW,KAAA,GAAW,SAAS,SAAS,OAAO;CAC1D,IAAI,OAAO,QAAQ,KAAA,GAAW;EAG7B,MAAM,YAAY,eAAe,OAAO,GAAG;EAC3C,IAAI,EAAE,WAAW,YAAY,SAAS,aAAa,UAAU;CAC9D;CACA,IAAI,OAAO,cAAc,KAAA,GAAW,SAAS,YAAY,OAAO;CAChE,IAAI,OAAO,UAAU,iBACpB,SAAS,WAAW,EACnB,iBAAiB,EAAE,GAAG,OAAO,SAAS,gBAAgB,EACvD;CAGD,MAAM,UAAU,qBACf,qBAAqB,MAAM,GAC3B,QACA,MACD;CACA,IAAI,SAAS,SAAS,UAAU;CAChC,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,SAAS,SAAS,GAAG,SAAS,WAAW;CAE7C,OAAO;AACR;;;;;AAMA,SAAS,qBACR,UACA,QACe;CACf,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,IAAI;CACJ,IAAI;EACH,MAAM,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;CAC5C,SAAS,OAAO;EACf,MAAM,IAAI,sBAAsB,CAC/B,gDAAgD,OAAO,KAAK,KAC3D,OAAiB,WAAW,OAAO,KAAK,CAC1C,CAAC;CACF;CACA,MAAM,SAAS,mBAAmB,UAAU,OAAO,CAAC,CAAC;CACrD,IAAI,CAAC,OAAO,SACX,MAAM,IAAI,sBAAsB,gBAAgB,OAAO,KAAK,CAAC;CAE9D,OAAO,OAAO;AACf;AAEA,SAAS,iBAAiB,QAAiD;CAC1E,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;;AAGA,SAAS,kBAAkB,OAA2C;CACrE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,OAAO;AACR;;AAGA,SAAS,gBACR,OAC6B;CAC7B,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,OAAO,EACN,GAAI,MAAM,mBAAmB,KAAA,IAC1B,EAAE,gBAAgB,CAAC,GAAG,MAAM,cAAc,EAAE,IAC5C,CAAC,EACL;AACD;;AAGA,SAAS,iBAAiB,OAA0C;CACnE,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,OAAO,MAAM,YAAY;AAC1B;;;;;;;AAQA,SAAS,eACR,OACoC;CACpC,IAAI,CAAC,iBAAiB,KAAK,GAAG,OAAO,KAAA;CACrC,IAAI,OAAO,UAAU,UAEpB,OAAO,EAAE,cAAc,OAAO;CAE/B,MAAM,eAAe,MAAM,gBAAgB;CAC3C,MAAM,WAAkC,EAAE,aAAa;CACvD,IAAI,iBAAiB,YAAY;EAChC,IAAI,MAAM,YAAY,KAAA,GAAW,SAAS,UAAU,MAAM;EAC1D,IAAI,MAAM,iBAAiB,KAAA,GAC1B,SAAS,eAAe,MAAM;EAC/B,IAAI,MAAM,gBAAgB,KAAA,GACzB,SAAS,cAAc,MAAM;CAC/B;CACA,MAAM,WAAW,yBAAyB,MAAM,QAAQ;CACxD,IAAI,UAAU,SAAS,WAAW;CAClC,OAAO;AACR;;AAGA,SAAS,yBACR,UAC8B;CAC9B,IAAI,CAAC,UAAU,OAAO,KAAA;CACtB,MAAM,MAAuB,CAAC;CAC9B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GACjD,IAAI,UAAU,KAAA,GACb,IAAiC,OAAO;CAG1C,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,MAAM,KAAA;AAC5C;;;;;;;AAQA,SAAS,qBACR,SACA,QACA,QACoC;CACpC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,WAAW,uBAAuB,MAAM;CAC9C,MAAM,YAAsC,OAAO,QAClD,QAAQ,aAAa,CAAC,CACvB,CAAC,CAAC,KAAK,CAAC,MAAM,SACb,sBAAsB,MAAM,KAAK,SAAS,SAAS,CAAC,GAAG,MAAM,CAC9D;CACA,kCAAkC,SAAS;CAO3C,OAAO;EACN;EACA,SARe,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,KACpD,CAAC,MAAM,UAAU;GACjB;GACA,QAAQ,IAAI,UAAU;EACvB,EAIM;EACN,kBAAkB,iBAAiB,QAAQ,SAAS;CACrD;AACD;AAEA,SAAS,sBACR,MACA,KACA,QACA,QACyB;CACzB,MAAM,gBAAgB,6BAA6B,KAAK,QAAQ,MAAM;CACtE,OAAO;EACN;EACA,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,KAAK,EAAE,GAAI,IAAI,OAAO,CAAC,EAAG;EAC1B,SAAS,OAAO,WAAW;EAC3B,SAAS,IAAI,WAAW;EAIxB,GAAI,IAAI,mBACL,EACA,kBAAkB,IAAI,iBAAiB,IACtC,wBACD,EACD,IACC,CAAC;EAEJ,GAAI,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC;EAClC,GAAI,kBAAkB,KAAA,IAAY,EAAE,cAAc,IAAI,CAAC;CACxD;AACD;AAEA,SAAS,gBACR,UAC4B;CAC5B,IAAI,CAAC,UAAU,OAAO,CAAC;CACvB,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa;EACxD,IAAI,QAAQ,SAAS,YACpB,OAAO;GACN,MAAM;GACN;GACA,cAAc,QAAQ;GACtB,MAAM,QAAQ;GACd,cAAc,QAAQ,gBAAgB;GACtC,SAAS,QAAQ,WAAW;EAC7B;EAED,OAAO;GACN,MAAM;GACN;GACA,cAAc,QAAQ;GACtB,YAAY,QAAQ;GACpB,GAAI,QAAQ,WAAW,KAAA,IAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,cAAc,QAAQ,gBAAgB;GACtC,SAAS,QAAQ,WAAW;EAC7B;CACD,CAAC;AACF;AAEA,SAAS,6BACR,KACA,QACA,QACuB;CACvB,IAAI,OAAO,kBAAkB,KAAA,GAC5B,OAAO,OAAO,cAAc,IAAI,qBAAqB;CAGtD,IAAI,IAAI,kBAAkB,KAAA,KAAa,OAAO,cAAc,MAC3D,OAAO,IAAI,cAAc,IAAI,qBAAqB;AAGpD;AAEA,SAAS,kCACR,WACO;CACP,MAAM,2BAAW,IAAI,IAAoB;CACzC,KAAK,MAAM,MAAM,WAChB,KAAK,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG;EAC5C,MAAM,QAAQ,SAAS,IAAI,MAAM;EACjC,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,sBAAsB,CAC/B,kBAAkB,OAAO,8BAA8B,MAAM,SAAS,GAAG,KAAK,EAC/E,CAAC;EAEF,SAAS,IAAI,QAAQ,GAAG,IAAI;CAC7B;AAEF;;;;;;AAOA,SAAgB,gBAAgB,QAAwB;CACvD,IAAI,cAAc,KAAK,MAAM,GAAG,OAAO;CACvC,OAAO,OAAO;AACf"}

package/dist/lib/schema.d.ts

@@ -358,7 +358,12 @@ declare const configInputSchema: z.ZodObject<{
  * and unknown-key issues from `strictObject` are normalised so the message contains the
  * substring "unknown key" — keeping pre-zod assertions in test suites and downstream tools
  * stable.
+ *
+ * `unknownKeyHints` maps the rendered path of an unknown key to a sentence appended to its
+ * issue, for keys the user most likely meant to write somewhere else.
  */
-declare function formatZodIssues(error: z.ZodError): string[];
-export { branchTuningSchema, bucketDefSchema, computeSettingsSchema, configInputSchema, dataApiConfigSchema, dataApiInputSchema, dataApiSettingsSchema, experimentalInputSchema, formatZodIssues, functionDefSchema, functionTuningSchema, functionsRecordSchema, hooksSchema, postgresConfigSchema, previewInputSchema, realtimeConfigSchema, realtimeInputSchema, serviceToggleInputSchema, serviceToggleSchema };
+declare function formatZodIssues(error: z.ZodError, unknownKeyHints?: ReadonlyMap<string, string>): string[];
+/** Hints for unknown keys at the top level of the `defineConfig` input. */
+declare const configInputUnknownKeyHints: ReadonlyMap<string, string>;
+export { branchTuningSchema, bucketDefSchema, computeSettingsSchema, configInputSchema, configInputUnknownKeyHints, dataApiConfigSchema, dataApiInputSchema, dataApiSettingsSchema, experimentalInputSchema, formatZodIssues, functionDefSchema, functionTuningSchema, functionsRecordSchema, hooksSchema, postgresConfigSchema, previewInputSchema, realtimeConfigSchema, realtimeInputSchema, serviceToggleInputSchema, serviceToggleSchema };
 //# sourceMappingURL=schema.d.ts.map

package/dist/lib/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","names":["z","FunctionBundlerInput","computeSettingsSchema","ZodLiteral","ZodOptional","ZodString","ZodNumber","ZodUnion","core","$strict","ZodObject","serviceToggleSchema","ZodBoolean","serviceToggleInputSchema","realtimeConfigSchema","ZodArray","realtimeInputSchema","dataApiSettingsSchema","dataApiConfigSchema","dataApiInputSchema","postgresConfigSchema","functionDefSchema","ZodRecord","ZodCustom","bucketDefSchema","functionsRecordSchema","previewInputSchema","functionTuningSchema","branchTuningSchema","hooksSchema","experimentalInputSchema","configInputSchema","ZodDiscriminatedUnion","formatZodIssues","ZodError","FunctionBundlerInput","z","computeSettingsSchema","ZodObject","autoscalingLimitMinCu","ZodOptional","ZodLiteral","autoscalingLimitMaxCu","suspendTimeout","ZodUnion","ZodString","ZodNumber","core","$strict","serviceToggleSchema","enabled","ZodBoolean","serviceToggleInputSchema","realtimeConfigSchema","allowedOrigins","ZodArray","realtimeInputSchema","dataApiSettingsSchema","dbAggregatesEnabled","dbAnonRole","dbExtraSearchPath","dbMaxRows","dbSchemas","jwtRoleClaimKey","jwtCacheMaxLifetime","openapiMode","serverCorsAllowedOrigins","serverTimingEnabled","dataApiConfigSchema","authProvider","jwksUrl","providerName","jwtAudience","settings","dataApiInputSchema","postgresConfigSchema","computeSettings","functionDefSchema","name","source","env","ZodRecord","externalPackages","includeFiles","bundler","ZodCustom","dev","port","customDomains","bucketDefSchema","access","functionsRecordSchema","previewInputSchema","realtime","aiGateway","functions","buckets","functionTuningSchema","runtime","branchTuningSchema","parent","protected","ttl","postgres","preview","hooksSchema","checkout","before","args","after","create","deploy","experimentalInputSchema","hooks","configInputSchema","auth","dataApi","triggers","ZodDiscriminatedUnion","type","function","cron","functionPath","bucket","prefix","branch","experimental","formatZodIssues","error","ZodError"],"sources":["../../src/lib/schema.ts"],"mappings":";;;;;;;AAkCA;AAsDG;;;;;;;;;;AAAAA;AAtD+BA,cAArBE,qBAAqBQ,EAAAV,CAAAA,CAAAU,SAAAA,CAAAA;EAAA6B,qBAAA,E,aAAA,C,YAAA,CAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,IAAA,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;EAyDrB5B,qBAAAA,E,aAEX,C,YAAA,CAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,IAAA,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;EAAAgC,cAAA,E,aAAA,C,UAAA,CAAA,SAAA,C,YAAA,CAAA,KAAA,CAAA,E,WAAA,E,WAAA,CAAA,CAAA,CAAA;A,GALC3C,CAAAA,CAAAQ,IAAAA,CAAAC,O;;AAKDT,cAFWW,mBAEXF,EAF8BT,CAAAA,CAAAU,SAE9BD,CAAAA;EAF8BT,OAAAU,E,aAAAA,C,YAAAA,CAAAA;AAAA,CAAA,EAE9BV,CAAAA,CAAAQ,IAAAA,CAAAC,OAF8B,CAAA;AAKhC;AAGE,cAHWI,wBAGX,EAHmCb,CAAAA,CAAAO,QAGnC,CAAA,SAAA,CAHmCP,CAAAA,CAAAY,UAGnC,EAHmCZ,CAAAA,CAAAU,SAGnC,CAAA;EAHmCV,OAAAY,E,aAAAA,C,YAAAA,CAAAA;A,GAGnCZ,CAAAA,CAAAQ,IAAAA,CAAAC,O;;AAAAT,cA6BWc,oBA7BXL,EA6B+BT,CAAAA,CAAAU,SA7B/BD,CAAAA;EAHmCT,cAAAU,E,aAAAA,C,UAAAA,C,WAAAA,CAAAA,CAAAA;AAAAV,CAAAA,EAwCnCA,CAAAA,CAAAQ,IAAAA,CAAAC,OAxCmCF,CAAAA;AAAA;AAgCxBO,cAWAE,mBAHX,EAG8BhB,CAAAA,CAAAO,QAH9B,CAAA,SAAA,CAG8BP,CAAAA,CAAAY,UAH9B,EAG8BZ,CAAAA,CAAAU,SAH9B,CAAA;EAAA4C,cAAA,E,aAAA,C,UAAA,C,WAAA,CAAA,CAAA;A,GAG6EtD,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;AAH7ET;AAR+BA;AAAA,cAiBpBiB,qBAjBoB,EAiBCjB,CAAAA,CAAAU,SAjBD,CAAA;EAWpBM,mBAAAA,E,aAAkE,C,YAAA,CAAA;EAAA2C,UAAA,E,aAAA,C,WAAA,CAAA;EAA/C3D,iBAAAY,E,aAAAA,C,WAAAA,CAAAA;;;;EAA+CZ,mBAAAS,E,aAAAA,C,WAAAA,CAAAA;EAA/CT,WAAAU,E,aAAAA,C,UAAAA,CAAAA,SAAAA,C,YAAAA,CAAAA,mBAAAA,CAAAA,E,YAAAA,CAAAA,UAAAA,CAAAA,CAAAA,CAAAA,CAAAA;EAAAV,wBAAAO,E,aAAAA,C,WAAAA,CAAAA;EAAA4D,mBAAA,E,aAAA,C,YAAA,CAAA;AAMhC,CAAA,EAaEnE,CAAAA,CAAAQ,IAAAA,CAAAC,OAbWQ,CAAAA;AAaX;;;;;;A,cAeWC,mB,EAAmBlB,CAAAA,CAAAU,S;;;;;;;;;;;;;;;;;;AAf9BV,CAAAA,EAsCCA,CAAAA,CAAAQ,IAAAA,CAAAC,OAtCDA,CAAAA;AAbgCT;AAAA,cAsDrBmB,kBAtDqB,EAsDHnB,CAAAA,CAAAO,QAtDG,CAAA,SAAA,CAsDHP,CAAAA,CAAAY,UAtDG,EAsDHZ,CAAAA,CAAAU,SAtDG,CAAA;EA4BrBQ,OAAAA,E,aAuBV,C,YAAA,CAAA;EAAAmD,YAAA,E,aAAA,C,UAAA,CAAA,SAAA,C,YAAA,CAAA,MAAA,CAAA,E,YAAA,CAAA,UAAA,CAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;A,GAG0ErE,CAAAA,CAAAQ,IAAAA,CAAAC,O;A,cAEhEW,oB,EAAoBpB,CAAAA,CAAAU,S;;;;;;A,GAE/BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;;;;;;A,cAyNWY,iB,EAAiBrB,CAAAA,CAAAU,S;;;;;IAhO3BV,IAAAQ,E,WAAAC;IAvB6BT,YAAAU,E,aAAAA,C,YAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;EA0BnBS,OAAAA,E,aAAgE,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;EAAAmE,GAAA,E,aAAA,C,WAAA,CAAA;IAA9CtF,IAAAY,E,aAAAA,C,WAAAA,CAAAA;;;A,GAgT5BZ,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGUe,e,EAAexB,CAAAA,CAAAU,S;;A,GAI1BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;A,cAOWgB,qB,EAAqBzB,CAAAA,CAAAsB,S,CAAAtB,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAU,S;;;;;;;;;;;;;A,GAGjCV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGYiB,kB,EAAkB1B,CAAAA,CAAAU,S;;;;;;;;;;;IApU8CV,gBAAAS,E,aAAAA,C,UAAAA,C,UAAAA,CAAAA,SAAAA,C,WAAAA,E,WAAAA,CAAAA;MAA9CC,IAAAA,E,WAAAA;MAAAH,YAAAA,E,aAAAA,C,YAAAA,CAAAA;IAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;IAElBa,OAAAA,E,aAEX,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;IAAAkE,GAAA,E,aAAA,C,WAAA,CAAA;;;;;;;;A,GAqUAtF,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGWkB,oB,EAAoB3B,CAAAA,CAAAU,S;;;AAxU/BV,CAAAA,EA2UAA,CAAAA,CAAAQ,IAAAA,CAAAC,OA3UAA,CAAAA;AAF+BT;AAAA;AA2NjC;AAmFG;A,cA0CU4B,kB,EAAkB5B,CAAAA,CAAAU,S;;;;;;;;;;;;;;;;;;;;;A,GAgC5BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;A,cAwCUoB,W,EAAW7B,CAAAA,CAAAU,S;EAlHrBV,QAAAQ,E,aAAAC,C,WAAAA,CAAAA;IAnF2BT,MAAAU,EAiLVV,CAAAA,CAAAI,WAjLUM,CAiLVV,CAAAA,CAAAO,QAjLUG,CAAAA,SAAAA,CAiLVV,CAAAA,CAAAuB,SAjLUb,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EAiLWV,CAAAA,CAAAO,QAjLXG,CAAAA,SAAAA,CAiLWV,CAAAA,CAAAK,SAjLXK,EAiLWV,CAAAA,CAAAe,QAjLXL,CAiLWV,CAAAA,CAAAK,SAjLXK,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAAAmG,KAAA,EAiLV7G,CAAAA,CAAAI,WAjLU,CAiLVJ,CAAAA,CAAAO,QAjLU,CAAA,SAAA,CAiLVP,CAAAA,CAAAuB,SAjLU,CAAA,CAAA,GAAAqF,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,EAAA,CAAA,GAAAA,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,CAAA,EAiLW5G,CAAAA,CAAAO,QAjLX,CAAA,SAAA,CAiLWP,CAAAA,CAAAK,SAjLX,EAiLWL,CAAAA,CAAAe,QAjLX,CAiLWf,CAAAA,CAAAK,SAjLX,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;EAsFjBmB,CAAAA,E,cAAAA,CAIX,CAAA;EAAAsF,MAAA,E,aAAA,C,WAAA,CAAA;I,QAuFkB9G,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;I,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;IAvFvCL,MAAAS,EAuFkBT,CAAAA,CAAAI,WAvFlBK,CAuFkBT,CAAAA,CAAAO,QAvFlBE,CAAAA,SAAAA,CAuFkBT,CAAAA,CAAAuB,SAvFlBd,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EAuFuCT,CAAAA,CAAAO,QAvFvCE,CAAAA,SAAAA,CAuFuCT,CAAAA,CAAAK,SAvFvCI,EAuFuCT,CAAAA,CAAAe,QAvFvCN,CAuFuCT,CAAAA,CAAAK,SAvFvCI,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAJ0BT,KAAAU,EA2FRV,CAAAA,CAAAI,WA3FQM,CA2FRV,CAAAA,CAAAO,QA3FQG,CAAAA,SAAAA,CA2FRV,CAAAA,CAAAuB,SA3FQb,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EA2FaV,CAAAA,CAAAO,QA3FbG,CAAAA,SAAAA,CA2FaV,CAAAA,CAAAK,SA3FbK,EA2FaV,CAAAA,CAAAe,QA3FbL,CA2FaV,CAAAA,CAAAK,SA3FbK,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA;AAW5B,CAAA,EAwGEV,CAAAA,CAAAQ,IAAAA,CAAAC,OAxGWgB,CAAAA;AAGZ;AAHiCzB,cA2GrB8B,uBA3GqBzB,EA2GEL,CAAAA,CAAAU,SA3GFL,CAAAA;;;M,QAgFdL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;M,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;M,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;A,GA6BvCL,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;A,cAOWsB,iB,EAAiB/B,CAAAA,CAAAU,S;;;;;;;IAjH7BV,OAAAS,E,aAAAA,C,WAAAA,CAAAA;IAHiCT,YAAAU,E,aAAAA,C,WAAAA,CAAAA;IAAAV,WAAAsB,E,aAAAA,C,WAAAA,CAAAA;IAAAmD,QAAA,E,aAAA,C,WAAA,CAAA;MAMrB/C,mBAKX,E,aAAA,C,YAAA,CAAA;MAAAiC,UAAA,E,aAAA,C,WAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAAlD,IAAAA,E,WAAAA;QAL6BC,YAAAA,E,aAAAA,C,YAAAA,CAAAA;MAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;MAQlBiB,OAAAA,E,aAGX,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;MAAA2D,GAAA,E,aAAA,C,WAAA,CAAA;;;;;;MAAA9E,MAAAC,E,aAAAA,C,UAAAA,CAAAA,SAAAA,C,YAAAA,CAAAA,SAAAA,CAAAA,E,YAAAA,CAAAA,aAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAH+BT,CAAAU,E,cAAAA,CAAAA,CAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA;EAcpBkB,MAAAA,EAkGQ5B,CAAAA,CAAAI,WAlElB,CAkEkBJ,CAAAA,CAAAuB,SAlElB,CAAA,CAAA,GAAAqF,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,EAAA,CAAA,GAAAA,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,CAAA,CAAA;EAAAkB,YAAA,E,aAAA,C,WAAA,CAAA;;;Q,QAoBiB9H,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;Q,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;Q,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;;A,GAyFtCL,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;;;;;A,iBA+GawB,eAAAA,C,OAAuBjC,CAAAA,CAAEkC,Q"}
+{"version":3,"file":"schema.d.ts","names":["z","FunctionBundlerInput","computeSettingsSchema","ZodLiteral","ZodOptional","ZodString","ZodNumber","ZodUnion","core","$strict","ZodObject","serviceToggleSchema","ZodBoolean","serviceToggleInputSchema","realtimeConfigSchema","ZodArray","realtimeInputSchema","dataApiSettingsSchema","dataApiConfigSchema","dataApiInputSchema","postgresConfigSchema","functionDefSchema","ZodRecord","ZodCustom","bucketDefSchema","functionsRecordSchema","previewInputSchema","functionTuningSchema","branchTuningSchema","hooksSchema","experimentalInputSchema","configInputSchema","ZodDiscriminatedUnion","formatZodIssues","ZodError","ReadonlyMap","configInputUnknownKeyHints","FunctionBundlerInput","z","computeSettingsSchema","ZodObject","autoscalingLimitMinCu","ZodOptional","ZodLiteral","autoscalingLimitMaxCu","suspendTimeout","ZodUnion","ZodString","ZodNumber","core","$strict","serviceToggleSchema","enabled","ZodBoolean","serviceToggleInputSchema","realtimeConfigSchema","allowedOrigins","ZodArray","realtimeInputSchema","dataApiSettingsSchema","dbAggregatesEnabled","dbAnonRole","dbExtraSearchPath","dbMaxRows","dbSchemas","jwtRoleClaimKey","jwtCacheMaxLifetime","openapiMode","serverCorsAllowedOrigins","serverTimingEnabled","dataApiConfigSchema","authProvider","jwksUrl","providerName","jwtAudience","settings","dataApiInputSchema","postgresConfigSchema","computeSettings","functionDefSchema","name","source","env","ZodRecord","externalPackages","includeFiles","bundler","ZodCustom","dev","port","customDomains","bucketDefSchema","access","functionsRecordSchema","previewInputSchema","realtime","aiGateway","functions","buckets","functionTuningSchema","runtime","branchTuningSchema","parent","protected","ttl","postgres","preview","hooksSchema","checkout","before","args","after","create","deploy","experimentalInputSchema","hooks","configInputSchema","auth","dataApi","triggers","ZodDiscriminatedUnion","type","function","cron","functionPath","bucket","prefix","branch","experimental","formatZodIssues","error","ZodError","unknownKeyHints","ReadonlyMap","configInputUnknownKeyHints"],"sources":["../../src/lib/schema.ts"],"mappings":";;;;;;;AAkCA;AAsDG;;;;;;;;;;AAAAA;AAtD+BA,cAArBE,qBAAqBQ,EAAAV,CAAAA,CAAAU,SAAAA,CAAAA;EAAA+B,qBAAA,E,aAAA,C,YAAA,CAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,IAAA,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;EAyDrB9B,qBAAAA,E,aAEX,C,YAAA,CAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,IAAA,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,GAAA,EAAA,CAAA,CAAA;EAAAkC,cAAA,E,aAAA,C,UAAA,CAAA,SAAA,C,YAAA,CAAA,KAAA,CAAA,E,WAAA,E,WAAA,CAAA,CAAA,CAAA;A,GALC7C,CAAAA,CAAAQ,IAAAA,CAAAC,O;;AAKDT,cAFWW,mBAEXF,EAF8BT,CAAAA,CAAAU,SAE9BD,CAAAA;EAF8BT,OAAAU,E,aAAAA,C,YAAAA,CAAAA;AAAA,CAAA,EAE9BV,CAAAA,CAAAQ,IAAAA,CAAAC,OAF8B,CAAA;AAKhC;AAGE,cAHWI,wBAGX,EAHmCb,CAAAA,CAAAO,QAGnC,CAAA,SAAA,CAHmCP,CAAAA,CAAAY,UAGnC,EAHmCZ,CAAAA,CAAAU,SAGnC,CAAA;EAHmCV,OAAAY,E,aAAAA,C,YAAAA,CAAAA;A,GAGnCZ,CAAAA,CAAAQ,IAAAA,CAAAC,O;;AAAAT,cA6BWc,oBA7BXL,EA6B+BT,CAAAA,CAAAU,SA7B/BD,CAAAA;EAHmCT,cAAAU,E,aAAAA,C,UAAAA,C,WAAAA,CAAAA,CAAAA;AAAAV,CAAAA,EAwCnCA,CAAAA,CAAAQ,IAAAA,CAAAC,OAxCmCF,CAAAA;AAAA;AAgCxBO,cAWAE,mBAHX,EAG8BhB,CAAAA,CAAAO,QAH9B,CAAA,SAAA,CAG8BP,CAAAA,CAAAY,UAH9B,EAG8BZ,CAAAA,CAAAU,SAH9B,CAAA;EAAA8C,cAAA,E,aAAA,C,UAAA,C,WAAA,CAAA,CAAA;A,GAG6ExD,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;AAH7ET;AAR+BA;AAAA,cAiBpBiB,qBAjBoB,EAiBCjB,CAAAA,CAAAU,SAjBD,CAAA;EAWpBM,mBAAAA,E,aAAkE,C,YAAA,CAAA;EAAA6C,UAAA,E,aAAA,C,WAAA,CAAA;EAA/C7D,iBAAAY,E,aAAAA,C,WAAAA,CAAAA;;;;EAA+CZ,mBAAAS,E,aAAAA,C,WAAAA,CAAAA;EAA/CT,WAAAU,E,aAAAA,C,UAAAA,CAAAA,SAAAA,C,YAAAA,CAAAA,mBAAAA,CAAAA,E,YAAAA,CAAAA,UAAAA,CAAAA,CAAAA,CAAAA,CAAAA;EAAAV,wBAAAO,E,aAAAA,C,WAAAA,CAAAA;EAAA8D,mBAAA,E,aAAA,C,YAAA,CAAA;AAMhC,CAAA,EAaErE,CAAAA,CAAAQ,IAAAA,CAAAC,OAbWQ,CAAAA;AAaX;;;;;;A,cAeWC,mB,EAAmBlB,CAAAA,CAAAU,S;;;;;;;;;;;;;;;;;;AAf9BV,CAAAA,EAsCCA,CAAAA,CAAAQ,IAAAA,CAAAC,OAtCDA,CAAAA;AAbgCT;AAAA,cAsDrBmB,kBAtDqB,EAsDHnB,CAAAA,CAAAO,QAtDG,CAAA,SAAA,CAsDHP,CAAAA,CAAAY,UAtDG,EAsDHZ,CAAAA,CAAAU,SAtDG,CAAA;EA4BrBQ,OAAAA,E,aAuBV,C,YAAA,CAAA;EAAAqD,YAAA,E,aAAA,C,UAAA,CAAA,SAAA,C,YAAA,CAAA,MAAA,CAAA,E,YAAA,CAAA,UAAA,CAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;A,GAG0EvE,CAAAA,CAAAQ,IAAAA,CAAAC,O;A,cAEhEW,oB,EAAoBpB,CAAAA,CAAAU,S;;;;;;A,GAE/BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;;;;;;A,cAyNWY,iB,EAAiBrB,CAAAA,CAAAU,S;;;;;IAhO3BV,IAAAQ,E,WAAAC;IAvB6BT,YAAAU,E,aAAAA,C,YAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;EA0BnBS,OAAAA,E,aAAgE,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;EAAAqE,GAAA,E,aAAA,C,WAAA,CAAA;IAA9CxF,IAAAY,E,aAAAA,C,WAAAA,CAAAA;;;A,GAgT5BZ,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGUe,e,EAAexB,CAAAA,CAAAU,S;;A,GAI1BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;A,cAOWgB,qB,EAAqBzB,CAAAA,CAAAsB,S,CAAAtB,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAU,S;;;;;;;;;;;;;A,GAGjCV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGYiB,kB,EAAkB1B,CAAAA,CAAAU,S;;;;;;;;;;;IApU8CV,gBAAAS,E,aAAAA,C,UAAAA,C,UAAAA,CAAAA,SAAAA,C,WAAAA,E,WAAAA,CAAAA;MAA9CC,IAAAA,E,WAAAA;MAAAH,YAAAA,E,aAAAA,C,YAAAA,CAAAA;IAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;IAElBa,OAAAA,E,aAEX,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;IAAAoE,GAAA,E,aAAA,C,WAAA,CAAA;;;;;;;;A,GAqUAxF,CAAAA,CAAAQ,IAAAA,CAAAC,O;;A,cAGWkB,oB,EAAoB3B,CAAAA,CAAAU,S;;;AAxU/BV,CAAAA,EA2UAA,CAAAA,CAAAQ,IAAAA,CAAAC,OA3UAA,CAAAA;AAF+BT;AAAA;AA2NjC;AAmFG;A,cA0CU4B,kB,EAAkB5B,CAAAA,CAAAU,S;;;;;;;;;;;;;;;;;;;;;A,GAgC5BV,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;A,cAwCUoB,W,EAAW7B,CAAAA,CAAAU,S;EAlHrBV,QAAAQ,E,aAAAC,C,WAAAA,CAAAA;IAnF2BT,MAAAU,EAiLVV,CAAAA,CAAAI,WAjLUM,CAiLVV,CAAAA,CAAAO,QAjLUG,CAAAA,SAAAA,CAiLVV,CAAAA,CAAAuB,SAjLUb,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EAiLWV,CAAAA,CAAAO,QAjLXG,CAAAA,SAAAA,CAiLWV,CAAAA,CAAAK,SAjLXK,EAiLWV,CAAAA,CAAAe,QAjLXL,CAiLWV,CAAAA,CAAAK,SAjLXK,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAAAqG,KAAA,EAiLV/G,CAAAA,CAAAI,WAjLU,CAiLVJ,CAAAA,CAAAO,QAjLU,CAAA,SAAA,CAiLVP,CAAAA,CAAAuB,SAjLU,CAAA,CAAA,GAAAuF,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,EAAA,CAAA,GAAAA,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,CAAA,EAiLW9G,CAAAA,CAAAO,QAjLX,CAAA,SAAA,CAiLWP,CAAAA,CAAAK,SAjLX,EAiLWL,CAAAA,CAAAe,QAjLX,CAiLWf,CAAAA,CAAAK,SAjLX,CAAA,CAAA,CAAA,CAAA,CAAA,CAAA;EAsFjBmB,CAAAA,E,cAAAA,CAIX,CAAA;EAAAwF,MAAA,E,aAAA,C,WAAA,CAAA;I,QAuFkBhH,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;I,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;IAvFvCL,MAAAS,EAuFkBT,CAAAA,CAAAI,WAvFlBK,CAuFkBT,CAAAA,CAAAO,QAvFlBE,CAAAA,SAAAA,CAuFkBT,CAAAA,CAAAuB,SAvFlBd,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EAuFuCT,CAAAA,CAAAO,QAvFvCE,CAAAA,SAAAA,CAuFuCT,CAAAA,CAAAK,SAvFvCI,EAuFuCT,CAAAA,CAAAe,QAvFvCN,CAuFuCT,CAAAA,CAAAK,SAvFvCI,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAJ0BT,KAAAU,EA2FRV,CAAAA,CAAAI,WA3FQM,CA2FRV,CAAAA,CAAAO,QA3FQG,CAAAA,SAAAA,CA2FRV,CAAAA,CAAAuB,SA3FQb,CAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,EAAAA,OAAAA,EAAAA,EAAAA,GAAAA,OAAAA,CAAAA,EA2FaV,CAAAA,CAAAO,QA3FbG,CAAAA,SAAAA,CA2FaV,CAAAA,CAAAK,SA3FbK,EA2FaV,CAAAA,CAAAe,QA3FbL,CA2FaV,CAAAA,CAAAK,SA3FbK,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA;AAW5B,CAAA,EAwGEV,CAAAA,CAAAQ,IAAAA,CAAAC,OAxGWgB,CAAAA;AAGZ;AAHiCzB,cA2GrB8B,uBA3GqBzB,EA2GEL,CAAAA,CAAAU,SA3GFL,CAAAA;;;M,QAgFdL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;M,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;M,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;M,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;A,GA6BvCL,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;A,cAOWsB,iB,EAAiB/B,CAAAA,CAAAU,S;;;;;;;IAjH7BV,OAAAS,E,aAAAA,C,WAAAA,CAAAA;IAHiCT,YAAAU,E,aAAAA,C,WAAAA,CAAAA;IAAAV,WAAAsB,E,aAAAA,C,WAAAA,CAAAA;IAAAqD,QAAA,E,aAAA,C,WAAA,CAAA;MAMrBjD,mBAKX,E,aAAA,C,YAAA,CAAA;MAAAmC,UAAA,E,aAAA,C,WAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAAApD,IAAAA,E,WAAAA;QAL6BC,YAAAA,E,aAAAA,C,YAAAA,CAAAA;MAAA,CAAA,E,cAAA,CAAA,CAAA,CAAA,CAAA,CAAA;MAQlBiB,OAAAA,E,aAGX,C,WAAA,C,oBAAA,E,oBAAA,CAAA,CAAA;MAAA6D,GAAA,E,aAAA,C,WAAA,CAAA;;;;;;MAAAhF,MAAAC,E,aAAAA,C,UAAAA,CAAAA,SAAAA,C,YAAAA,CAAAA,SAAAA,CAAAA,E,YAAAA,CAAAA,aAAAA,CAAAA,CAAAA,CAAAA,CAAAA;IAH+BT,CAAAU,E,cAAAA,CAAAA,CAAAA,CAAAA;EAAA,CAAA,E,cAAA,CAAA,CAAA;EAcpBkB,MAAAA,EAkGQ5B,CAAAA,CAAAI,WAlElB,CAkEkBJ,CAAAA,CAAAuB,SAlElB,CAAA,CAAA,GAAAuF,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,EAAA,CAAA,GAAAA,IAAA,EAAA,OAAA,EAAA,EAAA,GAAA,OAAA,CAAA,CAAA;EAAAkB,YAAA,E,aAAA,C,WAAA,CAAA;;;Q,QAoBiBhI,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;Q,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;Q,QAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;Q,OAArBL,CAAAA,CAAAI,W,CAAAJ,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAuB,S,oEAAqBvB,CAAAA,CAAAO,Q,WAAAP,CAAAA,CAAAK,S,EAAAL,CAAAA,CAAAe,Q,CAAAf,CAAAA,CAAAK,S;;;;A,GAyFtCL,CAAAA,CAAAQ,IAAAA,CAAAC,O;;;;;;;;;;;;;A,iBAkHawB,eAAAA,C,OACRjC,CAAAA,CAAEkC,Q,oBACQC,W;;A,cAgBLC,0B,EAA4BD,W"}

package/dist/lib/schema.js

@@ -533,14 +533,23 @@ function validateParentReference(args) {
 * and unknown-key issues from `strictObject` are normalised so the message contains the
 * substring "unknown key" — keeping pre-zod assertions in test suites and downstream tools
 * stable.
+*
+* `unknownKeyHints` maps the rendered path of an unknown key to a sentence appended to its
+* issue, for keys the user most likely meant to write somewhere else.
 */
-function formatZodIssues(error) {
+function formatZodIssues(error, unknownKeyHints = /* @__PURE__ */ new Map()) {
 	return error.issues.map((issue) => {
 		const path = renderPath(issue.path);
-		const message = normaliseIssueMessage(issue);
+		let message = normaliseIssueMessage(issue);
+		if (issue.code === "unrecognized_keys") for (const key of issue.keys) {
+			const hint = unknownKeyHints.get(path ? `${path}.${key}` : key);
+			if (hint) message += `. ${hint}`;
+		}
 		return path ? `${path}: ${message}` : message;
 	});
 }
+/** Hints for unknown keys at the top level of the `defineConfig` input. */
+const configInputUnknownKeyHints = /* @__PURE__ */ new Map([["realtime", "Realtime is in public beta and is configured under preview: `preview: { realtime: true }`"]]);
 function renderPath(path) {
 	let out = "";
 	for (const segment of path) if (typeof segment === "number") out += `[${segment}]`;
@@ -560,6 +569,6 @@ function normaliseIssueMessage(issue) {
 	}
 	return issue.message;
 }
-export { branchTuningSchema, bucketDefSchema, computeSettingsSchema, configInputSchema, dataApiConfigSchema, dataApiInputSchema, dataApiSettingsSchema, experimentalInputSchema, formatZodIssues, functionDefSchema, functionTuningSchema, functionsRecordSchema, hooksSchema, postgresConfigSchema, previewInputSchema, realtimeConfigSchema, realtimeInputSchema, serviceToggleInputSchema, serviceToggleSchema };
+export { branchTuningSchema, bucketDefSchema, computeSettingsSchema, configInputSchema, configInputUnknownKeyHints, dataApiConfigSchema, dataApiInputSchema, dataApiSettingsSchema, experimentalInputSchema, formatZodIssues, functionDefSchema, functionTuningSchema, functionsRecordSchema, hooksSchema, postgresConfigSchema, previewInputSchema, realtimeConfigSchema, realtimeInputSchema, serviceToggleInputSchema, serviceToggleSchema };
 
 //# sourceMappingURL=schema.js.map

package/dist/lib/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","names":[],"sources":["../../src/lib/schema.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n\tcustomDomainValidationError,\n\tnormalizeCustomDomain,\n} from \"./custom-domain.js\";\nimport { parseBranchTtl, parseSuspendTimeout } from \"./duration.js\";\nimport { externalPackageRoot } from \"./external-packages.js\";\nimport { isWildcardPattern, validatePattern } from \"./patterns.js\";\nimport { COMPUTE_UNITS, type FunctionBundlerInput } from \"./types.js\";\n\n/** Autoscaling max from the compute size table; larger sizes are fixed-size only. */\nconst AUTOSCALING_MAX_CU = 16;\n/** Documented ceiling on `max - min` when both bounds are set and differ. */\nconst AUTOSCALING_MAX_RANGE_CU = 8;\n\nconst computeUnitSchema = z.literal(COMPUTE_UNITS, {\n\terror: (issue) =>\n\t\t`must be a compute size Neon offers: 0.25, 0.5, an integer 1-16, or an even integer 18-56 (got ${JSON.stringify(issue.input)})`,\n});\n\n/**\n * Zod schema for {@link import(\"./types.js\").ComputeSettings}.\n *\n * CU values come from {@link COMPUTE_UNITS} (the Console size table). Plan limits are\n * the API's job. Cross-field autoscaling rules apply only when both bounds are set:\n * `min <= max`; if they differ, each bound is ≤ 16 and `max - min` ≤ 8. A single bound\n * cannot be checked against those rules because the other end is the project's default.\n *\n * `suspendTimeout` can be:\n *   - `false` (never suspend)\n *   - duration string like \"5m\", \"1h\" (must be 60s-604800s when parsed)\n *   - number in seconds (60-604800, or -1/0 for special values)\n *   - `undefined` (use platform default)\n */\nexport const computeSettingsSchema = z\n\t.strictObject({\n\t\tautoscalingLimitMinCu: computeUnitSchema.optional(),\n\t\tautoscalingLimitMaxCu: computeUnitSchema.optional(),\n\t\tsuspendTimeout: z\n\t\t\t.union([z.literal(false), z.string(), z.number()])\n\t\t\t.optional()\n\t\t\t.superRefine((value, ctx) => {\n\t\t\t\tif (value === undefined) return; // undefined is valid (use platform default)\n\t\t\t\tconst result = parseSuspendTimeout(value);\n\t\t\t\tif (\"error\" in result) {\n\t\t\t\t\tctx.addIssue({\n\t\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\t\tmessage: result.error,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}),\n\t})\n\t.superRefine((settings, ctx) => {\n\t\tconst { autoscalingLimitMinCu: min, autoscalingLimitMaxCu: max } =\n\t\t\tsettings;\n\t\tif (min === undefined || max === undefined) return;\n\t\tif (min > max) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMinCu\"],\n\t\t\t\tmessage: `autoscalingLimitMinCu (${min}) must be <= autoscalingLimitMaxCu (${max})`,\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tif (min === max) return;\n\t\tconst overMaxMessage = (field: string, value: number) =>\n\t\t\t`${field} (${value}) exceeds the autoscaling maximum of ${AUTOSCALING_MAX_CU} CU — sizes above ${AUTOSCALING_MAX_CU} are fixed-size only (set autoscalingLimitMinCu = autoscalingLimitMaxCu)`;\n\t\tif (min > AUTOSCALING_MAX_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMinCu\"],\n\t\t\t\tmessage: overMaxMessage(\"autoscalingLimitMinCu\", min),\n\t\t\t});\n\t\t}\n\t\tif (max > AUTOSCALING_MAX_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMaxCu\"],\n\t\t\t\tmessage: overMaxMessage(\"autoscalingLimitMaxCu\", max),\n\t\t\t});\n\t\t}\n\t\tif (max - min > AUTOSCALING_MAX_RANGE_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMaxCu\"],\n\t\t\t\tmessage: `autoscaling range cannot exceed ${AUTOSCALING_MAX_RANGE_CU} CU: min ${min} to max ${max} is a range of ${max - min}`,\n\t\t\t});\n\t\t}\n\t});\n\n/** Object form of a service toggle (`{ enabled?: boolean }`). */\nexport const serviceToggleSchema = z.strictObject({\n\tenabled: z.boolean().optional(),\n});\n\n/** A service toggle as written in a policy: `boolean` or `{ enabled?: boolean }`. */\nexport const serviceToggleInputSchema = z.union([\n\tz.boolean(),\n\tserviceToggleSchema,\n]);\n\nconst realtimeAllowedOriginSchema = z\n\t.string()\n\t.max(2048)\n\t.superRefine((value, ctx) => {\n\t\tif (value === \"*\") return;\n\t\ttry {\n\t\t\tconst url = new URL(value);\n\t\t\tif (\n\t\t\t\t(url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n\t\t\t\turl.username !== \"\" ||\n\t\t\t\turl.password !== \"\" ||\n\t\t\t\turl.pathname !== \"/\" ||\n\t\t\t\turl.search !== \"\" ||\n\t\t\t\turl.hash !== \"\"\n\t\t\t) {\n\t\t\t\tthrow new Error(\"not an HTTP origin\");\n\t\t\t}\n\t\t} catch {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage:\n\t\t\t\t\t'expected \"*\" or an http(s) origin with no path, query, or fragment',\n\t\t\t});\n\t\t}\n\t});\n\n/** Realtime object form (`{ allowedOrigins?: string[] }`). */\nexport const realtimeConfigSchema = z.strictObject({\n\tallowedOrigins: z\n\t\t.array(realtimeAllowedOriginSchema)\n\t\t.max(16)\n\t\t.refine((origins) => !(origins.length > 1 && origins.includes(\"*\")), {\n\t\t\tmessage: '\"*\" cannot be combined with other allowed origins',\n\t\t})\n\t\t.optional(),\n});\n\n/** Realtime as written in a policy: a boolean or its settings object. */\nexport const realtimeInputSchema = z.union([z.boolean(), realtimeConfigSchema]);\n\n/**\n * Reusable Data API runtime settings (camelCase mirror of the Neon API `DataAPISettings`).\n * `strictObject` so a typo / snake_case key fails loudly instead of being silently dropped.\n */\nexport const dataApiSettingsSchema = z.strictObject({\n\tdbAggregatesEnabled: z.boolean().optional(),\n\tdbAnonRole: z.string().optional(),\n\tdbExtraSearchPath: z.string().optional(),\n\tdbMaxRows: z.number().int().optional(),\n\tdbSchemas: z.array(z.string()).optional(),\n\tjwtRoleClaimKey: z.string().optional(),\n\tjwtCacheMaxLifetime: z.number().int().optional(),\n\topenapiMode: z\n\t\t.union([z.literal(\"ignore-privileges\"), z.literal(\"disabled\")])\n\t\t.optional(),\n\tserverCorsAllowedOrigins: z.string().optional(),\n\tserverTimingEnabled: z.boolean().optional(),\n});\n\n/** Names of the external-IdP-only fields, forbidden when `authProvider` is `\"neon\"`. */\nconst DATA_API_EXTERNAL_ONLY_KEYS = [\n\t\"jwksUrl\",\n\t\"providerName\",\n\t\"jwtAudience\",\n] as const;\n\n/**\n * Object form of the `dataApi` toggle. A single `strictObject` plus a `superRefine` (rather\n * than a discriminated union) so the `\"neon\"` default works without the discriminator being\n * present, and so the \"external-only field with authProvider neon\" error points at the exact\n * offending key — mirroring the `?: never` type-level guard at runtime.\n */\nexport const dataApiConfigSchema = z\n\t.strictObject({\n\t\tenabled: z.boolean().optional(),\n\t\tauthProvider: z\n\t\t\t.union([z.literal(\"neon\"), z.literal(\"external\")])\n\t\t\t.optional(),\n\t\tjwksUrl: z.string().optional(),\n\t\tproviderName: z.string().optional(),\n\t\tjwtAudience: z.string().optional(),\n\t\tsettings: dataApiSettingsSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\tconst provider = cfg.authProvider ?? \"neon\";\n\t\tif (provider !== \"neon\") return;\n\t\tfor (const key of DATA_API_EXTERNAL_ONLY_KEYS) {\n\t\t\tif (cfg[key] !== undefined) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tpath: [key],\n\t\t\t\t\tmessage: `${key} is only allowed with authProvider: \"external\" — Neon supplies it for authProvider: \"neon\".`,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t});\n\n/** A `dataApi` toggle as written in a policy: `boolean` or {@link dataApiConfigSchema}. */\nexport const dataApiInputSchema = z.union([z.boolean(), dataApiConfigSchema]);\n\nexport const postgresConfigSchema = z.strictObject({\n\tcomputeSettings: computeSettingsSchema.optional(),\n});\n\n/**\n * Branch-unique function slug. Mirrors the Neon Functions API path-segment rule\n * (`platform/internal/platform/functions/name.go`): 1–20 lowercase letters and digits.\n * Used as the **key schema** of the `functions` record, so a bad slug fails\n * validation with a path pointing at the offending key and duplicate slugs are impossible\n * by construction (object keys are unique).\n */\nconst functionSlugSchema = z\n\t.string()\n\t.regex(\n\t\t/^[a-z0-9]{1,20}$/,\n\t\t\"function slug must be 1-20 lowercase letters and digits (no hyphens or other characters)\",\n\t);\n\n/** Bucket name: 1–255 chars. Used as the key schema of the `buckets` record. */\nconst bucketNameSchema = z.string().min(1).max(255);\n\n/**\n * A single function environment-variable value. Must be a defined string: a `process.env.X`\n * that is unset evaluates to `undefined`, and the bare `z.string()` message for that case\n * (`Invalid input: expected string, received undefined`) gives no hint that an env var is the\n * culprit. The custom `error` replaces *only* the `undefined` case with a message that names\n * the offending function + env key (read from the issue path) and how to fix it; any other\n * wrong type keeps zod's default (`expected string, received number`, …).\n */\nconst functionEnvValueSchema = z.string({\n\terror: (issue) => {\n\t\tif (issue.input !== undefined) return undefined;\n\t\tconst path = issue.path ?? [];\n\t\tconst key = path.length > 0 ? String(path[path.length - 1]) : undefined;\n\t\tconst functionsIndex = path.indexOf(\"functions\");\n\t\tconst slug =\n\t\t\tfunctionsIndex >= 0 && functionsIndex + 1 < path.length\n\t\t\t\t? String(path[functionsIndex + 1])\n\t\t\t\t: undefined;\n\t\tconst subject =\n\t\t\tslug !== undefined && key !== undefined\n\t\t\t\t? `Environment variable \"${key}\" for function \"${slug}\"`\n\t\t\t\t: key !== undefined\n\t\t\t\t\t? `Environment variable \"${key}\"`\n\t\t\t\t\t: \"An environment variable\";\n\t\treturn `${subject} is undefined — its value (typically a \\`process.env.*\\`) is unset. Set it (for example \\`neon deploy --env <file>\\`) or omit the key from neon.ts if you do not want to write it. Do not coerce a missing value to an empty string: that uploads and deletes the live key.`;\n\t},\n});\n\n/**\n * Per-function environment map. Every value must be a defined string (see\n * {@link functionEnvValueSchema}): a `process.env.X` that is unset surfaces as `undefined` and\n * is rejected here (rather than silently shipping `undefined` into the deployment).\n */\nconst functionEnvSchema = z.record(z.string(), functionEnvValueSchema);\n\n/**\n * TCP port for a function's local dev server. Excludes 0 (which means \"any port\" to the OS\n * — `neon dev` expresses \"pick one for me\" by omitting `port`, not by passing 0).\n */\nconst devPortSchema = z.number().int().min(1).max(65535);\n\n/**\n * Local-dev settings for a function (`neon dev` only; never affects deploy). `port` is bound\n * exactly when set (and `neon dev` fails if it is taken), or a free port is found when omitted.\n */\nconst functionDevConfigSchema = z.strictObject({\n\tport: devPortSchema.optional(),\n});\n\nconst functionScheduleTriggerSchema = z.strictObject({\n\ttype: z.literal(\"schedule\"),\n\tfunction: functionSlugSchema,\n\tcron: z.string().min(1),\n\tfunctionPath: z.string().min(1).optional(),\n\tenabled: z.boolean().optional(),\n});\n\nconst functionStorageObjectCreatedTriggerSchema = z.strictObject({\n\ttype: z.literal(\"storage_object_created\"),\n\tfunction: functionSlugSchema,\n\tbucket: bucketNameSchema,\n\tprefix: z.string().min(1).max(1024).optional(),\n\tfunctionPath: z.string().min(1).optional(),\n\tenabled: z.boolean().optional(),\n});\n\nconst functionTriggerSchema = z.discriminatedUnion(\"type\", [\n\tfunctionScheduleTriggerSchema,\n\tfunctionStorageObjectCreatedTriggerSchema,\n]);\n\nconst triggerNameSchema = z.string().min(1).max(255);\n\nconst triggersRecordSchema = z.record(triggerNameSchema, functionTriggerSchema);\n\nconst customDomainSchema = z.string().superRefine((value, ctx) => {\n\tconst message = customDomainValidationError(value);\n\tif (message) {\n\t\tctx.addIssue({ code: \"custom\", message });\n\t}\n});\n\nconst customDomainsSchema = z\n\t.array(customDomainSchema)\n\t.superRefine((domains, ctx) => {\n\t\tconst seen = new Set<string>();\n\t\tfor (const [index, domain] of domains.entries()) {\n\t\t\tconst normalized = normalizeCustomDomain(domain);\n\t\t\tif (seen.has(normalized)) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tpath: [index],\n\t\t\t\t\tmessage: `custom domain \"${normalized}\" is listed more than once`,\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tseen.add(normalized);\n\t\t}\n\t});\n\n/**\n * The name of a package the bundler must leave alone. Accepts what esbuild's `external`\n * accepts for a package — a bare name, a scope, or a subpath — and rejects a relative or\n * absolute path, which names a local module rather than a dependency and is never the right\n * thing to externalize (the bundle would ship an import of a file that isn't deployed).\n */\nconst externalPackageNameSchema = z\n\t.string()\n\t.min(1)\n\t.refine((value) => !value.startsWith(\".\") && !value.startsWith(\"/\"), {\n\t\terror: 'must be a package name such as \"microsandbox\" or \"@scope/pkg\", not a relative or absolute path',\n\t});\n\n/**\n * An entry whose files are staged has to name one installable package, because the deploy\n * hands its root to `npm install`. esbuild's `external` additionally accepts a `*` wildcard\n * and a bare scope, which name a set rather than a package — legal only when nothing is\n * being installed for them.\n */\nconst stageablePackageName = (value: string): boolean => {\n\t// A protocol (`node:fs`, `npm:pkg`) is a specifier, not something to install.\n\tif (/^[a-z][a-z0-9+.-]*:/i.test(value)) return false;\n\t// An empty segment (`foo//bar`) or a traversal is not a subpath the deploy can act on.\n\tconst segments = value.split(\"/\");\n\tif (segments.some((segment) => segment === \"\" || segment === \"..\")) {\n\t\treturn false;\n\t}\n\treturn isNpmPackageName(externalPackageRoot(value));\n};\n\n/**\n * npm's own rules for a package name, which is what the deploy hands to `npm install`.\n * Deliberately strict: whatever slips through here becomes a subprocess argument.\n */\nconst NPM_NAME_SEGMENT = /^[a-z0-9~][a-z0-9._~-]*$/;\n\nconst isNpmPackageName = (root: string): boolean => {\n\tif (root.length === 0 || root.length > 214) return false;\n\tif (!root.startsWith(\"@\")) return NPM_NAME_SEGMENT.test(root);\n\tconst [scope, name, ...rest] = root.slice(1).split(\"/\");\n\t// A bare scope names every package in it, not one package.\n\tif (rest.length > 0 || name === undefined) return false;\n\treturn NPM_NAME_SEGMENT.test(scope) && NPM_NAME_SEGMENT.test(name);\n};\n\n/**\n * One entry of `externalPackages`. A bare string is the common case and ships the package's\n * files; the object form exists only to turn that off. See {@link FunctionDef.externalPackages}.\n */\nconst externalPackageEntrySchema = z.union([\n\texternalPackageNameSchema,\n\tz.strictObject({\n\t\tname: externalPackageNameSchema,\n\t\tincludeFiles: z.boolean().optional(),\n\t}),\n]);\n\n/**\n * Per-function list of packages esbuild leaves unresolved at deploy time. See\n * {@link FunctionDef.externalPackages}.\n */\nconst functionExternalPackagesSchema = z.array(externalPackageEntrySchema);\n\nconst runtimeSchema = z.literal(\"nodejs24\");\n\nconst bundlerSchema = z.custom<FunctionBundlerInput>(\n\t(value) =>\n\t\tvalue === \"esbuild\" || value === \"none\" || typeof value === \"function\",\n\t{\n\t\tmessage:\n\t\t\t'bundler must be \"esbuild\", \"none\", or a function (fn) => Promise<FunctionBundle>',\n\t},\n);\n\nconst isEsbuildBundler = (\n\tbundler: z.infer<typeof bundlerSchema> | undefined,\n): boolean => bundler === undefined || bundler === \"esbuild\";\n\n/** The declared name of an entry, whichever form it was written in. */\nconst entryName = (\n\tentry: z.infer<typeof externalPackageEntrySchema>,\n): string => (typeof entry === \"string\" ? entry : entry.name);\n\n/** Whether an entry ships its files. Absent means yes — see `FunctionDef.externalPackages`. */\nconst entryIncludesFiles = (\n\tentry: z.infer<typeof externalPackageEntrySchema>,\n): boolean => (typeof entry === \"string\" ? true : entry.includeFiles !== false);\n\n/**\n * Static definition of a function (existence). The slug is the record key (validated by\n * {@link functionSlugSchema}), so it is not a field here. Deploy tuning (`runtime`) lives\n * in the `branch` closure, not here.\n *\n * `externalPackages` entries are checked for contradictions: the same package named twice,\n * or named once bare and once through a subpath with a different `includeFiles`. Both state\n * two intents for one package, and files are staged per package rather than per subpath, so\n * neither can be honoured as written.\n */\nexport const functionDefSchema = z\n\t.strictObject({\n\t\tname: z.string().min(1).max(255),\n\t\tsource: z.string().min(1),\n\t\tenv: functionEnvSchema.optional(),\n\t\texternalPackages: functionExternalPackagesSchema.optional(),\n\t\tbundler: bundlerSchema.optional(),\n\t\tdev: functionDevConfigSchema.optional(),\n\t\tcustomDomains: customDomainsSchema.optional(),\n\t})\n\t.check((ctx) => {\n\t\tconst entries = ctx.value.externalPackages ?? [];\n\n\t\t// Other bundlers own their output, so `externalPackages` would be ignored.\n\t\tif (\n\t\t\tctx.value.externalPackages !== undefined &&\n\t\t\t!isEsbuildBundler(ctx.value.bundler)\n\t\t) {\n\t\t\tctx.issues.push({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tinput: ctx.value.externalPackages,\n\t\t\t\tpath: [\"externalPackages\"],\n\t\t\t\tmessage: `externalPackages only applies to the \"esbuild\" bundler; the \"${\n\t\t\t\t\ttypeof ctx.value.bundler === \"function\"\n\t\t\t\t\t\t? \"custom\"\n\t\t\t\t\t\t: ctx.value.bundler\n\t\t\t\t}\" bundler controls its own output. Remove externalPackages or switch to the esbuild bundler`,\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tconst seenNames = new Map<string, number>();\n\t\tconst rootIntent = new Map<\n\t\t\tstring,\n\t\t\t{ includeFiles: boolean; at: string }\n\t\t>();\n\n\t\tentries.forEach((entry, index) => {\n\t\t\tconst name = entryName(entry);\n\t\t\tconst includeFiles = entryIncludesFiles(entry);\n\n\t\t\tif (includeFiles && !stageablePackageName(name)) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`\"${name}\" does not name a single installable package, so its files cannot ` +\n\t\t\t\t\t\t`be staged. Name one package, or set includeFiles: false to leave the ` +\n\t\t\t\t\t\t`import unresolved without shipping anything for it`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst firstIndex = seenNames.get(name);\n\t\t\tif (firstIndex !== undefined) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage: `\"${name}\" is listed more than once (first at index ${firstIndex})`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tseenNames.set(name, index);\n\n\t\t\t// Files are installed and traced per package, so two specifiers that resolve to the\n\t\t\t// same package cannot disagree about whether that package's files ship.\n\t\t\tconst root = externalPackageRoot(name);\n\t\t\tconst prior = rootIntent.get(root);\n\t\t\tif (prior !== undefined && prior.includeFiles !== includeFiles) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`\"${name}\" and \"${prior.at}\" are both part of the \"${root}\" package but disagree ` +\n\t\t\t\t\t\t`about includeFiles; files ship per package, so the whole package either ships or does not`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\trootIntent.set(root, { includeFiles, at: name });\n\t\t});\n\t});\n\n/** Static definition of a bucket (existence). Name is the record key. */\nexport const bucketDefSchema = z.strictObject({\n\taccess: z\n\t\t.union([z.literal(\"private\"), z.literal(\"public_read\")])\n\t\t.optional(),\n});\n\n/**\n * Functions record. Used as both top-level `functions` and `preview.functions`\n * so {@link previewInputSchema} (`schemas.preview`) keeps the same validation\n * when parsed on its own.\n */\nexport const functionsRecordSchema = z.record(\n\tfunctionSlugSchema,\n\tfunctionDefSchema,\n);\n\n/** Preview features and deprecated aliases for graduated services. */\nexport const previewInputSchema = z.strictObject({\n\trealtime: realtimeInputSchema.optional(),\n\taiGateway: serviceToggleInputSchema.optional(),\n\tfunctions: functionsRecordSchema.optional(),\n\tbuckets: z.record(bucketNameSchema, bucketDefSchema).optional(),\n});\n\n/** Per-function deploy tuning returned by the `branch` closure. */\nexport const functionTuningSchema = z.strictObject({\n\truntime: runtimeSchema.optional(),\n\tcustomDomains: customDomainsSchema.optional(),\n});\n\n/** Per-branch Preview tuning. Keys must be slugs declared in the static `preview`. */\nconst previewTuningSchema = z.strictObject({\n\tfunctions: z.record(functionSlugSchema, functionTuningSchema).optional(),\n});\n\n/**\n * The object returned by the `branch` closure. Validated on every `resolveConfig` call so\n * tuning errors point at the concrete branch target that triggered them.\n */\nexport const branchTuningSchema = z\n\t.strictObject({\n\t\tparent: z.string().optional(),\n\t\tprotected: z.boolean().optional(),\n\t\tttl: z\n\t\t\t.union([z.string(), z.number()])\n\t\t\t.optional()\n\t\t\t.superRefine((value, ctx) => {\n\t\t\t\tif (value === undefined) return;\n\t\t\t\tconst result = parseBranchTtl(value);\n\t\t\t\tif (\"error\" in result) {\n\t\t\t\t\tctx.addIssue({ code: \"custom\", message: result.error });\n\t\t\t\t}\n\t\t\t}),\n\t\tpostgres: postgresConfigSchema.optional(),\n\t\tfunctions: z\n\t\t\t.record(functionSlugSchema, functionTuningSchema)\n\t\t\t.optional(),\n\t\tpreview: previewTuningSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\tvalidateParentReference({\n\t\t\tctx,\n\t\t\tpath: [\"parent\"],\n\t\t\tparent: cfg.parent,\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.functions !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.functions !== undefined,\n\t\t\tgaPath: \"functions\",\n\t\t\tpreviewPath: \"preview.functions\",\n\t\t});\n\t});\n\n/**\n * A single shell-command hook: a non-empty string, or a non-empty array of non-empty\n * strings run sequentially. Mirrors {@link import(\"./types.js\").ShellHook}.\n */\nconst shellHookSchema = z.union([\n\tz.string().min(1, \"a shell-command hook must be a non-empty string\"),\n\tz\n\t\t.array(\n\t\t\tz.string().min(1, \"each shell command must be a non-empty string\"),\n\t\t)\n\t\t.min(1, \"a shell-command hook array must have at least one command\"),\n]);\n\n/**\n * A lifecycle hook value: a function (validated structurally — its argument/return are\n * checked by TypeScript, and at call time by the runtime), or a {@link shellHookSchema}.\n */\nconst hookValueSchema = z.union([\n\tz.custom<(...args: unknown[]) => unknown>(\n\t\t(value) => typeof value === \"function\",\n\t\t{\n\t\t\tmessage:\n\t\t\t\t\"a hook must be a function `(ctx) => …` or a shell command string/array\",\n\t\t},\n\t),\n\tshellHookSchema,\n]);\n\n/** `before` / `after` pair shared by the `checkout`, `create`, and `deploy` hook phases. */\nconst hookPhaseSchema = z.strictObject({\n\tbefore: hookValueSchema.optional(),\n\tafter: hookValueSchema.optional(),\n});\n\n/**\n * Lifecycle hooks block (`hooks.checkout` / `hooks.create` / `hooks.deploy`, each\n * `before` / `after`).\n */\nexport const hooksSchema = z.strictObject({\n\tcheckout: hookPhaseSchema.optional(),\n\tcreate: hookPhaseSchema.optional(),\n\tdeploy: hookPhaseSchema.optional(),\n});\n\n/** Experimental (unstable) features block (`experimental.hooks`). Currently just `hooks`. */\nexport const experimentalInputSchema = z.strictObject({\n\thooks: hooksSchema.optional(),\n});\n\n/**\n * The top-level object accepted by `defineConfig`. The `branch` closure is validated\n * structurally as a function here; its returned tuning is validated per-evaluation by\n * {@link branchTuningSchema} inside `resolveConfig`.\n */\nexport const configInputSchema = z\n\t.strictObject({\n\t\tauth: serviceToggleInputSchema.optional(),\n\t\tdataApi: dataApiInputSchema.optional(),\n\t\taiGateway: serviceToggleInputSchema.optional(),\n\t\tfunctions: functionsRecordSchema.optional(),\n\t\tbuckets: z.record(bucketNameSchema, bucketDefSchema).optional(),\n\t\ttriggers: triggersRecordSchema.optional(),\n\t\tpreview: previewInputSchema.optional(),\n\t\tbranch: z\n\t\t\t.custom<(...args: unknown[]) => unknown>(\n\t\t\t\t(value) => typeof value === \"function\",\n\t\t\t\t{\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"branch must be a function: `branch: (branch) => ({ … })`\",\n\t\t\t\t},\n\t\t\t)\n\t\t\t.optional(),\n\t\texperimental: experimentalInputSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.aiGateway !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.aiGateway !== undefined,\n\t\t\tgaPath: \"aiGateway\",\n\t\t\tpreviewPath: \"preview.aiGateway\",\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.functions !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.functions !== undefined,\n\t\t\tgaPath: \"functions\",\n\t\t\tpreviewPath: \"preview.functions\",\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.buckets !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.buckets !== undefined,\n\t\t\tgaPath: \"buckets\",\n\t\t\tpreviewPath: \"preview.buckets\",\n\t\t});\n\t\tvalidateAuthoredTriggers(cfg, ctx);\n\t\t// A Data API verified by Neon Auth (`authProvider: \"neon\"`, the default) needs Neon\n\t\t// Auth enabled on the same branch so the tokens it verifies actually exist. Enforce\n\t\t// the same invariant the `defineConfig` type-level check expresses, at runtime.\n\t\tif (!isToggleEnabledValue(cfg.dataApi)) return;\n\t\tif (dataApiAuthProviderValue(cfg.dataApi) !== \"neon\") return;\n\t\tif (!isToggleEnabledValue(cfg.auth)) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"auth\"],\n\t\t\t\tmessage:\n\t\t\t\t\t'dataApi with authProvider \"neon\" requires Neon Auth — set `auth: true` (or `auth: { enabled: true }`), or use `dataApi.authProvider: \"external\"` with your own `jwksUrl`.',\n\t\t\t});\n\t\t}\n\t});\n\nfunction validateAuthoredTriggers(\n\tcfg: {\n\t\tfunctions?: Record<string, unknown>;\n\t\tbuckets?: Record<string, unknown>;\n\t\tpreview?: {\n\t\t\tfunctions?: Record<string, unknown>;\n\t\t\tbuckets?: Record<string, unknown>;\n\t\t};\n\t\ttriggers?: Record<string, z.infer<typeof functionTriggerSchema>>;\n\t},\n\tctx: z.RefinementCtx,\n): void {\n\tif (cfg.triggers === undefined) return;\n\tconst functions = new Set(\n\t\tObject.keys(cfg.functions ?? cfg.preview?.functions ?? {}),\n\t);\n\tconst buckets = new Set(\n\t\tObject.keys(cfg.buckets ?? cfg.preview?.buckets ?? {}),\n\t);\n\tfor (const [name, trigger] of Object.entries(cfg.triggers)) {\n\t\tif (!functions.has(trigger.function)) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"triggers\", name, \"function\"],\n\t\t\t\tmessage: `trigger \"${name}\" references function \"${trigger.function}\", which is not declared in functions (or preview.functions)`,\n\t\t\t});\n\t\t}\n\t\tif (\n\t\t\ttrigger.type === \"storage_object_created\" &&\n\t\t\t!buckets.has(trigger.bucket)\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"triggers\", name, \"bucket\"],\n\t\t\t\tmessage: `trigger \"${name}\" references bucket \"${trigger.bucket}\", which is not declared in buckets (or preview.buckets)`,\n\t\t\t});\n\t\t}\n\t}\n}\n\nfunction rejectDuplicateHome(\n\tctx: z.RefinementCtx,\n\targs: {\n\t\tgaPresent: boolean;\n\t\tpreviewPresent: boolean;\n\t\tgaPath: string;\n\t\tpreviewPath: string;\n\t},\n): void {\n\tif (!args.gaPresent || !args.previewPresent) return;\n\tctx.addIssue({\n\t\tcode: \"custom\",\n\t\tpath: args.gaPath.split(\".\"),\n\t\tmessage: `${args.gaPath} is also declared as ${args.previewPath}. Keep ${args.gaPath} and remove ${args.previewPath}.`,\n\t});\n}\n\n/**\n * Whether a parsed `auth` / `dataApi` toggle value is enabled: a present object (or `true`)\n * is on unless `enabled` is explicitly `false`. Mirrors `isServiceEnabled` in\n * `define-config.ts`, operating on the already-validated runtime value.\n */\nfunction isToggleEnabledValue(value: unknown): boolean {\n\tif (value === undefined || value === null) return false;\n\tif (typeof value === \"boolean\") return value;\n\tif (typeof value === \"object\") {\n\t\treturn (value as { enabled?: unknown }).enabled !== false;\n\t}\n\treturn false;\n}\n\n/** Read the (defaulted) `authProvider` from a parsed `dataApi` value. */\nfunction dataApiAuthProviderValue(value: unknown): \"neon\" | \"external\" {\n\tif (value !== null && typeof value === \"object\") {\n\t\tconst provider = (value as { authProvider?: unknown }).authProvider;\n\t\tif (provider === \"external\") return \"external\";\n\t}\n\treturn \"neon\";\n}\n\nfunction validateParentReference(args: {\n\tctx: z.RefinementCtx;\n\tpath: (string | number)[];\n\tparent: string | undefined;\n}): void {\n\tconst { ctx, path, parent } = args;\n\tif (parent === undefined) return;\n\n\tconst patternCheck = validatePattern(parent);\n\tif (\"error\" in patternCheck) {\n\t\tctx.addIssue({ code: \"custom\", path, message: patternCheck.error });\n\t} else if (isWildcardPattern(parent)) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tpath,\n\t\t\tmessage: `parent must be a concrete branch name (no wildcards), got \"${parent}\"`,\n\t\t});\n\t}\n}\n\n/**\n * Convert the structured {@link z.ZodError} produced by `configSchema.safeParse` into the\n * `string[]` shape used by {@link import(\"./errors.js\").ConfigValidationError}.\n *\n * Issue paths are rendered as dot-separated property accesses (`postgres.computeSettings`)\n * and unknown-key issues from `strictObject` are normalised so the message contains the\n * substring \"unknown key\" — keeping pre-zod assertions in test suites and downstream tools\n * stable.\n */\nexport function formatZodIssues(error: z.ZodError): string[] {\n\treturn error.issues.map((issue) => {\n\t\tconst path = renderPath(issue.path);\n\t\tconst message = normaliseIssueMessage(issue);\n\t\treturn path ? `${path}: ${message}` : message;\n\t});\n}\n\nfunction renderPath(path: ReadonlyArray<PropertyKey>): string {\n\tlet out = \"\";\n\tfor (const segment of path) {\n\t\tif (typeof segment === \"number\") out += `[${segment}]`;\n\t\telse if (out === \"\") out += String(segment);\n\t\telse out += `.${String(segment)}`;\n\t}\n\treturn out;\n}\n\nfunction normaliseIssueMessage(issue: z.core.$ZodIssue): string {\n\tif (issue.code === \"unrecognized_keys\") {\n\t\tconst keys = issue.keys ?? [];\n\t\tconst formatted = keys.map((k) => JSON.stringify(k)).join(\", \");\n\t\treturn `unknown key${keys.length === 1 ? \"\" : \"s\"}: ${formatted}`;\n\t}\n\tif (issue.code === \"invalid_key\") {\n\t\t// A record *key* that fails its key schema (e.g. a bad function slug) surfaces in\n\t\t// zod as a single `invalid_key` issue whose own `message` is the generic, useless\n\t\t// \"Invalid key in record\". The actual reason — the function-slug regex rule, say —\n\t\t// lives in the nested key-schema `issues`. Hoist those so the user sees *why* the\n\t\t// key was rejected (the offending key itself is already in the issue `path`).\n\t\tconst reasons = issue.issues\n\t\t\t.map((nested) => nested.message)\n\t\t\t.filter((message) => message.length > 0);\n\t\tif (reasons.length > 0) return reasons.join(\"; \");\n\t}\n\treturn issue.message;\n}\n"],"mappings":";;;;;;;;AAWA,MAAM,qBAAqB;;AAE3B,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB,EAAE,QAAQ,eAAe,EAClD,QAAQ,UACP,iGAAiG,KAAK,UAAU,MAAM,KAAK,EAAE,GAC/H,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,wBAAwB,EACnC,aAAa;CACb,uBAAuB,kBAAkB,SAAS;CAClD,uBAAuB,kBAAkB,SAAS;CAClD,gBAAgB,EACd,MAAM;EAAC,EAAE,QAAQ,KAAK;EAAG,EAAE,OAAO;EAAG,EAAE,OAAO;CAAC,CAAC,CAAC,CACjD,SAAS,CAAC,CACV,aAAa,OAAO,QAAQ;EAC5B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,SAAS,oBAAoB,KAAK;EACxC,IAAI,WAAW,QACd,IAAI,SAAS;GACZ,MAAM;GACN,SAAS,OAAO;EACjB,CAAC;CAEH,CAAC;AACH,CAAC,CAAC,CACD,aAAa,UAAU,QAAQ;CAC/B,MAAM,EAAE,uBAAuB,KAAK,uBAAuB,QAC1D;CACD,IAAI,QAAQ,KAAA,KAAa,QAAQ,KAAA,GAAW;CAC5C,IAAI,MAAM,KAAK;EACd,IAAI,SAAS;GACZ,MAAM;GACN,MAAM,CAAC,uBAAuB;GAC9B,SAAS,0BAA0B,IAAI,sCAAsC,IAAI;EAClF,CAAC;EACD;CACD;CACA,IAAI,QAAQ,KAAK;CACjB,MAAM,kBAAkB,OAAe,UACtC,GAAG,MAAM,IAAI,MAAM,uCAAuC,mBAAmB,oBAAoB,mBAAmB;CACrH,IAAI,MAAM,oBACT,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,eAAe,yBAAyB,GAAG;CACrD,CAAC;CAEF,IAAI,MAAM,oBACT,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,eAAe,yBAAyB,GAAG;CACrD,CAAC;CAEF,IAAI,MAAM,MAAM,0BACf,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,mCAAmC,yBAAyB,WAAW,IAAI,UAAU,IAAI,iBAAiB,MAAM;CAC1H,CAAC;AAEH,CAAC;;AAGF,MAAa,sBAAsB,EAAE,aAAa,EACjD,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,EAC/B,CAAC;;AAGD,MAAa,2BAA2B,EAAE,MAAM,CAC/C,EAAE,QAAQ,GACV,mBACD,CAAC;AAED,MAAM,8BAA8B,EAClC,OAAO,CAAC,CACR,IAAI,IAAI,CAAC,CACT,aAAa,OAAO,QAAQ;CAC5B,IAAI,UAAU,KAAK;CACnB,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,IACE,IAAI,aAAa,WAAW,IAAI,aAAa,YAC9C,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,aAAa,OACjB,IAAI,WAAW,MACf,IAAI,SAAS,IAEb,MAAM,IAAI,MAAM,oBAAoB;CAEtC,QAAQ;EACP,IAAI,SAAS;GACZ,MAAM;GACN,SACC;EACF,CAAC;CACF;AACD,CAAC;;AAGF,MAAa,uBAAuB,EAAE,aAAa,EAClD,gBAAgB,EACd,MAAM,2BAA2B,CAAC,CAClC,IAAI,EAAE,CAAC,CACP,QAAQ,YAAY,EAAE,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,IAAI,EACpE,SAAS,sDACV,CAAC,CAAC,CACD,SAAS,EACZ,CAAC;;AAGD,MAAa,sBAAsB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,oBAAoB,CAAC;;;;;AAM9E,MAAa,wBAAwB,EAAE,aAAa;CACnD,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,mBAAmB,EAAE,OAAO,CAAC,CAAC,SAAS;CACvC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACxC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC/C,aAAa,EACX,MAAM,CAAC,EAAE,QAAQ,mBAAmB,GAAG,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,CAC9D,SAAS;CACX,0BAA0B,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9C,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC3C,CAAC;;AAGD,MAAM,8BAA8B;CACnC;CACA;CACA;AACD;;;;;;;AAQA,MAAa,sBAAsB,EACjC,aAAa;CACb,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC9B,cAAc,EACZ,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,CACjD,SAAS;CACX,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,UAAU,sBAAsB,SAAS;AAC1C,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAE1B,KADiB,IAAI,gBAAgB,YACpB,QAAQ;CACzB,KAAK,MAAM,OAAO,6BACjB,IAAI,IAAI,SAAS,KAAA,GAChB,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,GAAG;EACV,SAAS,GAAG,IAAI;CACjB,CAAC;AAGJ,CAAC;;AAGF,MAAa,qBAAqB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAAC;AAE5E,MAAa,uBAAuB,EAAE,aAAa,EAClD,iBAAiB,sBAAsB,SAAS,EACjD,CAAC;;;;;;;;AASD,MAAM,qBAAqB,EACzB,OAAO,CAAC,CACR,MACA,oBACA,0FACD;;AAGD,MAAM,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;;;;;;;;;AAUlD,MAAM,yBAAyB,EAAE,OAAO,EACvC,QAAQ,UAAU;CACjB,IAAI,MAAM,UAAU,KAAA,GAAW,OAAO,KAAA;CACtC,MAAM,OAAO,MAAM,QAAQ,CAAC;CAC5B,MAAM,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,IAAI,KAAA;CAC9D,MAAM,iBAAiB,KAAK,QAAQ,WAAW;CAC/C,MAAM,OACL,kBAAkB,KAAK,iBAAiB,IAAI,KAAK,SAC9C,OAAO,KAAK,iBAAiB,EAAE,IAC/B,KAAA;CAOJ,OAAO,GALN,SAAS,KAAA,KAAa,QAAQ,KAAA,IAC3B,yBAAyB,IAAI,kBAAkB,KAAK,KACpD,QAAQ,KAAA,IACP,yBAAyB,IAAI,KAC7B,0BACa;AACnB,EACD,CAAC;;;;;;AAOD,MAAM,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,sBAAsB;;;;;AAMrE,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;;;;;AAMvD,MAAM,0BAA0B,EAAE,aAAa,EAC9C,MAAM,cAAc,SAAS,EAC9B,CAAC;AAED,MAAM,gCAAgC,EAAE,aAAa;CACpD,MAAM,EAAE,QAAQ,UAAU;CAC1B,UAAU;CACV,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC/B,CAAC;AAED,MAAM,4CAA4C,EAAE,aAAa;CAChE,MAAM,EAAE,QAAQ,wBAAwB;CACxC,UAAU;CACV,QAAQ;CACR,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS;CAC7C,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC/B,CAAC;AAED,MAAM,wBAAwB,EAAE,mBAAmB,QAAQ,CAC1D,+BACA,yCACD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAEnD,MAAM,uBAAuB,EAAE,OAAO,mBAAmB,qBAAqB;AAE9E,MAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC,aAAa,OAAO,QAAQ;CACjE,MAAM,UAAU,4BAA4B,KAAK;CACjD,IAAI,SACH,IAAI,SAAS;EAAE,MAAM;EAAU;CAAQ,CAAC;AAE1C,CAAC;AAED,MAAM,sBAAsB,EAC1B,MAAM,kBAAkB,CAAC,CACzB,aAAa,SAAS,QAAQ;CAC9B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG;EAChD,MAAM,aAAa,sBAAsB,MAAM;EAC/C,IAAI,KAAK,IAAI,UAAU,GAAG;GACzB,IAAI,SAAS;IACZ,MAAM;IACN,MAAM,CAAC,KAAK;IACZ,SAAS,kBAAkB,WAAW;GACvC,CAAC;GACD;EACD;EACA,KAAK,IAAI,UAAU;CACpB;AACD,CAAC;;;;;;;AAQF,MAAM,4BAA4B,EAChC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,GAAG,GAAG,EACpE,OAAO,qGACR,CAAC;;;;;;;AAQF,MAAM,wBAAwB,UAA2B;CAExD,IAAI,uBAAuB,KAAK,KAAK,GAAG,OAAO;CAG/C,IADiB,MAAM,MAAM,GAClB,CAAC,CAAC,MAAM,YAAY,YAAY,MAAM,YAAY,IAAI,GAChE,OAAO;CAER,OAAO,iBAAiB,oBAAoB,KAAK,CAAC;AACnD;;;;;AAMA,MAAM,mBAAmB;AAEzB,MAAM,oBAAoB,SAA0B;CACnD,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO;CACnD,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO,iBAAiB,KAAK,IAAI;CAC5D,MAAM,CAAC,OAAO,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG;CAEtD,IAAI,KAAK,SAAS,KAAK,SAAS,KAAA,GAAW,OAAO;CAClD,OAAO,iBAAiB,KAAK,KAAK,KAAK,iBAAiB,KAAK,IAAI;AAClE;;;;;AAMA,MAAM,6BAA6B,EAAE,MAAM,CAC1C,2BACA,EAAE,aAAa;CACd,MAAM;CACN,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACpC,CAAC,CACF,CAAC;;;;;AAMD,MAAM,iCAAiC,EAAE,MAAM,0BAA0B;AAEzE,MAAM,gBAAgB,EAAE,QAAQ,UAAU;AAE1C,MAAM,gBAAgB,EAAE,QACtB,UACA,UAAU,aAAa,UAAU,UAAU,OAAO,UAAU,YAC7D,EACC,SACC,uFACF,CACD;AAEA,MAAM,oBACL,YACa,YAAY,KAAA,KAAa,YAAY;;AAGnD,MAAM,aACL,UACa,OAAO,UAAU,WAAW,QAAQ,MAAM;;AAGxD,MAAM,sBACL,UACc,OAAO,UAAU,WAAW,OAAO,MAAM,iBAAiB;;;;;;;;;;;AAYzE,MAAa,oBAAoB,EAC/B,aAAa;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,KAAK,kBAAkB,SAAS;CAChC,kBAAkB,+BAA+B,SAAS;CAC1D,SAAS,cAAc,SAAS;CAChC,KAAK,wBAAwB,SAAS;CACtC,eAAe,oBAAoB,SAAS;AAC7C,CAAC,CAAC,CACD,OAAO,QAAQ;CACf,MAAM,UAAU,IAAI,MAAM,oBAAoB,CAAC;CAG/C,IACC,IAAI,MAAM,qBAAqB,KAAA,KAC/B,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAClC;EACD,IAAI,OAAO,KAAK;GACf,MAAM;GACN,OAAO,IAAI,MAAM;GACjB,MAAM,CAAC,kBAAkB;GACzB,SAAS,gEACR,OAAO,IAAI,MAAM,YAAY,aAC1B,WACA,IAAI,MAAM,QACb;EACF,CAAC;EACD;CACD;CAEA,MAAM,4BAAY,IAAI,IAAoB;CAC1C,MAAM,6BAAa,IAAI,IAGrB;CAEF,QAAQ,SAAS,OAAO,UAAU;EACjC,MAAM,OAAO,UAAU,KAAK;EAC5B,MAAM,eAAe,mBAAmB,KAAK;EAE7C,IAAI,gBAAgB,CAAC,qBAAqB,IAAI,GAAG;GAChD,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SACC,IAAI,KAAK;GAGX,CAAC;GACD;EACD;EAEA,MAAM,aAAa,UAAU,IAAI,IAAI;EACrC,IAAI,eAAe,KAAA,GAAW;GAC7B,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SAAS,IAAI,KAAK,6CAA6C,WAAW;GAC3E,CAAC;GACD;EACD;EACA,UAAU,IAAI,MAAM,KAAK;EAIzB,MAAM,OAAO,oBAAoB,IAAI;EACrC,MAAM,QAAQ,WAAW,IAAI,IAAI;EACjC,IAAI,UAAU,KAAA,KAAa,MAAM,iBAAiB,cAAc;GAC/D,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SACC,IAAI,KAAK,SAAS,MAAM,GAAG,0BAA0B,KAAK;GAE5D,CAAC;GACD;EACD;EACA,WAAW,IAAI,MAAM;GAAE;GAAc,IAAI;EAAK,CAAC;CAChD,CAAC;AACF,CAAC;;AAGF,MAAa,kBAAkB,EAAE,aAAa,EAC7C,QAAQ,EACN,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,aAAa,CAAC,CAAC,CAAC,CACvD,SAAS,EACZ,CAAC;;;;;;AAOD,MAAa,wBAAwB,EAAE,OACtC,oBACA,iBACD;;AAGA,MAAa,qBAAqB,EAAE,aAAa;CAChD,UAAU,oBAAoB,SAAS;CACvC,WAAW,yBAAyB,SAAS;CAC7C,WAAW,sBAAsB,SAAS;CAC1C,SAAS,EAAE,OAAO,kBAAkB,eAAe,CAAC,CAAC,SAAS;AAC/D,CAAC;;AAGD,MAAa,uBAAuB,EAAE,aAAa;CAClD,SAAS,cAAc,SAAS;CAChC,eAAe,oBAAoB,SAAS;AAC7C,CAAC;;AAGD,MAAM,sBAAsB,EAAE,aAAa,EAC1C,WAAW,EAAE,OAAO,oBAAoB,oBAAoB,CAAC,CAAC,SAAS,EACxE,CAAC;;;;;AAMD,MAAa,qBAAqB,EAChC,aAAa;CACb,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,KAAK,EACH,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAC/B,SAAS,CAAC,CACV,aAAa,OAAO,QAAQ;EAC5B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,SAAS,eAAe,KAAK;EACnC,IAAI,WAAW,QACd,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS,OAAO;EAAM,CAAC;CAExD,CAAC;CACF,UAAU,qBAAqB,SAAS;CACxC,WAAW,EACT,OAAO,oBAAoB,oBAAoB,CAAC,CAChD,SAAS;CACX,SAAS,oBAAoB,SAAS;AACvC,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAC1B,wBAAwB;EACvB;EACA,MAAM,CAAC,QAAQ;EACf,QAAQ,IAAI;CACb,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;AACF,CAAC;;;;;AAMF,MAAM,kBAAkB,EAAE,MAAM,CAC/B,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,iDAAiD,GACnE,EACE,MACA,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,+CAA+C,CAClE,CAAC,CACA,IAAI,GAAG,2DAA2D,CACrE,CAAC;;;;;AAMD,MAAM,kBAAkB,EAAE,MAAM,CAC/B,EAAE,QACA,UAAU,OAAO,UAAU,YAC5B,EACC,SACC,yEACF,CACD,GACA,eACD,CAAC;;AAGD,MAAM,kBAAkB,EAAE,aAAa;CACtC,QAAQ,gBAAgB,SAAS;CACjC,OAAO,gBAAgB,SAAS;AACjC,CAAC;;;;;AAMD,MAAa,cAAc,EAAE,aAAa;CACzC,UAAU,gBAAgB,SAAS;CACnC,QAAQ,gBAAgB,SAAS;CACjC,QAAQ,gBAAgB,SAAS;AAClC,CAAC;;AAGD,MAAa,0BAA0B,EAAE,aAAa,EACrD,OAAO,YAAY,SAAS,EAC7B,CAAC;;;;;;AAOD,MAAa,oBAAoB,EAC/B,aAAa;CACb,MAAM,yBAAyB,SAAS;CACxC,SAAS,mBAAmB,SAAS;CACrC,WAAW,yBAAyB,SAAS;CAC7C,WAAW,sBAAsB,SAAS;CAC1C,SAAS,EAAE,OAAO,kBAAkB,eAAe,CAAC,CAAC,SAAS;CAC9D,UAAU,qBAAqB,SAAS;CACxC,SAAS,mBAAmB,SAAS;CACrC,QAAQ,EACN,QACC,UAAU,OAAO,UAAU,YAC5B,EACC,SACC,2DACF,CACD,CAAC,CACA,SAAS;CACX,cAAc,wBAAwB,SAAS;AAChD,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAC1B,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,YAAY,KAAA;EAC3B,gBAAgB,IAAI,SAAS,YAAY,KAAA;EACzC,QAAQ;EACR,aAAa;CACd,CAAC;CACD,yBAAyB,KAAK,GAAG;CAIjC,IAAI,CAAC,qBAAqB,IAAI,OAAO,GAAG;CACxC,IAAI,yBAAyB,IAAI,OAAO,MAAM,QAAQ;CACtD,IAAI,CAAC,qBAAqB,IAAI,IAAI,GACjC,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,MAAM;EACb,SACC;CACF,CAAC;AAEH,CAAC;AAEF,SAAS,yBACR,KASA,KACO;CACP,IAAI,IAAI,aAAa,KAAA,GAAW;CAChC,MAAM,YAAY,IAAI,IACrB,OAAO,KAAK,IAAI,aAAa,IAAI,SAAS,aAAa,CAAC,CAAC,CAC1D;CACA,MAAM,UAAU,IAAI,IACnB,OAAO,KAAK,IAAI,WAAW,IAAI,SAAS,WAAW,CAAC,CAAC,CACtD;CACA,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,IAAI,QAAQ,GAAG;EAC3D,IAAI,CAAC,UAAU,IAAI,QAAQ,QAAQ,GAClC,IAAI,SAAS;GACZ,MAAM;GACN,MAAM;IAAC;IAAY;IAAM;GAAU;GACnC,SAAS,YAAY,KAAK,yBAAyB,QAAQ,SAAS;EACrE,CAAC;EAEF,IACC,QAAQ,SAAS,4BACjB,CAAC,QAAQ,IAAI,QAAQ,MAAM,GAE3B,IAAI,SAAS;GACZ,MAAM;GACN,MAAM;IAAC;IAAY;IAAM;GAAQ;GACjC,SAAS,YAAY,KAAK,uBAAuB,QAAQ,OAAO;EACjE,CAAC;CAEH;AACD;AAEA,SAAS,oBACR,KACA,MAMO;CACP,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,gBAAgB;CAC7C,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,KAAK,OAAO,MAAM,GAAG;EAC3B,SAAS,GAAG,KAAK,OAAO,uBAAuB,KAAK,YAAY,SAAS,KAAK,OAAO,cAAc,KAAK,YAAY;CACrH,CAAC;AACF;;;;;;AAOA,SAAS,qBAAqB,OAAyB;CACtD,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,IAAI,OAAO,UAAU,UACpB,OAAQ,MAAgC,YAAY;CAErD,OAAO;AACR;;AAGA,SAAS,yBAAyB,OAAqC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACpB;MAAA,MAAqC,iBACtC,YAAY,OAAO;CAAA;CAErC,OAAO;AACR;AAEA,SAAS,wBAAwB,MAIxB;CACR,MAAM,EAAE,KAAK,MAAM,WAAW;CAC9B,IAAI,WAAW,KAAA,GAAW;CAE1B,MAAM,eAAe,gBAAgB,MAAM;CAC3C,IAAI,WAAW,cACd,IAAI,SAAS;EAAE,MAAM;EAAU;EAAM,SAAS,aAAa;CAAM,CAAC;MAC5D,IAAI,kBAAkB,MAAM,GAClC,IAAI,SAAS;EACZ,MAAM;EACN;EACA,SAAS,8DAA8D,OAAO;CAC/E,CAAC;AAEH;;;;;;;;;;AAWA,SAAgB,gBAAgB,OAA6B;CAC5D,OAAO,MAAM,OAAO,KAAK,UAAU;EAClC,MAAM,OAAO,WAAW,MAAM,IAAI;EAClC,MAAM,UAAU,sBAAsB,KAAK;EAC3C,OAAO,OAAO,GAAG,KAAK,IAAI,YAAY;CACvC,CAAC;AACF;AAEA,SAAS,WAAW,MAA0C;CAC7D,IAAI,MAAM;CACV,KAAK,MAAM,WAAW,MACrB,IAAI,OAAO,YAAY,UAAU,OAAO,IAAI,QAAQ;MAC/C,IAAI,QAAQ,IAAI,OAAO,OAAO,OAAO;MACrC,OAAO,IAAI,OAAO,OAAO;CAE/B,OAAO;AACR;AAEA,SAAS,sBAAsB,OAAiC;CAC/D,IAAI,MAAM,SAAS,qBAAqB;EACvC,MAAM,OAAO,MAAM,QAAQ,CAAC;EAC5B,MAAM,YAAY,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;EAC9D,OAAO,cAAc,KAAK,WAAW,IAAI,KAAK,IAAI,IAAI;CACvD;CACA,IAAI,MAAM,SAAS,eAAe;EAMjC,MAAM,UAAU,MAAM,OACpB,KAAK,WAAW,OAAO,OAAO,CAAC,CAC/B,QAAQ,YAAY,QAAQ,SAAS,CAAC;EACxC,IAAI,QAAQ,SAAS,GAAG,OAAO,QAAQ,KAAK,IAAI;CACjD;CACA,OAAO,MAAM;AACd"}
+{"version":3,"file":"schema.js","names":[],"sources":["../../src/lib/schema.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n\tcustomDomainValidationError,\n\tnormalizeCustomDomain,\n} from \"./custom-domain.js\";\nimport { parseBranchTtl, parseSuspendTimeout } from \"./duration.js\";\nimport { externalPackageRoot } from \"./external-packages.js\";\nimport { isWildcardPattern, validatePattern } from \"./patterns.js\";\nimport { COMPUTE_UNITS, type FunctionBundlerInput } from \"./types.js\";\n\n/** Autoscaling max from the compute size table; larger sizes are fixed-size only. */\nconst AUTOSCALING_MAX_CU = 16;\n/** Documented ceiling on `max - min` when both bounds are set and differ. */\nconst AUTOSCALING_MAX_RANGE_CU = 8;\n\nconst computeUnitSchema = z.literal(COMPUTE_UNITS, {\n\terror: (issue) =>\n\t\t`must be a compute size Neon offers: 0.25, 0.5, an integer 1-16, or an even integer 18-56 (got ${JSON.stringify(issue.input)})`,\n});\n\n/**\n * Zod schema for {@link import(\"./types.js\").ComputeSettings}.\n *\n * CU values come from {@link COMPUTE_UNITS} (the Console size table). Plan limits are\n * the API's job. Cross-field autoscaling rules apply only when both bounds are set:\n * `min <= max`; if they differ, each bound is ≤ 16 and `max - min` ≤ 8. A single bound\n * cannot be checked against those rules because the other end is the project's default.\n *\n * `suspendTimeout` can be:\n *   - `false` (never suspend)\n *   - duration string like \"5m\", \"1h\" (must be 60s-604800s when parsed)\n *   - number in seconds (60-604800, or -1/0 for special values)\n *   - `undefined` (use platform default)\n */\nexport const computeSettingsSchema = z\n\t.strictObject({\n\t\tautoscalingLimitMinCu: computeUnitSchema.optional(),\n\t\tautoscalingLimitMaxCu: computeUnitSchema.optional(),\n\t\tsuspendTimeout: z\n\t\t\t.union([z.literal(false), z.string(), z.number()])\n\t\t\t.optional()\n\t\t\t.superRefine((value, ctx) => {\n\t\t\t\tif (value === undefined) return; // undefined is valid (use platform default)\n\t\t\t\tconst result = parseSuspendTimeout(value);\n\t\t\t\tif (\"error\" in result) {\n\t\t\t\t\tctx.addIssue({\n\t\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\t\tmessage: result.error,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}),\n\t})\n\t.superRefine((settings, ctx) => {\n\t\tconst { autoscalingLimitMinCu: min, autoscalingLimitMaxCu: max } =\n\t\t\tsettings;\n\t\tif (min === undefined || max === undefined) return;\n\t\tif (min > max) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMinCu\"],\n\t\t\t\tmessage: `autoscalingLimitMinCu (${min}) must be <= autoscalingLimitMaxCu (${max})`,\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tif (min === max) return;\n\t\tconst overMaxMessage = (field: string, value: number) =>\n\t\t\t`${field} (${value}) exceeds the autoscaling maximum of ${AUTOSCALING_MAX_CU} CU — sizes above ${AUTOSCALING_MAX_CU} are fixed-size only (set autoscalingLimitMinCu = autoscalingLimitMaxCu)`;\n\t\tif (min > AUTOSCALING_MAX_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMinCu\"],\n\t\t\t\tmessage: overMaxMessage(\"autoscalingLimitMinCu\", min),\n\t\t\t});\n\t\t}\n\t\tif (max > AUTOSCALING_MAX_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMaxCu\"],\n\t\t\t\tmessage: overMaxMessage(\"autoscalingLimitMaxCu\", max),\n\t\t\t});\n\t\t}\n\t\tif (max - min > AUTOSCALING_MAX_RANGE_CU) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"autoscalingLimitMaxCu\"],\n\t\t\t\tmessage: `autoscaling range cannot exceed ${AUTOSCALING_MAX_RANGE_CU} CU: min ${min} to max ${max} is a range of ${max - min}`,\n\t\t\t});\n\t\t}\n\t});\n\n/** Object form of a service toggle (`{ enabled?: boolean }`). */\nexport const serviceToggleSchema = z.strictObject({\n\tenabled: z.boolean().optional(),\n});\n\n/** A service toggle as written in a policy: `boolean` or `{ enabled?: boolean }`. */\nexport const serviceToggleInputSchema = z.union([\n\tz.boolean(),\n\tserviceToggleSchema,\n]);\n\nconst realtimeAllowedOriginSchema = z\n\t.string()\n\t.max(2048)\n\t.superRefine((value, ctx) => {\n\t\tif (value === \"*\") return;\n\t\ttry {\n\t\t\tconst url = new URL(value);\n\t\t\tif (\n\t\t\t\t(url.protocol !== \"http:\" && url.protocol !== \"https:\") ||\n\t\t\t\turl.username !== \"\" ||\n\t\t\t\turl.password !== \"\" ||\n\t\t\t\turl.pathname !== \"/\" ||\n\t\t\t\turl.search !== \"\" ||\n\t\t\t\turl.hash !== \"\"\n\t\t\t) {\n\t\t\t\tthrow new Error(\"not an HTTP origin\");\n\t\t\t}\n\t\t} catch {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tmessage:\n\t\t\t\t\t'expected \"*\" or an http(s) origin with no path, query, or fragment',\n\t\t\t});\n\t\t}\n\t});\n\n/** Realtime object form (`{ allowedOrigins?: string[] }`). */\nexport const realtimeConfigSchema = z.strictObject({\n\tallowedOrigins: z\n\t\t.array(realtimeAllowedOriginSchema)\n\t\t.max(16)\n\t\t.refine((origins) => !(origins.length > 1 && origins.includes(\"*\")), {\n\t\t\tmessage: '\"*\" cannot be combined with other allowed origins',\n\t\t})\n\t\t.optional(),\n});\n\n/** Realtime as written in a policy: a boolean or its settings object. */\nexport const realtimeInputSchema = z.union([z.boolean(), realtimeConfigSchema]);\n\n/**\n * Reusable Data API runtime settings (camelCase mirror of the Neon API `DataAPISettings`).\n * `strictObject` so a typo / snake_case key fails loudly instead of being silently dropped.\n */\nexport const dataApiSettingsSchema = z.strictObject({\n\tdbAggregatesEnabled: z.boolean().optional(),\n\tdbAnonRole: z.string().optional(),\n\tdbExtraSearchPath: z.string().optional(),\n\tdbMaxRows: z.number().int().optional(),\n\tdbSchemas: z.array(z.string()).optional(),\n\tjwtRoleClaimKey: z.string().optional(),\n\tjwtCacheMaxLifetime: z.number().int().optional(),\n\topenapiMode: z\n\t\t.union([z.literal(\"ignore-privileges\"), z.literal(\"disabled\")])\n\t\t.optional(),\n\tserverCorsAllowedOrigins: z.string().optional(),\n\tserverTimingEnabled: z.boolean().optional(),\n});\n\n/** Names of the external-IdP-only fields, forbidden when `authProvider` is `\"neon\"`. */\nconst DATA_API_EXTERNAL_ONLY_KEYS = [\n\t\"jwksUrl\",\n\t\"providerName\",\n\t\"jwtAudience\",\n] as const;\n\n/**\n * Object form of the `dataApi` toggle. A single `strictObject` plus a `superRefine` (rather\n * than a discriminated union) so the `\"neon\"` default works without the discriminator being\n * present, and so the \"external-only field with authProvider neon\" error points at the exact\n * offending key — mirroring the `?: never` type-level guard at runtime.\n */\nexport const dataApiConfigSchema = z\n\t.strictObject({\n\t\tenabled: z.boolean().optional(),\n\t\tauthProvider: z\n\t\t\t.union([z.literal(\"neon\"), z.literal(\"external\")])\n\t\t\t.optional(),\n\t\tjwksUrl: z.string().optional(),\n\t\tproviderName: z.string().optional(),\n\t\tjwtAudience: z.string().optional(),\n\t\tsettings: dataApiSettingsSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\tconst provider = cfg.authProvider ?? \"neon\";\n\t\tif (provider !== \"neon\") return;\n\t\tfor (const key of DATA_API_EXTERNAL_ONLY_KEYS) {\n\t\t\tif (cfg[key] !== undefined) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tpath: [key],\n\t\t\t\t\tmessage: `${key} is only allowed with authProvider: \"external\" — Neon supplies it for authProvider: \"neon\".`,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t});\n\n/** A `dataApi` toggle as written in a policy: `boolean` or {@link dataApiConfigSchema}. */\nexport const dataApiInputSchema = z.union([z.boolean(), dataApiConfigSchema]);\n\nexport const postgresConfigSchema = z.strictObject({\n\tcomputeSettings: computeSettingsSchema.optional(),\n});\n\n/**\n * Branch-unique function slug. Mirrors the Neon Functions API path-segment rule\n * (`platform/internal/platform/functions/name.go`): 1–20 lowercase letters and digits.\n * Used as the **key schema** of the `functions` record, so a bad slug fails\n * validation with a path pointing at the offending key and duplicate slugs are impossible\n * by construction (object keys are unique).\n */\nconst functionSlugSchema = z\n\t.string()\n\t.regex(\n\t\t/^[a-z0-9]{1,20}$/,\n\t\t\"function slug must be 1-20 lowercase letters and digits (no hyphens or other characters)\",\n\t);\n\n/** Bucket name: 1–255 chars. Used as the key schema of the `buckets` record. */\nconst bucketNameSchema = z.string().min(1).max(255);\n\n/**\n * A single function environment-variable value. Must be a defined string: a `process.env.X`\n * that is unset evaluates to `undefined`, and the bare `z.string()` message for that case\n * (`Invalid input: expected string, received undefined`) gives no hint that an env var is the\n * culprit. The custom `error` replaces *only* the `undefined` case with a message that names\n * the offending function + env key (read from the issue path) and how to fix it; any other\n * wrong type keeps zod's default (`expected string, received number`, …).\n */\nconst functionEnvValueSchema = z.string({\n\terror: (issue) => {\n\t\tif (issue.input !== undefined) return undefined;\n\t\tconst path = issue.path ?? [];\n\t\tconst key = path.length > 0 ? String(path[path.length - 1]) : undefined;\n\t\tconst functionsIndex = path.indexOf(\"functions\");\n\t\tconst slug =\n\t\t\tfunctionsIndex >= 0 && functionsIndex + 1 < path.length\n\t\t\t\t? String(path[functionsIndex + 1])\n\t\t\t\t: undefined;\n\t\tconst subject =\n\t\t\tslug !== undefined && key !== undefined\n\t\t\t\t? `Environment variable \"${key}\" for function \"${slug}\"`\n\t\t\t\t: key !== undefined\n\t\t\t\t\t? `Environment variable \"${key}\"`\n\t\t\t\t\t: \"An environment variable\";\n\t\treturn `${subject} is undefined — its value (typically a \\`process.env.*\\`) is unset. Set it (for example \\`neon deploy --env <file>\\`) or omit the key from neon.ts if you do not want to write it. Do not coerce a missing value to an empty string: that uploads and deletes the live key.`;\n\t},\n});\n\n/**\n * Per-function environment map. Every value must be a defined string (see\n * {@link functionEnvValueSchema}): a `process.env.X` that is unset surfaces as `undefined` and\n * is rejected here (rather than silently shipping `undefined` into the deployment).\n */\nconst functionEnvSchema = z.record(z.string(), functionEnvValueSchema);\n\n/**\n * TCP port for a function's local dev server. Excludes 0 (which means \"any port\" to the OS\n * — `neon dev` expresses \"pick one for me\" by omitting `port`, not by passing 0).\n */\nconst devPortSchema = z.number().int().min(1).max(65535);\n\n/**\n * Local-dev settings for a function (`neon dev` only; never affects deploy). `port` is bound\n * exactly when set (and `neon dev` fails if it is taken), or a free port is found when omitted.\n */\nconst functionDevConfigSchema = z.strictObject({\n\tport: devPortSchema.optional(),\n});\n\nconst functionScheduleTriggerSchema = z.strictObject({\n\ttype: z.literal(\"schedule\"),\n\tfunction: functionSlugSchema,\n\tcron: z.string().min(1),\n\tfunctionPath: z.string().min(1).optional(),\n\tenabled: z.boolean().optional(),\n});\n\nconst functionStorageObjectCreatedTriggerSchema = z.strictObject({\n\ttype: z.literal(\"storage_object_created\"),\n\tfunction: functionSlugSchema,\n\tbucket: bucketNameSchema,\n\tprefix: z.string().min(1).max(1024).optional(),\n\tfunctionPath: z.string().min(1).optional(),\n\tenabled: z.boolean().optional(),\n});\n\nconst functionTriggerSchema = z.discriminatedUnion(\"type\", [\n\tfunctionScheduleTriggerSchema,\n\tfunctionStorageObjectCreatedTriggerSchema,\n]);\n\nconst triggerNameSchema = z.string().min(1).max(255);\n\nconst triggersRecordSchema = z.record(triggerNameSchema, functionTriggerSchema);\n\nconst customDomainSchema = z.string().superRefine((value, ctx) => {\n\tconst message = customDomainValidationError(value);\n\tif (message) {\n\t\tctx.addIssue({ code: \"custom\", message });\n\t}\n});\n\nconst customDomainsSchema = z\n\t.array(customDomainSchema)\n\t.superRefine((domains, ctx) => {\n\t\tconst seen = new Set<string>();\n\t\tfor (const [index, domain] of domains.entries()) {\n\t\t\tconst normalized = normalizeCustomDomain(domain);\n\t\t\tif (seen.has(normalized)) {\n\t\t\t\tctx.addIssue({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tpath: [index],\n\t\t\t\t\tmessage: `custom domain \"${normalized}\" is listed more than once`,\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tseen.add(normalized);\n\t\t}\n\t});\n\n/**\n * The name of a package the bundler must leave alone. Accepts what esbuild's `external`\n * accepts for a package — a bare name, a scope, or a subpath — and rejects a relative or\n * absolute path, which names a local module rather than a dependency and is never the right\n * thing to externalize (the bundle would ship an import of a file that isn't deployed).\n */\nconst externalPackageNameSchema = z\n\t.string()\n\t.min(1)\n\t.refine((value) => !value.startsWith(\".\") && !value.startsWith(\"/\"), {\n\t\terror: 'must be a package name such as \"microsandbox\" or \"@scope/pkg\", not a relative or absolute path',\n\t});\n\n/**\n * An entry whose files are staged has to name one installable package, because the deploy\n * hands its root to `npm install`. esbuild's `external` additionally accepts a `*` wildcard\n * and a bare scope, which name a set rather than a package — legal only when nothing is\n * being installed for them.\n */\nconst stageablePackageName = (value: string): boolean => {\n\t// A protocol (`node:fs`, `npm:pkg`) is a specifier, not something to install.\n\tif (/^[a-z][a-z0-9+.-]*:/i.test(value)) return false;\n\t// An empty segment (`foo//bar`) or a traversal is not a subpath the deploy can act on.\n\tconst segments = value.split(\"/\");\n\tif (segments.some((segment) => segment === \"\" || segment === \"..\")) {\n\t\treturn false;\n\t}\n\treturn isNpmPackageName(externalPackageRoot(value));\n};\n\n/**\n * npm's own rules for a package name, which is what the deploy hands to `npm install`.\n * Deliberately strict: whatever slips through here becomes a subprocess argument.\n */\nconst NPM_NAME_SEGMENT = /^[a-z0-9~][a-z0-9._~-]*$/;\n\nconst isNpmPackageName = (root: string): boolean => {\n\tif (root.length === 0 || root.length > 214) return false;\n\tif (!root.startsWith(\"@\")) return NPM_NAME_SEGMENT.test(root);\n\tconst [scope, name, ...rest] = root.slice(1).split(\"/\");\n\t// A bare scope names every package in it, not one package.\n\tif (rest.length > 0 || name === undefined) return false;\n\treturn NPM_NAME_SEGMENT.test(scope) && NPM_NAME_SEGMENT.test(name);\n};\n\n/**\n * One entry of `externalPackages`. A bare string is the common case and ships the package's\n * files; the object form exists only to turn that off. See {@link FunctionDef.externalPackages}.\n */\nconst externalPackageEntrySchema = z.union([\n\texternalPackageNameSchema,\n\tz.strictObject({\n\t\tname: externalPackageNameSchema,\n\t\tincludeFiles: z.boolean().optional(),\n\t}),\n]);\n\n/**\n * Per-function list of packages esbuild leaves unresolved at deploy time. See\n * {@link FunctionDef.externalPackages}.\n */\nconst functionExternalPackagesSchema = z.array(externalPackageEntrySchema);\n\nconst runtimeSchema = z.literal(\"nodejs24\");\n\nconst bundlerSchema = z.custom<FunctionBundlerInput>(\n\t(value) =>\n\t\tvalue === \"esbuild\" || value === \"none\" || typeof value === \"function\",\n\t{\n\t\tmessage:\n\t\t\t'bundler must be \"esbuild\", \"none\", or a function (fn) => Promise<FunctionBundle>',\n\t},\n);\n\nconst isEsbuildBundler = (\n\tbundler: z.infer<typeof bundlerSchema> | undefined,\n): boolean => bundler === undefined || bundler === \"esbuild\";\n\n/** The declared name of an entry, whichever form it was written in. */\nconst entryName = (\n\tentry: z.infer<typeof externalPackageEntrySchema>,\n): string => (typeof entry === \"string\" ? entry : entry.name);\n\n/** Whether an entry ships its files. Absent means yes — see `FunctionDef.externalPackages`. */\nconst entryIncludesFiles = (\n\tentry: z.infer<typeof externalPackageEntrySchema>,\n): boolean => (typeof entry === \"string\" ? true : entry.includeFiles !== false);\n\n/**\n * Static definition of a function (existence). The slug is the record key (validated by\n * {@link functionSlugSchema}), so it is not a field here. Deploy tuning (`runtime`) lives\n * in the `branch` closure, not here.\n *\n * `externalPackages` entries are checked for contradictions: the same package named twice,\n * or named once bare and once through a subpath with a different `includeFiles`. Both state\n * two intents for one package, and files are staged per package rather than per subpath, so\n * neither can be honoured as written.\n */\nexport const functionDefSchema = z\n\t.strictObject({\n\t\tname: z.string().min(1).max(255),\n\t\tsource: z.string().min(1),\n\t\tenv: functionEnvSchema.optional(),\n\t\texternalPackages: functionExternalPackagesSchema.optional(),\n\t\tbundler: bundlerSchema.optional(),\n\t\tdev: functionDevConfigSchema.optional(),\n\t\tcustomDomains: customDomainsSchema.optional(),\n\t})\n\t.check((ctx) => {\n\t\tconst entries = ctx.value.externalPackages ?? [];\n\n\t\t// Other bundlers own their output, so `externalPackages` would be ignored.\n\t\tif (\n\t\t\tctx.value.externalPackages !== undefined &&\n\t\t\t!isEsbuildBundler(ctx.value.bundler)\n\t\t) {\n\t\t\tctx.issues.push({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tinput: ctx.value.externalPackages,\n\t\t\t\tpath: [\"externalPackages\"],\n\t\t\t\tmessage: `externalPackages only applies to the \"esbuild\" bundler; the \"${\n\t\t\t\t\ttypeof ctx.value.bundler === \"function\"\n\t\t\t\t\t\t? \"custom\"\n\t\t\t\t\t\t: ctx.value.bundler\n\t\t\t\t}\" bundler controls its own output. Remove externalPackages or switch to the esbuild bundler`,\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tconst seenNames = new Map<string, number>();\n\t\tconst rootIntent = new Map<\n\t\t\tstring,\n\t\t\t{ includeFiles: boolean; at: string }\n\t\t>();\n\n\t\tentries.forEach((entry, index) => {\n\t\t\tconst name = entryName(entry);\n\t\t\tconst includeFiles = entryIncludesFiles(entry);\n\n\t\t\tif (includeFiles && !stageablePackageName(name)) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`\"${name}\" does not name a single installable package, so its files cannot ` +\n\t\t\t\t\t\t`be staged. Name one package, or set includeFiles: false to leave the ` +\n\t\t\t\t\t\t`import unresolved without shipping anything for it`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst firstIndex = seenNames.get(name);\n\t\t\tif (firstIndex !== undefined) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage: `\"${name}\" is listed more than once (first at index ${firstIndex})`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tseenNames.set(name, index);\n\n\t\t\t// Files are installed and traced per package, so two specifiers that resolve to the\n\t\t\t// same package cannot disagree about whether that package's files ship.\n\t\t\tconst root = externalPackageRoot(name);\n\t\t\tconst prior = rootIntent.get(root);\n\t\t\tif (prior !== undefined && prior.includeFiles !== includeFiles) {\n\t\t\t\tctx.issues.push({\n\t\t\t\t\tcode: \"custom\",\n\t\t\t\t\tinput: entry,\n\t\t\t\t\tpath: [\"externalPackages\", index],\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`\"${name}\" and \"${prior.at}\" are both part of the \"${root}\" package but disagree ` +\n\t\t\t\t\t\t`about includeFiles; files ship per package, so the whole package either ships or does not`,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\t\t\trootIntent.set(root, { includeFiles, at: name });\n\t\t});\n\t});\n\n/** Static definition of a bucket (existence). Name is the record key. */\nexport const bucketDefSchema = z.strictObject({\n\taccess: z\n\t\t.union([z.literal(\"private\"), z.literal(\"public_read\")])\n\t\t.optional(),\n});\n\n/**\n * Functions record. Used as both top-level `functions` and `preview.functions`\n * so {@link previewInputSchema} (`schemas.preview`) keeps the same validation\n * when parsed on its own.\n */\nexport const functionsRecordSchema = z.record(\n\tfunctionSlugSchema,\n\tfunctionDefSchema,\n);\n\n/** Preview features and deprecated aliases for graduated services. */\nexport const previewInputSchema = z.strictObject({\n\trealtime: realtimeInputSchema.optional(),\n\taiGateway: serviceToggleInputSchema.optional(),\n\tfunctions: functionsRecordSchema.optional(),\n\tbuckets: z.record(bucketNameSchema, bucketDefSchema).optional(),\n});\n\n/** Per-function deploy tuning returned by the `branch` closure. */\nexport const functionTuningSchema = z.strictObject({\n\truntime: runtimeSchema.optional(),\n\tcustomDomains: customDomainsSchema.optional(),\n});\n\n/** Per-branch Preview tuning. Keys must be slugs declared in the static `preview`. */\nconst previewTuningSchema = z.strictObject({\n\tfunctions: z.record(functionSlugSchema, functionTuningSchema).optional(),\n});\n\n/**\n * The object returned by the `branch` closure. Validated on every `resolveConfig` call so\n * tuning errors point at the concrete branch target that triggered them.\n */\nexport const branchTuningSchema = z\n\t.strictObject({\n\t\tparent: z.string().optional(),\n\t\tprotected: z.boolean().optional(),\n\t\tttl: z\n\t\t\t.union([z.string(), z.number()])\n\t\t\t.optional()\n\t\t\t.superRefine((value, ctx) => {\n\t\t\t\tif (value === undefined) return;\n\t\t\t\tconst result = parseBranchTtl(value);\n\t\t\t\tif (\"error\" in result) {\n\t\t\t\t\tctx.addIssue({ code: \"custom\", message: result.error });\n\t\t\t\t}\n\t\t\t}),\n\t\tpostgres: postgresConfigSchema.optional(),\n\t\tfunctions: z\n\t\t\t.record(functionSlugSchema, functionTuningSchema)\n\t\t\t.optional(),\n\t\tpreview: previewTuningSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\tvalidateParentReference({\n\t\t\tctx,\n\t\t\tpath: [\"parent\"],\n\t\t\tparent: cfg.parent,\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.functions !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.functions !== undefined,\n\t\t\tgaPath: \"functions\",\n\t\t\tpreviewPath: \"preview.functions\",\n\t\t});\n\t});\n\n/**\n * A single shell-command hook: a non-empty string, or a non-empty array of non-empty\n * strings run sequentially. Mirrors {@link import(\"./types.js\").ShellHook}.\n */\nconst shellHookSchema = z.union([\n\tz.string().min(1, \"a shell-command hook must be a non-empty string\"),\n\tz\n\t\t.array(\n\t\t\tz.string().min(1, \"each shell command must be a non-empty string\"),\n\t\t)\n\t\t.min(1, \"a shell-command hook array must have at least one command\"),\n]);\n\n/**\n * A lifecycle hook value: a function (validated structurally — its argument/return are\n * checked by TypeScript, and at call time by the runtime), or a {@link shellHookSchema}.\n */\nconst hookValueSchema = z.union([\n\tz.custom<(...args: unknown[]) => unknown>(\n\t\t(value) => typeof value === \"function\",\n\t\t{\n\t\t\tmessage:\n\t\t\t\t\"a hook must be a function `(ctx) => …` or a shell command string/array\",\n\t\t},\n\t),\n\tshellHookSchema,\n]);\n\n/** `before` / `after` pair shared by the `checkout`, `create`, and `deploy` hook phases. */\nconst hookPhaseSchema = z.strictObject({\n\tbefore: hookValueSchema.optional(),\n\tafter: hookValueSchema.optional(),\n});\n\n/**\n * Lifecycle hooks block (`hooks.checkout` / `hooks.create` / `hooks.deploy`, each\n * `before` / `after`).\n */\nexport const hooksSchema = z.strictObject({\n\tcheckout: hookPhaseSchema.optional(),\n\tcreate: hookPhaseSchema.optional(),\n\tdeploy: hookPhaseSchema.optional(),\n});\n\n/** Experimental (unstable) features block (`experimental.hooks`). Currently just `hooks`. */\nexport const experimentalInputSchema = z.strictObject({\n\thooks: hooksSchema.optional(),\n});\n\n/**\n * The top-level object accepted by `defineConfig`. The `branch` closure is validated\n * structurally as a function here; its returned tuning is validated per-evaluation by\n * {@link branchTuningSchema} inside `resolveConfig`.\n */\nexport const configInputSchema = z\n\t.strictObject({\n\t\tauth: serviceToggleInputSchema.optional(),\n\t\tdataApi: dataApiInputSchema.optional(),\n\t\taiGateway: serviceToggleInputSchema.optional(),\n\t\tfunctions: functionsRecordSchema.optional(),\n\t\tbuckets: z.record(bucketNameSchema, bucketDefSchema).optional(),\n\t\ttriggers: triggersRecordSchema.optional(),\n\t\tpreview: previewInputSchema.optional(),\n\t\tbranch: z\n\t\t\t.custom<(...args: unknown[]) => unknown>(\n\t\t\t\t(value) => typeof value === \"function\",\n\t\t\t\t{\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t\"branch must be a function: `branch: (branch) => ({ … })`\",\n\t\t\t\t},\n\t\t\t)\n\t\t\t.optional(),\n\t\texperimental: experimentalInputSchema.optional(),\n\t})\n\t.superRefine((cfg, ctx) => {\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.aiGateway !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.aiGateway !== undefined,\n\t\t\tgaPath: \"aiGateway\",\n\t\t\tpreviewPath: \"preview.aiGateway\",\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.functions !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.functions !== undefined,\n\t\t\tgaPath: \"functions\",\n\t\t\tpreviewPath: \"preview.functions\",\n\t\t});\n\t\trejectDuplicateHome(ctx, {\n\t\t\tgaPresent: cfg.buckets !== undefined,\n\t\t\tpreviewPresent: cfg.preview?.buckets !== undefined,\n\t\t\tgaPath: \"buckets\",\n\t\t\tpreviewPath: \"preview.buckets\",\n\t\t});\n\t\tvalidateAuthoredTriggers(cfg, ctx);\n\t\t// A Data API verified by Neon Auth (`authProvider: \"neon\"`, the default) needs Neon\n\t\t// Auth enabled on the same branch so the tokens it verifies actually exist. Enforce\n\t\t// the same invariant the `defineConfig` type-level check expresses, at runtime.\n\t\tif (!isToggleEnabledValue(cfg.dataApi)) return;\n\t\tif (dataApiAuthProviderValue(cfg.dataApi) !== \"neon\") return;\n\t\tif (!isToggleEnabledValue(cfg.auth)) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"auth\"],\n\t\t\t\tmessage:\n\t\t\t\t\t'dataApi with authProvider \"neon\" requires Neon Auth — set `auth: true` (or `auth: { enabled: true }`), or use `dataApi.authProvider: \"external\"` with your own `jwksUrl`.',\n\t\t\t});\n\t\t}\n\t});\n\nfunction validateAuthoredTriggers(\n\tcfg: {\n\t\tfunctions?: Record<string, unknown>;\n\t\tbuckets?: Record<string, unknown>;\n\t\tpreview?: {\n\t\t\tfunctions?: Record<string, unknown>;\n\t\t\tbuckets?: Record<string, unknown>;\n\t\t};\n\t\ttriggers?: Record<string, z.infer<typeof functionTriggerSchema>>;\n\t},\n\tctx: z.RefinementCtx,\n): void {\n\tif (cfg.triggers === undefined) return;\n\tconst functions = new Set(\n\t\tObject.keys(cfg.functions ?? cfg.preview?.functions ?? {}),\n\t);\n\tconst buckets = new Set(\n\t\tObject.keys(cfg.buckets ?? cfg.preview?.buckets ?? {}),\n\t);\n\tfor (const [name, trigger] of Object.entries(cfg.triggers)) {\n\t\tif (!functions.has(trigger.function)) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"triggers\", name, \"function\"],\n\t\t\t\tmessage: `trigger \"${name}\" references function \"${trigger.function}\", which is not declared in functions (or preview.functions)`,\n\t\t\t});\n\t\t}\n\t\tif (\n\t\t\ttrigger.type === \"storage_object_created\" &&\n\t\t\t!buckets.has(trigger.bucket)\n\t\t) {\n\t\t\tctx.addIssue({\n\t\t\t\tcode: \"custom\",\n\t\t\t\tpath: [\"triggers\", name, \"bucket\"],\n\t\t\t\tmessage: `trigger \"${name}\" references bucket \"${trigger.bucket}\", which is not declared in buckets (or preview.buckets)`,\n\t\t\t});\n\t\t}\n\t}\n}\n\nfunction rejectDuplicateHome(\n\tctx: z.RefinementCtx,\n\targs: {\n\t\tgaPresent: boolean;\n\t\tpreviewPresent: boolean;\n\t\tgaPath: string;\n\t\tpreviewPath: string;\n\t},\n): void {\n\tif (!args.gaPresent || !args.previewPresent) return;\n\tctx.addIssue({\n\t\tcode: \"custom\",\n\t\tpath: args.gaPath.split(\".\"),\n\t\tmessage: `${args.gaPath} is also declared as ${args.previewPath}. Keep ${args.gaPath} and remove ${args.previewPath}.`,\n\t});\n}\n\n/**\n * Whether a parsed `auth` / `dataApi` toggle value is enabled: a present object (or `true`)\n * is on unless `enabled` is explicitly `false`. Mirrors `isServiceEnabled` in\n * `define-config.ts`, operating on the already-validated runtime value.\n */\nfunction isToggleEnabledValue(value: unknown): boolean {\n\tif (value === undefined || value === null) return false;\n\tif (typeof value === \"boolean\") return value;\n\tif (typeof value === \"object\") {\n\t\treturn (value as { enabled?: unknown }).enabled !== false;\n\t}\n\treturn false;\n}\n\n/** Read the (defaulted) `authProvider` from a parsed `dataApi` value. */\nfunction dataApiAuthProviderValue(value: unknown): \"neon\" | \"external\" {\n\tif (value !== null && typeof value === \"object\") {\n\t\tconst provider = (value as { authProvider?: unknown }).authProvider;\n\t\tif (provider === \"external\") return \"external\";\n\t}\n\treturn \"neon\";\n}\n\nfunction validateParentReference(args: {\n\tctx: z.RefinementCtx;\n\tpath: (string | number)[];\n\tparent: string | undefined;\n}): void {\n\tconst { ctx, path, parent } = args;\n\tif (parent === undefined) return;\n\n\tconst patternCheck = validatePattern(parent);\n\tif (\"error\" in patternCheck) {\n\t\tctx.addIssue({ code: \"custom\", path, message: patternCheck.error });\n\t} else if (isWildcardPattern(parent)) {\n\t\tctx.addIssue({\n\t\t\tcode: \"custom\",\n\t\t\tpath,\n\t\t\tmessage: `parent must be a concrete branch name (no wildcards), got \"${parent}\"`,\n\t\t});\n\t}\n}\n\n/**\n * Convert the structured {@link z.ZodError} produced by `configSchema.safeParse` into the\n * `string[]` shape used by {@link import(\"./errors.js\").ConfigValidationError}.\n *\n * Issue paths are rendered as dot-separated property accesses (`postgres.computeSettings`)\n * and unknown-key issues from `strictObject` are normalised so the message contains the\n * substring \"unknown key\" — keeping pre-zod assertions in test suites and downstream tools\n * stable.\n *\n * `unknownKeyHints` maps the rendered path of an unknown key to a sentence appended to its\n * issue, for keys the user most likely meant to write somewhere else.\n */\nexport function formatZodIssues(\n\terror: z.ZodError,\n\tunknownKeyHints: ReadonlyMap<string, string> = new Map(),\n): string[] {\n\treturn error.issues.map((issue) => {\n\t\tconst path = renderPath(issue.path);\n\t\tlet message = normaliseIssueMessage(issue);\n\t\tif (issue.code === \"unrecognized_keys\") {\n\t\t\tfor (const key of issue.keys) {\n\t\t\t\tconst hint = unknownKeyHints.get(path ? `${path}.${key}` : key);\n\t\t\t\tif (hint) message += `. ${hint}`;\n\t\t\t}\n\t\t}\n\t\treturn path ? `${path}: ${message}` : message;\n\t});\n}\n\n/** Hints for unknown keys at the top level of the `defineConfig` input. */\nexport const configInputUnknownKeyHints: ReadonlyMap<string, string> = new Map([\n\t[\n\t\t\"realtime\",\n\t\t\"Realtime is in public beta and is configured under preview: `preview: { realtime: true }`\",\n\t],\n]);\n\nfunction renderPath(path: ReadonlyArray<PropertyKey>): string {\n\tlet out = \"\";\n\tfor (const segment of path) {\n\t\tif (typeof segment === \"number\") out += `[${segment}]`;\n\t\telse if (out === \"\") out += String(segment);\n\t\telse out += `.${String(segment)}`;\n\t}\n\treturn out;\n}\n\nfunction normaliseIssueMessage(issue: z.core.$ZodIssue): string {\n\tif (issue.code === \"unrecognized_keys\") {\n\t\tconst keys = issue.keys ?? [];\n\t\tconst formatted = keys.map((k) => JSON.stringify(k)).join(\", \");\n\t\treturn `unknown key${keys.length === 1 ? \"\" : \"s\"}: ${formatted}`;\n\t}\n\tif (issue.code === \"invalid_key\") {\n\t\t// A record *key* that fails its key schema (e.g. a bad function slug) surfaces in\n\t\t// zod as a single `invalid_key` issue whose own `message` is the generic, useless\n\t\t// \"Invalid key in record\". The actual reason — the function-slug regex rule, say —\n\t\t// lives in the nested key-schema `issues`. Hoist those so the user sees *why* the\n\t\t// key was rejected (the offending key itself is already in the issue `path`).\n\t\tconst reasons = issue.issues\n\t\t\t.map((nested) => nested.message)\n\t\t\t.filter((message) => message.length > 0);\n\t\tif (reasons.length > 0) return reasons.join(\"; \");\n\t}\n\treturn issue.message;\n}\n"],"mappings":";;;;;;;;AAWA,MAAM,qBAAqB;;AAE3B,MAAM,2BAA2B;AAEjC,MAAM,oBAAoB,EAAE,QAAQ,eAAe,EAClD,QAAQ,UACP,iGAAiG,KAAK,UAAU,MAAM,KAAK,EAAE,GAC/H,CAAC;;;;;;;;;;;;;;;AAgBD,MAAa,wBAAwB,EACnC,aAAa;CACb,uBAAuB,kBAAkB,SAAS;CAClD,uBAAuB,kBAAkB,SAAS;CAClD,gBAAgB,EACd,MAAM;EAAC,EAAE,QAAQ,KAAK;EAAG,EAAE,OAAO;EAAG,EAAE,OAAO;CAAC,CAAC,CAAC,CACjD,SAAS,CAAC,CACV,aAAa,OAAO,QAAQ;EAC5B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,SAAS,oBAAoB,KAAK;EACxC,IAAI,WAAW,QACd,IAAI,SAAS;GACZ,MAAM;GACN,SAAS,OAAO;EACjB,CAAC;CAEH,CAAC;AACH,CAAC,CAAC,CACD,aAAa,UAAU,QAAQ;CAC/B,MAAM,EAAE,uBAAuB,KAAK,uBAAuB,QAC1D;CACD,IAAI,QAAQ,KAAA,KAAa,QAAQ,KAAA,GAAW;CAC5C,IAAI,MAAM,KAAK;EACd,IAAI,SAAS;GACZ,MAAM;GACN,MAAM,CAAC,uBAAuB;GAC9B,SAAS,0BAA0B,IAAI,sCAAsC,IAAI;EAClF,CAAC;EACD;CACD;CACA,IAAI,QAAQ,KAAK;CACjB,MAAM,kBAAkB,OAAe,UACtC,GAAG,MAAM,IAAI,MAAM,uCAAuC,mBAAmB,oBAAoB,mBAAmB;CACrH,IAAI,MAAM,oBACT,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,eAAe,yBAAyB,GAAG;CACrD,CAAC;CAEF,IAAI,MAAM,oBACT,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,eAAe,yBAAyB,GAAG;CACrD,CAAC;CAEF,IAAI,MAAM,MAAM,0BACf,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,uBAAuB;EAC9B,SAAS,mCAAmC,yBAAyB,WAAW,IAAI,UAAU,IAAI,iBAAiB,MAAM;CAC1H,CAAC;AAEH,CAAC;;AAGF,MAAa,sBAAsB,EAAE,aAAa,EACjD,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,EAC/B,CAAC;;AAGD,MAAa,2BAA2B,EAAE,MAAM,CAC/C,EAAE,QAAQ,GACV,mBACD,CAAC;AAED,MAAM,8BAA8B,EAClC,OAAO,CAAC,CACR,IAAI,IAAI,CAAC,CACT,aAAa,OAAO,QAAQ;CAC5B,IAAI,UAAU,KAAK;CACnB,IAAI;EACH,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,IACE,IAAI,aAAa,WAAW,IAAI,aAAa,YAC9C,IAAI,aAAa,MACjB,IAAI,aAAa,MACjB,IAAI,aAAa,OACjB,IAAI,WAAW,MACf,IAAI,SAAS,IAEb,MAAM,IAAI,MAAM,oBAAoB;CAEtC,QAAQ;EACP,IAAI,SAAS;GACZ,MAAM;GACN,SACC;EACF,CAAC;CACF;AACD,CAAC;;AAGF,MAAa,uBAAuB,EAAE,aAAa,EAClD,gBAAgB,EACd,MAAM,2BAA2B,CAAC,CAClC,IAAI,EAAE,CAAC,CACP,QAAQ,YAAY,EAAE,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,IAAI,EACpE,SAAS,sDACV,CAAC,CAAC,CACD,SAAS,EACZ,CAAC;;AAGD,MAAa,sBAAsB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,oBAAoB,CAAC;;;;;AAM9E,MAAa,wBAAwB,EAAE,aAAa;CACnD,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC1C,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,mBAAmB,EAAE,OAAO,CAAC,CAAC,SAAS;CACvC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACxC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;CACrC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC/C,aAAa,EACX,MAAM,CAAC,EAAE,QAAQ,mBAAmB,GAAG,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,CAC9D,SAAS;CACX,0BAA0B,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9C,qBAAqB,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC3C,CAAC;;AAGD,MAAM,8BAA8B;CACnC;CACA;CACA;AACD;;;;;;;AAQA,MAAa,sBAAsB,EACjC,aAAa;CACb,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC9B,cAAc,EACZ,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,CACjD,SAAS;CACX,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,UAAU,sBAAsB,SAAS;AAC1C,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAE1B,KADiB,IAAI,gBAAgB,YACpB,QAAQ;CACzB,KAAK,MAAM,OAAO,6BACjB,IAAI,IAAI,SAAS,KAAA,GAChB,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,GAAG;EACV,SAAS,GAAG,IAAI;CACjB,CAAC;AAGJ,CAAC;;AAGF,MAAa,qBAAqB,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAAC;AAE5E,MAAa,uBAAuB,EAAE,aAAa,EAClD,iBAAiB,sBAAsB,SAAS,EACjD,CAAC;;;;;;;;AASD,MAAM,qBAAqB,EACzB,OAAO,CAAC,CACR,MACA,oBACA,0FACD;;AAGD,MAAM,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;;;;;;;;;AAUlD,MAAM,yBAAyB,EAAE,OAAO,EACvC,QAAQ,UAAU;CACjB,IAAI,MAAM,UAAU,KAAA,GAAW,OAAO,KAAA;CACtC,MAAM,OAAO,MAAM,QAAQ,CAAC;CAC5B,MAAM,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,IAAI,KAAA;CAC9D,MAAM,iBAAiB,KAAK,QAAQ,WAAW;CAC/C,MAAM,OACL,kBAAkB,KAAK,iBAAiB,IAAI,KAAK,SAC9C,OAAO,KAAK,iBAAiB,EAAE,IAC/B,KAAA;CAOJ,OAAO,GALN,SAAS,KAAA,KAAa,QAAQ,KAAA,IAC3B,yBAAyB,IAAI,kBAAkB,KAAK,KACpD,QAAQ,KAAA,IACP,yBAAyB,IAAI,KAC7B,0BACa;AACnB,EACD,CAAC;;;;;;AAOD,MAAM,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,sBAAsB;;;;;AAMrE,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;;;;;AAMvD,MAAM,0BAA0B,EAAE,aAAa,EAC9C,MAAM,cAAc,SAAS,EAC9B,CAAC;AAED,MAAM,gCAAgC,EAAE,aAAa;CACpD,MAAM,EAAE,QAAQ,UAAU;CAC1B,UAAU;CACV,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC/B,CAAC;AAED,MAAM,4CAA4C,EAAE,aAAa;CAChE,MAAM,EAAE,QAAQ,wBAAwB;CACxC,UAAU;CACV,QAAQ;CACR,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS;CAC7C,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS;AAC/B,CAAC;AAED,MAAM,wBAAwB,EAAE,mBAAmB,QAAQ,CAC1D,+BACA,yCACD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAEnD,MAAM,uBAAuB,EAAE,OAAO,mBAAmB,qBAAqB;AAE9E,MAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC,aAAa,OAAO,QAAQ;CACjE,MAAM,UAAU,4BAA4B,KAAK;CACjD,IAAI,SACH,IAAI,SAAS;EAAE,MAAM;EAAU;CAAQ,CAAC;AAE1C,CAAC;AAED,MAAM,sBAAsB,EAC1B,MAAM,kBAAkB,CAAC,CACzB,aAAa,SAAS,QAAQ;CAC9B,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG;EAChD,MAAM,aAAa,sBAAsB,MAAM;EAC/C,IAAI,KAAK,IAAI,UAAU,GAAG;GACzB,IAAI,SAAS;IACZ,MAAM;IACN,MAAM,CAAC,KAAK;IACZ,SAAS,kBAAkB,WAAW;GACvC,CAAC;GACD;EACD;EACA,KAAK,IAAI,UAAU;CACpB;AACD,CAAC;;;;;;;AAQF,MAAM,4BAA4B,EAChC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,GAAG,GAAG,EACpE,OAAO,qGACR,CAAC;;;;;;;AAQF,MAAM,wBAAwB,UAA2B;CAExD,IAAI,uBAAuB,KAAK,KAAK,GAAG,OAAO;CAG/C,IADiB,MAAM,MAAM,GAClB,CAAC,CAAC,MAAM,YAAY,YAAY,MAAM,YAAY,IAAI,GAChE,OAAO;CAER,OAAO,iBAAiB,oBAAoB,KAAK,CAAC;AACnD;;;;;AAMA,MAAM,mBAAmB;AAEzB,MAAM,oBAAoB,SAA0B;CACnD,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO;CACnD,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO,iBAAiB,KAAK,IAAI;CAC5D,MAAM,CAAC,OAAO,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG;CAEtD,IAAI,KAAK,SAAS,KAAK,SAAS,KAAA,GAAW,OAAO;CAClD,OAAO,iBAAiB,KAAK,KAAK,KAAK,iBAAiB,KAAK,IAAI;AAClE;;;;;AAMA,MAAM,6BAA6B,EAAE,MAAM,CAC1C,2BACA,EAAE,aAAa;CACd,MAAM;CACN,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACpC,CAAC,CACF,CAAC;;;;;AAMD,MAAM,iCAAiC,EAAE,MAAM,0BAA0B;AAEzE,MAAM,gBAAgB,EAAE,QAAQ,UAAU;AAE1C,MAAM,gBAAgB,EAAE,QACtB,UACA,UAAU,aAAa,UAAU,UAAU,OAAO,UAAU,YAC7D,EACC,SACC,uFACF,CACD;AAEA,MAAM,oBACL,YACa,YAAY,KAAA,KAAa,YAAY;;AAGnD,MAAM,aACL,UACa,OAAO,UAAU,WAAW,QAAQ,MAAM;;AAGxD,MAAM,sBACL,UACc,OAAO,UAAU,WAAW,OAAO,MAAM,iBAAiB;;;;;;;;;;;AAYzE,MAAa,oBAAoB,EAC/B,aAAa;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,KAAK,kBAAkB,SAAS;CAChC,kBAAkB,+BAA+B,SAAS;CAC1D,SAAS,cAAc,SAAS;CAChC,KAAK,wBAAwB,SAAS;CACtC,eAAe,oBAAoB,SAAS;AAC7C,CAAC,CAAC,CACD,OAAO,QAAQ;CACf,MAAM,UAAU,IAAI,MAAM,oBAAoB,CAAC;CAG/C,IACC,IAAI,MAAM,qBAAqB,KAAA,KAC/B,CAAC,iBAAiB,IAAI,MAAM,OAAO,GAClC;EACD,IAAI,OAAO,KAAK;GACf,MAAM;GACN,OAAO,IAAI,MAAM;GACjB,MAAM,CAAC,kBAAkB;GACzB,SAAS,gEACR,OAAO,IAAI,MAAM,YAAY,aAC1B,WACA,IAAI,MAAM,QACb;EACF,CAAC;EACD;CACD;CAEA,MAAM,4BAAY,IAAI,IAAoB;CAC1C,MAAM,6BAAa,IAAI,IAGrB;CAEF,QAAQ,SAAS,OAAO,UAAU;EACjC,MAAM,OAAO,UAAU,KAAK;EAC5B,MAAM,eAAe,mBAAmB,KAAK;EAE7C,IAAI,gBAAgB,CAAC,qBAAqB,IAAI,GAAG;GAChD,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SACC,IAAI,KAAK;GAGX,CAAC;GACD;EACD;EAEA,MAAM,aAAa,UAAU,IAAI,IAAI;EACrC,IAAI,eAAe,KAAA,GAAW;GAC7B,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SAAS,IAAI,KAAK,6CAA6C,WAAW;GAC3E,CAAC;GACD;EACD;EACA,UAAU,IAAI,MAAM,KAAK;EAIzB,MAAM,OAAO,oBAAoB,IAAI;EACrC,MAAM,QAAQ,WAAW,IAAI,IAAI;EACjC,IAAI,UAAU,KAAA,KAAa,MAAM,iBAAiB,cAAc;GAC/D,IAAI,OAAO,KAAK;IACf,MAAM;IACN,OAAO;IACP,MAAM,CAAC,oBAAoB,KAAK;IAChC,SACC,IAAI,KAAK,SAAS,MAAM,GAAG,0BAA0B,KAAK;GAE5D,CAAC;GACD;EACD;EACA,WAAW,IAAI,MAAM;GAAE;GAAc,IAAI;EAAK,CAAC;CAChD,CAAC;AACF,CAAC;;AAGF,MAAa,kBAAkB,EAAE,aAAa,EAC7C,QAAQ,EACN,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,QAAQ,aAAa,CAAC,CAAC,CAAC,CACvD,SAAS,EACZ,CAAC;;;;;;AAOD,MAAa,wBAAwB,EAAE,OACtC,oBACA,iBACD;;AAGA,MAAa,qBAAqB,EAAE,aAAa;CAChD,UAAU,oBAAoB,SAAS;CACvC,WAAW,yBAAyB,SAAS;CAC7C,WAAW,sBAAsB,SAAS;CAC1C,SAAS,EAAE,OAAO,kBAAkB,eAAe,CAAC,CAAC,SAAS;AAC/D,CAAC;;AAGD,MAAa,uBAAuB,EAAE,aAAa;CAClD,SAAS,cAAc,SAAS;CAChC,eAAe,oBAAoB,SAAS;AAC7C,CAAC;;AAGD,MAAM,sBAAsB,EAAE,aAAa,EAC1C,WAAW,EAAE,OAAO,oBAAoB,oBAAoB,CAAC,CAAC,SAAS,EACxE,CAAC;;;;;AAMD,MAAa,qBAAqB,EAChC,aAAa;CACb,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;CAChC,KAAK,EACH,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAC/B,SAAS,CAAC,CACV,aAAa,OAAO,QAAQ;EAC5B,IAAI,UAAU,KAAA,GAAW;EACzB,MAAM,SAAS,eAAe,KAAK;EACnC,IAAI,WAAW,QACd,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS,OAAO;EAAM,CAAC;CAExD,CAAC;CACF,UAAU,qBAAqB,SAAS;CACxC,WAAW,EACT,OAAO,oBAAoB,oBAAoB,CAAC,CAChD,SAAS;CACX,SAAS,oBAAoB,SAAS;AACvC,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAC1B,wBAAwB;EACvB;EACA,MAAM,CAAC,QAAQ;EACf,QAAQ,IAAI;CACb,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;AACF,CAAC;;;;;AAMF,MAAM,kBAAkB,EAAE,MAAM,CAC/B,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,iDAAiD,GACnE,EACE,MACA,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,+CAA+C,CAClE,CAAC,CACA,IAAI,GAAG,2DAA2D,CACrE,CAAC;;;;;AAMD,MAAM,kBAAkB,EAAE,MAAM,CAC/B,EAAE,QACA,UAAU,OAAO,UAAU,YAC5B,EACC,SACC,yEACF,CACD,GACA,eACD,CAAC;;AAGD,MAAM,kBAAkB,EAAE,aAAa;CACtC,QAAQ,gBAAgB,SAAS;CACjC,OAAO,gBAAgB,SAAS;AACjC,CAAC;;;;;AAMD,MAAa,cAAc,EAAE,aAAa;CACzC,UAAU,gBAAgB,SAAS;CACnC,QAAQ,gBAAgB,SAAS;CACjC,QAAQ,gBAAgB,SAAS;AAClC,CAAC;;AAGD,MAAa,0BAA0B,EAAE,aAAa,EACrD,OAAO,YAAY,SAAS,EAC7B,CAAC;;;;;;AAOD,MAAa,oBAAoB,EAC/B,aAAa;CACb,MAAM,yBAAyB,SAAS;CACxC,SAAS,mBAAmB,SAAS;CACrC,WAAW,yBAAyB,SAAS;CAC7C,WAAW,sBAAsB,SAAS;CAC1C,SAAS,EAAE,OAAO,kBAAkB,eAAe,CAAC,CAAC,SAAS;CAC9D,UAAU,qBAAqB,SAAS;CACxC,SAAS,mBAAmB,SAAS;CACrC,QAAQ,EACN,QACC,UAAU,OAAO,UAAU,YAC5B,EACC,SACC,2DACF,CACD,CAAC,CACA,SAAS;CACX,cAAc,wBAAwB,SAAS;AAChD,CAAC,CAAC,CACD,aAAa,KAAK,QAAQ;CAC1B,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,cAAc,KAAA;EAC7B,gBAAgB,IAAI,SAAS,cAAc,KAAA;EAC3C,QAAQ;EACR,aAAa;CACd,CAAC;CACD,oBAAoB,KAAK;EACxB,WAAW,IAAI,YAAY,KAAA;EAC3B,gBAAgB,IAAI,SAAS,YAAY,KAAA;EACzC,QAAQ;EACR,aAAa;CACd,CAAC;CACD,yBAAyB,KAAK,GAAG;CAIjC,IAAI,CAAC,qBAAqB,IAAI,OAAO,GAAG;CACxC,IAAI,yBAAyB,IAAI,OAAO,MAAM,QAAQ;CACtD,IAAI,CAAC,qBAAqB,IAAI,IAAI,GACjC,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,CAAC,MAAM;EACb,SACC;CACF,CAAC;AAEH,CAAC;AAEF,SAAS,yBACR,KASA,KACO;CACP,IAAI,IAAI,aAAa,KAAA,GAAW;CAChC,MAAM,YAAY,IAAI,IACrB,OAAO,KAAK,IAAI,aAAa,IAAI,SAAS,aAAa,CAAC,CAAC,CAC1D;CACA,MAAM,UAAU,IAAI,IACnB,OAAO,KAAK,IAAI,WAAW,IAAI,SAAS,WAAW,CAAC,CAAC,CACtD;CACA,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,IAAI,QAAQ,GAAG;EAC3D,IAAI,CAAC,UAAU,IAAI,QAAQ,QAAQ,GAClC,IAAI,SAAS;GACZ,MAAM;GACN,MAAM;IAAC;IAAY;IAAM;GAAU;GACnC,SAAS,YAAY,KAAK,yBAAyB,QAAQ,SAAS;EACrE,CAAC;EAEF,IACC,QAAQ,SAAS,4BACjB,CAAC,QAAQ,IAAI,QAAQ,MAAM,GAE3B,IAAI,SAAS;GACZ,MAAM;GACN,MAAM;IAAC;IAAY;IAAM;GAAQ;GACjC,SAAS,YAAY,KAAK,uBAAuB,QAAQ,OAAO;EACjE,CAAC;CAEH;AACD;AAEA,SAAS,oBACR,KACA,MAMO;CACP,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,gBAAgB;CAC7C,IAAI,SAAS;EACZ,MAAM;EACN,MAAM,KAAK,OAAO,MAAM,GAAG;EAC3B,SAAS,GAAG,KAAK,OAAO,uBAAuB,KAAK,YAAY,SAAS,KAAK,OAAO,cAAc,KAAK,YAAY;CACrH,CAAC;AACF;;;;;;AAOA,SAAS,qBAAqB,OAAyB;CACtD,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,OAAO,UAAU,WAAW,OAAO;CACvC,IAAI,OAAO,UAAU,UACpB,OAAQ,MAAgC,YAAY;CAErD,OAAO;AACR;;AAGA,SAAS,yBAAyB,OAAqC;CACtE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACpB;MAAA,MAAqC,iBACtC,YAAY,OAAO;CAAA;CAErC,OAAO;AACR;AAEA,SAAS,wBAAwB,MAIxB;CACR,MAAM,EAAE,KAAK,MAAM,WAAW;CAC9B,IAAI,WAAW,KAAA,GAAW;CAE1B,MAAM,eAAe,gBAAgB,MAAM;CAC3C,IAAI,WAAW,cACd,IAAI,SAAS;EAAE,MAAM;EAAU;EAAM,SAAS,aAAa;CAAM,CAAC;MAC5D,IAAI,kBAAkB,MAAM,GAClC,IAAI,SAAS;EACZ,MAAM;EACN;EACA,SAAS,8DAA8D,OAAO;CAC/E,CAAC;AAEH;;;;;;;;;;;;;AAcA,SAAgB,gBACf,OACA,kCAA+C,IAAI,IAAI,GAC5C;CACX,OAAO,MAAM,OAAO,KAAK,UAAU;EAClC,MAAM,OAAO,WAAW,MAAM,IAAI;EAClC,IAAI,UAAU,sBAAsB,KAAK;EACzC,IAAI,MAAM,SAAS,qBAClB,KAAK,MAAM,OAAO,MAAM,MAAM;GAC7B,MAAM,OAAO,gBAAgB,IAAI,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG;GAC9D,IAAI,MAAM,WAAW,KAAK;EAC3B;EAED,OAAO,OAAO,GAAG,KAAK,IAAI,YAAY;CACvC,CAAC;AACF;;AAGA,MAAa,6CAA0D,IAAI,IAAI,CAC9E,CACC,YACA,2FACD,CACD,CAAC;AAED,SAAS,WAAW,MAA0C;CAC7D,IAAI,MAAM;CACV,KAAK,MAAM,WAAW,MACrB,IAAI,OAAO,YAAY,UAAU,OAAO,IAAI,QAAQ;MAC/C,IAAI,QAAQ,IAAI,OAAO,OAAO,OAAO;MACrC,OAAO,IAAI,OAAO,OAAO;CAE/B,OAAO;AACR;AAEA,SAAS,sBAAsB,OAAiC;CAC/D,IAAI,MAAM,SAAS,qBAAqB;EACvC,MAAM,OAAO,MAAM,QAAQ,CAAC;EAC5B,MAAM,YAAY,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;EAC9D,OAAO,cAAc,KAAK,WAAW,IAAI,KAAK,IAAI,IAAI;CACvD;CACA,IAAI,MAAM,SAAS,eAAe;EAMjC,MAAM,UAAU,MAAM,OACpB,KAAK,WAAW,OAAO,OAAO,CAAC,CAC/B,QAAQ,YAAY,QAAQ,SAAS,CAAC;EACxC,IAAI,QAAQ,SAAS,GAAG,OAAO,QAAQ,KAAK,IAAI;CACjD;CACA,OAAO,MAAM;AACd"}

package/dist/lib/types.d.ts

@@ -433,7 +433,7 @@ interface FunctionDef {
    */
   dev?: FunctionDevConfig;
   /**
-   * Customer-owned hostnames that should point at this function (beta).
+   * Customer-owned hostnames that should point at this function.
    * v1 only supports functions. Hostnames are unique across functions in the resolved
    * policy. Applied after the function is deployed, on the project's default branch.
    * Other branches apply a list only when {@link FunctionTuning.customDomains} sets one.

package/dist/lib/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../src/lib/types.ts"],"sourcesContent":["/**\n * Every compute size in the Console size table\n * (https://neon.com/docs/manage/endpoints#compute-size-and-autoscaling-configuration).\n * Plan availability is enforced by the API, not this list.\n */\nexport const COMPUTE_UNITS = [\n\t0.25, 0.5, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20,\n\t22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56,\n] as const;\n\nexport type ComputeUnit = (typeof COMPUTE_UNITS)[number];\n\n/** Time units accepted in a {@link DurationString}: seconds, minutes, hours, days, weeks. */\nexport type DurationUnit = \"s\" | \"m\" | \"h\" | \"d\" | \"w\";\n\n/**\n * A Neon duration string: a positive integer **followed by a unit** — `s` (seconds),\n * `m` (minutes), `h` (hours), `d` (days), or `w` (weeks). Used by\n * {@link ComputeSettings.suspendTimeout} and {@link BranchTuning.ttl}.\n *\n * A **unit is required**: a bare numeric string like `\"7\"` is rejected at the type level. To\n * express a raw number of seconds, pass a `number` (`300`) — not a string (`\"300\"`). This\n * removes the old ambiguity where `\"7\"` silently meant 7 *seconds* instead of, say, `\"7d\"`.\n *\n * @example \"5m\"  // 5 minutes\n * @example \"1h\"  // 1 hour\n * @example \"7d\"  // 7 days\n */\nexport type DurationString = `${number}${DurationUnit}`;\n\n/**\n * Autocomplete suggestions for {@link ComputeSettings.suspendTimeout}. Every value sits inside\n * the Neon API's allowed scale-to-zero band: **60s–604800s** (1 minute – 1 week). This is *not*\n * a closed set — the field also accepts any other {@link DurationString} or a `number` of\n * seconds; out-of-range values type-check but are rejected at apply time.\n */\ntype SuspendTimeoutSuggestion =\n\t| \"1m\"\n\t| \"5m\"\n\t| \"15m\"\n\t| \"30m\"\n\t| \"1h\"\n\t| \"6h\"\n\t| \"12h\"\n\t| \"1d\"\n\t| \"7d\";\n\n/**\n * Autocomplete suggestions for {@link BranchTuning.ttl}. Every value sits within the Neon API's\n * branch-expiration limit (**max 30 days** from creation; the Console's own presets are 1h / 1d\n * / 7d). This is *not* a closed set — the field also accepts any other {@link DurationString} or\n * a `number` of seconds; values over 30 days are rejected at apply time.\n */\ntype TtlSuggestion = \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"3d\" | \"7d\" | \"14d\" | \"30d\";\n\n/**\n * Compose a field's duration type: its curated autocomplete `Suggestions` plus the open\n * `DurationString` template (so any `<integer><unit>` string still type-checks) and a `number`\n * of seconds. Intersecting the template arm with `NonNullable<unknown>` stops TypeScript from\n * collapsing the literal suggestions into the template, which is what preserves the autocomplete.\n */\ntype DurationField<Suggestions extends DurationString> =\n\t| Suggestions\n\t| (DurationString & NonNullable<unknown>)\n\t| number;\n\n/**\n * Compute settings applied to the read/write endpoint of a branch.\n *\n * Mirrors the subset of {@link https://api-docs.neon.tech/reference/getting-started-with-neon-api Neon endpoint}\n * fields that we expose as IaC primitives. Anything left undefined falls back to the project's\n * `default_endpoint_settings` (which themselves fall back to Neon defaults).\n */\nexport interface ComputeSettings {\n\t/**\n\t * Minimum number of Compute Units. Set to 0.25 for true scale-to-zero.\n\t *\n\t * Sizes above 16 CU are fixed-size only: if this is set with a different\n\t * {@link ComputeSettings.autoscalingLimitMaxCu}, both bounds must be ≤ 16 and\n\t * `max - min` cannot exceed 8 CU. A single bound is checked against the catalog\n\t * only — the other bound comes from the project's default endpoint settings, so\n\t * the API is the arbiter of the resolved pair.\n\t *\n\t * @example 0.25  // scale-to-zero\n\t * @example 1     // always-on with 1 CU minimum\n\t * @example 4\n\t */\n\tautoscalingLimitMinCu?: ComputeUnit;\n\t/**\n\t * Maximum number of Compute Units for autoscaling, or the fixed size when equal\n\t * to {@link ComputeSettings.autoscalingLimitMinCu}.\n\t *\n\t * @example 2\n\t * @example 12\n\t * @example 56  // fixed-size; pair with the same min\n\t */\n\tautoscalingLimitMaxCu?: ComputeUnit;\n\t/**\n\t * How long an idle compute waits before suspending (Neon's scale-to-zero). Accepts a\n\t * {@link DurationString} (autocompletes common values), a number of seconds, or `false`.\n\t *\n\t * - `false` — never suspend (always-on compute)\n\t * - {@link DurationString} — e.g. `\"5m\"`; autocompletes the in-range values `\"1m\"`, `\"5m\"`,\n\t *   `\"15m\"`, `\"30m\"`, `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`, `\"7d\"`, and accepts any other\n\t *   `<integer><unit>` (units: `s`, `m`, `h`, `d`, `w`). A **unit is required** — for raw\n\t *   seconds pass a `number`, not a string.\n\t * - `number` — custom timeout in **seconds**, must be in `60`–`604800` (1 minute to 1 week)\n\t * - `undefined` — use the Neon default (currently 300s / 5 minutes)\n\t *\n\t * Whichever form you use, the resolved timeout must fall in `60`–`604800` seconds (the Neon\n\t * API limit); the suggestions are all within that band, anything else is checked at apply.\n\t *\n\t * @example false  // never suspend (always-on)\n\t * @example \"5m\"   // suspend after 5 minutes idle\n\t * @example \"1h\"   // suspend after 1 hour idle\n\t * @example 300    // 5 minutes, expressed in seconds\n\t */\n\tsuspendTimeout?: false | DurationField<SuspendTimeoutSuggestion>;\n}\n\n/**\n * Read-only descriptor of the branch a {@link Config} policy is being evaluated for — the\n * `branch` argument passed to your `defineConfig({ branch: (branch) => … })` closure. It describes\n * **which** branch this invocation decides for; it is not a live branch handle and must not\n * be mutated. Switch on its fields and return the desired {@link BranchConfig}.\n */\nexport interface BranchTarget {\n\t/** Branch name being evaluated. For `branch dev`, this is the generated branch name. */\n\tname: string;\n\t/** Neon branch id when the branch already exists. Undefined during pre-create eval. */\n\tid?: string;\n\t/** Whether this branch already exists on Neon. */\n\texists: boolean;\n\t/** Parent branch id from Neon when known. */\n\tparentId?: string;\n\t/** Whether Neon marks this branch as the project default. */\n\tisDefault?: boolean;\n\t/** Whether Neon currently marks this branch protected. */\n\tisProtected?: boolean;\n\t/** Current expiration timestamp from Neon, when set. */\n\texpiresAt?: string;\n}\n\n/**\n * Object form of a branch-scoped service toggle. `{}` or `{ enabled: true }` enables it;\n * `{ enabled: false }` opts out. Used as the object half of {@link ServiceToggleInput}.\n */\nexport interface ServiceToggle {\n\t/** Defaults to `true` when the service namespace is present. Set `false` to opt out. */\n\tenabled?: boolean;\n}\n\n/**\n * How a branch-scoped service (Neon Auth, Data API, AI Gateway) is toggled in a policy.\n *\n * - `true` / `{}` / `{ enabled: true }` — enabled.\n * - `false` / `{ enabled: false }` — disabled.\n * - omitted (`undefined`) — not part of the policy at all.\n *\n * These toggles are **static** (they live in the top-level `defineConfig({ … })` object,\n * not in the per-branch `branch` closure) so the secret set they imply can be derived at\n * the type level — that's what makes `NeonEnv<typeof config>` exact.\n */\nexport type ServiceToggleInput = boolean | ServiceToggle;\n\n/**\n * Realtime settings for a branch. The object's presence enables Realtime; omit\n * `allowedOrigins` to leave the inherited/current allowlist unchanged.\n */\nexport interface RealtimeConfig {\n\t/** Browser origins allowed to connect. `[]` or `[\"*\"]` allows every origin. */\n\tallowedOrigins?: readonly string[];\n}\n\n/**\n * How Realtime is managed by a policy.\n *\n * - `true` — enable Realtime without changing allowed origins.\n * - `{ allowedOrigins?: [...] }` — enable Realtime and optionally configure origins.\n * - `false` — disable Realtime.\n * - omitted (`undefined`) — leave Realtime unmanaged.\n */\nexport type RealtimeInput = boolean | RealtimeConfig;\n\n/**\n * Resolve a **static** service toggle (`true` / `false` / `{ enabled?: boolean }` / object /\n * `undefined`) to a type-level boolean. The tuple wrapping (`[T] extends […]`) disables\n * distribution so a union/`undefined` is judged as a single unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | … | undefined` (no literal info) → `false`\n *\n * Shared by the {@link Config} static cross-field checks and the `@neon/env`\n * `NeonEnv` namespace derivation, so both read \"is this service on?\" identically.\n */\nexport type ServiceEnabled<T> = [T] extends [false]\n\t? false\n\t: [T] extends [{ enabled: false }]\n\t\t? false\n\t\t: [T] extends [undefined]\n\t\t\t? false\n\t\t\t: [T] extends [true]\n\t\t\t\t? true\n\t\t\t\t: [T] extends [{ enabled: true }]\n\t\t\t\t\t? true\n\t\t\t\t\t: [T] extends [object]\n\t\t\t\t\t\t? true\n\t\t\t\t\t\t: false;\n\nexport interface PostgresConfig {\n\tcomputeSettings?: ComputeSettings;\n}\n\n/**\n * Authentication providers a Data API integration can verify JWTs against, as written in\n * `neon.ts`. Friendly authoring values (mapped to the Neon API's `neon_auth` / `external`\n * at the API boundary):\n *\n * - `\"neon\"` — verify tokens minted by **Neon Auth** on the same branch. Neon supplies the\n *   JWKS URL / provider wiring for you, so the `jwksUrl` / `providerName` / `jwtAudience`\n *   fields are forbidden (a type error) on this variant — and the policy must also enable\n *   top-level `auth` (Neon Auth) so the tokens exist.\n * - `\"external\"` — verify tokens from a third-party IdP (Clerk, Stytch, Auth0, …). You\n *   provide `jwksUrl` (and optionally `providerName` / `jwtAudience`).\n */\nexport const DATA_API_AUTH_PROVIDERS = [\"neon\", \"external\"] as const;\nexport type DataApiAuthProvider = (typeof DATA_API_AUTH_PROVIDERS)[number];\n\n/**\n * Reusable runtime settings for a Data API integration (the Neon API `DataAPISettings`,\n * camelCased to match the rest of `neon.ts`). Every field is optional; omitted fields keep\n * the Neon defaults shown below. These are the **only** Data API fields that can change on\n * an already-enabled integration — drift here is reconciled as an *update* (requires\n * `updateExisting` / `--update-existing`); the create-only auth wiring above cannot.\n */\nexport interface DataApiSettings {\n\t/** Enable the aggregates feature (`db_aggregates_enabled`). Default `true`. */\n\tdbAggregatesEnabled?: boolean;\n\t/** Database role used for anonymous requests (`db_anon_role`). Default `\"anonymous\"`. */\n\tdbAnonRole?: string;\n\t/** Extra schemas appended to the search path (`db_extra_search_path`). */\n\tdbExtraSearchPath?: string;\n\t/** Maximum rows returned in a single request (`db_max_rows`). */\n\tdbMaxRows?: number;\n\t/** Schemas exposed via the API (`db_schemas`). Default `[\"public\"]`. */\n\tdbSchemas?: string[];\n\t/** JWT claim key used for role extraction (`jwt_role_claim_key`). Default `\".role\"`. */\n\tjwtRoleClaimKey?: string;\n\t/** Maximum lifetime of the JWT cache, in seconds (`jwt_cache_max_lifetime`). */\n\tjwtCacheMaxLifetime?: number;\n\t/** OpenAPI spec mode (`openapi_mode`). Default `\"disabled\"`. */\n\topenapiMode?: \"ignore-privileges\" | \"disabled\";\n\t/** CORS allowed origins (`server_cors_allowed_origins`). */\n\tserverCorsAllowedOrigins?: string;\n\t/** Emit server-timing headers (`server_timing_enabled`). */\n\tserverTimingEnabled?: boolean;\n}\n\n/** Fields shared by every {@link DataApiConfig} variant. */\ninterface DataApiConfigBase {\n\t/** Defaults to `true` when the `dataApi` namespace is present. `false` disables and apply deletes. */\n\tenabled?: boolean;\n\t/** Reusable runtime settings. Drift here is reconciled as an update. */\n\tsettings?: DataApiSettings;\n}\n\n/**\n * Data API verified by **Neon Auth** (`authProvider: \"neon\"`, the default). The external\n * IdP fields are statically forbidden (`?: never`) because Neon supplies them; declaring any\n * of them is a type error directing you to `authProvider: \"external\"`.\n */\nexport interface DataApiNeonAuthConfig extends DataApiConfigBase {\n\tauthProvider?: \"neon\";\n\t/** Forbidden with `authProvider: \"neon\"` — Neon provides the JWKS URL. */\n\tjwksUrl?: never;\n\t/** Forbidden with `authProvider: \"neon\"` — the provider is Neon Auth. */\n\tproviderName?: never;\n\t/** Forbidden with `authProvider: \"neon\"` — Neon manages the audience. */\n\tjwtAudience?: never;\n}\n\n/**\n * Data API verified by an **external** IdP (`authProvider: \"external\"`). You provide the\n * JWKS URL (and optionally a provider label / expected audience).\n */\nexport interface DataApiExternalAuthConfig extends DataApiConfigBase {\n\tauthProvider: \"external\";\n\t/** URL that publishes the IdP's JWKS (JSON Web Key Set). */\n\tjwksUrl?: string;\n\t/** Human label for the IdP (e.g. \"Clerk\", \"Stytch\", \"Auth0\"). */\n\tproviderName?: string;\n\t/**\n\t * Expected `aud` claim. ⚠️ This only **rejects** tokens carrying a *different* audience;\n\t * tokens with no `aud` claim are still accepted.\n\t */\n\tjwtAudience?: string;\n}\n\n/**\n * Object form of the `dataApi` toggle. A discriminated union on {@link DataApiAuthProvider}:\n * the `\"neon\"` variant forbids the external-IdP fields, the `\"external\"` variant allows them.\n */\nexport type DataApiConfig = DataApiNeonAuthConfig | DataApiExternalAuthConfig;\n\n/**\n * How the Data API is toggled in a policy: a bare boolean (like the other service toggles)\n * or the richer {@link DataApiConfig} object. `true` / `{}` / `{ enabled: true }` enable it\n * with Neon defaults. `false` / `{ enabled: false }` disable it; apply deletes an existing\n * Data API. Omit the field to leave an existing integration alone.\n */\nexport type DataApiInput = boolean | DataApiConfig;\n\n/**\n * Supported function runtimes. Mirrors the Neon Functions deploy API `runtime` enum.\n * Only `nodejs24` exists today; kept as a union so adding runtimes later is a\n * non-breaking, type-checked change.\n */\nexport type FunctionRuntime = \"nodejs24\";\n\n/**\n * Local-development settings for a function, used by `neon dev` when it serves every\n * function declared in `neon.ts` (i.e. invoked with no `--source`). Never affects deploy.\n */\nexport interface FunctionDevConfig {\n\t/**\n\t * Port the local server binds. Bound exactly (and `neon dev` fails loudly if it is taken)\n\t * when set; a free port is found automatically when omitted.\n\t */\n\tport?: number;\n}\n\n/**\n * The object form of an {@link FunctionDef.externalPackages} entry, for the one case the\n * bare string cannot express: externalizing a package without shipping its files.\n */\nexport interface ExternalPackageDef {\n\t/** Package name, optionally with a subpath: `sharp`, `@scope/pkg`, `pkg/sub`. */\n\tname: string;\n\t/**\n\t * Whether the package's real files ship into the deployed archive next to the bundle.\n\t *\n\t * Defaults to `true`, which is the state where the import resolves and the function\n\t * works. Set it to `false` only for a package the function never reaches: nothing is\n\t * shipped for it, so reaching it throws `Cannot find module` at invoke.\n\t */\n\tincludeFiles?: boolean;\n}\n\n/**\n * One entry of {@link FunctionDef.externalPackages}. A bare string is the common form and\n * ships the package's files; {@link ExternalPackageDef} exists to turn that off.\n */\nexport type ExternalPackageEntry = string | ExternalPackageDef;\n\n/**\n * An {@link ExternalPackageEntry} with its default applied, as every consumer downstream of\n * `resolveConfig` reads it.\n */\nexport interface ResolvedExternalPackage {\n\t/** Package name as declared, subpath included. */\n\tname: string;\n\t/** Whether this package's files are staged into the archive. */\n\tincludeFiles: boolean;\n}\n\n/** Archive-relative paths. The runtime imports `index.mjs` or `index.js` at the root. */\nexport type FunctionBundle = Record<string, Uint8Array>;\n\n/** Defined here so policy imports stay free of build-time dependencies. */\nexport type FunctionBundler = (\n\tfn: ResolvedFunctionConfig,\n) => Promise<FunctionBundle>;\n\n/**\n * `\"esbuild\"` (default) bundles a file, or a directory from the first of\n * `index.ts`, `index.js`, `index.mjs`. `\"none\"` ships a prebuilt directory or a\n * single `index.mjs` / `index.js`. An inline {@link FunctionBundler} returns the\n * file map.\n */\nexport type FunctionBundlerInput = \"esbuild\" | \"none\" | FunctionBundler;\n\n/**\n * Static definition of a Neon Function. Declares that the function\n * **exists** on every branch; its branch-unique slug is the **record key** in\n * `functions` (or deprecated {@link PreviewInput.functions}), so slugs are statically enumerable,\n * cannot duplicate, and the `branch` closure can only tune slugs that are declared here.\n * Runtime tuning is **not** here — it varies per branch and lives in the `branch` closure\n * (see {@link FunctionTuning}). Memory is fixed by the platform policy for now and is not\n * user-configurable.\n */\nexport interface FunctionDef {\n\t/** Free-form display name. @example \"Hello World\" */\n\tname: string;\n\t/**\n\t * Path to the entry module or source directory, relative to `neon.ts` (or\n\t * absolute). A file is the entry; a directory is searched for `index.ts`,\n\t * then `index.js`, then `index.mjs`. A JS function value has no source path\n\t * for a bundler to resolve.\n\t * @example \"./functions/hello-world.ts\"\n\t * @example \".mastra/output\"\n\t */\n\tsource: string;\n\t/**\n\t * Environment variables injected into the deployed function, keyed by the var name the\n\t * function reads at runtime. The **keys** are static (preserved at the type level so\n\t * `parseEnv(config, \"<slug>\").function.<key>` is typed). An unset `process.env.X`\n\t * fails validation. Omit a key to preserve its deployed value; an empty string deletes it.\n\t * @example { resendApiKey: process.env.RESEND_API_KEY! }\n\t */\n\tenv?: Record<string, string>;\n\t/**\n\t * Ship a dependency's real files into the deployed archive instead of bundling it —\n\t * `sharp` and other packages backed by a native binary.\n\t *\n\t * The deploy-time equivalent of Next.js's `serverExternalPackages`. Every entry is passed\n\t * to esbuild's `external`, so the import survives into the bundle instead of being\n\t * followed, and the package's own files are shipped beside the bundle so that import\n\t * resolves.\n\t *\n\t * Reach for this when bundling a package is impossible rather than merely undesirable.\n\t * The case that comes up is a package backed by a native `.node` binary: the binary is a\n\t * compiled object the platform loads from a real path, so no bundler can inline it.\n\t * `sharp` is the common one, and it does not even fail at build time — it loads its\n\t * binary through `createRequire`, which esbuild does not follow, so it bundles cleanly\n\t * and then fails at invoke with \"Could not load the sharp module\".\n\t *\n\t * ```ts\n\t * externalPackages: [\"sharp\"]\n\t * ```\n\t *\n\t * Each declared package is installed for the Functions runtime target — **linux-arm64,\n\t * glibc** — into a throwaway directory, traced for the files it actually reaches, and\n\t * copied into the archive under `node_modules/` with its directory layout preserved. That\n\t * layout is load-bearing rather than cosmetic: a `.node` addon locates its sibling shared\n\t * libraries relative to its own directory, so a flattened tree fails to load.\n\t *\n\t * Your own `node_modules` is never read for these files or modified. Its binaries are\n\t * built for your machine rather than the deploy target, and a cross-platform install does\n\t * not survive your next plain `npm install`, so the target's packages are resolved fresh\n\t * on each deploy.\n\t *\n\t * Requirements, all reported at deploy time rather than at invoke: the package must\n\t * publish a linux-arm64 glibc build (`sharp` and most `@napi-rs/*` packages do; anything\n\t * compiled from source at install time does not), `npm` must be on `PATH`, and the\n\t * archive must stay inside the deploy size limits — native binaries are large.\n\t *\n\t * ### Excluding a package's files\n\t *\n\t * `includeFiles: false` externalizes the import without shipping anything, which is the\n\t * escape hatch for a package that cannot be staged — no build for the target, or too\n\t * large — and that the function never actually reaches:\n\t *\n\t * ```ts\n\t * externalPackages: [\"sharp\", { name: \"canvas\", includeFiles: false }]\n\t * ```\n\t *\n\t * **An excluded package is not resolvable at runtime.** Nothing is shipped for it, so it\n\t * throws `Cannot find module` if the function reaches it. It unblocks an import that is\n\t * never evaluated; it does not make a dependency usable.\n\t *\n\t * Entries are package names, optionally with a subpath (`pkg`, `@scope/pkg`, `pkg/sub`),\n\t * matching esbuild. A relative or absolute path is rejected at validation time: those are\n\t * local modules, and a local module that cannot be bundled is a different problem. Files\n\t * are staged per package, so a subpath narrows what esbuild leaves unresolved without\n\t * narrowing what ships.\n\t *\n\t * Under `neon dev` the list only keeps the package out of the bundle — nothing is\n\t * installed or copied, and it resolves from your own `node_modules` against your host\n\t * architecture, which is what you want locally.\n\t * @example [\"sharp\", { name: \"canvas\", includeFiles: false }]\n\t */\n\texternalPackages?: ExternalPackageEntry[];\n\t/**\n\t * How {@link source} becomes deployable files. Defaults to `\"esbuild\"`.\n\t * `\"none\"` ships a prebuilt directory or `index.mjs` / `index.js` file.\n\t * An inline {@link FunctionBundler} returns the file map used by deploy and\n\t * `neon dev`. Inline functions do not round-trip through inspect or pull and\n\t * must be re-declared.\n\t * @example \"none\"\n\t * @example (fn) => myFrameworkBuild(fn.source)\n\t */\n\tbundler?: FunctionBundlerInput;\n\t/**\n\t * Local-development settings used by `neon dev` when serving every function from\n\t * `neon.ts`. Ignored at deploy time. See {@link FunctionDevConfig}.\n\t */\n\tdev?: FunctionDevConfig;\n\t/**\n\t * Customer-owned hostnames that should point at this function (beta).\n\t * v1 only supports functions. Hostnames are unique across functions in the resolved\n\t * policy. Applied after the function is deployed, on the project's default branch.\n\t * Other branches apply a list only when {@link FunctionTuning.customDomains} sets one.\n\t * Domains that exist remotely but are omitted here are left alone — delete with\n\t * `neon function domains delete`.\n\t *\n\t * @example [\"docs.example.com\"]\n\t */\n\tcustomDomains?: string[];\n}\n\n/**\n * A trigger that invokes a function. The trigger name is the record key in\n * {@link Config.triggers}. `functionPath` defaults to `/`. `enabled` defaults to `true`.\n *\n * @example { type: \"schedule\", function: \"cron\", cron: \"0 * * * *\" }\n * @example { type: \"storage_object_created\", function: \"ingest\", bucket: \"assets\", prefix: \"logos/\" }\n */\nexport type FunctionTriggerDef =\n\t| FunctionScheduleTriggerDef\n\t| FunctionStorageObjectCreatedTriggerDef;\n\n/**\n * A cron schedule that invokes a function. `function` is a slug from {@link Config.functions}\n * (or deprecated `preview.functions`). `cron` is a numeric five-field expression in UTC.\n *\n * @example { type: \"schedule\", function: \"cron\", cron: \"0 * * * *\" }\n */\nexport interface FunctionScheduleTriggerDef {\n\ttype: \"schedule\";\n\tfunction: string;\n\tcron: string;\n\tfunctionPath?: string;\n\tenabled?: boolean;\n}\n\n/**\n * Invokes a function when an object is created in a bucket from {@link Config.buckets}\n * (or deprecated `preview.buckets`). `prefix` is an exact object-key prefix; omit it to\n * match every key in the bucket.\n *\n * @example { type: \"storage_object_created\", function: \"ingest\", bucket: \"assets\", prefix: \"logos/\" }\n */\nexport interface FunctionStorageObjectCreatedTriggerDef {\n\ttype: \"storage_object_created\";\n\tfunction: string;\n\tbucket: string;\n\tprefix?: string;\n\tfunctionPath?: string;\n\tenabled?: boolean;\n}\n\n/**\n * A single capability a branch-scoped service credential may exercise (Preview). A\n * credential is granted a set of these and may only perform the listed actions. Mirrors\n * the Neon API `CredentialScope` enum (`x-stability-level: beta`):\n *\n * - `storage:read` / `storage:write` — object-storage (bucket) access via the S3 key.\n * - `ai_gateway:invoke` — call the AI Gateway with the bearer `api_token`.\n * - `functions:invoke` — invoke Neon Functions with the bearer `api_token`.\n *\n * The set a policy needs is derived from its enabled Preview features (see\n * {@link deriveCredentialScopes}); it is never authored by hand.\n */\nexport type CredentialScope =\n\t| \"storage:read\"\n\t| \"storage:write\"\n\t| \"ai_gateway:invoke\"\n\t| \"functions:invoke\";\n\n/**\n * Who a credential acts as. `user` is the developer/app principal minted for local dev and\n * app bootstrap (`fetchEnv` / `env pull`); `function` is a deployed-function principal\n * (carries a `function_id`). The env tooling only mints `user` credentials today.\n */\nexport type CredentialPrincipalType = \"user\" | \"function\";\n\n/** Anonymous-access level for a branchable object-storage bucket. */\nexport type BucketAccessLevel = \"private\" | \"public_read\";\n\n/**\n * Static definition of a branchable object-storage bucket. The bucket's\n * name is the **record key** in `buckets` (or deprecated {@link PreviewInput.buckets}), so names are statically\n * enumerable and cannot duplicate.\n */\nexport interface BucketDef {\n\t/**\n\t * Anonymous access level. `private` (default) requires authenticated reads/writes;\n\t * `public_read` allows anonymous GetObject/HeadObject.\n\t */\n\taccess?: BucketAccessLevel;\n}\n\n/** Preview features, plus deprecated homes for services that have graduated to GA. */\nexport interface PreviewInput {\n\t/** Enable, configure, or disable Realtime on every branch this policy is applied to. */\n\trealtime?: RealtimeInput;\n\t/**\n\t * Enable/disable the AI Gateway on the branch (toggle, like auth / dataApi).\n\t * @deprecated Use top-level `aiGateway`.\n\t */\n\taiGateway?: ServiceToggleInput;\n\t/**\n\t * Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`).\n\t * @deprecated Use top-level `functions`.\n\t */\n\tfunctions?: Record<string, FunctionDef>;\n\t/**\n\t * Object-storage buckets to create, keyed by bucket name.\n\t * @deprecated Use top-level `buckets`.\n\t */\n\tbuckets?: Record<string, BucketDef>;\n}\n\n/**\n * Per-branch deploy tuning for a single function. Returned (per slug) by the `branch`\n * closure. Deliberately **cannot** change the function's existence, source, name, env\n * **keys**, or memory — so the static secret/function set stays sound. Runtime selection\n * and the custom-domain list may vary per branch.\n */\nexport interface FunctionTuning {\n\t/** Runtime to execute the function with. Defaults to `\"nodejs24\"`. */\n\truntime?: FunctionRuntime;\n\t/**\n\t * When present, replaces {@link FunctionDef.customDomains} for this branch.\n\t * `[]` registers nothing on this branch. Omit the key: the default branch\n\t * inherits the static list; other branches do not.\n\t */\n\tcustomDomains?: string[];\n}\n\n/**\n * Per-branch tuning of functions under the deprecated `preview` key.\n * Only existing function slugs may be tuned — `Slug` is constrained to the\n * declared keys by {@link BranchTuningFn}.\n *\n * @deprecated Use top-level `branch: (branch) => ({ functions: { … } })`.\n */\nexport interface PreviewTuning<Slug extends string = string> {\n\t/**\n\t * @deprecated Use top-level `functions` on the object returned by `branch`.\n\t */\n\tfunctions?: Partial<Record<Slug, FunctionTuning>>;\n}\n\n/**\n * The per-branch tuning object returned by the `branch` closure. It can adjust branch\n * lifecycle (`parent`, `ttl`, `protected`), Postgres compute settings, and per-function\n * deploy tuning — but **cannot** add/remove services or functions. That guarantee is what\n * keeps the static secret set (and therefore `NeonEnv`) exact.\n */\nexport interface BranchTuning<Slug extends string = string> {\n\t/** Parent branch name used when creating a new branch. Not a Postgres setting. */\n\tparent?: string;\n\t/**\n\t * Branch time-to-live: how long after creation the branch should auto-expire. Applied\n\t * when creating a new branch and reconciled on existing branches (when `updateExisting`\n\t * is set). Accepts a {@link DurationString} (autocompletes common values) or a number of\n\t * seconds. Omit to keep the branch indefinitely.\n\t *\n\t * - {@link DurationString} — e.g. `\"7d\"`; autocompletes `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`,\n\t *   `\"3d\"`, `\"7d\"`, `\"14d\"`, `\"30d\"`, and accepts any other `<integer><unit>` (units: `s`,\n\t *   `m`, `h`, `d`, `w` — e.g. `\"12h\"`, `\"2w\"`). A **unit is required** — `\"7\"` is rejected;\n\t *   for raw seconds pass a `number`.\n\t * - `number` — custom TTL in **seconds** (e.g. `3600`)\n\t * - `undefined` — no expiry; the branch persists until explicitly deleted\n\t *\n\t * The Neon API caps branch expiration at **30 days** from creation, so the resolved TTL must\n\t * be `> 0` and `<= 30d`; the suggestions stay within that limit and anything longer is\n\t * rejected at apply.\n\t *\n\t * @example \"1d\"   // ephemeral preview branch: expires a day after creation\n\t * @example \"7d\"   // one-week TTL\n\t * @example \"30d\"  // the maximum the API allows\n\t * @example 3600   // 1 hour, expressed in seconds\n\t */\n\tttl?: DurationField<TtlSuggestion>;\n\t/** Whether the selected branch should be protected. Undefined means \"leave as-is\". */\n\tprotected?: boolean;\n\tpostgres?: PostgresConfig;\n\t/** Per-function deploy tuning, keyed by declared slug. */\n\tfunctions?: Partial<Record<Slug, FunctionTuning>>;\n\t/**\n\t * @deprecated Use top-level `functions` on this object.\n\t */\n\tpreview?: PreviewTuning<Slug>;\n}\n\n/** Extract declared function slugs from top-level `functions` and/or `preview.functions`. */\ntype PreviewFunctionSlugs<Preview> = Preview extends { functions: infer F }\n\t? Extract<keyof F, string>\n\t: never;\n\n// Config's Functions default is `Record<string, FunctionDef> | undefined`. A string\n// index would otherwise union into FunctionSlugsOf as `string` and drop slug checking\n// on positional `Config<Auth, DataApi, Preview>`.\ntype GaFunctionSlugs<Functions> = [Functions] extends [undefined]\n\t? never\n\t: string extends keyof NonNullable<Functions>\n\t\t? never\n\t\t: Extract<keyof NonNullable<Functions>, string>;\n\ntype FunctionSlugsOf<\n\tPreview extends PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined = undefined,\n> = [PreviewFunctionSlugs<Preview> | GaFunctionSlugs<Functions>] extends [never]\n\t? string\n\t: PreviewFunctionSlugs<Preview> | GaFunctionSlugs<Functions>;\n\n/**\n * Signature of the `branch` closure. Generic over the static function homes so the\n * `functions` keys it may tune are constrained to the slugs actually declared.\n */\nexport type BranchTuningFn<\n\tPreview extends PreviewInput | undefined = PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined = undefined,\n> = (branch: BranchTarget) => BranchTuning<FunctionSlugsOf<Preview, Functions>>;\n\n/**\n * A validated Neon branch policy — the value `defineConfig({ … })` returns and `neon.ts`\n * default-exports.\n *\n * Split into a **static** existential set (top-level service toggles and records) and a\n * **dynamic** per-branch `branch` closure for tuning. The static half is what makes the\n * secret set — and therefore `NeonEnv<typeof config>` and `parseEnv` — exact; the closure\n * can tune but never change what exists.\n *\n * Generic over the static fields so the type system can read the exact toggle/slug\n * literals; the defaults make the bare `Config` a usable \"any policy\" type for runtime\n * function signatures. The first three type parameters stay `Auth`, `DataApi`, `Preview`\n * so existing positional `Config<Auth, DataApi, Preview>` consumers keep compiling.\n */\nexport interface Config<\n\tAuth extends ServiceToggleInput | undefined =\n\t\t| ServiceToggleInput\n\t\t| undefined,\n\tDataApi extends DataApiInput | undefined = DataApiInput | undefined,\n\tPreview extends PreviewInput | undefined = PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined =\n\t\t| Record<string, FunctionDef>\n\t\t| undefined,\n\tBuckets extends Record<string, BucketDef> | undefined =\n\t\t| Record<string, BucketDef>\n\t\t| undefined,\n\tAiGateway extends ServiceToggleInput | undefined =\n\t\t| ServiceToggleInput\n\t\t| undefined,\n> {\n\t/** Neon Auth integration toggle (GA). Static — drives `NeonEnv.auth`. */\n\tauth?: Auth;\n\t/**\n\t * Neon Data API integration (GA). Static — drives `NeonEnv.dataApi`. A boolean/toggle, or\n\t * a {@link DataApiConfig} object selecting the auth provider (`\"neon\"` / `\"external\"`) and\n\t * runtime {@link DataApiSettings}. With `authProvider: \"neon\"` the policy must also enable\n\t * top-level `auth`.\n\t */\n\tdataApi?: DataApi;\n\t/**\n\t * AI Gateway toggle (GA). Static — drives `NeonEnv.aiGateway`. Same shapes as `auth`.\n\t */\n\taiGateway?: AiGateway;\n\t/**\n\t * Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`).\n\t */\n\tfunctions?: Functions;\n\t/**\n\t * Object-storage buckets to create, keyed by bucket name.\n\t */\n\tbuckets?: Buckets;\n\t/**\n\t * Function triggers, keyed by branch-unique name. Each value names the function\n\t * (and, for `storage_object_created`, the bucket) it binds. Applied after functions\n\t * are deployed. Triggers that exist remotely but are omitted here are left alone.\n\t */\n\ttriggers?: Record<string, FunctionTriggerDef>;\n\t/** Preview features and deprecated aliases for graduated services. */\n\tpreview?: Preview;\n\t/** Per-branch tuning closure. Cannot change the static existential set. */\n\tbranch?: BranchTuningFn<Preview, Functions>;\n\t/**\n\t * Experimental (unstable) features, isolated in their own namespace so they can change\n\t * shape or disappear without touching the rest of the policy. See {@link ExperimentalInput}.\n\t */\n\texperimental?: ExperimentalInput;\n}\n\n/**\n * Experimental (unstable) features. Currently just `hooks`. Kept out of the top-level\n * namespace — rather than a sibling of `auth` / `functions` / `branch` — as a signal that\n * this shape is still moving and isn't covered by the same stability guarantees as the rest\n * of the policy.\n */\nexport interface ExperimentalInput {\n\t/**\n\t * Imperative lifecycle hooks (Preview) — run side effects (migrations, seeding, …) on the\n\t * real `checkout` / `deploy` commands. The declarative companion to {@link Config.branch}:\n\t * hooks never run during `plan` / `status` / `inspect`, so the diff engine stays sound.\n\t * See {@link Hooks}.\n\t */\n\thooks?: Hooks;\n}\n\n// ─── Lifecycle hooks (Preview) ──────────────────────────────────────────────────\n//\n// Hooks are the **imperative** companion to the pure, declarative `branch` closure.\n// `branch()` answers *\"what should this branch look like?\"* (and runs during `plan` /\n// `status` / `apply`, so it must stay side-effect free). Hooks answer *\"do this when a\n// branch is created / checked out / deployed\"* (migrations, seeding, notifications) and\n// run **only** during the real `checkout` / `deploy` commands (and, for `create`,\n// whenever those actually create a branch) — never during `plan` / `status` / `inspect`.\n\n/**\n * Read-only git facts injected into every hook by the CLI. A hook can *read* the git state\n * (to name a branch, gate a migration, …) but the hooks never *drive* git — that keeps the\n * git → Neon relationship a loop-free, one-way edge (`git checkout` syncs Neon, never the\n * reverse). Populated from the surrounding repository; all fields except `available`,\n * `isDetached`, and `isDirty` are absent when {@link available} is `false` (not a git repo,\n * or `git` is not installed).\n *\n * What *triggered* this hook invocation — the installed git hook vs. an explicit CLI\n * command — is a separate concern; see {@link CheckoutEvent} / {@link DeployEvent} on each\n * hook context's `event` field, not this type.\n */\nexport interface GitContext {\n\t/** `false` when the command did not run inside a git work tree (or `git` is missing). */\n\tavailable: boolean;\n\t/** Current branch (`git symbolic-ref --short HEAD`). Undefined in detached-HEAD state. */\n\tbranch?: string;\n\t/**\n\t * `branch`, sanitized into a valid Neon branch name: lowercased, each `/`-separated\n\t * segment reduced to `[a-z0-9-]`, empty results fall back to `\"branch\"`, clamped to 256\n\t * characters. Undefined whenever `branch` is (detached HEAD, not a git repo, or `git` is\n\t * unavailable). Prepend your own prefix with plain string concatenation, e.g.\n\t * `` `preview/${git.neonSafeBranchName}` ``.\n\t */\n\tneonSafeBranchName?: string;\n\t/** Full commit SHA of `HEAD`. */\n\tsha?: string;\n\t/** Abbreviated commit SHA of `HEAD`. */\n\tshortSha?: string;\n\t/** `true` when `HEAD` is detached (no current branch). */\n\tisDetached: boolean;\n\t/** `true` when the work tree has uncommitted changes (`git status --porcelain`). */\n\tisDirty: boolean;\n\t/** Default branch the remote points at (`origin/HEAD`), e.g. `\"main\"`, when resolvable. */\n\tdefaultBranch?: string;\n\t/** `origin` remote URL, when configured. */\n\tremoteUrl?: string;\n\t/** Absolute path to the repository root (`git rev-parse --show-toplevel`). */\n\trepoRoot?: string;\n}\n\n/**\n * What triggered a `checkout` (and the `create` it may perform). `inputName` — what the user\n * typed at a Neon prompt, if anything — lives *inside* the event so narrowing on `event.type`\n * narrows `inputName` too (TypeScript only propagates discriminated-union narrowing within\n * the object actually holding the discriminant, not to sibling fields of an outer object):\n *\n * - `\"git-checkout\"` — the installed `post-checkout` git hook, via `neon git sync`. Carries\n *   the git branch that triggered it (`gitBranch`); `inputName` is always `undefined` here —\n *   nothing was typed at a Neon prompt. The sanitized Neon-safe form of that branch is on the\n *   sibling `git` context, at `git.neonSafeBranchName`.\n * - `\"neon-checkout\"` — an explicit `neon checkout` invocation. `inputName` is the name/id\n *   the user passed, or `undefined` when they omitted it (interactive picker).\n */\nexport type CheckoutEvent =\n\t| { type: \"git-checkout\"; gitBranch: string; inputName?: undefined }\n\t| { type: \"neon-checkout\"; inputName?: string };\n\n/** What triggered a `deploy`. Currently always `\"neon-deploy\"` — an explicit `neon deploy` / `config apply` invocation; `deploy` is never triggered by the git hook. */\nexport type DeployEvent = { type: \"neon-deploy\" };\n\n/**\n * The branch a hook is acting on — a resolved, live branch (unlike the pre-create\n * {@link BranchTarget} the `branch` closure may receive). Always carries a concrete `id`.\n */\nexport interface HookBranch {\n\t/** Neon project id the branch belongs to. */\n\tprojectId: string;\n\t/** Neon branch id (`br-…`). */\n\tid: string;\n\t/** Branch name. */\n\tname: string;\n\t/** `true` when **this** operation created the branch (vs selecting an existing one). */\n\tcreated: boolean;\n\t/** Whether Neon marks the branch as the project default. */\n\tisDefault: boolean;\n\t/** Whether Neon marks the branch protected. */\n\tisProtected: boolean;\n\t/** Parent branch id, when known. */\n\tparentId?: string;\n\t/** Branch expiration timestamp, when set. */\n\texpiresAt?: string;\n}\n\n/**\n * A resolved branch's env vars, namespaced like `@neon/env`'s `NeonEnv<C>` — but **not**\n * generic over the policy. `@neon/config` cannot import the real, policy-exact `NeonEnv<C>`\n * (it lives in a package that itself depends on `@neon/config`, and importing it back would\n * be a dependency cycle), so every namespace here is optional regardless of what the policy\n * declares, rather than conditionally present/absent. `postgres` is the only field every\n * resolved branch actually has, so it stays the one non-optional namespace.\n */\nexport interface HookEnv {\n\tpostgres: {\n\t\tdatabaseUrl: string;\n\t\tdatabaseUrlUnpooled: string;\n\t};\n\tbranch?: { name: string };\n\tauth?: { baseUrl: string; jwksUrl: string };\n\tdataApi?: { url: string };\n\tstorage?: {\n\t\taccessKeyId: string;\n\t\tsecretAccessKey: string;\n\t\tendpoint: string;\n\t\tregion: string;\n\t};\n\taiGateway?: { apiKey: string; baseUrl: string };\n\tfunctions?: Record<string, { baseUrl: string }>;\n}\n\n/** Context passed to `hooks.checkout.before` (runs before the branch name is resolved). */\nexport interface CheckoutBeforeContext {\n\tevent: CheckoutEvent;\n\tgit: GitContext;\n}\n\n/**\n * Return value of a `hooks.checkout.before` **function** hook. Return `{ name }` to rewrite\n * the branch that will be checked out / created; return nothing to keep the resolved name.\n * Throw to abort the checkout. (Shell-command `before` hooks cannot rewrite the name — only\n * abort via a non-zero exit — since they have no return channel.)\n */\nexport interface CheckoutBeforeResult {\n\t/** Overrides the Neon branch name to check out / create. */\n\tname?: string;\n}\n\n/**\n * Context passed to `hooks.checkout.after` (branch resolved + env pulled). `env` is\n * {@link HookEnv} — every namespace optional; see that type for why it can't be the exact,\n * policy-typed `NeonEnv<C>`.\n */\nexport interface CheckoutAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\tgit: GitContext;\n\tevent: CheckoutEvent;\n}\n\n/**\n * Context passed to `hooks.create.before` (runs before a new branch is created). Fires only\n * for a genuine creation — never for `checkout` selecting an existing branch. Unlike\n * `checkout.before`, this cannot rename the branch: by the time a `create` is reached, the\n * name is already resolved (rename via `checkout.before` if you need that).\n */\nexport interface CreateBeforeContext {\n\t/** Name of the branch about to be created. */\n\tbranchName: string;\n\tgit: GitContext;\n\t/** The event that triggered the enclosing `checkout` — `create` never runs standalone. */\n\tevent: CheckoutEvent;\n}\n\n/** Context passed to `hooks.create.after` (branch created, policy applied, env pulled). `branch.created` is always `true` here. */\nexport interface CreateAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\tgit: GitContext;\n\tevent: CheckoutEvent;\n}\n\n/** Context passed to `hooks.deploy.before` (branch resolved, policy not yet applied). */\nexport interface DeployBeforeContext {\n\tbranch: HookBranch;\n\tgit: GitContext;\n\tevent: DeployEvent;\n}\n\n/** Context passed to `hooks.deploy.after` (policy applied, env pulled). */\nexport interface DeployAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\t/** What the apply changed. */\n\tresult: PushResult;\n\tgit: GitContext;\n\tevent: DeployEvent;\n}\n\n/**\n * A shell-command hook: a single command string, or a list of commands run sequentially\n * (each must exit 0 or the operation aborts). Commands run **non-interactively** (stdin is\n * not a TTY and `CI=1` is set) so an accidental interactive command fails fast instead of\n * hanging. Resolved Neon env vars are injected into the command's environment.\n */\nexport type ShellHook = string | string[];\n\n/**\n * A lifecycle hook: either a (possibly async) function receiving a typed `Ctx`, or a\n * {@link ShellHook}. `before` hooks may influence/abort (functions can return `Result`,\n * any hook can throw to abort); `after` hooks observe (their return value is ignored).\n */\nexport type Hook<Ctx, Result = void> =\n\t| ((ctx: Ctx) => Result | Promise<Result>)\n\t| ShellHook;\n\n/** Hooks for the `checkout` command (`neon checkout`). */\nexport interface CheckoutHooks {\n\t/** Runs before the branch is resolved; may rewrite the name (function form) or abort. */\n\t// biome-ignore lint/suspicious/noConfusingVoidType: a `before` hook may return an override or nothing — `void` (not `undefined`) is what lets a no-op `() => {}` validation hook type-check.\n\tbefore?: Hook<CheckoutBeforeContext, CheckoutBeforeResult | void>;\n\t/** Runs after checkout + env pull. Use `branch.created` to distinguish new vs existing. */\n\tafter?: Hook<CheckoutAfterContext>;\n}\n\n/**\n * Hooks for branch **creation**. Fires only when `checkout` (or another consumer of the\n * runtime's create operation) actually creates a new branch — not when `checkout` selects\n * an existing one. Distinct from `checkout`, which brackets the whole `checkout` command\n * regardless of whether it created or selected a branch: use `create` when you specifically\n * care about the creation moment.\n */\nexport interface CreateHooks {\n\t/** Runs before the branch is created; throw/non-zero exit to abort. */\n\tbefore?: Hook<CreateBeforeContext, void>;\n\t/** Runs after the branch is created and the policy applied. */\n\tafter?: Hook<CreateAfterContext>;\n}\n\n/** Hooks for the `deploy` command (`neon deploy` / `config apply`). */\nexport interface DeployHooks {\n\t/** Runs before the policy is applied; throw/non-zero exit to abort. */\n\tbefore?: Hook<DeployBeforeContext, void>;\n\t/** Runs after a successful apply + env pull. */\n\tafter?: Hook<DeployAfterContext>;\n}\n\n/**\n * Imperative lifecycle hooks, keyed by the phase they bracket. Each phase exposes a\n * `before` (influence/abort) and `after` (observe) hook. Hooks never run during `plan` /\n * `status` / `inspect`.\n *\n * `env` in every `after` hook is the fixed {@link HookEnv}, not a policy-exact type — see\n * that type's doc comment for why.\n */\nexport interface Hooks {\n\tcheckout?: CheckoutHooks;\n\tcreate?: CreateHooks;\n\tdeploy?: DeployHooks;\n}\n\n/**\n * A function with all deploy defaults applied. `resolveConfig` fills in `runtime` so\n * downstream diff/apply never has to re-derive it.\n */\nexport interface ResolvedFunctionConfig {\n\tslug: string;\n\tname: string;\n\tsource: string;\n\tenv: Record<string, string>;\n\t/**\n\t * Packages the bundler leaves unresolved, normalized from\n\t * {@link FunctionDef.externalPackages} with `includeFiles` defaulted.\n\t *\n\t * Absent rather than empty when undeclared, so a policy that never mentions it takes the\n\t * pre-existing bundling path and produces the archive it always did.\n\t */\n\texternalPackages?: ResolvedExternalPackage[];\n\truntime: FunctionRuntime;\n\tbundler: FunctionBundlerInput;\n\t/**\n\t * Local-development settings, passed through untouched from {@link FunctionDef.dev}\n\t * (no defaults applied). Only consumed by `neon dev`; deploy ignores it.\n\t */\n\tdev?: FunctionDevConfig;\n\t/**\n\t * Normalized hostnames this function should own on the branch. Absent when this\n\t * branch has no list to apply. Empty when tuning replaced the list with `[]`.\n\t */\n\tcustomDomains?: string[];\n}\n\nexport type ResolvedFunctionTrigger =\n\t| ResolvedFunctionScheduleTrigger\n\t| ResolvedFunctionStorageObjectCreatedTrigger;\n\nexport interface ResolvedFunctionScheduleTrigger {\n\ttype: \"schedule\";\n\tname: string;\n\tfunctionSlug: string;\n\tcron: string;\n\tfunctionPath: string;\n\tenabled: boolean;\n}\n\nexport interface ResolvedFunctionStorageObjectCreatedTrigger {\n\ttype: \"storage_object_created\";\n\tname: string;\n\tfunctionSlug: string;\n\tbucketName: string;\n\tprefix?: string;\n\tfunctionPath: string;\n\tenabled: boolean;\n}\n\n/** A bucket with its access level defaulted to `private`. */\nexport interface ResolvedBucketConfig {\n\tname: string;\n\taccess: BucketAccessLevel;\n}\n\n/**\n * Normalized {@link PreviewInput}. Only present on {@link ResolvedBranchConfig} when the\n * policy returned a `preview` block. `aiGatewayEnabled` follows the same\n * \"present-and-not-`false`\" semantics as `authEnabled` / `dataApiEnabled`.\n */\nexport interface ResolvedPreviewConfig {\n\tfunctions: ResolvedFunctionConfig[];\n\tbuckets: ResolvedBucketConfig[];\n\taiGatewayEnabled: boolean;\n}\n\n/**\n * Normalized Data API integration. Present on {@link ResolvedBranchConfig} only when the\n * policy enables `dataApi`. `authProvider` always resolves (defaults to `\"neon\"`); the\n * external-IdP wiring is present only for `\"external\"`; `settings` carries the camelCase\n * runtime settings (reconciled as an update when they drift).\n */\nexport interface ResolvedDataApiConfig {\n\tauthProvider: DataApiAuthProvider;\n\tjwksUrl?: string;\n\tproviderName?: string;\n\tjwtAudience?: string;\n\tsettings?: DataApiSettings;\n}\n\nexport interface ResolvedBranchConfig {\n\tparent?: string;\n\tttlSeconds?: number;\n\tprotected?: boolean;\n\tpostgres?: PostgresConfig;\n\t/** Optional for compatibility with hand-built configs. */\n\trealtimePolicy?: \"omitted\" | \"enabled\" | \"disabled\";\n\t/** Realtime options to apply when {@link realtimePolicy} is `\"enabled\"`. */\n\trealtime?: RealtimeConfig;\n\tauthEnabled: boolean;\n\tdataApiEnabled: boolean;\n\t/** Optional for compatibility with hand-built configs. */\n\tdataApiPolicy?: \"omitted\" | \"enabled\" | \"disabled\";\n\t/**\n\t * Resolved Data API integration. Present iff {@link dataApiEnabled} is `true`. Carries the\n\t * create-time auth wiring and the updatable {@link DataApiSettings}.\n\t */\n\tdataApi?: ResolvedDataApiConfig;\n\tpreview?: ResolvedPreviewConfig;\n\t/**\n\t * Resolved triggers from {@link Config.triggers}. Absent when none are declared\n\t * (hand-built configs may omit it).\n\t */\n\ttriggers?: ResolvedFunctionTrigger[];\n}\n\n/**\n * One concrete change `pushConfig` made (or, in dry-run, would make) on the remote.\n */\nexport interface AppliedChange {\n\t/**\n\t * `service` covers branch-scoped integrations driven by the branch policy (e.g.\n\t * Neon Auth, Data API).\n\t */\n\tkind: \"branch\" | \"service\";\n\taction: \"create\" | \"update\" | \"delete\" | \"noop\";\n\tidentifier: string;\n\tdetails?: Record<string, unknown>;\n}\n\n/**\n * A diff entry that conflicts with the desired config. `pushConfig` throws\n * {@link PushConflictError} on the first call when conflicts exist; pass\n * `updateExisting: true` to apply mutable drift (settings, `protected`, TTL, project\n * rename). Immutable fields (region, Postgres major version) are always conflicts —\n * recreate the project to change them.\n */\nexport interface ConflictReport {\n\tkind: \"branch\";\n\tidentifier: string;\n\tfield: string;\n\tcurrent: unknown;\n\tdesired: unknown;\n\treason: string;\n}\n\n/**\n * Result of a `pushConfig` invocation.\n */\nexport interface PushResult {\n\tprojectId: string;\n\torgId?: string;\n\tbranchId: string;\n\tbranchName: string;\n\t/**\n\t * `true` when `pushConfig` was called with `{ dryRun: true }`. `applied` then records\n\t * what **would** be applied on a real push; no API mutations were performed.\n\t */\n\tdryRun: boolean;\n\tapplied: AppliedChange[];\n\tconflicts: ConflictReport[];\n\t/**\n\t * Declared custom domains for this branch after the push (or what apply would\n\t * leave in place). `cnameTarget` is omitted when the domain is not registered yet\n\t * (dry-run of a new registration). An empty string means the region has no\n\t * custom-domains front door.\n\t */\n\tcustomDomains?: Array<{\n\t\tdomain: string;\n\t\tslug: string;\n\t\tcnameTarget?: string;\n\t}>;\n\t/**\n\t * Advisory findings from the push — a function that bundles a native dependency it never\n\t * declared, or a staged package whose version could not be pinned.\n\t *\n\t * Returned rather than logged, because a library has no business choosing an output\n\t * channel, and returned rather than left to an opt-in callback, because these are the\n\t * only warning that a deployed function will fail at invoke and an unregistered callback\n\t * is easy to never notice. Empty when there is nothing to report.\n\t *\n\t * Only populated by the built-in bundler: a caller that injects its own `bundleFunction`\n\t * owns its own reporting.\n\t */\n\twarnings: string[];\n}\n"],"mappings":";;;;;;AAKA,MAAa,gBAAgB;CAC5B;CAAM;CAAK;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CACtE;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AACrE;;;;;;;;;;;;;AA2NA,MAAa,0BAA0B,CAAC,QAAQ,UAAU"}
+{"version":3,"file":"types.js","names":[],"sources":["../../src/lib/types.ts"],"sourcesContent":["/**\n * Every compute size in the Console size table\n * (https://neon.com/docs/manage/endpoints#compute-size-and-autoscaling-configuration).\n * Plan availability is enforced by the API, not this list.\n */\nexport const COMPUTE_UNITS = [\n\t0.25, 0.5, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20,\n\t22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56,\n] as const;\n\nexport type ComputeUnit = (typeof COMPUTE_UNITS)[number];\n\n/** Time units accepted in a {@link DurationString}: seconds, minutes, hours, days, weeks. */\nexport type DurationUnit = \"s\" | \"m\" | \"h\" | \"d\" | \"w\";\n\n/**\n * A Neon duration string: a positive integer **followed by a unit** — `s` (seconds),\n * `m` (minutes), `h` (hours), `d` (days), or `w` (weeks). Used by\n * {@link ComputeSettings.suspendTimeout} and {@link BranchTuning.ttl}.\n *\n * A **unit is required**: a bare numeric string like `\"7\"` is rejected at the type level. To\n * express a raw number of seconds, pass a `number` (`300`) — not a string (`\"300\"`). This\n * removes the old ambiguity where `\"7\"` silently meant 7 *seconds* instead of, say, `\"7d\"`.\n *\n * @example \"5m\"  // 5 minutes\n * @example \"1h\"  // 1 hour\n * @example \"7d\"  // 7 days\n */\nexport type DurationString = `${number}${DurationUnit}`;\n\n/**\n * Autocomplete suggestions for {@link ComputeSettings.suspendTimeout}. Every value sits inside\n * the Neon API's allowed scale-to-zero band: **60s–604800s** (1 minute – 1 week). This is *not*\n * a closed set — the field also accepts any other {@link DurationString} or a `number` of\n * seconds; out-of-range values type-check but are rejected at apply time.\n */\ntype SuspendTimeoutSuggestion =\n\t| \"1m\"\n\t| \"5m\"\n\t| \"15m\"\n\t| \"30m\"\n\t| \"1h\"\n\t| \"6h\"\n\t| \"12h\"\n\t| \"1d\"\n\t| \"7d\";\n\n/**\n * Autocomplete suggestions for {@link BranchTuning.ttl}. Every value sits within the Neon API's\n * branch-expiration limit (**max 30 days** from creation; the Console's own presets are 1h / 1d\n * / 7d). This is *not* a closed set — the field also accepts any other {@link DurationString} or\n * a `number` of seconds; values over 30 days are rejected at apply time.\n */\ntype TtlSuggestion = \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"3d\" | \"7d\" | \"14d\" | \"30d\";\n\n/**\n * Compose a field's duration type: its curated autocomplete `Suggestions` plus the open\n * `DurationString` template (so any `<integer><unit>` string still type-checks) and a `number`\n * of seconds. Intersecting the template arm with `NonNullable<unknown>` stops TypeScript from\n * collapsing the literal suggestions into the template, which is what preserves the autocomplete.\n */\ntype DurationField<Suggestions extends DurationString> =\n\t| Suggestions\n\t| (DurationString & NonNullable<unknown>)\n\t| number;\n\n/**\n * Compute settings applied to the read/write endpoint of a branch.\n *\n * Mirrors the subset of {@link https://api-docs.neon.tech/reference/getting-started-with-neon-api Neon endpoint}\n * fields that we expose as IaC primitives. Anything left undefined falls back to the project's\n * `default_endpoint_settings` (which themselves fall back to Neon defaults).\n */\nexport interface ComputeSettings {\n\t/**\n\t * Minimum number of Compute Units. Set to 0.25 for true scale-to-zero.\n\t *\n\t * Sizes above 16 CU are fixed-size only: if this is set with a different\n\t * {@link ComputeSettings.autoscalingLimitMaxCu}, both bounds must be ≤ 16 and\n\t * `max - min` cannot exceed 8 CU. A single bound is checked against the catalog\n\t * only — the other bound comes from the project's default endpoint settings, so\n\t * the API is the arbiter of the resolved pair.\n\t *\n\t * @example 0.25  // scale-to-zero\n\t * @example 1     // always-on with 1 CU minimum\n\t * @example 4\n\t */\n\tautoscalingLimitMinCu?: ComputeUnit;\n\t/**\n\t * Maximum number of Compute Units for autoscaling, or the fixed size when equal\n\t * to {@link ComputeSettings.autoscalingLimitMinCu}.\n\t *\n\t * @example 2\n\t * @example 12\n\t * @example 56  // fixed-size; pair with the same min\n\t */\n\tautoscalingLimitMaxCu?: ComputeUnit;\n\t/**\n\t * How long an idle compute waits before suspending (Neon's scale-to-zero). Accepts a\n\t * {@link DurationString} (autocompletes common values), a number of seconds, or `false`.\n\t *\n\t * - `false` — never suspend (always-on compute)\n\t * - {@link DurationString} — e.g. `\"5m\"`; autocompletes the in-range values `\"1m\"`, `\"5m\"`,\n\t *   `\"15m\"`, `\"30m\"`, `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`, `\"7d\"`, and accepts any other\n\t *   `<integer><unit>` (units: `s`, `m`, `h`, `d`, `w`). A **unit is required** — for raw\n\t *   seconds pass a `number`, not a string.\n\t * - `number` — custom timeout in **seconds**, must be in `60`–`604800` (1 minute to 1 week)\n\t * - `undefined` — use the Neon default (currently 300s / 5 minutes)\n\t *\n\t * Whichever form you use, the resolved timeout must fall in `60`–`604800` seconds (the Neon\n\t * API limit); the suggestions are all within that band, anything else is checked at apply.\n\t *\n\t * @example false  // never suspend (always-on)\n\t * @example \"5m\"   // suspend after 5 minutes idle\n\t * @example \"1h\"   // suspend after 1 hour idle\n\t * @example 300    // 5 minutes, expressed in seconds\n\t */\n\tsuspendTimeout?: false | DurationField<SuspendTimeoutSuggestion>;\n}\n\n/**\n * Read-only descriptor of the branch a {@link Config} policy is being evaluated for — the\n * `branch` argument passed to your `defineConfig({ branch: (branch) => … })` closure. It describes\n * **which** branch this invocation decides for; it is not a live branch handle and must not\n * be mutated. Switch on its fields and return the desired {@link BranchConfig}.\n */\nexport interface BranchTarget {\n\t/** Branch name being evaluated. For `branch dev`, this is the generated branch name. */\n\tname: string;\n\t/** Neon branch id when the branch already exists. Undefined during pre-create eval. */\n\tid?: string;\n\t/** Whether this branch already exists on Neon. */\n\texists: boolean;\n\t/** Parent branch id from Neon when known. */\n\tparentId?: string;\n\t/** Whether Neon marks this branch as the project default. */\n\tisDefault?: boolean;\n\t/** Whether Neon currently marks this branch protected. */\n\tisProtected?: boolean;\n\t/** Current expiration timestamp from Neon, when set. */\n\texpiresAt?: string;\n}\n\n/**\n * Object form of a branch-scoped service toggle. `{}` or `{ enabled: true }` enables it;\n * `{ enabled: false }` opts out. Used as the object half of {@link ServiceToggleInput}.\n */\nexport interface ServiceToggle {\n\t/** Defaults to `true` when the service namespace is present. Set `false` to opt out. */\n\tenabled?: boolean;\n}\n\n/**\n * How a branch-scoped service (Neon Auth, Data API, AI Gateway) is toggled in a policy.\n *\n * - `true` / `{}` / `{ enabled: true }` — enabled.\n * - `false` / `{ enabled: false }` — disabled.\n * - omitted (`undefined`) — not part of the policy at all.\n *\n * These toggles are **static** (they live in the top-level `defineConfig({ … })` object,\n * not in the per-branch `branch` closure) so the secret set they imply can be derived at\n * the type level — that's what makes `NeonEnv<typeof config>` exact.\n */\nexport type ServiceToggleInput = boolean | ServiceToggle;\n\n/**\n * Realtime settings for a branch. The object's presence enables Realtime; omit\n * `allowedOrigins` to leave the inherited/current allowlist unchanged.\n */\nexport interface RealtimeConfig {\n\t/** Browser origins allowed to connect. `[]` or `[\"*\"]` allows every origin. */\n\tallowedOrigins?: readonly string[];\n}\n\n/**\n * How Realtime is managed by a policy.\n *\n * - `true` — enable Realtime without changing allowed origins.\n * - `{ allowedOrigins?: [...] }` — enable Realtime and optionally configure origins.\n * - `false` — disable Realtime.\n * - omitted (`undefined`) — leave Realtime unmanaged.\n */\nexport type RealtimeInput = boolean | RealtimeConfig;\n\n/**\n * Resolve a **static** service toggle (`true` / `false` / `{ enabled?: boolean }` / object /\n * `undefined`) to a type-level boolean. The tuple wrapping (`[T] extends […]`) disables\n * distribution so a union/`undefined` is judged as a single unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | … | undefined` (no literal info) → `false`\n *\n * Shared by the {@link Config} static cross-field checks and the `@neon/env`\n * `NeonEnv` namespace derivation, so both read \"is this service on?\" identically.\n */\nexport type ServiceEnabled<T> = [T] extends [false]\n\t? false\n\t: [T] extends [{ enabled: false }]\n\t\t? false\n\t\t: [T] extends [undefined]\n\t\t\t? false\n\t\t\t: [T] extends [true]\n\t\t\t\t? true\n\t\t\t\t: [T] extends [{ enabled: true }]\n\t\t\t\t\t? true\n\t\t\t\t\t: [T] extends [object]\n\t\t\t\t\t\t? true\n\t\t\t\t\t\t: false;\n\nexport interface PostgresConfig {\n\tcomputeSettings?: ComputeSettings;\n}\n\n/**\n * Authentication providers a Data API integration can verify JWTs against, as written in\n * `neon.ts`. Friendly authoring values (mapped to the Neon API's `neon_auth` / `external`\n * at the API boundary):\n *\n * - `\"neon\"` — verify tokens minted by **Neon Auth** on the same branch. Neon supplies the\n *   JWKS URL / provider wiring for you, so the `jwksUrl` / `providerName` / `jwtAudience`\n *   fields are forbidden (a type error) on this variant — and the policy must also enable\n *   top-level `auth` (Neon Auth) so the tokens exist.\n * - `\"external\"` — verify tokens from a third-party IdP (Clerk, Stytch, Auth0, …). You\n *   provide `jwksUrl` (and optionally `providerName` / `jwtAudience`).\n */\nexport const DATA_API_AUTH_PROVIDERS = [\"neon\", \"external\"] as const;\nexport type DataApiAuthProvider = (typeof DATA_API_AUTH_PROVIDERS)[number];\n\n/**\n * Reusable runtime settings for a Data API integration (the Neon API `DataAPISettings`,\n * camelCased to match the rest of `neon.ts`). Every field is optional; omitted fields keep\n * the Neon defaults shown below. These are the **only** Data API fields that can change on\n * an already-enabled integration — drift here is reconciled as an *update* (requires\n * `updateExisting` / `--update-existing`); the create-only auth wiring above cannot.\n */\nexport interface DataApiSettings {\n\t/** Enable the aggregates feature (`db_aggregates_enabled`). Default `true`. */\n\tdbAggregatesEnabled?: boolean;\n\t/** Database role used for anonymous requests (`db_anon_role`). Default `\"anonymous\"`. */\n\tdbAnonRole?: string;\n\t/** Extra schemas appended to the search path (`db_extra_search_path`). */\n\tdbExtraSearchPath?: string;\n\t/** Maximum rows returned in a single request (`db_max_rows`). */\n\tdbMaxRows?: number;\n\t/** Schemas exposed via the API (`db_schemas`). Default `[\"public\"]`. */\n\tdbSchemas?: string[];\n\t/** JWT claim key used for role extraction (`jwt_role_claim_key`). Default `\".role\"`. */\n\tjwtRoleClaimKey?: string;\n\t/** Maximum lifetime of the JWT cache, in seconds (`jwt_cache_max_lifetime`). */\n\tjwtCacheMaxLifetime?: number;\n\t/** OpenAPI spec mode (`openapi_mode`). Default `\"disabled\"`. */\n\topenapiMode?: \"ignore-privileges\" | \"disabled\";\n\t/** CORS allowed origins (`server_cors_allowed_origins`). */\n\tserverCorsAllowedOrigins?: string;\n\t/** Emit server-timing headers (`server_timing_enabled`). */\n\tserverTimingEnabled?: boolean;\n}\n\n/** Fields shared by every {@link DataApiConfig} variant. */\ninterface DataApiConfigBase {\n\t/** Defaults to `true` when the `dataApi` namespace is present. `false` disables and apply deletes. */\n\tenabled?: boolean;\n\t/** Reusable runtime settings. Drift here is reconciled as an update. */\n\tsettings?: DataApiSettings;\n}\n\n/**\n * Data API verified by **Neon Auth** (`authProvider: \"neon\"`, the default). The external\n * IdP fields are statically forbidden (`?: never`) because Neon supplies them; declaring any\n * of them is a type error directing you to `authProvider: \"external\"`.\n */\nexport interface DataApiNeonAuthConfig extends DataApiConfigBase {\n\tauthProvider?: \"neon\";\n\t/** Forbidden with `authProvider: \"neon\"` — Neon provides the JWKS URL. */\n\tjwksUrl?: never;\n\t/** Forbidden with `authProvider: \"neon\"` — the provider is Neon Auth. */\n\tproviderName?: never;\n\t/** Forbidden with `authProvider: \"neon\"` — Neon manages the audience. */\n\tjwtAudience?: never;\n}\n\n/**\n * Data API verified by an **external** IdP (`authProvider: \"external\"`). You provide the\n * JWKS URL (and optionally a provider label / expected audience).\n */\nexport interface DataApiExternalAuthConfig extends DataApiConfigBase {\n\tauthProvider: \"external\";\n\t/** URL that publishes the IdP's JWKS (JSON Web Key Set). */\n\tjwksUrl?: string;\n\t/** Human label for the IdP (e.g. \"Clerk\", \"Stytch\", \"Auth0\"). */\n\tproviderName?: string;\n\t/**\n\t * Expected `aud` claim. ⚠️ This only **rejects** tokens carrying a *different* audience;\n\t * tokens with no `aud` claim are still accepted.\n\t */\n\tjwtAudience?: string;\n}\n\n/**\n * Object form of the `dataApi` toggle. A discriminated union on {@link DataApiAuthProvider}:\n * the `\"neon\"` variant forbids the external-IdP fields, the `\"external\"` variant allows them.\n */\nexport type DataApiConfig = DataApiNeonAuthConfig | DataApiExternalAuthConfig;\n\n/**\n * How the Data API is toggled in a policy: a bare boolean (like the other service toggles)\n * or the richer {@link DataApiConfig} object. `true` / `{}` / `{ enabled: true }` enable it\n * with Neon defaults. `false` / `{ enabled: false }` disable it; apply deletes an existing\n * Data API. Omit the field to leave an existing integration alone.\n */\nexport type DataApiInput = boolean | DataApiConfig;\n\n/**\n * Supported function runtimes. Mirrors the Neon Functions deploy API `runtime` enum.\n * Only `nodejs24` exists today; kept as a union so adding runtimes later is a\n * non-breaking, type-checked change.\n */\nexport type FunctionRuntime = \"nodejs24\";\n\n/**\n * Local-development settings for a function, used by `neon dev` when it serves every\n * function declared in `neon.ts` (i.e. invoked with no `--source`). Never affects deploy.\n */\nexport interface FunctionDevConfig {\n\t/**\n\t * Port the local server binds. Bound exactly (and `neon dev` fails loudly if it is taken)\n\t * when set; a free port is found automatically when omitted.\n\t */\n\tport?: number;\n}\n\n/**\n * The object form of an {@link FunctionDef.externalPackages} entry, for the one case the\n * bare string cannot express: externalizing a package without shipping its files.\n */\nexport interface ExternalPackageDef {\n\t/** Package name, optionally with a subpath: `sharp`, `@scope/pkg`, `pkg/sub`. */\n\tname: string;\n\t/**\n\t * Whether the package's real files ship into the deployed archive next to the bundle.\n\t *\n\t * Defaults to `true`, which is the state where the import resolves and the function\n\t * works. Set it to `false` only for a package the function never reaches: nothing is\n\t * shipped for it, so reaching it throws `Cannot find module` at invoke.\n\t */\n\tincludeFiles?: boolean;\n}\n\n/**\n * One entry of {@link FunctionDef.externalPackages}. A bare string is the common form and\n * ships the package's files; {@link ExternalPackageDef} exists to turn that off.\n */\nexport type ExternalPackageEntry = string | ExternalPackageDef;\n\n/**\n * An {@link ExternalPackageEntry} with its default applied, as every consumer downstream of\n * `resolveConfig` reads it.\n */\nexport interface ResolvedExternalPackage {\n\t/** Package name as declared, subpath included. */\n\tname: string;\n\t/** Whether this package's files are staged into the archive. */\n\tincludeFiles: boolean;\n}\n\n/** Archive-relative paths. The runtime imports `index.mjs` or `index.js` at the root. */\nexport type FunctionBundle = Record<string, Uint8Array>;\n\n/** Defined here so policy imports stay free of build-time dependencies. */\nexport type FunctionBundler = (\n\tfn: ResolvedFunctionConfig,\n) => Promise<FunctionBundle>;\n\n/**\n * `\"esbuild\"` (default) bundles a file, or a directory from the first of\n * `index.ts`, `index.js`, `index.mjs`. `\"none\"` ships a prebuilt directory or a\n * single `index.mjs` / `index.js`. An inline {@link FunctionBundler} returns the\n * file map.\n */\nexport type FunctionBundlerInput = \"esbuild\" | \"none\" | FunctionBundler;\n\n/**\n * Static definition of a Neon Function. Declares that the function\n * **exists** on every branch; its branch-unique slug is the **record key** in\n * `functions` (or deprecated {@link PreviewInput.functions}), so slugs are statically enumerable,\n * cannot duplicate, and the `branch` closure can only tune slugs that are declared here.\n * Runtime tuning is **not** here — it varies per branch and lives in the `branch` closure\n * (see {@link FunctionTuning}). Memory is fixed by the platform policy for now and is not\n * user-configurable.\n */\nexport interface FunctionDef {\n\t/** Free-form display name. @example \"Hello World\" */\n\tname: string;\n\t/**\n\t * Path to the entry module or source directory, relative to `neon.ts` (or\n\t * absolute). A file is the entry; a directory is searched for `index.ts`,\n\t * then `index.js`, then `index.mjs`. A JS function value has no source path\n\t * for a bundler to resolve.\n\t * @example \"./functions/hello-world.ts\"\n\t * @example \".mastra/output\"\n\t */\n\tsource: string;\n\t/**\n\t * Environment variables injected into the deployed function, keyed by the var name the\n\t * function reads at runtime. The **keys** are static (preserved at the type level so\n\t * `parseEnv(config, \"<slug>\").function.<key>` is typed). An unset `process.env.X`\n\t * fails validation. Omit a key to preserve its deployed value; an empty string deletes it.\n\t * @example { resendApiKey: process.env.RESEND_API_KEY! }\n\t */\n\tenv?: Record<string, string>;\n\t/**\n\t * Ship a dependency's real files into the deployed archive instead of bundling it —\n\t * `sharp` and other packages backed by a native binary.\n\t *\n\t * The deploy-time equivalent of Next.js's `serverExternalPackages`. Every entry is passed\n\t * to esbuild's `external`, so the import survives into the bundle instead of being\n\t * followed, and the package's own files are shipped beside the bundle so that import\n\t * resolves.\n\t *\n\t * Reach for this when bundling a package is impossible rather than merely undesirable.\n\t * The case that comes up is a package backed by a native `.node` binary: the binary is a\n\t * compiled object the platform loads from a real path, so no bundler can inline it.\n\t * `sharp` is the common one, and it does not even fail at build time — it loads its\n\t * binary through `createRequire`, which esbuild does not follow, so it bundles cleanly\n\t * and then fails at invoke with \"Could not load the sharp module\".\n\t *\n\t * ```ts\n\t * externalPackages: [\"sharp\"]\n\t * ```\n\t *\n\t * Each declared package is installed for the Functions runtime target — **linux-arm64,\n\t * glibc** — into a throwaway directory, traced for the files it actually reaches, and\n\t * copied into the archive under `node_modules/` with its directory layout preserved. That\n\t * layout is load-bearing rather than cosmetic: a `.node` addon locates its sibling shared\n\t * libraries relative to its own directory, so a flattened tree fails to load.\n\t *\n\t * Your own `node_modules` is never read for these files or modified. Its binaries are\n\t * built for your machine rather than the deploy target, and a cross-platform install does\n\t * not survive your next plain `npm install`, so the target's packages are resolved fresh\n\t * on each deploy.\n\t *\n\t * Requirements, all reported at deploy time rather than at invoke: the package must\n\t * publish a linux-arm64 glibc build (`sharp` and most `@napi-rs/*` packages do; anything\n\t * compiled from source at install time does not), `npm` must be on `PATH`, and the\n\t * archive must stay inside the deploy size limits — native binaries are large.\n\t *\n\t * ### Excluding a package's files\n\t *\n\t * `includeFiles: false` externalizes the import without shipping anything, which is the\n\t * escape hatch for a package that cannot be staged — no build for the target, or too\n\t * large — and that the function never actually reaches:\n\t *\n\t * ```ts\n\t * externalPackages: [\"sharp\", { name: \"canvas\", includeFiles: false }]\n\t * ```\n\t *\n\t * **An excluded package is not resolvable at runtime.** Nothing is shipped for it, so it\n\t * throws `Cannot find module` if the function reaches it. It unblocks an import that is\n\t * never evaluated; it does not make a dependency usable.\n\t *\n\t * Entries are package names, optionally with a subpath (`pkg`, `@scope/pkg`, `pkg/sub`),\n\t * matching esbuild. A relative or absolute path is rejected at validation time: those are\n\t * local modules, and a local module that cannot be bundled is a different problem. Files\n\t * are staged per package, so a subpath narrows what esbuild leaves unresolved without\n\t * narrowing what ships.\n\t *\n\t * Under `neon dev` the list only keeps the package out of the bundle — nothing is\n\t * installed or copied, and it resolves from your own `node_modules` against your host\n\t * architecture, which is what you want locally.\n\t * @example [\"sharp\", { name: \"canvas\", includeFiles: false }]\n\t */\n\texternalPackages?: ExternalPackageEntry[];\n\t/**\n\t * How {@link source} becomes deployable files. Defaults to `\"esbuild\"`.\n\t * `\"none\"` ships a prebuilt directory or `index.mjs` / `index.js` file.\n\t * An inline {@link FunctionBundler} returns the file map used by deploy and\n\t * `neon dev`. Inline functions do not round-trip through inspect or pull and\n\t * must be re-declared.\n\t * @example \"none\"\n\t * @example (fn) => myFrameworkBuild(fn.source)\n\t */\n\tbundler?: FunctionBundlerInput;\n\t/**\n\t * Local-development settings used by `neon dev` when serving every function from\n\t * `neon.ts`. Ignored at deploy time. See {@link FunctionDevConfig}.\n\t */\n\tdev?: FunctionDevConfig;\n\t/**\n\t * Customer-owned hostnames that should point at this function.\n\t * v1 only supports functions. Hostnames are unique across functions in the resolved\n\t * policy. Applied after the function is deployed, on the project's default branch.\n\t * Other branches apply a list only when {@link FunctionTuning.customDomains} sets one.\n\t * Domains that exist remotely but are omitted here are left alone — delete with\n\t * `neon function domains delete`.\n\t *\n\t * @example [\"docs.example.com\"]\n\t */\n\tcustomDomains?: string[];\n}\n\n/**\n * A trigger that invokes a function. The trigger name is the record key in\n * {@link Config.triggers}. `functionPath` defaults to `/`. `enabled` defaults to `true`.\n *\n * @example { type: \"schedule\", function: \"cron\", cron: \"0 * * * *\" }\n * @example { type: \"storage_object_created\", function: \"ingest\", bucket: \"assets\", prefix: \"logos/\" }\n */\nexport type FunctionTriggerDef =\n\t| FunctionScheduleTriggerDef\n\t| FunctionStorageObjectCreatedTriggerDef;\n\n/**\n * A cron schedule that invokes a function. `function` is a slug from {@link Config.functions}\n * (or deprecated `preview.functions`). `cron` is a numeric five-field expression in UTC.\n *\n * @example { type: \"schedule\", function: \"cron\", cron: \"0 * * * *\" }\n */\nexport interface FunctionScheduleTriggerDef {\n\ttype: \"schedule\";\n\tfunction: string;\n\tcron: string;\n\tfunctionPath?: string;\n\tenabled?: boolean;\n}\n\n/**\n * Invokes a function when an object is created in a bucket from {@link Config.buckets}\n * (or deprecated `preview.buckets`). `prefix` is an exact object-key prefix; omit it to\n * match every key in the bucket.\n *\n * @example { type: \"storage_object_created\", function: \"ingest\", bucket: \"assets\", prefix: \"logos/\" }\n */\nexport interface FunctionStorageObjectCreatedTriggerDef {\n\ttype: \"storage_object_created\";\n\tfunction: string;\n\tbucket: string;\n\tprefix?: string;\n\tfunctionPath?: string;\n\tenabled?: boolean;\n}\n\n/**\n * A single capability a branch-scoped service credential may exercise (Preview). A\n * credential is granted a set of these and may only perform the listed actions. Mirrors\n * the Neon API `CredentialScope` enum (`x-stability-level: beta`):\n *\n * - `storage:read` / `storage:write` — object-storage (bucket) access via the S3 key.\n * - `ai_gateway:invoke` — call the AI Gateway with the bearer `api_token`.\n * - `functions:invoke` — invoke Neon Functions with the bearer `api_token`.\n *\n * The set a policy needs is derived from its enabled Preview features (see\n * {@link deriveCredentialScopes}); it is never authored by hand.\n */\nexport type CredentialScope =\n\t| \"storage:read\"\n\t| \"storage:write\"\n\t| \"ai_gateway:invoke\"\n\t| \"functions:invoke\";\n\n/**\n * Who a credential acts as. `user` is the developer/app principal minted for local dev and\n * app bootstrap (`fetchEnv` / `env pull`); `function` is a deployed-function principal\n * (carries a `function_id`). The env tooling only mints `user` credentials today.\n */\nexport type CredentialPrincipalType = \"user\" | \"function\";\n\n/** Anonymous-access level for a branchable object-storage bucket. */\nexport type BucketAccessLevel = \"private\" | \"public_read\";\n\n/**\n * Static definition of a branchable object-storage bucket. The bucket's\n * name is the **record key** in `buckets` (or deprecated {@link PreviewInput.buckets}), so names are statically\n * enumerable and cannot duplicate.\n */\nexport interface BucketDef {\n\t/**\n\t * Anonymous access level. `private` (default) requires authenticated reads/writes;\n\t * `public_read` allows anonymous GetObject/HeadObject.\n\t */\n\taccess?: BucketAccessLevel;\n}\n\n/** Preview features, plus deprecated homes for services that have graduated to GA. */\nexport interface PreviewInput {\n\t/** Enable, configure, or disable Realtime on every branch this policy is applied to. */\n\trealtime?: RealtimeInput;\n\t/**\n\t * Enable/disable the AI Gateway on the branch (toggle, like auth / dataApi).\n\t * @deprecated Use top-level `aiGateway`.\n\t */\n\taiGateway?: ServiceToggleInput;\n\t/**\n\t * Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`).\n\t * @deprecated Use top-level `functions`.\n\t */\n\tfunctions?: Record<string, FunctionDef>;\n\t/**\n\t * Object-storage buckets to create, keyed by bucket name.\n\t * @deprecated Use top-level `buckets`.\n\t */\n\tbuckets?: Record<string, BucketDef>;\n}\n\n/**\n * Per-branch deploy tuning for a single function. Returned (per slug) by the `branch`\n * closure. Deliberately **cannot** change the function's existence, source, name, env\n * **keys**, or memory — so the static secret/function set stays sound. Runtime selection\n * and the custom-domain list may vary per branch.\n */\nexport interface FunctionTuning {\n\t/** Runtime to execute the function with. Defaults to `\"nodejs24\"`. */\n\truntime?: FunctionRuntime;\n\t/**\n\t * When present, replaces {@link FunctionDef.customDomains} for this branch.\n\t * `[]` registers nothing on this branch. Omit the key: the default branch\n\t * inherits the static list; other branches do not.\n\t */\n\tcustomDomains?: string[];\n}\n\n/**\n * Per-branch tuning of functions under the deprecated `preview` key.\n * Only existing function slugs may be tuned — `Slug` is constrained to the\n * declared keys by {@link BranchTuningFn}.\n *\n * @deprecated Use top-level `branch: (branch) => ({ functions: { … } })`.\n */\nexport interface PreviewTuning<Slug extends string = string> {\n\t/**\n\t * @deprecated Use top-level `functions` on the object returned by `branch`.\n\t */\n\tfunctions?: Partial<Record<Slug, FunctionTuning>>;\n}\n\n/**\n * The per-branch tuning object returned by the `branch` closure. It can adjust branch\n * lifecycle (`parent`, `ttl`, `protected`), Postgres compute settings, and per-function\n * deploy tuning — but **cannot** add/remove services or functions. That guarantee is what\n * keeps the static secret set (and therefore `NeonEnv`) exact.\n */\nexport interface BranchTuning<Slug extends string = string> {\n\t/** Parent branch name used when creating a new branch. Not a Postgres setting. */\n\tparent?: string;\n\t/**\n\t * Branch time-to-live: how long after creation the branch should auto-expire. Applied\n\t * when creating a new branch and reconciled on existing branches (when `updateExisting`\n\t * is set). Accepts a {@link DurationString} (autocompletes common values) or a number of\n\t * seconds. Omit to keep the branch indefinitely.\n\t *\n\t * - {@link DurationString} — e.g. `\"7d\"`; autocompletes `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`,\n\t *   `\"3d\"`, `\"7d\"`, `\"14d\"`, `\"30d\"`, and accepts any other `<integer><unit>` (units: `s`,\n\t *   `m`, `h`, `d`, `w` — e.g. `\"12h\"`, `\"2w\"`). A **unit is required** — `\"7\"` is rejected;\n\t *   for raw seconds pass a `number`.\n\t * - `number` — custom TTL in **seconds** (e.g. `3600`)\n\t * - `undefined` — no expiry; the branch persists until explicitly deleted\n\t *\n\t * The Neon API caps branch expiration at **30 days** from creation, so the resolved TTL must\n\t * be `> 0` and `<= 30d`; the suggestions stay within that limit and anything longer is\n\t * rejected at apply.\n\t *\n\t * @example \"1d\"   // ephemeral preview branch: expires a day after creation\n\t * @example \"7d\"   // one-week TTL\n\t * @example \"30d\"  // the maximum the API allows\n\t * @example 3600   // 1 hour, expressed in seconds\n\t */\n\tttl?: DurationField<TtlSuggestion>;\n\t/** Whether the selected branch should be protected. Undefined means \"leave as-is\". */\n\tprotected?: boolean;\n\tpostgres?: PostgresConfig;\n\t/** Per-function deploy tuning, keyed by declared slug. */\n\tfunctions?: Partial<Record<Slug, FunctionTuning>>;\n\t/**\n\t * @deprecated Use top-level `functions` on this object.\n\t */\n\tpreview?: PreviewTuning<Slug>;\n}\n\n/** Extract declared function slugs from top-level `functions` and/or `preview.functions`. */\ntype PreviewFunctionSlugs<Preview> = Preview extends { functions: infer F }\n\t? Extract<keyof F, string>\n\t: never;\n\n// Config's Functions default is `Record<string, FunctionDef> | undefined`. A string\n// index would otherwise union into FunctionSlugsOf as `string` and drop slug checking\n// on positional `Config<Auth, DataApi, Preview>`.\ntype GaFunctionSlugs<Functions> = [Functions] extends [undefined]\n\t? never\n\t: string extends keyof NonNullable<Functions>\n\t\t? never\n\t\t: Extract<keyof NonNullable<Functions>, string>;\n\ntype FunctionSlugsOf<\n\tPreview extends PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined = undefined,\n> = [PreviewFunctionSlugs<Preview> | GaFunctionSlugs<Functions>] extends [never]\n\t? string\n\t: PreviewFunctionSlugs<Preview> | GaFunctionSlugs<Functions>;\n\n/**\n * Signature of the `branch` closure. Generic over the static function homes so the\n * `functions` keys it may tune are constrained to the slugs actually declared.\n */\nexport type BranchTuningFn<\n\tPreview extends PreviewInput | undefined = PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined = undefined,\n> = (branch: BranchTarget) => BranchTuning<FunctionSlugsOf<Preview, Functions>>;\n\n/**\n * A validated Neon branch policy — the value `defineConfig({ … })` returns and `neon.ts`\n * default-exports.\n *\n * Split into a **static** existential set (top-level service toggles and records) and a\n * **dynamic** per-branch `branch` closure for tuning. The static half is what makes the\n * secret set — and therefore `NeonEnv<typeof config>` and `parseEnv` — exact; the closure\n * can tune but never change what exists.\n *\n * Generic over the static fields so the type system can read the exact toggle/slug\n * literals; the defaults make the bare `Config` a usable \"any policy\" type for runtime\n * function signatures. The first three type parameters stay `Auth`, `DataApi`, `Preview`\n * so existing positional `Config<Auth, DataApi, Preview>` consumers keep compiling.\n */\nexport interface Config<\n\tAuth extends ServiceToggleInput | undefined =\n\t\t| ServiceToggleInput\n\t\t| undefined,\n\tDataApi extends DataApiInput | undefined = DataApiInput | undefined,\n\tPreview extends PreviewInput | undefined = PreviewInput | undefined,\n\tFunctions extends Record<string, FunctionDef> | undefined =\n\t\t| Record<string, FunctionDef>\n\t\t| undefined,\n\tBuckets extends Record<string, BucketDef> | undefined =\n\t\t| Record<string, BucketDef>\n\t\t| undefined,\n\tAiGateway extends ServiceToggleInput | undefined =\n\t\t| ServiceToggleInput\n\t\t| undefined,\n> {\n\t/** Neon Auth integration toggle (GA). Static — drives `NeonEnv.auth`. */\n\tauth?: Auth;\n\t/**\n\t * Neon Data API integration (GA). Static — drives `NeonEnv.dataApi`. A boolean/toggle, or\n\t * a {@link DataApiConfig} object selecting the auth provider (`\"neon\"` / `\"external\"`) and\n\t * runtime {@link DataApiSettings}. With `authProvider: \"neon\"` the policy must also enable\n\t * top-level `auth`.\n\t */\n\tdataApi?: DataApi;\n\t/**\n\t * AI Gateway toggle (GA). Static — drives `NeonEnv.aiGateway`. Same shapes as `auth`.\n\t */\n\taiGateway?: AiGateway;\n\t/**\n\t * Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`).\n\t */\n\tfunctions?: Functions;\n\t/**\n\t * Object-storage buckets to create, keyed by bucket name.\n\t */\n\tbuckets?: Buckets;\n\t/**\n\t * Function triggers, keyed by branch-unique name. Each value names the function\n\t * (and, for `storage_object_created`, the bucket) it binds. Applied after functions\n\t * are deployed. Triggers that exist remotely but are omitted here are left alone.\n\t */\n\ttriggers?: Record<string, FunctionTriggerDef>;\n\t/** Preview features and deprecated aliases for graduated services. */\n\tpreview?: Preview;\n\t/** Per-branch tuning closure. Cannot change the static existential set. */\n\tbranch?: BranchTuningFn<Preview, Functions>;\n\t/**\n\t * Experimental (unstable) features, isolated in their own namespace so they can change\n\t * shape or disappear without touching the rest of the policy. See {@link ExperimentalInput}.\n\t */\n\texperimental?: ExperimentalInput;\n}\n\n/**\n * Experimental (unstable) features. Currently just `hooks`. Kept out of the top-level\n * namespace — rather than a sibling of `auth` / `functions` / `branch` — as a signal that\n * this shape is still moving and isn't covered by the same stability guarantees as the rest\n * of the policy.\n */\nexport interface ExperimentalInput {\n\t/**\n\t * Imperative lifecycle hooks (Preview) — run side effects (migrations, seeding, …) on the\n\t * real `checkout` / `deploy` commands. The declarative companion to {@link Config.branch}:\n\t * hooks never run during `plan` / `status` / `inspect`, so the diff engine stays sound.\n\t * See {@link Hooks}.\n\t */\n\thooks?: Hooks;\n}\n\n// ─── Lifecycle hooks (Preview) ──────────────────────────────────────────────────\n//\n// Hooks are the **imperative** companion to the pure, declarative `branch` closure.\n// `branch()` answers *\"what should this branch look like?\"* (and runs during `plan` /\n// `status` / `apply`, so it must stay side-effect free). Hooks answer *\"do this when a\n// branch is created / checked out / deployed\"* (migrations, seeding, notifications) and\n// run **only** during the real `checkout` / `deploy` commands (and, for `create`,\n// whenever those actually create a branch) — never during `plan` / `status` / `inspect`.\n\n/**\n * Read-only git facts injected into every hook by the CLI. A hook can *read* the git state\n * (to name a branch, gate a migration, …) but the hooks never *drive* git — that keeps the\n * git → Neon relationship a loop-free, one-way edge (`git checkout` syncs Neon, never the\n * reverse). Populated from the surrounding repository; all fields except `available`,\n * `isDetached`, and `isDirty` are absent when {@link available} is `false` (not a git repo,\n * or `git` is not installed).\n *\n * What *triggered* this hook invocation — the installed git hook vs. an explicit CLI\n * command — is a separate concern; see {@link CheckoutEvent} / {@link DeployEvent} on each\n * hook context's `event` field, not this type.\n */\nexport interface GitContext {\n\t/** `false` when the command did not run inside a git work tree (or `git` is missing). */\n\tavailable: boolean;\n\t/** Current branch (`git symbolic-ref --short HEAD`). Undefined in detached-HEAD state. */\n\tbranch?: string;\n\t/**\n\t * `branch`, sanitized into a valid Neon branch name: lowercased, each `/`-separated\n\t * segment reduced to `[a-z0-9-]`, empty results fall back to `\"branch\"`, clamped to 256\n\t * characters. Undefined whenever `branch` is (detached HEAD, not a git repo, or `git` is\n\t * unavailable). Prepend your own prefix with plain string concatenation, e.g.\n\t * `` `preview/${git.neonSafeBranchName}` ``.\n\t */\n\tneonSafeBranchName?: string;\n\t/** Full commit SHA of `HEAD`. */\n\tsha?: string;\n\t/** Abbreviated commit SHA of `HEAD`. */\n\tshortSha?: string;\n\t/** `true` when `HEAD` is detached (no current branch). */\n\tisDetached: boolean;\n\t/** `true` when the work tree has uncommitted changes (`git status --porcelain`). */\n\tisDirty: boolean;\n\t/** Default branch the remote points at (`origin/HEAD`), e.g. `\"main\"`, when resolvable. */\n\tdefaultBranch?: string;\n\t/** `origin` remote URL, when configured. */\n\tremoteUrl?: string;\n\t/** Absolute path to the repository root (`git rev-parse --show-toplevel`). */\n\trepoRoot?: string;\n}\n\n/**\n * What triggered a `checkout` (and the `create` it may perform). `inputName` — what the user\n * typed at a Neon prompt, if anything — lives *inside* the event so narrowing on `event.type`\n * narrows `inputName` too (TypeScript only propagates discriminated-union narrowing within\n * the object actually holding the discriminant, not to sibling fields of an outer object):\n *\n * - `\"git-checkout\"` — the installed `post-checkout` git hook, via `neon git sync`. Carries\n *   the git branch that triggered it (`gitBranch`); `inputName` is always `undefined` here —\n *   nothing was typed at a Neon prompt. The sanitized Neon-safe form of that branch is on the\n *   sibling `git` context, at `git.neonSafeBranchName`.\n * - `\"neon-checkout\"` — an explicit `neon checkout` invocation. `inputName` is the name/id\n *   the user passed, or `undefined` when they omitted it (interactive picker).\n */\nexport type CheckoutEvent =\n\t| { type: \"git-checkout\"; gitBranch: string; inputName?: undefined }\n\t| { type: \"neon-checkout\"; inputName?: string };\n\n/** What triggered a `deploy`. Currently always `\"neon-deploy\"` — an explicit `neon deploy` / `config apply` invocation; `deploy` is never triggered by the git hook. */\nexport type DeployEvent = { type: \"neon-deploy\" };\n\n/**\n * The branch a hook is acting on — a resolved, live branch (unlike the pre-create\n * {@link BranchTarget} the `branch` closure may receive). Always carries a concrete `id`.\n */\nexport interface HookBranch {\n\t/** Neon project id the branch belongs to. */\n\tprojectId: string;\n\t/** Neon branch id (`br-…`). */\n\tid: string;\n\t/** Branch name. */\n\tname: string;\n\t/** `true` when **this** operation created the branch (vs selecting an existing one). */\n\tcreated: boolean;\n\t/** Whether Neon marks the branch as the project default. */\n\tisDefault: boolean;\n\t/** Whether Neon marks the branch protected. */\n\tisProtected: boolean;\n\t/** Parent branch id, when known. */\n\tparentId?: string;\n\t/** Branch expiration timestamp, when set. */\n\texpiresAt?: string;\n}\n\n/**\n * A resolved branch's env vars, namespaced like `@neon/env`'s `NeonEnv<C>` — but **not**\n * generic over the policy. `@neon/config` cannot import the real, policy-exact `NeonEnv<C>`\n * (it lives in a package that itself depends on `@neon/config`, and importing it back would\n * be a dependency cycle), so every namespace here is optional regardless of what the policy\n * declares, rather than conditionally present/absent. `postgres` is the only field every\n * resolved branch actually has, so it stays the one non-optional namespace.\n */\nexport interface HookEnv {\n\tpostgres: {\n\t\tdatabaseUrl: string;\n\t\tdatabaseUrlUnpooled: string;\n\t};\n\tbranch?: { name: string };\n\tauth?: { baseUrl: string; jwksUrl: string };\n\tdataApi?: { url: string };\n\tstorage?: {\n\t\taccessKeyId: string;\n\t\tsecretAccessKey: string;\n\t\tendpoint: string;\n\t\tregion: string;\n\t};\n\taiGateway?: { apiKey: string; baseUrl: string };\n\tfunctions?: Record<string, { baseUrl: string }>;\n}\n\n/** Context passed to `hooks.checkout.before` (runs before the branch name is resolved). */\nexport interface CheckoutBeforeContext {\n\tevent: CheckoutEvent;\n\tgit: GitContext;\n}\n\n/**\n * Return value of a `hooks.checkout.before` **function** hook. Return `{ name }` to rewrite\n * the branch that will be checked out / created; return nothing to keep the resolved name.\n * Throw to abort the checkout. (Shell-command `before` hooks cannot rewrite the name — only\n * abort via a non-zero exit — since they have no return channel.)\n */\nexport interface CheckoutBeforeResult {\n\t/** Overrides the Neon branch name to check out / create. */\n\tname?: string;\n}\n\n/**\n * Context passed to `hooks.checkout.after` (branch resolved + env pulled). `env` is\n * {@link HookEnv} — every namespace optional; see that type for why it can't be the exact,\n * policy-typed `NeonEnv<C>`.\n */\nexport interface CheckoutAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\tgit: GitContext;\n\tevent: CheckoutEvent;\n}\n\n/**\n * Context passed to `hooks.create.before` (runs before a new branch is created). Fires only\n * for a genuine creation — never for `checkout` selecting an existing branch. Unlike\n * `checkout.before`, this cannot rename the branch: by the time a `create` is reached, the\n * name is already resolved (rename via `checkout.before` if you need that).\n */\nexport interface CreateBeforeContext {\n\t/** Name of the branch about to be created. */\n\tbranchName: string;\n\tgit: GitContext;\n\t/** The event that triggered the enclosing `checkout` — `create` never runs standalone. */\n\tevent: CheckoutEvent;\n}\n\n/** Context passed to `hooks.create.after` (branch created, policy applied, env pulled). `branch.created` is always `true` here. */\nexport interface CreateAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\tgit: GitContext;\n\tevent: CheckoutEvent;\n}\n\n/** Context passed to `hooks.deploy.before` (branch resolved, policy not yet applied). */\nexport interface DeployBeforeContext {\n\tbranch: HookBranch;\n\tgit: GitContext;\n\tevent: DeployEvent;\n}\n\n/** Context passed to `hooks.deploy.after` (policy applied, env pulled). */\nexport interface DeployAfterContext {\n\tbranch: HookBranch;\n\tenv: HookEnv;\n\t/** What the apply changed. */\n\tresult: PushResult;\n\tgit: GitContext;\n\tevent: DeployEvent;\n}\n\n/**\n * A shell-command hook: a single command string, or a list of commands run sequentially\n * (each must exit 0 or the operation aborts). Commands run **non-interactively** (stdin is\n * not a TTY and `CI=1` is set) so an accidental interactive command fails fast instead of\n * hanging. Resolved Neon env vars are injected into the command's environment.\n */\nexport type ShellHook = string | string[];\n\n/**\n * A lifecycle hook: either a (possibly async) function receiving a typed `Ctx`, or a\n * {@link ShellHook}. `before` hooks may influence/abort (functions can return `Result`,\n * any hook can throw to abort); `after` hooks observe (their return value is ignored).\n */\nexport type Hook<Ctx, Result = void> =\n\t| ((ctx: Ctx) => Result | Promise<Result>)\n\t| ShellHook;\n\n/** Hooks for the `checkout` command (`neon checkout`). */\nexport interface CheckoutHooks {\n\t/** Runs before the branch is resolved; may rewrite the name (function form) or abort. */\n\t// biome-ignore lint/suspicious/noConfusingVoidType: a `before` hook may return an override or nothing — `void` (not `undefined`) is what lets a no-op `() => {}` validation hook type-check.\n\tbefore?: Hook<CheckoutBeforeContext, CheckoutBeforeResult | void>;\n\t/** Runs after checkout + env pull. Use `branch.created` to distinguish new vs existing. */\n\tafter?: Hook<CheckoutAfterContext>;\n}\n\n/**\n * Hooks for branch **creation**. Fires only when `checkout` (or another consumer of the\n * runtime's create operation) actually creates a new branch — not when `checkout` selects\n * an existing one. Distinct from `checkout`, which brackets the whole `checkout` command\n * regardless of whether it created or selected a branch: use `create` when you specifically\n * care about the creation moment.\n */\nexport interface CreateHooks {\n\t/** Runs before the branch is created; throw/non-zero exit to abort. */\n\tbefore?: Hook<CreateBeforeContext, void>;\n\t/** Runs after the branch is created and the policy applied. */\n\tafter?: Hook<CreateAfterContext>;\n}\n\n/** Hooks for the `deploy` command (`neon deploy` / `config apply`). */\nexport interface DeployHooks {\n\t/** Runs before the policy is applied; throw/non-zero exit to abort. */\n\tbefore?: Hook<DeployBeforeContext, void>;\n\t/** Runs after a successful apply + env pull. */\n\tafter?: Hook<DeployAfterContext>;\n}\n\n/**\n * Imperative lifecycle hooks, keyed by the phase they bracket. Each phase exposes a\n * `before` (influence/abort) and `after` (observe) hook. Hooks never run during `plan` /\n * `status` / `inspect`.\n *\n * `env` in every `after` hook is the fixed {@link HookEnv}, not a policy-exact type — see\n * that type's doc comment for why.\n */\nexport interface Hooks {\n\tcheckout?: CheckoutHooks;\n\tcreate?: CreateHooks;\n\tdeploy?: DeployHooks;\n}\n\n/**\n * A function with all deploy defaults applied. `resolveConfig` fills in `runtime` so\n * downstream diff/apply never has to re-derive it.\n */\nexport interface ResolvedFunctionConfig {\n\tslug: string;\n\tname: string;\n\tsource: string;\n\tenv: Record<string, string>;\n\t/**\n\t * Packages the bundler leaves unresolved, normalized from\n\t * {@link FunctionDef.externalPackages} with `includeFiles` defaulted.\n\t *\n\t * Absent rather than empty when undeclared, so a policy that never mentions it takes the\n\t * pre-existing bundling path and produces the archive it always did.\n\t */\n\texternalPackages?: ResolvedExternalPackage[];\n\truntime: FunctionRuntime;\n\tbundler: FunctionBundlerInput;\n\t/**\n\t * Local-development settings, passed through untouched from {@link FunctionDef.dev}\n\t * (no defaults applied). Only consumed by `neon dev`; deploy ignores it.\n\t */\n\tdev?: FunctionDevConfig;\n\t/**\n\t * Normalized hostnames this function should own on the branch. Absent when this\n\t * branch has no list to apply. Empty when tuning replaced the list with `[]`.\n\t */\n\tcustomDomains?: string[];\n}\n\nexport type ResolvedFunctionTrigger =\n\t| ResolvedFunctionScheduleTrigger\n\t| ResolvedFunctionStorageObjectCreatedTrigger;\n\nexport interface ResolvedFunctionScheduleTrigger {\n\ttype: \"schedule\";\n\tname: string;\n\tfunctionSlug: string;\n\tcron: string;\n\tfunctionPath: string;\n\tenabled: boolean;\n}\n\nexport interface ResolvedFunctionStorageObjectCreatedTrigger {\n\ttype: \"storage_object_created\";\n\tname: string;\n\tfunctionSlug: string;\n\tbucketName: string;\n\tprefix?: string;\n\tfunctionPath: string;\n\tenabled: boolean;\n}\n\n/** A bucket with its access level defaulted to `private`. */\nexport interface ResolvedBucketConfig {\n\tname: string;\n\taccess: BucketAccessLevel;\n}\n\n/**\n * Normalized {@link PreviewInput}. Only present on {@link ResolvedBranchConfig} when the\n * policy returned a `preview` block. `aiGatewayEnabled` follows the same\n * \"present-and-not-`false`\" semantics as `authEnabled` / `dataApiEnabled`.\n */\nexport interface ResolvedPreviewConfig {\n\tfunctions: ResolvedFunctionConfig[];\n\tbuckets: ResolvedBucketConfig[];\n\taiGatewayEnabled: boolean;\n}\n\n/**\n * Normalized Data API integration. Present on {@link ResolvedBranchConfig} only when the\n * policy enables `dataApi`. `authProvider` always resolves (defaults to `\"neon\"`); the\n * external-IdP wiring is present only for `\"external\"`; `settings` carries the camelCase\n * runtime settings (reconciled as an update when they drift).\n */\nexport interface ResolvedDataApiConfig {\n\tauthProvider: DataApiAuthProvider;\n\tjwksUrl?: string;\n\tproviderName?: string;\n\tjwtAudience?: string;\n\tsettings?: DataApiSettings;\n}\n\nexport interface ResolvedBranchConfig {\n\tparent?: string;\n\tttlSeconds?: number;\n\tprotected?: boolean;\n\tpostgres?: PostgresConfig;\n\t/** Optional for compatibility with hand-built configs. */\n\trealtimePolicy?: \"omitted\" | \"enabled\" | \"disabled\";\n\t/** Realtime options to apply when {@link realtimePolicy} is `\"enabled\"`. */\n\trealtime?: RealtimeConfig;\n\tauthEnabled: boolean;\n\tdataApiEnabled: boolean;\n\t/** Optional for compatibility with hand-built configs. */\n\tdataApiPolicy?: \"omitted\" | \"enabled\" | \"disabled\";\n\t/**\n\t * Resolved Data API integration. Present iff {@link dataApiEnabled} is `true`. Carries the\n\t * create-time auth wiring and the updatable {@link DataApiSettings}.\n\t */\n\tdataApi?: ResolvedDataApiConfig;\n\tpreview?: ResolvedPreviewConfig;\n\t/**\n\t * Resolved triggers from {@link Config.triggers}. Absent when none are declared\n\t * (hand-built configs may omit it).\n\t */\n\ttriggers?: ResolvedFunctionTrigger[];\n}\n\n/**\n * One concrete change `pushConfig` made (or, in dry-run, would make) on the remote.\n */\nexport interface AppliedChange {\n\t/**\n\t * `service` covers branch-scoped integrations driven by the branch policy (e.g.\n\t * Neon Auth, Data API).\n\t */\n\tkind: \"branch\" | \"service\";\n\taction: \"create\" | \"update\" | \"delete\" | \"noop\";\n\tidentifier: string;\n\tdetails?: Record<string, unknown>;\n}\n\n/**\n * A diff entry that conflicts with the desired config. `pushConfig` throws\n * {@link PushConflictError} on the first call when conflicts exist; pass\n * `updateExisting: true` to apply mutable drift (settings, `protected`, TTL, project\n * rename). Immutable fields (region, Postgres major version) are always conflicts —\n * recreate the project to change them.\n */\nexport interface ConflictReport {\n\tkind: \"branch\";\n\tidentifier: string;\n\tfield: string;\n\tcurrent: unknown;\n\tdesired: unknown;\n\treason: string;\n}\n\n/**\n * Result of a `pushConfig` invocation.\n */\nexport interface PushResult {\n\tprojectId: string;\n\torgId?: string;\n\tbranchId: string;\n\tbranchName: string;\n\t/**\n\t * `true` when `pushConfig` was called with `{ dryRun: true }`. `applied` then records\n\t * what **would** be applied on a real push; no API mutations were performed.\n\t */\n\tdryRun: boolean;\n\tapplied: AppliedChange[];\n\tconflicts: ConflictReport[];\n\t/**\n\t * Declared custom domains for this branch after the push (or what apply would\n\t * leave in place). `cnameTarget` is omitted when the domain is not registered yet\n\t * (dry-run of a new registration). An empty string means the region has no\n\t * custom-domains front door.\n\t */\n\tcustomDomains?: Array<{\n\t\tdomain: string;\n\t\tslug: string;\n\t\tcnameTarget?: string;\n\t}>;\n\t/**\n\t * Advisory findings from the push — a function that bundles a native dependency it never\n\t * declared, or a staged package whose version could not be pinned.\n\t *\n\t * Returned rather than logged, because a library has no business choosing an output\n\t * channel, and returned rather than left to an opt-in callback, because these are the\n\t * only warning that a deployed function will fail at invoke and an unregistered callback\n\t * is easy to never notice. Empty when there is nothing to report.\n\t *\n\t * Only populated by the built-in bundler: a caller that injects its own `bundleFunction`\n\t * owns its own reporting.\n\t */\n\twarnings: string[];\n}\n"],"mappings":";;;;;;AAKA,MAAa,gBAAgB;CAC5B;CAAM;CAAK;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAG;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CACtE;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AACrE;;;;;;;;;;;;;AA2NA,MAAa,0BAA0B,CAAC,QAAQ,UAAU"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neondatabase/config",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Config-as-Code for Neon. Define a `neon.ts` policy and inspect/diff/deploy it against the Neon API as plain TypeScript functions.",
   "keywords": [
     "neon",
@@ -51,7 +51,7 @@
   "dependencies": {
     "jiti": "^2.7.0",
     "zod": "^4.5.4",
-    "@neon/sdk": "7.7.0"
+    "@neon/sdk": "7.8.0"
   },
   "engines": {
     "node": ">=20.19.0"