@neondatabase/env 0.11.5 → 0.11.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/config/dist/lib/neon-api.d.ts.map +1 -1
  2. package/dist/config/dist/lib/types.d.ts.map +1 -1
  3. package/dist/lib/cli/commands.d.ts.map +1 -1
  4. package/dist/lib/cli/resolve-context.d.ts.map +1 -1
  5. package/dist/lib/env.d.ts.map +1 -1
  6. package/package.json +3 -3
package/dist/config/dist/lib/neon-api.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"neon-api.d.ts","names":["BucketAccessLevel","ComputeSettings","CredentialPrincipalType","CredentialScope","DataApiAuthProvider","DataApiSettings","FunctionRuntime","NeonProjectSnapshot","NeonBranchSnapshot","NeonEndpointSnapshot","CreateProjectInput","CreateBranchInput","UpdateBranchInput","NeonRoleSnapshot","NeonDatabaseSnapshot","NeonAuthSnapshot","NeonDataApiSnapshot","EnableDataApiInput","NeonBucketSnapshot","NeonBranchStorageSnapshot","CreateBucketInput","NeonFunctionSnapshot","DeployFunctionInput","Uint8Array","Record","NeonFunctionDeploymentSnapshot","CreateCredentialInput","NeonCredentialSecret","NeonCredentialMeta","GetConnectionUriInput","NeonApi","Promise"],"sources":["../../../../../config/dist/lib/neon-api.d.ts"],"sourcesContent":["import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from \"./types.js\";\n\n//#region src/lib/neon-api.d.ts\n\n/**\n * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream\n * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream\n * shape — keeping the surface narrow makes the in-memory fake practical to maintain.\n */\ninterface NeonProjectSnapshot {\n id: string;\n name: string;\n regionId: string;\n pgVersion: number;\n orgId?: string;\n defaultEndpointSettings?: ComputeSettings;\n}\ninterface NeonBranchSnapshot {\n id: string;\n name: string;\n parentId?: string;\n isDefault: boolean;\n /** Whether the branch is marked protected on Neon. */\n protected: boolean;\n expiresAt?: string;\n}\ninterface NeonEndpointSnapshot {\n id: string;\n branchId: string;\n type: \"read_only\" | \"read_write\";\n autoscalingLimitMinCu: ComputeSettings[\"autoscalingLimitMinCu\"];\n autoscalingLimitMaxCu: ComputeSettings[\"autoscalingLimitMaxCu\"];\n suspendTimeout: ComputeSettings[\"suspendTimeout\"];\n}\ninterface CreateProjectInput {\n name: string;\n regionId: string;\n pgVersion?: number;\n orgId?: string;\n defaultEndpointSettings?: ComputeSettings;\n /**\n * Optional name for the project's auto-created default branch. When omitted, Neon\n * uses its own default (`main`).\n */\n defaultBranchName?: string;\n}\ninterface CreateBranchInput {\n name: string;\n parentId?: string;\n expiresAt?: string;\n /** When `true`, the branch is created with the `protected` flag set on Neon. */\n protected?: boolean;\n computeSettings?: ComputeSettings;\n}\ninterface UpdateBranchInput {\n name?: string;\n expiresAt?: string | null;\n /** When set, toggles the branch's `protected` flag on Neon. */\n protected?: boolean;\n}\n/**\n * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by\n * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI\n * with the role's password baked in.\n */\ninterface NeonRoleSnapshot {\n name: string;\n branchId: string;\n /** Whether the role is system-protected (cannot be deleted). */\n protected: boolean;\n}\n/**\n * A database on a Neon branch (e.g. `neondb`).\n */\ninterface NeonDatabaseSnapshot {\n name: string;\n branchId: string;\n /** The role that owns the database (one role can own multiple databases). */\n ownerName: string;\n}\n/**\n * Bits of a Neon Auth integration. The key fields are optional because the Neon API only\n * includes them on create / rotate responses; `GET /auth` returns the public fields.\n */\ninterface NeonAuthSnapshot {\n /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */\n projectId: string;\n /** Public client key (`pub_client_key`), only present on create / rotate responses. */\n publishableClientKey?: string;\n /** Secret server key (`secret_server_key`), only present on create / rotate responses. */\n secretServerKey?: string;\n /** JWKS URL for verifying tokens issued by Neon Auth. */\n jwksUrl: string;\n /** Optional base URL of the Neon Auth deployment. */\n baseUrl?: string;\n}\n/**\n * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of\n * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed\n * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing\n * when present and ignored when absent.\n */\ninterface NeonDataApiSnapshot {\n /** REST endpoint URL. */\n url: string;\n /** Deployment status (e.g. `\"ready\"`), when reported. */\n status?: string;\n /** Current runtime settings (SubZero only); `null`/absent when not reported. */\n settings?: DataApiSettings | null;\n}\n/**\n * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data\n * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the\n * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).\n * `authProvider` is the friendly `\"neon\"` / `\"external\"` value (mapped to the API's\n * `neon_auth` / `external` by the adapter).\n */\ninterface EnableDataApiInput {\n authProvider?: DataApiAuthProvider;\n jwksUrl?: string;\n providerName?: string;\n jwtAudience?: string;\n settings?: DataApiSettings;\n}\n/**\n * A branchable object-storage bucket (Preview). Backed by the Neon Platform\n * branchable-storage service.\n */\ninterface NeonBucketSnapshot {\n name: string;\n accessLevel: BucketAccessLevel;\n}\n/**\n * S3-compatible connection details for a branch's object storage (Preview) — the\n * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it\n * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from\n * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's\n * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the\n * path).\n */\ninterface NeonBranchStorageSnapshot {\n /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */\n s3Endpoint: string;\n /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */\n region: string;\n /** Whether the S3 client must use path-style addressing (always `true` today). */\n forcePathStyle: boolean;\n}\n/**\n * Input for creating a bucket on a branch.\n */\ninterface CreateBucketInput {\n name: string;\n accessLevel?: BucketAccessLevel;\n}\n/**\n * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:\n * the immutable `slug`, the display `name`, and the active deployment id when one exists.\n */\ninterface NeonFunctionSnapshot {\n /** Opaque, stable function identifier. */\n id: string;\n /** Branch-unique slug (the invocation path segment). Immutable. */\n slug: string;\n /** Free-form display name. */\n name: string;\n /** URL at which the function is invoked. */\n invocationUrl: string;\n /** Id (platform version number) of the active deployment, when any code is deployed. */\n activeDeploymentId?: number;\n}\n/**\n * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the\n * function source — building it (esbuild + zip) is an imperative step performed by the\n * caller, not by the {@link NeonApi} adapter.\n */\ninterface DeployFunctionInput {\n bundle: Uint8Array;\n runtime: FunctionRuntime;\n environment: Record<string, string>;\n}\n/**\n * A function deployment (Preview).\n */\ninterface NeonFunctionDeploymentSnapshot {\n /** The deployment id (monotonic per function). */\n id: number;\n status: \"pending\" | \"building\" | \"completed\" | \"failed\";\n}\n/**\n * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`\n * (`POST .../credentials`, `x-stability-level: beta`):\n *\n * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's\n * enabled Preview features, never hand-authored).\n * - `principalType` — `user` (developer/app) or `function` (a deployed function).\n * - `functionId` — required when `principalType === \"function\"`.\n * - `name` — optional free-form label echoed back on the response.\n */\ninterface CreateCredentialInput {\n scopes: CredentialScope[];\n principalType: CredentialPrincipalType;\n functionId?: string;\n name?: string;\n}\n/**\n * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API\n * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly\n * once** (they are not stored server-side), so the caller must persist them immediately;\n * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`\n * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles\n * as the S3 access-key id.\n */\ninterface NeonCredentialSecret {\n tokenId: string;\n tokenIdShort: string;\n name?: string;\n /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */\n apiToken: string;\n /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */\n s3SecretAccessKey: string;\n scopes: CredentialScope[];\n branchId: string;\n createdAt: string;\n /** When the credential expires; absent means it never expires. */\n expiresAt?: string;\n}\n/**\n * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by\n * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.\n */\ninterface NeonCredentialMeta {\n tokenId: string;\n tokenIdShort: string;\n name?: string;\n scopes: CredentialScope[];\n principalType: CredentialPrincipalType;\n functionId?: string;\n branchId?: string;\n createdAt: string;\n lastUsedAt?: string;\n revokedAt?: string;\n expiresAt?: string;\n}\n/**\n * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`\n * are optional — when omitted, the API uses the project's default branch and that\n * branch's read-write endpoint, respectively.\n */\ninterface GetConnectionUriInput {\n branchId?: string;\n endpointId?: string;\n databaseName: string;\n roleName: string;\n /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */\n pooled?: boolean;\n}\n/**\n * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`\n * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us\n * inject a real in-memory fake during tests without resorting to module mocks.\n */\ninterface NeonApi {\n listProjects(filter: {\n orgId?: string;\n }): Promise<NeonProjectSnapshot[]>;\n getProject(projectId: string): Promise<NeonProjectSnapshot>;\n createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;\n updateProject(projectId: string, input: {\n name?: string;\n defaultEndpointSettings?: ComputeSettings;\n }): Promise<NeonProjectSnapshot>;\n listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;\n createBranch(projectId: string, input: CreateBranchInput): Promise<{\n branch: NeonBranchSnapshot;\n endpoints: NeonEndpointSnapshot[];\n }>;\n updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;\n listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;\n updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;\n /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */\n listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;\n /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */\n listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;\n /**\n * Fetch a Postgres connection URI for the given role + database on a branch.\n * Returns the same string the Neon Console shows under \"Connection Details\".\n */\n getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{\n uri: string;\n }>;\n /**\n * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when\n * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`\n * namespace can be populated.\n */\n getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;\n /**\n * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration\n * is already enabled, the existing snapshot is returned unchanged. Used by\n * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.\n */\n enableNeonAuth(projectId: string, branchId: string, input?: {\n databaseName?: string;\n }): Promise<NeonAuthSnapshot>;\n /**\n * Fetch the Neon Data API integration attached to a specific branch + database.\n * Returns `null` when no integration is enabled — used by `fetchEnv` to decide\n * whether the `env.dataApi` namespace can be populated.\n */\n getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;\n /**\n * Enable the Neon Data API integration on a specific branch + database. Idempotent:\n * if an integration is already enabled, the existing snapshot is returned unchanged.\n * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The\n * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial\n * settings; omit it for an all-defaults, Neon-Auth integration.\n */\n enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;\n /**\n * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration\n * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only\n * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at\n * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.\n */\n updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;\n /** List branchable object-storage buckets visible on a branch. */\n listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;\n /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */\n createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;\n /** Delete a bucket from a branch. */\n deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;\n /**\n * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,\n * path-style). Returns `null` when storage is not enabled for the branch (the API's 404\n * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env\n * alongside the minted credential's access keys.\n */\n getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;\n /** List functions on a branch. */\n listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;\n /** Delete a function (by slug) from a branch. */\n deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;\n /**\n * Deploy a built bundle to a function, creating the function if it does not yet exist —\n * Neon has no separate create endpoint, so the first deployment to a slug creates the\n * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)\n * by the caller and passed in as bytes.\n */\n deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;\n /**\n * Mint a new scoped service credential on a branch (`POST .../credentials`). The\n * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`\n * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the\n * unified credential for the branch's enabled Preview features (object storage, AI\n * Gateway, Functions).\n */\n createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;\n /**\n * List the secret-free metadata for credentials issued on a branch\n * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)\n * and to verify a persisted credential still exists / isn't revoked.\n */\n listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;\n /**\n * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).\n * Idempotent.\n */\n revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;\n}\n//#endregion\nexport { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };\n//# sourceMappingURL=neon-api.d.ts.map"],"mappings":";;;;;AAe2C;AAEf;;;;UARlBO,mBAAAA,CAuBQN;EAAe,EAAA,EAAA,MAAA;EAAA,IAEvBS,EAAAA,MAAAA;EAKiC,QAOjCC,EAAAA,MAAAA;EAMyB,SAEzBC,EAAAA,MAAAA;EAAiB,KAWjBC,CAAAA,EAAAA,MAAAA;EAAgB,uBAShBC,CAAAA,EA3DkBb,eA2DE;AAAA;AAUJ,UAnEhBO,kBAAAA,CAqFmB;EAMD,EASlBS,EAAAA,MAAAA;EAAkB,IAAA,EAAA,MAAA;UACXb,CAAAA,EAAAA,MAAAA;WAIJC,EAAAA,OAAAA;EAAe;EAAA,SAMlBa,EAAAA,OAAAA;EAEsB,SAUtBC,CAAAA,EAAAA,MAAAA;AAAyB;AAaF,UA/HvBV,oBAAAA,CAqIoB;EAAA,EAiBpBa,EAAAA,MAAAA;EAAmB,QAAA,EAAA,MAAA;QACnBC,WAAAA,GAAAA,YAAAA;uBACCjB,EApJcL,eAoJdK,CAAAA,uBAAAA,CAAAA;uBACIkB,EApJUvB,eAoJVuB,CAAAA,uBAAAA,CAAAA;EAAM,cAAA,EAnJHvB,eAmJG,CAAA,gBAAA,CAAA;AAAA;AAKmB,UAtJ9BS,kBAAAA,CAqKqB;EAAA,IAAA,EAAA,MAAA;UACrBP,EAAAA,MAAAA;WACOD,CAAAA,EAAAA,MAAAA;EAAuB,KAAA,CAAA,EAAA,MAAA;EAAA,uBAY9ByB,CAAAA,EA9KkB1B,eAsLlBE;EAAe;;;;EAee,iBAAA,CAAA,EAAA,MAAA;AAAA;AAaT,UA3MrBQ,iBAAAA,CAwNO;EAAA,IAAA,EAAA,MAAA;UAGHJ,CAAAA,EAAAA,MAAAA;WAARwB,CAAAA,EAAAA,MAAAA;;WAC2BA,CAAAA,EAAAA,OAAAA;iBACVrB,CAAAA,EAvNHT,eAuNGS;;UArNbE,iBAAAA,CAqNkCmB;OAGd9B,EAAAA,MAAAA;WAChBM,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;;WAC6BC,CAAAA,EAAAA,OAAAA;;;;;;;UA/MjCK,gBAAAA,CAoN6EL;QAARuB,MAAAA;UACnCtB,EAAAA,MAAAA;;WACsBR,EAAAA,OAAAA;;;;;UA7MxDa,oBAAAA,CAiN0DA;QAARiB,MAAAA;UAKfF,EAAAA,MAAAA;;WAQed,EAAAA,MAAAA;;;;;;UApNlDA,gBAAAA,CA0OsFE;;WAAqBc,EAAAA,MAAAA;;sBAOOf,CAAAA,EAAAA,MAAAA;;iBAE1DE,CAAAA,EAAAA,MAAAA;;SAEDE,EAAAA,MAAAA;;SAAoBW,CAAAA,EAAAA,MAAAA;;;;;;;;UAnO3Ef,mBAAAA,CAuPqGS;;OAQhDC,MAAAA;;QAAwBK,CAAAA,EAAAA,MAAAA;;UAM/BA,CAAAA,EA/P3C1B,eA+P2C0B,GAAAA,IAAAA;;AAKyB;;;;;;;UA3PvEd,kBAAAA;iBACOb;;;;aAIJC;;;;;;UAMHa,kBAAAA;;eAEKlB;;;;;;;;;;UAULmB,yBAAAA;;;;;;;;;;;UAWAC,iBAAAA;;gBAEMpB;;;;;;UAMNqB,oBAAAA;;;;;;;;;;;;;;;;;UAiBAC,mBAAAA;UACAC;WACCjB;eACIkB;;;;;UAKLC,8BAAAA;;;;;;;;;;;;;;;UAeAC,qBAAAA;UACAvB;iBACOD;;;;;;;;;;;;UAYPyB,oBAAAA;;;;;;;;UAQAxB;;;;;;;;;;UAUAyB,kBAAAA;;;;UAIAzB;iBACOD;;;;;;;;;;;;;UAaP2B,qBAAAA;;;;;;;;;;;;;UAaAC,OAAAA;;;MAGJC,QAAQxB;iCACmBwB,QAAQxB;uBAClBG,qBAAqBqB,QAAQxB;;;8BAGtBN;MACxB8B,QAAQxB;mCACqBwB,QAAQvB;yCACFG,oBAAoBoB;YACjDvB;eACGC;;2DAE4CG,oBAAoBmB,QAAQvB;oCACnDuB,QAAQtB;kEACsBR,kBAAkB8B,QAAQtB;;wDAEpCsB,QAAQlB;;4DAEJkB,QAAQjB;;;;;6CAKvBe,wBAAwBE;;;;;;;;oDAQjBA,QAAQhB;;;;;;;;MAQtDgB,QAAQhB;;;;;;6EAM+DgB,QAAQf;;;;;;;;gGAQWC,qBAAqBc,QAAQf;;;;;;;kGAO3BX,kBAAkB0B,QAAQf;;0DAElEe,QAAQb;;iEAEDE,oBAAoBW,QAAQb;;+EAEda;;;;;;;gEAOfA,QAAQZ;;4DAEZY,QAAQV;;2EAEOU;;;;;;;iFAOMT,sBAAsBS,QAAQN;;;;;;;;+DAQhDC,wBAAwBK,QAAQJ;;;;;;wDAMvCI,QAAQH;;;;;0EAKUG"}
1
+ {"version":3,"file":"neon-api.d.ts","names":["BucketAccessLevel","ComputeSettings","CredentialPrincipalType","CredentialScope","DataApiAuthProvider","DataApiSettings","FunctionRuntime","NeonProjectSnapshot","NeonBranchSnapshot","NeonEndpointSnapshot","CreateProjectInput","CreateBranchInput","UpdateBranchInput","NeonRoleSnapshot","NeonDatabaseSnapshot","NeonAuthSnapshot","NeonDataApiSnapshot","EnableDataApiInput","NeonBucketSnapshot","NeonBranchStorageSnapshot","CreateBucketInput","NeonFunctionSnapshot","DeployFunctionInput","Uint8Array","Record","NeonFunctionDeploymentSnapshot","CreateCredentialInput","NeonCredentialSecret","NeonCredentialMeta","GetConnectionUriInput","NeonApi","Promise"],"sources":["../../../../../config/dist/lib/neon-api.d.ts"],"sourcesContent":["import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from \"./types.js\";\n\n//#region src/lib/neon-api.d.ts\n\n/**\n * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream\n * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream\n * shape — keeping the surface narrow makes the in-memory fake practical to maintain.\n */\ninterface NeonProjectSnapshot {\n id: string;\n name: string;\n regionId: string;\n pgVersion: number;\n orgId?: string;\n defaultEndpointSettings?: ComputeSettings;\n}\ninterface NeonBranchSnapshot {\n id: string;\n name: string;\n parentId?: string;\n isDefault: boolean;\n /** Whether the branch is marked protected on Neon. */\n protected: boolean;\n expiresAt?: string;\n}\ninterface NeonEndpointSnapshot {\n id: string;\n branchId: string;\n type: \"read_only\" | \"read_write\";\n autoscalingLimitMinCu: ComputeSettings[\"autoscalingLimitMinCu\"];\n autoscalingLimitMaxCu: ComputeSettings[\"autoscalingLimitMaxCu\"];\n suspendTimeout: ComputeSettings[\"suspendTimeout\"];\n}\ninterface CreateProjectInput {\n name: string;\n regionId: string;\n pgVersion?: number;\n orgId?: string;\n defaultEndpointSettings?: ComputeSettings;\n /**\n * Optional name for the project's auto-created default branch. When omitted, Neon\n * uses its own default (`main`).\n */\n defaultBranchName?: string;\n}\ninterface CreateBranchInput {\n name: string;\n parentId?: string;\n expiresAt?: string;\n /** When `true`, the branch is created with the `protected` flag set on Neon. */\n protected?: boolean;\n computeSettings?: ComputeSettings;\n}\ninterface UpdateBranchInput {\n name?: string;\n expiresAt?: string | null;\n /** When set, toggles the branch's `protected` flag on Neon. */\n protected?: boolean;\n}\n/**\n * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by\n * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI\n * with the role's password baked in.\n */\ninterface NeonRoleSnapshot {\n name: string;\n branchId: string;\n /** Whether the role is system-protected (cannot be deleted). */\n protected: boolean;\n}\n/**\n * A database on a Neon branch (e.g. `neondb`).\n */\ninterface NeonDatabaseSnapshot {\n name: string;\n branchId: string;\n /** The role that owns the database (one role can own multiple databases). */\n ownerName: string;\n}\n/**\n * Bits of a Neon Auth integration. The key fields are optional because the Neon API only\n * includes them on create / rotate responses; `GET /auth` returns the public fields.\n */\ninterface NeonAuthSnapshot {\n /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */\n projectId: string;\n /** Public client key (`pub_client_key`), only present on create / rotate responses. */\n publishableClientKey?: string;\n /** Secret server key (`secret_server_key`), only present on create / rotate responses. */\n secretServerKey?: string;\n /** JWKS URL for verifying tokens issued by Neon Auth. */\n jwksUrl: string;\n /** Optional base URL of the Neon Auth deployment. */\n baseUrl?: string;\n}\n/**\n * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of\n * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed\n * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing\n * when present and ignored when absent.\n */\ninterface NeonDataApiSnapshot {\n /** REST endpoint URL. */\n url: string;\n /** Deployment status (e.g. `\"ready\"`), when reported. */\n status?: string;\n /** Current runtime settings (SubZero only); `null`/absent when not reported. */\n settings?: DataApiSettings | null;\n}\n/**\n * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data\n * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the\n * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).\n * `authProvider` is the friendly `\"neon\"` / `\"external\"` value (mapped to the API's\n * `neon_auth` / `external` by the adapter).\n */\ninterface EnableDataApiInput {\n authProvider?: DataApiAuthProvider;\n jwksUrl?: string;\n providerName?: string;\n jwtAudience?: string;\n settings?: DataApiSettings;\n}\n/**\n * A branchable object-storage bucket (Preview). Backed by the Neon Platform\n * branchable-storage service.\n */\ninterface NeonBucketSnapshot {\n name: string;\n accessLevel: BucketAccessLevel;\n}\n/**\n * S3-compatible connection details for a branch's object storage (Preview) — the\n * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it\n * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from\n * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's\n * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the\n * path).\n */\ninterface NeonBranchStorageSnapshot {\n /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */\n s3Endpoint: string;\n /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */\n region: string;\n /** Whether the S3 client must use path-style addressing (always `true` today). */\n forcePathStyle: boolean;\n}\n/**\n * Input for creating a bucket on a branch.\n */\ninterface CreateBucketInput {\n name: string;\n accessLevel?: BucketAccessLevel;\n}\n/**\n * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:\n * the immutable `slug`, the display `name`, and the active deployment id when one exists.\n */\ninterface NeonFunctionSnapshot {\n /** Opaque, stable function identifier. */\n id: string;\n /** Branch-unique slug (the invocation path segment). Immutable. */\n slug: string;\n /** Free-form display name. */\n name: string;\n /** URL at which the function is invoked. */\n invocationUrl: string;\n /** Id (platform version number) of the active deployment, when any code is deployed. */\n activeDeploymentId?: number;\n}\n/**\n * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the\n * function source — building it (esbuild + zip) is an imperative step performed by the\n * caller, not by the {@link NeonApi} adapter.\n */\ninterface DeployFunctionInput {\n bundle: Uint8Array;\n runtime: FunctionRuntime;\n environment: Record<string, string>;\n}\n/**\n * A function deployment (Preview).\n */\ninterface NeonFunctionDeploymentSnapshot {\n /** The deployment id (monotonic per function). */\n id: number;\n status: \"pending\" | \"building\" | \"completed\" | \"failed\";\n}\n/**\n * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`\n * (`POST .../credentials`, `x-stability-level: beta`):\n *\n * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's\n * enabled Preview features, never hand-authored).\n * - `principalType` — `user` (developer/app) or `function` (a deployed function).\n * - `functionId` — required when `principalType === \"function\"`.\n * - `name` — optional free-form label echoed back on the response.\n */\ninterface CreateCredentialInput {\n scopes: CredentialScope[];\n principalType: CredentialPrincipalType;\n functionId?: string;\n name?: string;\n}\n/**\n * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API\n * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly\n * once** (they are not stored server-side), so the caller must persist them immediately;\n * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`\n * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles\n * as the S3 access-key id.\n */\ninterface NeonCredentialSecret {\n tokenId: string;\n tokenIdShort: string;\n name?: string;\n /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */\n apiToken: string;\n /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */\n s3SecretAccessKey: string;\n scopes: CredentialScope[];\n branchId: string;\n createdAt: string;\n /** When the credential expires; absent means it never expires. */\n expiresAt?: string;\n}\n/**\n * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by\n * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.\n */\ninterface NeonCredentialMeta {\n tokenId: string;\n tokenIdShort: string;\n name?: string;\n scopes: CredentialScope[];\n principalType: CredentialPrincipalType;\n functionId?: string;\n branchId?: string;\n createdAt: string;\n lastUsedAt?: string;\n revokedAt?: string;\n expiresAt?: string;\n}\n/**\n * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`\n * are optional — when omitted, the API uses the project's default branch and that\n * branch's read-write endpoint, respectively.\n */\ninterface GetConnectionUriInput {\n branchId?: string;\n endpointId?: string;\n databaseName: string;\n roleName: string;\n /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */\n pooled?: boolean;\n}\n/**\n * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`\n * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us\n * inject a real in-memory fake during tests without resorting to module mocks.\n */\ninterface NeonApi {\n listProjects(filter: {\n orgId?: string;\n }): Promise<NeonProjectSnapshot[]>;\n getProject(projectId: string): Promise<NeonProjectSnapshot>;\n createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;\n updateProject(projectId: string, input: {\n name?: string;\n defaultEndpointSettings?: ComputeSettings;\n }): Promise<NeonProjectSnapshot>;\n listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;\n createBranch(projectId: string, input: CreateBranchInput): Promise<{\n branch: NeonBranchSnapshot;\n endpoints: NeonEndpointSnapshot[];\n }>;\n updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;\n listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;\n updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;\n /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */\n listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;\n /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */\n listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;\n /**\n * Fetch a Postgres connection URI for the given role + database on a branch.\n * Returns the same string the Neon Console shows under \"Connection Details\".\n */\n getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{\n uri: string;\n }>;\n /**\n * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when\n * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`\n * namespace can be populated.\n */\n getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;\n /**\n * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration\n * is already enabled, the existing snapshot is returned unchanged. Used by\n * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.\n */\n enableNeonAuth(projectId: string, branchId: string, input?: {\n databaseName?: string;\n }): Promise<NeonAuthSnapshot>;\n /**\n * Fetch the Neon Data API integration attached to a specific branch + database.\n * Returns `null` when no integration is enabled — used by `fetchEnv` to decide\n * whether the `env.dataApi` namespace can be populated.\n */\n getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;\n /**\n * Enable the Neon Data API integration on a specific branch + database. Idempotent:\n * if an integration is already enabled, the existing snapshot is returned unchanged.\n * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The\n * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial\n * settings; omit it for an all-defaults, Neon-Auth integration.\n */\n enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;\n /**\n * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration\n * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only\n * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at\n * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.\n */\n updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;\n /** List branchable object-storage buckets visible on a branch. */\n listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;\n /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */\n createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;\n /** Delete a bucket from a branch. */\n deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;\n /**\n * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,\n * path-style). Returns `null` when storage is not enabled for the branch (the API's 404\n * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env\n * alongside the minted credential's access keys.\n */\n getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;\n /** List functions on a branch. */\n listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;\n /** Delete a function (by slug) from a branch. */\n deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;\n /**\n * Deploy a built bundle to a function, creating the function if it does not yet exist —\n * Neon has no separate create endpoint, so the first deployment to a slug creates the\n * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)\n * by the caller and passed in as bytes.\n */\n deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;\n /**\n * Mint a new scoped service credential on a branch (`POST .../credentials`). The\n * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`\n * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the\n * unified credential for the branch's enabled Preview features (object storage, AI\n * Gateway, Functions).\n */\n createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;\n /**\n * List the secret-free metadata for credentials issued on a branch\n * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)\n * and to verify a persisted credential still exists / isn't revoked.\n */\n listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;\n /**\n * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).\n * Idempotent.\n */\n revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;\n}\n//#endregion\nexport { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };\n//# sourceMappingURL=neon-api.d.ts.map"],"mappings":";;;;;AAe2C;AAEf;AASE;AAILC;AACAA;AACPA,UAvBRM,mBAAAA,CAuBQN;EAAe,EAAA,EAAA,MAAA;EAAA,IAEvBS,EAAAA,MAAAA;EAKiC,QAOjCC,EAAAA,MAAAA;EAMyB,SAEzBC,EAAAA,MAAAA;EAAiB,KAWjBC,CAAAA,EAAAA,MAAAA;EAAgB,uBAShBC,CAAAA,EA3DkBb,eA2DE;AAAA;AAUJ,UAnEhBO,kBAAAA,CAqFmB;EAMD,EASlBS,EAAAA,MAAAA;EAAkB,IAAA,EAAA,MAAA;EACXb,QAAAA,CAAAA,EAAAA,MAAAA;EAIJC,SAAAA,EAAAA,OAAAA;EAAe;EAAA,SAMlBa,EAAAA,OAAAA;EAEsB,SAUtBC,CAAAA,EAAAA,MAAAA;AAAyB;AAaF,UA/HvBV,oBAAAA,CAqIoB;EAAA,EAiBpBa,EAAAA,MAAAA;EAAmB,QAAA,EAAA,MAAA;EACnBC,IAAAA,EAAAA,WAAAA,GAAAA,YAAAA;EACCjB,qBAAAA,EApJcL,eAoJdK,CAAAA,uBAAAA,CAAAA;EACIkB,qBAAAA,EApJUvB,eAoJVuB,CAAAA,uBAAAA,CAAAA;EAAM,cAAA,EAnJHvB,eAmJG,CAAA,gBAAA,CAAA;AAAA;AAKmB,UAtJ9BS,kBAAAA,CAqKqB;EAAA,IAAA,EAAA,MAAA;EACrBP,QAAAA,EAAAA,MAAAA;EACOD,SAAAA,CAAAA,EAAAA,MAAAA;EAAuB,KAAA,CAAA,EAAA,MAAA;EAAA,uBAY9ByB,CAAAA,EA9KkB1B,eAsLlBE;EAAe;AAUG;AAIlBA;AACOD;EAAuB,iBAAA,CAAA,EAAA,MAAA;AAAA;AAaT,UA3MrBS,iBAAAA,CAwNO;EAAA,IAAA,EAAA,MAAA;EAGHJ,QAAAA,CAAAA,EAAAA,MAAAA;EAARwB,SAAAA,CAAAA,EAAAA,MAAAA;EACmCxB;EAARwB,SAAAA,CAAAA,EAAAA,OAAAA;EACVrB,eAAAA,CAAAA,EAvNHT,eAuNGS;AAA6BH;AAARwB,UArNlCnB,iBAAAA,CAqNkCmB;EAGd9B,IAAAA,CAAAA,EAAAA,MAAAA;EAChBM,SAAAA,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;EAARwB;EACqCvB,SAAAA,CAAAA,EAAAA,OAAAA;AAARuB;AACMpB;AAC7BH;AACGC;AAF8CsB;AAIFnB;AAA4BJ,UApN7EK,gBAAAA,CAoN6EL;EAARuB,IAAAA,EAAAA,MAAAA;EACnCtB,QAAAA,EAAAA,MAAAA;EAARsB;EAC8B9B,SAAAA,EAAAA,OAAAA;AAA0BQ;AAARsB;AAEpBlB;AAARkB;AAEYjB,UAjN1DA,oBAAAA,CAiN0DA;EAARiB,IAAAA,EAAAA,MAAAA;EAKfF,QAAAA,EAAAA,MAAAA;EAAwBE;EAQThB,SAAAA,EAAAA,MAAAA;AAARgB;AAQtChB;AAARgB;AAM+Ef;AAARe;AAQmBd,UA1OtFF,gBAAAA,CA0OsFE;EAA6BD;EAARe,SAAAA,EAAAA,MAAAA;EAOnB1B;EAA0BW,oBAAAA,CAAAA,EAAAA,MAAAA;EAARe;EAElDb,eAAAA,CAAAA,EAAAA,MAAAA;EAARa;EAEOX,OAAAA,EAAAA,MAAAA;EAA4BF;EAARa,OAAAA,CAAAA,EAAAA,MAAAA;AAENA;AAOPZ;AAARY;AAEIV;AAARU;AAEeA;AAOMT;AAA8BG,UAvPrGT,mBAAAA,CAuPqGS;EAARM;EAQxCL,GAAAA,EAAAA,MAAAA;EAAgCC;EAARI,MAAAA,CAAAA,EAAAA,MAAAA;EAMvBH;EAARG,QAAAA,CAAAA,EA/P3C1B,eA+P2C0B,GAAAA,IAAAA;AAKkBA;AAAO;;;;;;;UA3PvEd,kBAAAA;iBACOb;;;;aAIJC;;;;;;UAMHa,kBAAAA;;eAEKlB;;;;;;;;;;UAULmB,yBAAAA;;;;;;;;;;;UAWAC,iBAAAA;;gBAEMpB;;;;;;UAMNqB,oBAAAA;;;;;;;;;;;;;;;;;UAiBAC,mBAAAA;UACAC;WACCjB;eACIkB;;;;;UAKLC,8BAAAA;;;;;;;;;;;;;;;UAeAC,qBAAAA;UACAvB;iBACOD;;;;;;;;;;;;UAYPyB,oBAAAA;;;;;;;;UAQAxB;;;;;;;;;;UAUAyB,kBAAAA;;;;UAIAzB;iBACOD;;;;;;;;;;;;;UAaP2B,qBAAAA;;;;;;;;;;;;;UAaAC,OAAAA;;;MAGJC,QAAQxB;iCACmBwB,QAAQxB;uBAClBG,qBAAqBqB,QAAQxB;;;8BAGtBN;MACxB8B,QAAQxB;mCACqBwB,QAAQvB;yCACFG,oBAAoBoB;YACjDvB;eACGC;;2DAE4CG,oBAAoBmB,QAAQvB;oCACnDuB,QAAQtB;kEACsBR,kBAAkB8B,QAAQtB;;wDAEpCsB,QAAQlB;;4DAEJkB,QAAQjB;;;;;6CAKvBe,wBAAwBE;;;;;;;;oDAQjBA,QAAQhB;;;;;;;;MAQtDgB,QAAQhB;;;;;;6EAM+DgB,QAAQf;;;;;;;;gGAQWC,qBAAqBc,QAAQf;;;;;;;kGAO3BX,kBAAkB0B,QAAQf;;0DAElEe,QAAQb;;iEAEDE,oBAAoBW,QAAQb;;+EAEda;;;;;;;gEAOfA,QAAQZ;;4DAEZY,QAAQV;;2EAEOU;;;;;;;iFAOMT,sBAAsBS,QAAQN;;;;;;;;+DAQhDC,wBAAwBK,QAAQJ;;;;;;wDAMvCI,QAAQH;;;;;0EAKUG"}
package/dist/config/dist/lib/types.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","names":["ComputeUnit","DurationUnit","DurationString","SuspendTimeoutSuggestion","TtlSuggestion","DurationField","Suggestions","NonNullable","ComputeSettings","BranchTarget","ServiceToggle","ServiceToggleInput","ServiceEnabled","T","PostgresConfig","DATA_API_AUTH_PROVIDERS","DataApiAuthProvider","DataApiSettings","DataApiConfigBase","DataApiNeonAuthConfig","DataApiExternalAuthConfig","DataApiConfig","DataApiInput","FunctionRuntime","FunctionDevConfig","FunctionDef","Record","CredentialScope","CredentialPrincipalType","BucketAccessLevel","BucketDef","PreviewInput","FunctionTuning","PreviewTuning","Slug","Partial","BranchTuning","FunctionSlugsOf","Preview","F","Extract","BranchTuningFn","Config","Auth","DataApi","ResolvedFunctionConfig","ResolvedBucketConfig","ResolvedPreviewConfig","ResolvedDataApiConfig","ResolvedBranchConfig","AppliedChange","ConflictReport","PushResult"],"sources":["../../../../../config/dist/lib/types.d.ts"],"sourcesContent":["//#region src/lib/types.d.ts\n/**\n * Valid Neon Compute Unit values.\n * Most plans support 0.25, 0.5, 1, 2, 4, 8. Higher values may be available on Business plans.\n */\ntype ComputeUnit = 0.25 | 0.5 | 1 | 2 | 4 | 8;\n/** Time units accepted in a {@link DurationString}: seconds, minutes, hours, days, weeks. */\ntype DurationUnit = \"s\" | \"m\" | \"h\" | \"d\" | \"w\";\n/**\n * A Neon duration string: a positive integer **followed by a unit** — `s` (seconds),\n * `m` (minutes), `h` (hours), `d` (days), or `w` (weeks). Used by\n * {@link ComputeSettings.suspendTimeout} and {@link BranchTuning.ttl}.\n *\n * A **unit is required**: a bare numeric string like `\"7\"` is rejected at the type level. To\n * express a raw number of seconds, pass a `number` (`300`) — not a string (`\"300\"`). This\n * removes the old ambiguity where `\"7\"` silently meant 7 *seconds* instead of, say, `\"7d\"`.\n *\n * @example \"5m\" // 5 minutes\n * @example \"1h\" // 1 hour\n * @example \"7d\" // 7 days\n */\ntype DurationString = `${number}${DurationUnit}`;\n/**\n * Autocomplete suggestions for {@link ComputeSettings.suspendTimeout}. Every value sits inside\n * the Neon API's allowed scale-to-zero band: **60s–604800s** (1 minute – 1 week). This is *not*\n * a closed set — the field also accepts any other {@link DurationString} or a `number` of\n * seconds; out-of-range values type-check but are rejected at apply time.\n */\ntype SuspendTimeoutSuggestion = \"1m\" | \"5m\" | \"15m\" | \"30m\" | \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"7d\";\n/**\n * Autocomplete suggestions for {@link BranchTuning.ttl}. Every value sits within the Neon API's\n * branch-expiration limit (**max 30 days** from creation; the Console's own presets are 1h / 1d\n * / 7d). This is *not* a closed set — the field also accepts any other {@link DurationString} or\n * a `number` of seconds; values over 30 days are rejected at apply time.\n */\ntype TtlSuggestion = \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"3d\" | \"7d\" | \"14d\" | \"30d\";\n/**\n * Compose a field's duration type: its curated autocomplete `Suggestions` plus the open\n * `DurationString` template (so any `<integer><unit>` string still type-checks) and a `number`\n * of seconds. Intersecting the template arm with `NonNullable<unknown>` stops TypeScript from\n * collapsing the literal suggestions into the template, which is what preserves the autocomplete.\n */\ntype DurationField<Suggestions extends DurationString> = Suggestions | (DurationString & NonNullable<unknown>) | number;\n/**\n * Compute settings applied to the read/write endpoint of a branch.\n *\n * Mirrors the subset of {@link https://api-docs.neon.tech/reference/getting-started-with-neon-api Neon endpoint}\n * fields that we expose as IaC primitives. Anything left undefined falls back to the project's\n * `default_endpoint_settings` (which themselves fall back to Neon platform defaults).\n */\ninterface ComputeSettings {\n /**\n * Minimum number of Compute Units. Set to 0.25 for true scale-to-zero.\n * @example 0.25 // scale-to-zero\n * @example 1 // always-on with 1 CU minimum\n */\n autoscalingLimitMinCu?: ComputeUnit;\n /**\n * Maximum number of Compute Units for autoscaling.\n * @example 2\n * @example 8\n */\n autoscalingLimitMaxCu?: ComputeUnit;\n /**\n * How long an idle compute waits before suspending (Neon's scale-to-zero). Accepts a\n * {@link DurationString} (autocompletes common values), a number of seconds, or `false`.\n *\n * - `false` — never suspend (always-on compute)\n * - {@link DurationString} — e.g. `\"5m\"`; autocompletes the in-range values `\"1m\"`, `\"5m\"`,\n * `\"15m\"`, `\"30m\"`, `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`, `\"7d\"`, and accepts any other\n * `<integer><unit>` (units: `s`, `m`, `h`, `d`, `w`). A **unit is required** — for raw\n * seconds pass a `number`, not a string.\n * - `number` — custom timeout in **seconds**, must be in `60`–`604800` (1 minute to 1 week)\n * - `undefined` — use the Neon platform default (currently 300s / 5 minutes)\n *\n * Whichever form you use, the resolved timeout must fall in `60`–`604800` seconds (the Neon\n * API limit); the suggestions are all within that band, anything else is checked at apply.\n *\n * @example false // never suspend (always-on)\n * @example \"5m\" // suspend after 5 minutes idle\n * @example \"1h\" // suspend after 1 hour idle\n * @example 300 // 5 minutes, expressed in seconds\n */\n suspendTimeout?: false | DurationField<SuspendTimeoutSuggestion>;\n}\n/**\n * Read-only descriptor of the branch a {@link Config} policy is being evaluated for — the\n * `branch` argument passed to your `defineConfig({ branch: (branch) => … })` closure. It describes\n * **which** branch this invocation decides for; it is not a live branch handle and must not\n * be mutated. Switch on its fields and return the desired {@link BranchConfig}.\n */\ninterface BranchTarget {\n /** Branch name being evaluated. For `branch dev`, this is the generated branch name. */\n name: string;\n /** Neon branch id when the branch already exists. Undefined during pre-create eval. */\n id?: string;\n /** Whether this branch already exists on Neon. */\n exists: boolean;\n /** Parent branch id from Neon when known. */\n parentId?: string;\n /** Whether Neon marks this branch as the project default. */\n isDefault?: boolean;\n /** Whether Neon currently marks this branch protected. */\n isProtected?: boolean;\n /** Current expiration timestamp from Neon, when set. */\n expiresAt?: string;\n}\n/**\n * Object form of a branch-scoped service toggle. `{}` or `{ enabled: true }` enables it;\n * `{ enabled: false }` opts out. Used as the object half of {@link ServiceToggleInput}.\n */\ninterface ServiceToggle {\n /** Defaults to `true` when the service namespace is present. Set `false` to opt out. */\n enabled?: boolean;\n}\n/**\n * How a branch-scoped service (Neon Auth, Data API, AI Gateway) is toggled in a policy.\n *\n * - `true` / `{}` / `{ enabled: true }` — enabled.\n * - `false` / `{ enabled: false }` — disabled.\n * - omitted (`undefined`) — not part of the policy at all.\n *\n * These toggles are **static** (they live in the top-level `defineConfig({ … })` object,\n * not in the per-branch `branch` closure) so the secret set they imply can be derived at\n * the type level — that's what makes `NeonEnv<typeof config>` exact.\n */\ntype ServiceToggleInput = boolean | ServiceToggle;\n/**\n * Resolve a **static** service toggle (`true` / `false` / `{ enabled?: boolean }` / object /\n * `undefined`) to a type-level boolean. The tuple wrapping (`[T] extends […]`) disables\n * distribution so a union/`undefined` is judged as a single unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n * (a present toggle defaults to enabled)\n * - the bare `boolean | … | undefined` (no literal info) → `false`\n *\n * Shared by the {@link Config} static cross-field checks and the `@neon/env`\n * `NeonEnv` namespace derivation, so both read \"is this service on?\" identically.\n */\ntype ServiceEnabled<T> = [T] extends [false] ? false : [T] extends [{\n enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n enabled: true;\n}] ? true : [T] extends [object] ? true : false;\ninterface PostgresConfig {\n computeSettings?: ComputeSettings;\n}\n/**\n * Authentication providers a Data API integration can verify JWTs against, as written in\n * `neon.ts`. Friendly authoring values (mapped to the Neon API's `neon_auth` / `external`\n * at the API boundary):\n *\n * - `\"neon\"` — verify tokens minted by **Neon Auth** on the same branch. Neon supplies the\n * JWKS URL / provider wiring for you, so the `jwksUrl` / `providerName` / `jwtAudience`\n * fields are forbidden (a type error) on this variant — and the policy must also enable\n * top-level `auth` (Neon Auth) so the tokens exist.\n * - `\"external\"` — verify tokens from a third-party IdP (Clerk, Stytch, Auth0, …). You\n * provide `jwksUrl` (and optionally `providerName` / `jwtAudience`).\n */\ndeclare const DATA_API_AUTH_PROVIDERS: readonly [\"neon\", \"external\"];\ntype DataApiAuthProvider = (typeof DATA_API_AUTH_PROVIDERS)[number];\n/**\n * Reusable runtime settings for a Data API integration (the Neon API `DataAPISettings`,\n * camelCased to match the rest of `neon.ts`). Every field is optional; omitted fields keep\n * the Neon defaults shown below. These are the **only** Data API fields that can change on\n * an already-enabled integration — drift here is reconciled as an *update* (requires\n * `updateExisting` / `--update-existing`); the create-only auth wiring above cannot.\n */\ninterface DataApiSettings {\n /** Enable the aggregates feature (`db_aggregates_enabled`). Default `true`. */\n dbAggregatesEnabled?: boolean;\n /** Database role used for anonymous requests (`db_anon_role`). Default `\"anonymous\"`. */\n dbAnonRole?: string;\n /** Extra schemas appended to the search path (`db_extra_search_path`). */\n dbExtraSearchPath?: string;\n /** Maximum rows returned in a single request (`db_max_rows`). */\n dbMaxRows?: number;\n /** Schemas exposed via the API (`db_schemas`). Default `[\"public\"]`. */\n dbSchemas?: string[];\n /** JWT claim key used for role extraction (`jwt_role_claim_key`). Default `\".role\"`. */\n jwtRoleClaimKey?: string;\n /** Maximum lifetime of the JWT cache, in seconds (`jwt_cache_max_lifetime`). */\n jwtCacheMaxLifetime?: number;\n /** OpenAPI spec mode (`openapi_mode`). Default `\"disabled\"`. */\n openapiMode?: \"ignore-privileges\" | \"disabled\";\n /** CORS allowed origins (`server_cors_allowed_origins`). */\n serverCorsAllowedOrigins?: string;\n /** Emit server-timing headers (`server_timing_enabled`). */\n serverTimingEnabled?: boolean;\n}\n/** Fields shared by every {@link DataApiConfig} variant. */\ninterface DataApiConfigBase {\n /** Defaults to `true` when the `dataApi` namespace is present. Set `false` to opt out. */\n enabled?: boolean;\n /** Reusable runtime settings. Drift here is reconciled as an update. */\n settings?: DataApiSettings;\n}\n/**\n * Data API verified by **Neon Auth** (`authProvider: \"neon\"`, the default). The external\n * IdP fields are statically forbidden (`?: never`) because Neon supplies them; declaring any\n * of them is a type error directing you to `authProvider: \"external\"`.\n */\ninterface DataApiNeonAuthConfig extends DataApiConfigBase {\n authProvider?: \"neon\";\n /** Forbidden with `authProvider: \"neon\"` — Neon provides the JWKS URL. */\n jwksUrl?: never;\n /** Forbidden with `authProvider: \"neon\"` — the provider is Neon Auth. */\n providerName?: never;\n /** Forbidden with `authProvider: \"neon\"` — Neon manages the audience. */\n jwtAudience?: never;\n}\n/**\n * Data API verified by an **external** IdP (`authProvider: \"external\"`). You provide the\n * JWKS URL (and optionally a provider label / expected audience).\n */\ninterface DataApiExternalAuthConfig extends DataApiConfigBase {\n authProvider: \"external\";\n /** URL that publishes the IdP's JWKS (JSON Web Key Set). */\n jwksUrl?: string;\n /** Human label for the IdP (e.g. \"Clerk\", \"Stytch\", \"Auth0\"). */\n providerName?: string;\n /**\n * Expected `aud` claim. ⚠️ This only **rejects** tokens carrying a *different* audience;\n * tokens with no `aud` claim are still accepted.\n */\n jwtAudience?: string;\n}\n/**\n * Object form of the `dataApi` toggle. A discriminated union on {@link DataApiAuthProvider}:\n * the `\"neon\"` variant forbids the external-IdP fields, the `\"external\"` variant allows them.\n */\ntype DataApiConfig = DataApiNeonAuthConfig | DataApiExternalAuthConfig;\n/**\n * How the Data API is toggled in a policy: a bare boolean (like the other service toggles)\n * or the richer {@link DataApiConfig} object. `true` / `{}` / `{ enabled: true }` enable it\n * with Neon defaults; `false` / `{ enabled: false }` opt out.\n */\ntype DataApiInput = boolean | DataApiConfig;\n/**\n * Supported function runtimes. Mirrors the Neon Functions deploy API `runtime` enum.\n * Only `nodejs24` exists today; kept as a union so adding runtimes later is a\n * non-breaking, type-checked change.\n */\ntype FunctionRuntime = \"nodejs24\";\n/**\n * Local-development settings for a function, used by `neon dev` when it serves every\n * function declared in `neon.ts` (i.e. invoked with no `--source`). Never affects deploy.\n */\ninterface FunctionDevConfig {\n /**\n * Port the local server binds. Bound exactly (and `neon dev` fails loudly if it is taken)\n * when set; a free port is found automatically when omitted.\n */\n port?: number;\n}\n/**\n * Static definition of a Neon Function (Preview feature). Declares that the function\n * **exists** on every branch; its branch-unique slug is the **record key** in\n * {@link PreviewInput.functions} (not a field here), so slugs are statically enumerable,\n * cannot duplicate, and the `branch` closure can only tune slugs that are declared here.\n *\n * A function is invoked like a Cloudflare/Vercel handler — its source module\n * `export default { fetch }` or `export async function handler(req): Response`. The\n * `source` path is bundled (esbuild) and uploaded as a deployment; the newest deployment\n * becomes active.\n *\n * Runtime tuning is **not** here — it varies per branch and lives in the `branch` closure\n * (see {@link FunctionTuning}). Memory is fixed by the platform policy for now and is not\n * user-configurable.\n */\ninterface FunctionDef {\n /** Free-form display name. @example \"Hello World\" */\n name: string;\n /**\n * Path to the function's entry module, **relative to `neon.ts`** (or absolute). The\n * module's default export (`{ fetch }`) or `handler` export is the function entry. This\n * path is resolved against the loaded `neon.ts` location and bundled with esbuild at\n * deploy time.\n *\n * We require a string path rather than an imported handler because a JS function value\n * carries no reference back to its source file, so esbuild has nothing to bundle from.\n * @example \"./functions/hello-world.ts\"\n */\n source: string;\n /**\n * Environment variables injected into the deployed function, keyed by the var name the\n * function reads at runtime. The **keys** are static (preserved at the type level so\n * `parseEnv(config, \"<slug>\").function.<key>` is typed); the **values** are arbitrary\n * strings evaluated when `neon.ts` is loaded (typically `process.env.X`) and uploaded\n * at `config apply`. Every value must be a defined string — a `process.env.X` that is\n * `undefined` (unset) errors at validation time rather than silently shipping\n * `undefined`.\n * @example { resendApiKey: process.env.RESEND_API_KEY ?? \"\" }\n */\n env?: Record<string, string>;\n /**\n * Local-development settings used by `neon dev` when serving every function from\n * `neon.ts`. Ignored at deploy time. See {@link FunctionDevConfig}.\n */\n dev?: FunctionDevConfig;\n}\n/**\n * A single capability a branch-scoped service credential may exercise (Preview). A\n * credential is granted a set of these and may only perform the listed actions. Mirrors\n * the Neon API `CredentialScope` enum (`x-stability-level: beta`):\n *\n * - `storage:read` / `storage:write` — object-storage (bucket) access via the S3 key.\n * - `ai_gateway:invoke` — call the AI Gateway with the bearer `api_token`.\n * - `functions:invoke` — invoke Neon Functions with the bearer `api_token`.\n *\n * The set a policy needs is derived from its enabled Preview features (see\n * {@link deriveCredentialScopes}); it is never authored by hand.\n */\ntype CredentialScope = \"storage:read\" | \"storage:write\" | \"ai_gateway:invoke\" | \"functions:invoke\";\n/**\n * Who a credential acts as. `user` is the developer/app principal minted for local dev and\n * app bootstrap (`fetchEnv` / `env pull`); `function` is a deployed-function principal\n * (carries a `function_id`). The env tooling only mints `user` credentials today.\n */\ntype CredentialPrincipalType = \"user\" | \"function\";\n/** Anonymous-access level for a branchable object-storage bucket. */\ntype BucketAccessLevel = \"private\" | \"public_read\";\n/**\n * Static definition of a branchable object-storage bucket (Preview feature). The bucket's\n * name is the **record key** in {@link PreviewInput.buckets}, so names are statically\n * enumerable and cannot duplicate.\n */\ninterface BucketDef {\n /**\n * Anonymous access level. `private` (default) requires authenticated reads/writes;\n * `public_read` allows anonymous GetObject/HeadObject.\n */\n access?: BucketAccessLevel;\n}\n/**\n * Static, branch-scoped **Preview** features. Grouped under `preview` to signal they are\n * backed by Neon `x-stability-level: beta` endpoints and may change before GA. Everything\n * here is existential (it determines what exists on the branch); per-branch tuning lives in\n * the `branch` closure.\n */\ninterface PreviewInput {\n /** Enable/disable the AI Gateway on the branch (toggle, like auth / dataApi). */\n aiGateway?: ServiceToggleInput;\n /** Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`). */\n functions?: Record<string, FunctionDef>;\n /** Object-storage buckets to create, keyed by bucket name. */\n buckets?: Record<string, BucketDef>;\n}\n/**\n * Per-branch deploy tuning for a single function. Returned (per slug) by the `branch`\n * closure. Deliberately **cannot** change the function's existence, source, name, env\n * **keys**, or memory — only runtime selection is currently configurable — so the static\n * secret/function set stays sound.\n */\ninterface FunctionTuning {\n /** Runtime to execute the function with. Defaults to `\"nodejs24\"`. */\n runtime?: FunctionRuntime;\n}\n/**\n * Per-branch tuning of Preview features. Only existing function slugs (those declared in\n * the static {@link PreviewInput.functions}) may be tuned — `Slug` is constrained to the\n * declared keys by {@link BranchTuningFn}.\n */\ninterface PreviewTuning<Slug extends string = string> {\n functions?: Partial<Record<Slug, FunctionTuning>>;\n}\n/**\n * The per-branch tuning object returned by the `branch` closure. It can adjust branch\n * lifecycle (`parent`, `ttl`, `protected`), Postgres compute settings, and per-function\n * deploy tuning — but **cannot** add/remove services or functions. That guarantee is what\n * keeps the static secret set (and therefore `NeonEnv`) exact.\n */\ninterface BranchTuning<Slug extends string = string> {\n /** Parent branch name used when creating a new branch. Not a Postgres setting. */\n parent?: string;\n /**\n * Branch time-to-live: how long after creation the branch should auto-expire. Applied\n * when creating a new branch and reconciled on existing branches (when `updateExisting`\n * is set). Accepts a {@link DurationString} (autocompletes common values) or a number of\n * seconds. Omit to keep the branch indefinitely.\n *\n * - {@link DurationString} — e.g. `\"7d\"`; autocompletes `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`,\n * `\"3d\"`, `\"7d\"`, `\"14d\"`, `\"30d\"`, and accepts any other `<integer><unit>` (units: `s`,\n * `m`, `h`, `d`, `w` — e.g. `\"12h\"`, `\"2w\"`). A **unit is required** — `\"7\"` is rejected;\n * for raw seconds pass a `number`.\n * - `number` — custom TTL in **seconds** (e.g. `3600`)\n * - `undefined` — no expiry; the branch persists until explicitly deleted\n *\n * The Neon API caps branch expiration at **30 days** from creation, so the resolved TTL must\n * be `> 0` and `<= 30d`; the suggestions stay within that limit and anything longer is\n * rejected at apply.\n *\n * @example \"1d\" // ephemeral preview branch: expires a day after creation\n * @example \"7d\" // one-week TTL\n * @example \"30d\" // the maximum the API allows\n * @example 3600 // 1 hour, expressed in seconds\n */\n ttl?: DurationField<TtlSuggestion>;\n /** Whether the selected branch should be protected. Undefined means \"leave as-is\". */\n protected?: boolean;\n postgres?: PostgresConfig;\n preview?: PreviewTuning<Slug>;\n}\n/** Extract the declared function slugs from a {@link PreviewInput} for closure typing. */\ntype FunctionSlugsOf<Preview extends PreviewInput | undefined> = Preview extends {\n functions: infer F;\n} ? Extract<keyof F, string> : string;\n/**\n * Signature of the `branch` closure. Generic over the static {@link PreviewInput} so the\n * `preview.functions` keys it may tune are constrained to the slugs actually declared.\n */\ntype BranchTuningFn<Preview extends PreviewInput | undefined = PreviewInput | undefined> = (branch: BranchTarget) => BranchTuning<FunctionSlugsOf<Preview>>;\n/**\n * A validated Neon branch policy — the value `defineConfig({ … })` returns and `neon.ts`\n * default-exports.\n *\n * Split into a **static** existential set (top-level `auth` / `dataApi` GA toggles plus the\n * beta `preview` block) and a **dynamic** per-branch `branch` closure for tuning. The\n * static half is what makes the secret set — and therefore `NeonEnv<typeof config>` and\n * `parseEnv` — exact; the closure can tune but never change what exists.\n *\n * Generic over the three static fields so the type system can read the exact toggle/slug\n * literals; the defaults make the bare `Config` a usable \"any policy\" type for runtime\n * function signatures.\n */\ninterface Config<Auth extends ServiceToggleInput | undefined = ServiceToggleInput | undefined, DataApi extends DataApiInput | undefined = DataApiInput | undefined, Preview extends PreviewInput | undefined = PreviewInput | undefined> {\n /** Neon Auth integration toggle (GA). Static — drives `NeonEnv.auth`. */\n auth?: Auth;\n /**\n * Neon Data API integration (GA). Static — drives `NeonEnv.dataApi`. A boolean/toggle, or\n * a {@link DataApiConfig} object selecting the auth provider (`\"neon\"` / `\"external\"`) and\n * runtime {@link DataApiSettings}. With `authProvider: \"neon\"` the policy must also enable\n * top-level `auth`.\n */\n dataApi?: DataApi;\n /** Beta (Preview) feature set: AI Gateway, functions, buckets. Static. */\n preview?: Preview;\n /** Per-branch tuning closure. Cannot change the static existential set. */\n branch?: BranchTuningFn<Preview>;\n}\n/**\n * A function with all deploy defaults applied. `resolveConfig` fills in `runtime` so\n * downstream diff/apply never has to re-derive it.\n */\ninterface ResolvedFunctionConfig {\n slug: string;\n name: string;\n source: string;\n env: Record<string, string>;\n runtime: FunctionRuntime;\n /**\n * Local-development settings, passed through untouched from {@link FunctionDef.dev}\n * (no defaults applied). Only consumed by `neon dev`; deploy ignores it.\n */\n dev?: FunctionDevConfig;\n}\n/** A bucket with its access level defaulted to `private`. */\ninterface ResolvedBucketConfig {\n name: string;\n access: BucketAccessLevel;\n}\n/**\n * Normalized {@link PreviewInput}. Only present on {@link ResolvedBranchConfig} when the\n * policy returned a `preview` block. `aiGatewayEnabled` follows the same\n * \"present-and-not-`false`\" semantics as `authEnabled` / `dataApiEnabled`.\n */\ninterface ResolvedPreviewConfig {\n functions: ResolvedFunctionConfig[];\n buckets: ResolvedBucketConfig[];\n aiGatewayEnabled: boolean;\n}\n/**\n * Normalized Data API integration. Present on {@link ResolvedBranchConfig} only when the\n * policy enables `dataApi`. `authProvider` always resolves (defaults to `\"neon\"`); the\n * external-IdP wiring is present only for `\"external\"`; `settings` carries the camelCase\n * runtime settings (reconciled as an update when they drift).\n */\ninterface ResolvedDataApiConfig {\n authProvider: DataApiAuthProvider;\n jwksUrl?: string;\n providerName?: string;\n jwtAudience?: string;\n settings?: DataApiSettings;\n}\ninterface ResolvedBranchConfig {\n parent?: string;\n ttlSeconds?: number;\n protected?: boolean;\n postgres?: PostgresConfig;\n authEnabled: boolean;\n dataApiEnabled: boolean;\n /**\n * Resolved Data API integration. Present iff {@link dataApiEnabled} is `true`. Carries the\n * create-time auth wiring and the updatable {@link DataApiSettings}.\n */\n dataApi?: ResolvedDataApiConfig;\n preview?: ResolvedPreviewConfig;\n}\n/**\n * One concrete change `pushConfig` made (or, in dry-run, would make) on the remote.\n */\ninterface AppliedChange {\n /**\n * `service` covers branch-scoped integrations driven by the branch policy (e.g.\n * Neon Auth, Data API).\n */\n kind: \"branch\" | \"service\";\n action: \"create\" | \"update\" | \"noop\";\n identifier: string;\n details?: Record<string, unknown>;\n}\n/**\n * A diff entry that conflicts with the desired config. `pushConfig` throws\n * {@link PushConflictError} on the first call when conflicts exist; pass\n * `updateExisting: true` to apply mutable drift (settings, `protected`, TTL, project\n * rename). Immutable fields (region, Postgres major version) are always conflicts —\n * recreate the project to change them.\n */\ninterface ConflictReport {\n kind: \"branch\";\n identifier: string;\n field: string;\n current: unknown;\n desired: unknown;\n reason: string;\n}\n/**\n * Result of a `pushConfig` invocation.\n */\ninterface PushResult {\n projectId: string;\n orgId?: string;\n branchId: string;\n branchName: string;\n /**\n * `true` when `pushConfig` was called with `{ dryRun: true }`. `applied` then records\n * what **would** be applied on a real push; no API mutations were performed.\n */\n dryRun: boolean;\n applied: AppliedChange[];\n conflicts: ConflictReport[];\n}\n//#endregion\nexport { AppliedChange, BranchTarget, BranchTuning, BranchTuningFn, BucketAccessLevel, BucketDef, ComputeSettings, ComputeUnit, Config, ConflictReport, CredentialPrincipalType, CredentialScope, DATA_API_AUTH_PROVIDERS, DataApiAuthProvider, DataApiConfig, DataApiExternalAuthConfig, DataApiInput, DataApiNeonAuthConfig, DataApiSettings, DurationString, DurationUnit, FunctionDef, FunctionDevConfig, FunctionRuntime, FunctionTuning, PostgresConfig, PreviewInput, PreviewTuning, PushResult, ResolvedBranchConfig, ResolvedBucketConfig, ResolvedDataApiConfig, ResolvedFunctionConfig, ResolvedPreviewConfig, ServiceEnabled, ServiceToggle, ServiceToggleInput };\n//# sourceMappingURL=types.d.ts.map"],"mappings":";;;AAKgB;AAEC;AAc6B;AAOjB,KAvBxBA,WAAAA,GA8BAI,IAAa,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA;AAAA;KA5BbH,YAAAA,GAmCa,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA;;;;;AAAkF;AAAA;;;;;;AAyC5D;AAAA;AAQlB,KAtEjBC,cAAAA,GA0FkB,GAAA,MAAA,GA1FWD,YA0FX,EAAA;AAAA;AAiCT;AAEqB;AAciC;AACV;AAQjC;AA2BG,KAxKvBE,wBAAAA,GA+K0B,IAAA,GAASe,IAAAA,GAAAA,KAAAA,GAAAA,KAAiB,GAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,IAAA,GAAA,IAAA;AAAA;AAaI;;;;AAgBS;AAAA,KArMjEd,aAAAA,GA2MY,IAAA,GAAA,IAAaiB,GAAAA,KAAAA,GAAa,IAAA,GAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,KAAA;AAAA;AAMvB;AAKO;;;;AAmDF,KAlQpBhB,aAkQoB,CAAA,oBAlQcH,cAkQd,CAAA,GAlQgCI,WAkQhC,GAAA,CAlQ+CJ,cAkQ/C,GAlQgEK,WAkQhE,CAAA,OAAA,CAAA,CAAA,GAAA,MAAA;AAAA;AAcL;AAMQ;AAEN;AAWM;;;UA3RlBC,eAAAA,CAuSmBiB;;;;AAEX;AAAA;EAUS,qBAOJ,CAAA,EApTGzB,WAoTH;EAAA;;;;;EACF,qBAAA,CAAA,EA/SKA,WA+SL;EAAA;;;;;;;AAqCI;AAAA;;;;;;AAKd;AAAA;;;;;gBAKuIsC,CAAAA,EAAAA,KAAAA,GAzUvHjC,aAyUuHiC,CAzUzGnC,wBAyUyGmC,CAAAA;;;AAAjB;AAAA;;;;UAjUvH7B,YAAAA,CA+UqGa;;QAAqES,MAAAA;;OAE3KY,MAAAA;;QASGL,EAAAA,OAAAA;;UAEDG,CAAAA,EAAAA,MAAAA;EAAc;;;;;;;;;;;UAxUf/B,aAAAA;;;;;;;;;;;;;;;KAeLC,kBAAAA,aAA+BD;;;;;;;;;;;;;;;UAmB1BI,cAAAA;oBACUN;;;;;;;;;;;;;;cAcNO;KACTC,mBAAAA,WAA8BD;;;;;;;;UAQzBE,eAAAA;;;;;;;;;;;;;;;;;;;;;;;UAuBAC,iBAAAA;;;;aAIGD;;;;;;;UAOHE,qBAAAA,SAA8BD;;;;;;;;;;;;;UAa9BE,yBAAAA,SAAkCF;;;;;;;;;;;;;;;;KAgBvCG,aAAAA,GAAgBF,wBAAwBC;;;;;;KAMxCE,YAAAA,aAAyBD;;;;;;KAMzBE,eAAAA;;;;;UAKKC,iBAAAA;;;;;;;;;;;;;;;;;;;;;;UAsBAC,WAAAA;;;;;;;;;;;;;;;;;;;;;;;;QAwBFC;;;;;QAKAF;;;;;;;;;;;;;;KAcHG,eAAAA;;;;;;KAMAC,uBAAAA;;KAEAC,iBAAAA;;;;;;UAMKC,SAAAA;;;;;WAKCD;;;;;;;;UAQDE,YAAAA;;cAEIpB;;cAEAe,eAAeD;;YAEjBC,eAAeI;;;;;;;;UAQjBE,cAAAA;;YAEET;;;;;;;UAOFU;cACIE,QAAQT,OAAOQ,MAAMF;;;;;;;;UAQzBI;;;;;;;;;;;;;;;;;;;;;;;;;QAyBF/B,cAAcD;;;aAGTU;YACDmB,cAAcC;;;KAGrBG,gCAAgCN,4BAA4BO;;IAE7DE,cAAcD;;;;;KAKbE,+BAA+BV,2BAA2BA,qCAAqCtB,iBAAiB2B,aAAaC,gBAAgBC;;;;;;;;;;;;;;UAcxII,oBAAoB/B,iCAAiCA,gDAAgDW,2BAA2BA,0CAA0CS,2BAA2BA;;SAEtMY;;;;;;;YAOGC;;YAEAN;;WAEDG,eAAeH"}
1
+ {"version":3,"file":"types.d.ts","names":["ComputeUnit","DurationUnit","DurationString","SuspendTimeoutSuggestion","TtlSuggestion","DurationField","Suggestions","NonNullable","ComputeSettings","BranchTarget","ServiceToggle","ServiceToggleInput","ServiceEnabled","T","PostgresConfig","DATA_API_AUTH_PROVIDERS","DataApiAuthProvider","DataApiSettings","DataApiConfigBase","DataApiNeonAuthConfig","DataApiExternalAuthConfig","DataApiConfig","DataApiInput","FunctionRuntime","FunctionDevConfig","FunctionDef","Record","CredentialScope","CredentialPrincipalType","BucketAccessLevel","BucketDef","PreviewInput","FunctionTuning","PreviewTuning","Slug","Partial","BranchTuning","FunctionSlugsOf","Preview","F","Extract","BranchTuningFn","Config","Auth","DataApi","ResolvedFunctionConfig","ResolvedBucketConfig","ResolvedPreviewConfig","ResolvedDataApiConfig","ResolvedBranchConfig","AppliedChange","ConflictReport","PushResult"],"sources":["../../../../../config/dist/lib/types.d.ts"],"sourcesContent":["//#region src/lib/types.d.ts\n/**\n * Valid Neon Compute Unit values.\n * Most plans support 0.25, 0.5, 1, 2, 4, 8. Higher values may be available on Business plans.\n */\ntype ComputeUnit = 0.25 | 0.5 | 1 | 2 | 4 | 8;\n/** Time units accepted in a {@link DurationString}: seconds, minutes, hours, days, weeks. */\ntype DurationUnit = \"s\" | \"m\" | \"h\" | \"d\" | \"w\";\n/**\n * A Neon duration string: a positive integer **followed by a unit** — `s` (seconds),\n * `m` (minutes), `h` (hours), `d` (days), or `w` (weeks). Used by\n * {@link ComputeSettings.suspendTimeout} and {@link BranchTuning.ttl}.\n *\n * A **unit is required**: a bare numeric string like `\"7\"` is rejected at the type level. To\n * express a raw number of seconds, pass a `number` (`300`) — not a string (`\"300\"`). This\n * removes the old ambiguity where `\"7\"` silently meant 7 *seconds* instead of, say, `\"7d\"`.\n *\n * @example \"5m\" // 5 minutes\n * @example \"1h\" // 1 hour\n * @example \"7d\" // 7 days\n */\ntype DurationString = `${number}${DurationUnit}`;\n/**\n * Autocomplete suggestions for {@link ComputeSettings.suspendTimeout}. Every value sits inside\n * the Neon API's allowed scale-to-zero band: **60s–604800s** (1 minute – 1 week). This is *not*\n * a closed set — the field also accepts any other {@link DurationString} or a `number` of\n * seconds; out-of-range values type-check but are rejected at apply time.\n */\ntype SuspendTimeoutSuggestion = \"1m\" | \"5m\" | \"15m\" | \"30m\" | \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"7d\";\n/**\n * Autocomplete suggestions for {@link BranchTuning.ttl}. Every value sits within the Neon API's\n * branch-expiration limit (**max 30 days** from creation; the Console's own presets are 1h / 1d\n * / 7d). This is *not* a closed set — the field also accepts any other {@link DurationString} or\n * a `number` of seconds; values over 30 days are rejected at apply time.\n */\ntype TtlSuggestion = \"1h\" | \"6h\" | \"12h\" | \"1d\" | \"3d\" | \"7d\" | \"14d\" | \"30d\";\n/**\n * Compose a field's duration type: its curated autocomplete `Suggestions` plus the open\n * `DurationString` template (so any `<integer><unit>` string still type-checks) and a `number`\n * of seconds. Intersecting the template arm with `NonNullable<unknown>` stops TypeScript from\n * collapsing the literal suggestions into the template, which is what preserves the autocomplete.\n */\ntype DurationField<Suggestions extends DurationString> = Suggestions | (DurationString & NonNullable<unknown>) | number;\n/**\n * Compute settings applied to the read/write endpoint of a branch.\n *\n * Mirrors the subset of {@link https://api-docs.neon.tech/reference/getting-started-with-neon-api Neon endpoint}\n * fields that we expose as IaC primitives. Anything left undefined falls back to the project's\n * `default_endpoint_settings` (which themselves fall back to Neon platform defaults).\n */\ninterface ComputeSettings {\n /**\n * Minimum number of Compute Units. Set to 0.25 for true scale-to-zero.\n * @example 0.25 // scale-to-zero\n * @example 1 // always-on with 1 CU minimum\n */\n autoscalingLimitMinCu?: ComputeUnit;\n /**\n * Maximum number of Compute Units for autoscaling.\n * @example 2\n * @example 8\n */\n autoscalingLimitMaxCu?: ComputeUnit;\n /**\n * How long an idle compute waits before suspending (Neon's scale-to-zero). Accepts a\n * {@link DurationString} (autocompletes common values), a number of seconds, or `false`.\n *\n * - `false` — never suspend (always-on compute)\n * - {@link DurationString} — e.g. `\"5m\"`; autocompletes the in-range values `\"1m\"`, `\"5m\"`,\n * `\"15m\"`, `\"30m\"`, `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`, `\"7d\"`, and accepts any other\n * `<integer><unit>` (units: `s`, `m`, `h`, `d`, `w`). A **unit is required** — for raw\n * seconds pass a `number`, not a string.\n * - `number` — custom timeout in **seconds**, must be in `60`–`604800` (1 minute to 1 week)\n * - `undefined` — use the Neon platform default (currently 300s / 5 minutes)\n *\n * Whichever form you use, the resolved timeout must fall in `60`–`604800` seconds (the Neon\n * API limit); the suggestions are all within that band, anything else is checked at apply.\n *\n * @example false // never suspend (always-on)\n * @example \"5m\" // suspend after 5 minutes idle\n * @example \"1h\" // suspend after 1 hour idle\n * @example 300 // 5 minutes, expressed in seconds\n */\n suspendTimeout?: false | DurationField<SuspendTimeoutSuggestion>;\n}\n/**\n * Read-only descriptor of the branch a {@link Config} policy is being evaluated for — the\n * `branch` argument passed to your `defineConfig({ branch: (branch) => … })` closure. It describes\n * **which** branch this invocation decides for; it is not a live branch handle and must not\n * be mutated. Switch on its fields and return the desired {@link BranchConfig}.\n */\ninterface BranchTarget {\n /** Branch name being evaluated. For `branch dev`, this is the generated branch name. */\n name: string;\n /** Neon branch id when the branch already exists. Undefined during pre-create eval. */\n id?: string;\n /** Whether this branch already exists on Neon. */\n exists: boolean;\n /** Parent branch id from Neon when known. */\n parentId?: string;\n /** Whether Neon marks this branch as the project default. */\n isDefault?: boolean;\n /** Whether Neon currently marks this branch protected. */\n isProtected?: boolean;\n /** Current expiration timestamp from Neon, when set. */\n expiresAt?: string;\n}\n/**\n * Object form of a branch-scoped service toggle. `{}` or `{ enabled: true }` enables it;\n * `{ enabled: false }` opts out. Used as the object half of {@link ServiceToggleInput}.\n */\ninterface ServiceToggle {\n /** Defaults to `true` when the service namespace is present. Set `false` to opt out. */\n enabled?: boolean;\n}\n/**\n * How a branch-scoped service (Neon Auth, Data API, AI Gateway) is toggled in a policy.\n *\n * - `true` / `{}` / `{ enabled: true }` — enabled.\n * - `false` / `{ enabled: false }` — disabled.\n * - omitted (`undefined`) — not part of the policy at all.\n *\n * These toggles are **static** (they live in the top-level `defineConfig({ … })` object,\n * not in the per-branch `branch` closure) so the secret set they imply can be derived at\n * the type level — that's what makes `NeonEnv<typeof config>` exact.\n */\ntype ServiceToggleInput = boolean | ServiceToggle;\n/**\n * Resolve a **static** service toggle (`true` / `false` / `{ enabled?: boolean }` / object /\n * `undefined`) to a type-level boolean. The tuple wrapping (`[T] extends […]`) disables\n * distribution so a union/`undefined` is judged as a single unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n * (a present toggle defaults to enabled)\n * - the bare `boolean | … | undefined` (no literal info) → `false`\n *\n * Shared by the {@link Config} static cross-field checks and the `@neon/env`\n * `NeonEnv` namespace derivation, so both read \"is this service on?\" identically.\n */\ntype ServiceEnabled<T> = [T] extends [false] ? false : [T] extends [{\n enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n enabled: true;\n}] ? true : [T] extends [object] ? true : false;\ninterface PostgresConfig {\n computeSettings?: ComputeSettings;\n}\n/**\n * Authentication providers a Data API integration can verify JWTs against, as written in\n * `neon.ts`. Friendly authoring values (mapped to the Neon API's `neon_auth` / `external`\n * at the API boundary):\n *\n * - `\"neon\"` — verify tokens minted by **Neon Auth** on the same branch. Neon supplies the\n * JWKS URL / provider wiring for you, so the `jwksUrl` / `providerName` / `jwtAudience`\n * fields are forbidden (a type error) on this variant — and the policy must also enable\n * top-level `auth` (Neon Auth) so the tokens exist.\n * - `\"external\"` — verify tokens from a third-party IdP (Clerk, Stytch, Auth0, …). You\n * provide `jwksUrl` (and optionally `providerName` / `jwtAudience`).\n */\ndeclare const DATA_API_AUTH_PROVIDERS: readonly [\"neon\", \"external\"];\ntype DataApiAuthProvider = (typeof DATA_API_AUTH_PROVIDERS)[number];\n/**\n * Reusable runtime settings for a Data API integration (the Neon API `DataAPISettings`,\n * camelCased to match the rest of `neon.ts`). Every field is optional; omitted fields keep\n * the Neon defaults shown below. These are the **only** Data API fields that can change on\n * an already-enabled integration — drift here is reconciled as an *update* (requires\n * `updateExisting` / `--update-existing`); the create-only auth wiring above cannot.\n */\ninterface DataApiSettings {\n /** Enable the aggregates feature (`db_aggregates_enabled`). Default `true`. */\n dbAggregatesEnabled?: boolean;\n /** Database role used for anonymous requests (`db_anon_role`). Default `\"anonymous\"`. */\n dbAnonRole?: string;\n /** Extra schemas appended to the search path (`db_extra_search_path`). */\n dbExtraSearchPath?: string;\n /** Maximum rows returned in a single request (`db_max_rows`). */\n dbMaxRows?: number;\n /** Schemas exposed via the API (`db_schemas`). Default `[\"public\"]`. */\n dbSchemas?: string[];\n /** JWT claim key used for role extraction (`jwt_role_claim_key`). Default `\".role\"`. */\n jwtRoleClaimKey?: string;\n /** Maximum lifetime of the JWT cache, in seconds (`jwt_cache_max_lifetime`). */\n jwtCacheMaxLifetime?: number;\n /** OpenAPI spec mode (`openapi_mode`). Default `\"disabled\"`. */\n openapiMode?: \"ignore-privileges\" | \"disabled\";\n /** CORS allowed origins (`server_cors_allowed_origins`). */\n serverCorsAllowedOrigins?: string;\n /** Emit server-timing headers (`server_timing_enabled`). */\n serverTimingEnabled?: boolean;\n}\n/** Fields shared by every {@link DataApiConfig} variant. */\ninterface DataApiConfigBase {\n /** Defaults to `true` when the `dataApi` namespace is present. Set `false` to opt out. */\n enabled?: boolean;\n /** Reusable runtime settings. Drift here is reconciled as an update. */\n settings?: DataApiSettings;\n}\n/**\n * Data API verified by **Neon Auth** (`authProvider: \"neon\"`, the default). The external\n * IdP fields are statically forbidden (`?: never`) because Neon supplies them; declaring any\n * of them is a type error directing you to `authProvider: \"external\"`.\n */\ninterface DataApiNeonAuthConfig extends DataApiConfigBase {\n authProvider?: \"neon\";\n /** Forbidden with `authProvider: \"neon\"` — Neon provides the JWKS URL. */\n jwksUrl?: never;\n /** Forbidden with `authProvider: \"neon\"` — the provider is Neon Auth. */\n providerName?: never;\n /** Forbidden with `authProvider: \"neon\"` — Neon manages the audience. */\n jwtAudience?: never;\n}\n/**\n * Data API verified by an **external** IdP (`authProvider: \"external\"`). You provide the\n * JWKS URL (and optionally a provider label / expected audience).\n */\ninterface DataApiExternalAuthConfig extends DataApiConfigBase {\n authProvider: \"external\";\n /** URL that publishes the IdP's JWKS (JSON Web Key Set). */\n jwksUrl?: string;\n /** Human label for the IdP (e.g. \"Clerk\", \"Stytch\", \"Auth0\"). */\n providerName?: string;\n /**\n * Expected `aud` claim. ⚠️ This only **rejects** tokens carrying a *different* audience;\n * tokens with no `aud` claim are still accepted.\n */\n jwtAudience?: string;\n}\n/**\n * Object form of the `dataApi` toggle. A discriminated union on {@link DataApiAuthProvider}:\n * the `\"neon\"` variant forbids the external-IdP fields, the `\"external\"` variant allows them.\n */\ntype DataApiConfig = DataApiNeonAuthConfig | DataApiExternalAuthConfig;\n/**\n * How the Data API is toggled in a policy: a bare boolean (like the other service toggles)\n * or the richer {@link DataApiConfig} object. `true` / `{}` / `{ enabled: true }` enable it\n * with Neon defaults; `false` / `{ enabled: false }` opt out.\n */\ntype DataApiInput = boolean | DataApiConfig;\n/**\n * Supported function runtimes. Mirrors the Neon Functions deploy API `runtime` enum.\n * Only `nodejs24` exists today; kept as a union so adding runtimes later is a\n * non-breaking, type-checked change.\n */\ntype FunctionRuntime = \"nodejs24\";\n/**\n * Local-development settings for a function, used by `neon dev` when it serves every\n * function declared in `neon.ts` (i.e. invoked with no `--source`). Never affects deploy.\n */\ninterface FunctionDevConfig {\n /**\n * Port the local server binds. Bound exactly (and `neon dev` fails loudly if it is taken)\n * when set; a free port is found automatically when omitted.\n */\n port?: number;\n}\n/**\n * Static definition of a Neon Function (Preview feature). Declares that the function\n * **exists** on every branch; its branch-unique slug is the **record key** in\n * {@link PreviewInput.functions} (not a field here), so slugs are statically enumerable,\n * cannot duplicate, and the `branch` closure can only tune slugs that are declared here.\n *\n * A function is invoked like a Cloudflare/Vercel handler — its source module\n * `export default { fetch }` or `export async function handler(req): Response`. The\n * `source` path is bundled (esbuild) and uploaded as a deployment; the newest deployment\n * becomes active.\n *\n * Runtime tuning is **not** here — it varies per branch and lives in the `branch` closure\n * (see {@link FunctionTuning}). Memory is fixed by the platform policy for now and is not\n * user-configurable.\n */\ninterface FunctionDef {\n /** Free-form display name. @example \"Hello World\" */\n name: string;\n /**\n * Path to the function's entry module, **relative to `neon.ts`** (or absolute). The\n * module's default export (`{ fetch }`) or `handler` export is the function entry. This\n * path is resolved against the loaded `neon.ts` location and bundled with esbuild at\n * deploy time.\n *\n * We require a string path rather than an imported handler because a JS function value\n * carries no reference back to its source file, so esbuild has nothing to bundle from.\n * @example \"./functions/hello-world.ts\"\n */\n source: string;\n /**\n * Environment variables injected into the deployed function, keyed by the var name the\n * function reads at runtime. The **keys** are static (preserved at the type level so\n * `parseEnv(config, \"<slug>\").function.<key>` is typed); the **values** are arbitrary\n * strings evaluated when `neon.ts` is loaded (typically `process.env.X`) and uploaded\n * at `config apply`. Every value must be a defined string — a `process.env.X` that is\n * `undefined` (unset) errors at validation time rather than silently shipping\n * `undefined`.\n * @example { resendApiKey: process.env.RESEND_API_KEY ?? \"\" }\n */\n env?: Record<string, string>;\n /**\n * Local-development settings used by `neon dev` when serving every function from\n * `neon.ts`. Ignored at deploy time. See {@link FunctionDevConfig}.\n */\n dev?: FunctionDevConfig;\n}\n/**\n * A single capability a branch-scoped service credential may exercise (Preview). A\n * credential is granted a set of these and may only perform the listed actions. Mirrors\n * the Neon API `CredentialScope` enum (`x-stability-level: beta`):\n *\n * - `storage:read` / `storage:write` — object-storage (bucket) access via the S3 key.\n * - `ai_gateway:invoke` — call the AI Gateway with the bearer `api_token`.\n * - `functions:invoke` — invoke Neon Functions with the bearer `api_token`.\n *\n * The set a policy needs is derived from its enabled Preview features (see\n * {@link deriveCredentialScopes}); it is never authored by hand.\n */\ntype CredentialScope = \"storage:read\" | \"storage:write\" | \"ai_gateway:invoke\" | \"functions:invoke\";\n/**\n * Who a credential acts as. `user` is the developer/app principal minted for local dev and\n * app bootstrap (`fetchEnv` / `env pull`); `function` is a deployed-function principal\n * (carries a `function_id`). The env tooling only mints `user` credentials today.\n */\ntype CredentialPrincipalType = \"user\" | \"function\";\n/** Anonymous-access level for a branchable object-storage bucket. */\ntype BucketAccessLevel = \"private\" | \"public_read\";\n/**\n * Static definition of a branchable object-storage bucket (Preview feature). The bucket's\n * name is the **record key** in {@link PreviewInput.buckets}, so names are statically\n * enumerable and cannot duplicate.\n */\ninterface BucketDef {\n /**\n * Anonymous access level. `private` (default) requires authenticated reads/writes;\n * `public_read` allows anonymous GetObject/HeadObject.\n */\n access?: BucketAccessLevel;\n}\n/**\n * Static, branch-scoped **Preview** features. Grouped under `preview` to signal they are\n * backed by Neon `x-stability-level: beta` endpoints and may change before GA. Everything\n * here is existential (it determines what exists on the branch); per-branch tuning lives in\n * the `branch` closure.\n */\ninterface PreviewInput {\n /** Enable/disable the AI Gateway on the branch (toggle, like auth / dataApi). */\n aiGateway?: ServiceToggleInput;\n /** Functions to deploy, keyed by branch-unique slug (`^[a-z0-9]{1,20}$`). */\n functions?: Record<string, FunctionDef>;\n /** Object-storage buckets to create, keyed by bucket name. */\n buckets?: Record<string, BucketDef>;\n}\n/**\n * Per-branch deploy tuning for a single function. Returned (per slug) by the `branch`\n * closure. Deliberately **cannot** change the function's existence, source, name, env\n * **keys**, or memory — only runtime selection is currently configurable — so the static\n * secret/function set stays sound.\n */\ninterface FunctionTuning {\n /** Runtime to execute the function with. Defaults to `\"nodejs24\"`. */\n runtime?: FunctionRuntime;\n}\n/**\n * Per-branch tuning of Preview features. Only existing function slugs (those declared in\n * the static {@link PreviewInput.functions}) may be tuned — `Slug` is constrained to the\n * declared keys by {@link BranchTuningFn}.\n */\ninterface PreviewTuning<Slug extends string = string> {\n functions?: Partial<Record<Slug, FunctionTuning>>;\n}\n/**\n * The per-branch tuning object returned by the `branch` closure. It can adjust branch\n * lifecycle (`parent`, `ttl`, `protected`), Postgres compute settings, and per-function\n * deploy tuning — but **cannot** add/remove services or functions. That guarantee is what\n * keeps the static secret set (and therefore `NeonEnv`) exact.\n */\ninterface BranchTuning<Slug extends string = string> {\n /** Parent branch name used when creating a new branch. Not a Postgres setting. */\n parent?: string;\n /**\n * Branch time-to-live: how long after creation the branch should auto-expire. Applied\n * when creating a new branch and reconciled on existing branches (when `updateExisting`\n * is set). Accepts a {@link DurationString} (autocompletes common values) or a number of\n * seconds. Omit to keep the branch indefinitely.\n *\n * - {@link DurationString} — e.g. `\"7d\"`; autocompletes `\"1h\"`, `\"6h\"`, `\"12h\"`, `\"1d\"`,\n * `\"3d\"`, `\"7d\"`, `\"14d\"`, `\"30d\"`, and accepts any other `<integer><unit>` (units: `s`,\n * `m`, `h`, `d`, `w` — e.g. `\"12h\"`, `\"2w\"`). A **unit is required** — `\"7\"` is rejected;\n * for raw seconds pass a `number`.\n * - `number` — custom TTL in **seconds** (e.g. `3600`)\n * - `undefined` — no expiry; the branch persists until explicitly deleted\n *\n * The Neon API caps branch expiration at **30 days** from creation, so the resolved TTL must\n * be `> 0` and `<= 30d`; the suggestions stay within that limit and anything longer is\n * rejected at apply.\n *\n * @example \"1d\" // ephemeral preview branch: expires a day after creation\n * @example \"7d\" // one-week TTL\n * @example \"30d\" // the maximum the API allows\n * @example 3600 // 1 hour, expressed in seconds\n */\n ttl?: DurationField<TtlSuggestion>;\n /** Whether the selected branch should be protected. Undefined means \"leave as-is\". */\n protected?: boolean;\n postgres?: PostgresConfig;\n preview?: PreviewTuning<Slug>;\n}\n/** Extract the declared function slugs from a {@link PreviewInput} for closure typing. */\ntype FunctionSlugsOf<Preview extends PreviewInput | undefined> = Preview extends {\n functions: infer F;\n} ? Extract<keyof F, string> : string;\n/**\n * Signature of the `branch` closure. Generic over the static {@link PreviewInput} so the\n * `preview.functions` keys it may tune are constrained to the slugs actually declared.\n */\ntype BranchTuningFn<Preview extends PreviewInput | undefined = PreviewInput | undefined> = (branch: BranchTarget) => BranchTuning<FunctionSlugsOf<Preview>>;\n/**\n * A validated Neon branch policy — the value `defineConfig({ … })` returns and `neon.ts`\n * default-exports.\n *\n * Split into a **static** existential set (top-level `auth` / `dataApi` GA toggles plus the\n * beta `preview` block) and a **dynamic** per-branch `branch` closure for tuning. The\n * static half is what makes the secret set — and therefore `NeonEnv<typeof config>` and\n * `parseEnv` — exact; the closure can tune but never change what exists.\n *\n * Generic over the three static fields so the type system can read the exact toggle/slug\n * literals; the defaults make the bare `Config` a usable \"any policy\" type for runtime\n * function signatures.\n */\ninterface Config<Auth extends ServiceToggleInput | undefined = ServiceToggleInput | undefined, DataApi extends DataApiInput | undefined = DataApiInput | undefined, Preview extends PreviewInput | undefined = PreviewInput | undefined> {\n /** Neon Auth integration toggle (GA). Static — drives `NeonEnv.auth`. */\n auth?: Auth;\n /**\n * Neon Data API integration (GA). Static — drives `NeonEnv.dataApi`. A boolean/toggle, or\n * a {@link DataApiConfig} object selecting the auth provider (`\"neon\"` / `\"external\"`) and\n * runtime {@link DataApiSettings}. With `authProvider: \"neon\"` the policy must also enable\n * top-level `auth`.\n */\n dataApi?: DataApi;\n /** Beta (Preview) feature set: AI Gateway, functions, buckets. Static. */\n preview?: Preview;\n /** Per-branch tuning closure. Cannot change the static existential set. */\n branch?: BranchTuningFn<Preview>;\n}\n/**\n * A function with all deploy defaults applied. `resolveConfig` fills in `runtime` so\n * downstream diff/apply never has to re-derive it.\n */\ninterface ResolvedFunctionConfig {\n slug: string;\n name: string;\n source: string;\n env: Record<string, string>;\n runtime: FunctionRuntime;\n /**\n * Local-development settings, passed through untouched from {@link FunctionDef.dev}\n * (no defaults applied). Only consumed by `neon dev`; deploy ignores it.\n */\n dev?: FunctionDevConfig;\n}\n/** A bucket with its access level defaulted to `private`. */\ninterface ResolvedBucketConfig {\n name: string;\n access: BucketAccessLevel;\n}\n/**\n * Normalized {@link PreviewInput}. Only present on {@link ResolvedBranchConfig} when the\n * policy returned a `preview` block. `aiGatewayEnabled` follows the same\n * \"present-and-not-`false`\" semantics as `authEnabled` / `dataApiEnabled`.\n */\ninterface ResolvedPreviewConfig {\n functions: ResolvedFunctionConfig[];\n buckets: ResolvedBucketConfig[];\n aiGatewayEnabled: boolean;\n}\n/**\n * Normalized Data API integration. Present on {@link ResolvedBranchConfig} only when the\n * policy enables `dataApi`. `authProvider` always resolves (defaults to `\"neon\"`); the\n * external-IdP wiring is present only for `\"external\"`; `settings` carries the camelCase\n * runtime settings (reconciled as an update when they drift).\n */\ninterface ResolvedDataApiConfig {\n authProvider: DataApiAuthProvider;\n jwksUrl?: string;\n providerName?: string;\n jwtAudience?: string;\n settings?: DataApiSettings;\n}\ninterface ResolvedBranchConfig {\n parent?: string;\n ttlSeconds?: number;\n protected?: boolean;\n postgres?: PostgresConfig;\n authEnabled: boolean;\n dataApiEnabled: boolean;\n /**\n * Resolved Data API integration. Present iff {@link dataApiEnabled} is `true`. Carries the\n * create-time auth wiring and the updatable {@link DataApiSettings}.\n */\n dataApi?: ResolvedDataApiConfig;\n preview?: ResolvedPreviewConfig;\n}\n/**\n * One concrete change `pushConfig` made (or, in dry-run, would make) on the remote.\n */\ninterface AppliedChange {\n /**\n * `service` covers branch-scoped integrations driven by the branch policy (e.g.\n * Neon Auth, Data API).\n */\n kind: \"branch\" | \"service\";\n action: \"create\" | \"update\" | \"noop\";\n identifier: string;\n details?: Record<string, unknown>;\n}\n/**\n * A diff entry that conflicts with the desired config. `pushConfig` throws\n * {@link PushConflictError} on the first call when conflicts exist; pass\n * `updateExisting: true` to apply mutable drift (settings, `protected`, TTL, project\n * rename). Immutable fields (region, Postgres major version) are always conflicts —\n * recreate the project to change them.\n */\ninterface ConflictReport {\n kind: \"branch\";\n identifier: string;\n field: string;\n current: unknown;\n desired: unknown;\n reason: string;\n}\n/**\n * Result of a `pushConfig` invocation.\n */\ninterface PushResult {\n projectId: string;\n orgId?: string;\n branchId: string;\n branchName: string;\n /**\n * `true` when `pushConfig` was called with `{ dryRun: true }`. `applied` then records\n * what **would** be applied on a real push; no API mutations were performed.\n */\n dryRun: boolean;\n applied: AppliedChange[];\n conflicts: ConflictReport[];\n}\n//#endregion\nexport { AppliedChange, BranchTarget, BranchTuning, BranchTuningFn, BucketAccessLevel, BucketDef, ComputeSettings, ComputeUnit, Config, ConflictReport, CredentialPrincipalType, CredentialScope, DATA_API_AUTH_PROVIDERS, DataApiAuthProvider, DataApiConfig, DataApiExternalAuthConfig, DataApiInput, DataApiNeonAuthConfig, DataApiSettings, DurationString, DurationUnit, FunctionDef, FunctionDevConfig, FunctionRuntime, FunctionTuning, PostgresConfig, PreviewInput, PreviewTuning, PushResult, ResolvedBranchConfig, ResolvedBucketConfig, ResolvedDataApiConfig, ResolvedFunctionConfig, ResolvedPreviewConfig, ServiceEnabled, ServiceToggle, ServiceToggleInput };\n//# sourceMappingURL=types.d.ts.map"],"mappings":";;AAKKA;AAAW;AAEC;AAc6B;AAOjB,KAvBxBA,WAAAA,GA8BAI,IAAa,GAAA,GAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA,GAAA,CAAA;AAAA;AAOA,KAnCbH,YAAAA,GAmCa,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA,GAAA;AAAqBC;AAAkBI;AAAeJ;AAAiBK;AAAW;AAAA;AAQ3E;AAMCP;AAMAA;AAqBeG;AAAdE;AAAa;AAAA;AAQlB,KAtEjBH,cAAAA,GA0FkB,GAAA,MAAA,GA1FWD,YA0FX,EAAA;AAAA;AAiCT;AAEqB;AAciC;AACV;AAQjC;AA2BG,KAxKvBE,wBAAAA,GA+K0B,IAAA,GAASe,IAAAA,GAAAA,KAAAA,GAAAA,KAAiB,GAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,IAAA,GAAA,IAAA;AAAA;AAaI;AAgB3C;AAAGC;AAAwBC;AAAyB;AAAA,KArMjEhB,aAAAA,GA2MY,IAAA,GAAA,IAAaiB,GAAAA,KAAAA,GAAa,IAAA,GAAA,IAAA,GAAA,IAAA,GAAA,KAAA,GAAA,KAAA;AAAA;AAMvB;AAKO;AAsBN;AAwBbK;AAKAF;AAAiB,KAlQpBnB,aAkQoB,CAAA,oBAlQcH,cAkQd,CAAA,GAlQgCI,WAkQhC,GAAA,CAlQ+CJ,cAkQ/C,GAlQgEK,WAkQhE,CAAA,OAAA,CAAA,CAAA,GAAA,MAAA;AAAA;AAcL;AAMQ;AAEN;AAWM;AAQN;AAERI;AAEec,UAvSnBjB,eAAAA,CAuSmBiB;EAAfC;AAEaI;AAAfJ;AAAM;AAAA;EAUS,qBAOJ,CAAA,EApTG1B,WAoTH;EAAA;AACMkC;AAAMF;AAAbN;AAARS;EAAO,qBAAA,CAAA,EA/SKnC,WA+SL;EAAA;AAQC;AAyBAI;AAAdC;AAGKS;AACaoB;AAAdD;AAAa;AAAA;AAGL;AAAiBF;AAA4BO;AAE/CC;AAAdC;AAAO;AAAA;AAKQ;AAAiBT;AAA2BA;AAAqCtB;EAA8C6B,cAAAA,CAAAA,EAAAA,KAAAA,GAzUvHjC,aAyUuHiC,CAzUzGnC,wBAyUyGmC,CAAAA;AAAhBD;AAAbD;AAAY;AAAA;AAcjH;AAAczB;AAAiCA;AAAgDW,UA/UrGb,YAAAA,CA+UqGa;EAA2BA;EAA0CS,IAAAA,EAAAA,MAAAA;EAA2BA;EAEtMY,EAAAA,CAAAA,EAAAA,MAAAA;EAOGC;EAEAN,MAAAA,EAAAA,OAAAA;EAEcA;EAAfG,QAAAA,CAAAA,EAAAA,MAAAA;EAAc;;;;;;;;;;;UAxUf/B,aAAAA;;;;;;;;;;;;;;;KAeLC,kBAAAA,aAA+BD;;;;;;;;;;;;;;;UAmB1BI,cAAAA;oBACUN;;;;;;;;;;;;;;cAcNO;KACTC,mBAAAA,WAA8BD;;;;;;;;UAQzBE,eAAAA;;;;;;;;;;;;;;;;;;;;;;;UAuBAC,iBAAAA;;;;aAIGD;;;;;;;UAOHE,qBAAAA,SAA8BD;;;;;;;;;;;;;UAa9BE,yBAAAA,SAAkCF;;;;;;;;;;;;;;;;KAgBvCG,aAAAA,GAAgBF,wBAAwBC;;;;;;KAMxCE,YAAAA,aAAyBD;;;;;;KAMzBE,eAAAA;;;;;UAKKC,iBAAAA;;;;;;;;;;;;;;;;;;;;;;UAsBAC,WAAAA;;;;;;;;;;;;;;;;;;;;;;;;QAwBFC;;;;;QAKAF;;;;;;;;;;;;;;KAcHG,eAAAA;;;;;;KAMAC,uBAAAA;;KAEAC,iBAAAA;;;;;;UAMKC,SAAAA;;;;;WAKCD;;;;;;;;UAQDE,YAAAA;;cAEIpB;;cAEAe,eAAeD;;YAEjBC,eAAeI;;;;;;;;UAQjBE,cAAAA;;YAEET;;;;;;;UAOFU;cACIE,QAAQT,OAAOQ,MAAMF;;;;;;;;UAQzBI;;;;;;;;;;;;;;;;;;;;;;;;;QAyBF/B,cAAcD;;;aAGTU;YACDmB,cAAcC;;;KAGrBG,gCAAgCN,4BAA4BO;;IAE7DE,cAAcD;;;;;KAKbE,+BAA+BV,2BAA2BA,qCAAqCtB,iBAAiB2B,aAAaC,gBAAgBC;;;;;;;;;;;;;;UAcxII,oBAAoB/B,iCAAiCA,gDAAgDW,2BAA2BA,0CAA0CS,2BAA2BA;;SAEtMY;;;;;;;YAOGC;;YAEAN;;WAEDG,eAAeH"}
package/dist/lib/cli/commands.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"commands.d.ts","names":[],"sources":["../../../src/lib/cli/commands.ts"],"mappings":";;;;;;;;AAsBA;AASA;AAgBiB,UAzBA,UAAA,CAyBiB;EAOjB,GAAA,EAAA,MAAA;EAWK;;;;KAGX,CAAA,EAxCJ,OAwCI;;AAAD,UArCO,aAAA,CAqCP;EA4CO;EAWK,QAAA,EAAA,MAAY;EAAA;QACxB,EAAA,MAAA;;QAEC,EAAA,MAAA;;EAAD,SAAA,CAAA,EAAA,MAAA;;;;;;;UA/EO,iBAAA;;;;;;UAOA,oBAAA,SAA6B;;;;;;;;;;iBAWxB,SAAA,UACZ,2BACJ,aACH,QAAQ;UA4CM,uBAAA,SAAgC;;;;;;;;;;iBAW3B,YAAA,UACZ,8BACJ,aACH,QAAQ"}
1
+ {"version":3,"file":"commands.d.ts","names":[],"sources":["../../../src/lib/cli/commands.ts"],"mappings":";;;;;;;;AAsBA;AASA;AAgBiB,UAzBA,UAAA,CAyBiB;EAOjB,GAAA,EAAA,MAAA;EAWK;AAAS;AACrB;AACJ;EACK,GAAA,CAAA,EAxCJ,OAwCI;AAAR;AAAO,UArCO,aAAA,CAqCP;EA4CO;EAWK,QAAA,EAAA,MAAY;EAAA;EACxB,MAAA,EAAA,MAAA;EACJ;EACK,MAAA,EAAA,MAAA;EAAR;EAAO,SAAA,CAAA,EAAA,MAAA;;;;;;;UA/EO,iBAAA;;;;;;UAOA,oBAAA,SAA6B;;;;;;;;;;iBAWxB,SAAA,UACZ,2BACJ,aACH,QAAQ;UA4CM,uBAAA,SAAgC;;;;;;;;;;iBAW3B,YAAA,UACZ,8BACJ,aACH,QAAQ"}
package/dist/lib/cli/resolve-context.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"resolve-context.d.ts","names":[],"sources":["../../../src/lib/cli/resolve-context.ts"],"mappings":";;AASA;AAMA;AAcA;;AACU,UArBO,eAAA,CAqBP;WACc,EAAA,MAAA;EAAe;;;UAhBtB,qBAAA;;;;QAIV,MAAA,CAAO;;;;;;;;;iBAUE,cAAA,UACN;;WACc"}
1
+ {"version":3,"file":"resolve-context.d.ts","names":[],"sources":["../../../src/lib/cli/resolve-context.ts"],"mappings":";;AASA;AAMA;AAcA;AAA8B;AACpB,UArBO,eAAA,CAqBP;EACc,SAAA,EAAA,MAAA;EAAe;;;UAhBtB,qBAAA;;;;QAIV,MAAA,CAAO;;;;;;;;;iBAUE,cAAA,UACN;;WACc"}
package/dist/lib/env.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"env.d.ts","names":[],"sources":["../../src/lib/env.ts"],"mappings":";;;;;cAqDa;;;;AAAb;AAkDA;EAKiB,SAAA,MAAA,EAAA;IAuBA,SAAA,IAAW,EAAA,aAAA;EAOX,CAAA;EAeA,SAAA,QAAc,EAAA;IAiBd,SAAA,WAAgB,EAAA,cAAA;IAU5B,SAAA,mBAAoB,EAAA,uBAAA;EAapB,CAAA;EAAS,SAAA,IAAA,EAAA;IAAO,SAAA,OAAA,EAAA,oBAAA;IAEjB,SAAA,OAAA,EAAA,oBAAA;;WAIE,OAAA,EAAA;IAEC,SAAA,GAAA,EAAA,mBAAA;;EAEE;AAAA;AAKiB;;;WAWuB,OAAA,EAAA;IAAZ,SAAA,WAAA,EAAA,mBAAA;IAEtB,SAAA,eAAA,EAAA,uBAAA;IAAZ,SAAA,QAAA,EAAA,qBAAA;IACqB,SAAA,MAAA,EAAA,YAAA;;;AAAb;AAAA;;;;;WAcI,SAAA,EAAA;IAAZ,SAAA,MAAA,EAAA,uBAAA;IACuB,SAAA,OAAA,EAAA,0BAAA;;;AAAb;AAiBb;;;;;AAMU,UA7JO,aAAA,CA6JP;MACiB,EAAA,MAAA;;;AAChB,UA1JM,eAAA,CA0JN;;;;;aAGI,EAAA,MAAA;;;;;;qBAGD,EAAA,MAAA;;;;AAEC;AAAE;;;;;;AAQb,UAnJa,WAAA,CAmJb;EAAM,OAAA,EAAA,MAAA;EAGE;EAAc,OAAA,EAAA,MAAA;;;AACnB,UAhJU,cAAA,CAgJV;KADwC,EAAA,MAAA;AAAO;AAGpD;;;;;;;;;;;AAQE,UA3Ia,cAAA,CA2Ib;EAAO,WAAA,EAAA,MAAA;EAQC,eAAA,EAAA,MAAe;EAAA;UAAW,EAAA,MAAA;;QACC,EAAA,MAAA;;;AAAtB;AACf;AAW0B;;;;;AAiBlB,UAhKO,gBAAA,CAgKP;QACE,EAAA,MAAA;EAAgB,OAAA,EAAA,MAAA;AAAA;AAwB5B;;;;;KA/KK,WAAA,GAAc,MAgLO,CAAA,KAAA,EAAA,KAAA,CAAA;;AAAqC;AAiB/D;;;;;;;;;KApLK,SA0Lc,CAAA,CAAA,CAAA,GAAA,CA1LE,CA0LF,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CAxLf,CAwLe,CAAA,SAAA,CAAA;SAAmB,EAAA,KAAA;UAA9B,GAAA,CAtLH,CAsLG,CAAA,SAAA,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CApLF,CAoLE,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAlLD,CAkLC,CAAA,SAAA,CAAA;SAAqC,EAAA,IAAA;SAAa,GAAA,CAhLlD,CAgLkD,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;;KA3KrD,OA4KoB,CAAA,CAAA,CAAA,GAAA,CAAA,MA5KA,CA4KA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;;;;;;;AAEF;AAIvB;;KAvKK,UAwME,CAAA,UAxMmB,MAwMnB,CAAA,GAAA,CAxM8B,WAwM9B,CAxM0C,CAwM1C,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAtMJ,WAsMI,CAtMQ,CAsMR,CAAA,SAAA,CAAA,CAAA,SAAA;SAqBA,EAAA,KAAO,EAAA;AAAU,CAAA,GA1NpB,OA0NoB,CA1NZ,WA0NY,CA1NA,CA0NA,CAAA,CAAA,GAAA,KAAA;AA0BxB;;;;;;;;AAGU;AAslBV,KAj0BK,WAi0BmB,CAAA,UAj0BG,MAi0BH,CAAA,GAAA,CAj0Bc,WAi0Bd,CAj0B0B,CAi0B1B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA/zBrB,WA+zBqB,CA/zBT,CA+zBS,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,SAAA,EAAA,KAAA,EAAA;IA9zBpB,SA8zBqC,CA9zB3B,WA8zB2B,CA9zBf,CA8zBe,CAAA,CAAA,GAAA,KAAA;;;;AAA2B;AACpE;;;;;;;;;AAGiD;AACjC,KAlzBJ,OAkzBY,CAAA,UAlzBM,MAkzBN,GAlzBe,MAkzBf,CAAA,GAAA;EAAA,QAAA,EAjzBb,eAizBa;;;;;QAGJ,CAAA,EA/yBV,aA+yBU;KA9yBf,SA8yB2B,CA9yBjB,WA8yBiB,CA9yBL,CA8yBK,CAAA,MAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;MAAR,EA7yBb,WA6yBa;IA5yBrB,WA4yBkD,CAAA,GAAA,CA3yBnD,SA2yBmD,CA3yBzC,WA2yByC,CA3yB7B,CA2yB6B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;SAAG,EA1yBzC,cA0yByC;IAzyBpD,WAyyBiC,CAAA,GAAA,CAxyBnC,UAwyBmC,CAxyBxB,CAwyBwB,CAAA,SAAA,IAAA,GAAA;EAAe,OAAA,EAxyBV,cAwyBU;AAwOpD,CAAA,GAhhC6D,WAghC7C,CAAS,GAAA,CA/gCvB,WA+gCuB,CA/gCX,CA+gCW,CAAA,SAAA,IAAA,GAAA;EAAA,SAAA,EA9gCR,gBA8gCQ;IA7gCrB,WA6gCmC,CAAA;;KA1gClC,kBA0gC4C,CAAA,UA1gCf,MA0gCe,CAAA,GAzgChD,WAygCgD,CAzgCpC,CAygCoC,CAAA,SAAA,CAAA,CAAA,SAAA;EAAM,SAAA,EAAA,KAAA,EAAA;IAtgCnD,IACA;;KAGQ,yBAAyB,UAAU,cACxC,mBAAmB;;KAKrB,4BACM,4BAEP,gBAAgB,mBAAmB,KACpC,YAAY,mBAAmB,GAAG;;IACjC,cAAc;;;;;KAQN,0BAA0B;YAC3B,OAAO,kBAAkB,GAAG;;;;;;;;;UAY7B,kBAAA;;;;;;;;UAaA,YAAA;YACC;QACJ;WACG;WACA;aACE;;;UAIF,YAAA;;;;;;;;;;;;;;;;;;;KAoBE,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;QAqBA,MAAA,CAAO;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BQ,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAslBH,yBAAyB,gBAAgB,IAAI,QAAQ;iBACrD,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB;iBAClC,yBACC,wBACA,eAAe,YACtB,UAAU,IAAI,QAAQ,KAAK,gBAAgB,GAAG;;;;;;;;;;;;iBAwOxC,SAAA,MAAe,QAAQ,UAAU"}
1
+ {"version":3,"file":"env.d.ts","names":[],"sources":["../../src/lib/env.ts"],"mappings":";;;;;cAqDa;;;;AAAb;AAkDA;EAKiB,SAAA,MAAA,EAAA;IAuBA,SAAA,IAAW,EAAA,aAAA;EAOX,CAAA;EAeA,SAAA,QAAc,EAAA;IAiBd,SAAA,WAAgB,EAAA,cAAA;IAU5B,SAAA,mBAAoB,EAAA,uBAAA;EAapB,CAAA;EAAS,SAAA,IAAA,EAAA;IAAO,SAAA,OAAA,EAAA,oBAAA;IAEjB,SAAA,OAAA,EAAA,oBAAA;EAEC,CAAA;EAEC,SAAA,OAAA,EAAA;IAEC,SAAA,GAAA,EAAA,mBAAA;EAEC,CAAA;EAAC;AAAA;AAKiB;AAWX;AAAW;EAAuB,SAAA,OAAA,EAAA;IAAZ,SAAA,WAAA,EAAA,mBAAA;IAEtB,SAAA,eAAA,EAAA,uBAAA;IAAZ,SAAA,QAAA,EAAA,qBAAA;IACqB,SAAA,MAAA,EAAA,YAAA;EAAZ,CAAA;EAAR;AAAO;AAAA;AAYK;AAAW;AAAuB;AAAZ;EAEvB,SAAA,SAAA,EAAA;IAAZ,SAAA,MAAA,EAAA,uBAAA;IACuB,SAAA,OAAA,EAAA,0BAAA;EAAZ,CAAA;AAAV,CAAA;AAAS;AAiBb;AAAmB;AAAW;AAAS;AAC5B;AAKD,UA7JO,aAAA,CA6JP;EACiB,IAAA,EAAA,MAAA;AAAZ;AAAV;AACM,UA1JM,eAAA,CA0JN;EACR;AACqB;AAAZ;AAAV;EACa,WAAA,EAAA,MAAA;EACX;AACS;AAAX;AAAwC;AAAmB;EAC/C,mBAAA,EAAA,MAAA;AAAZ;AACe;AACb;AAAW;AAAE;AAGM;AAAW;AACrB;AAAZ;AAGG;AACA,UAnJa,WAAA,CAmJb;EAAM,OAAA,EAAA,MAAA;EAGE;EAAc,OAAA,EAAA,MAAA;AAAW;AACX;AAAnB,UAhJU,cAAA,CAgJV;EADwC,GAAA,EAAA,MAAA;AAAO;AAGpD;AAGoB;AACX;AAEP;AAAmC;AAAnB;AACc;AAAnB;AAAsB;AAAlC;AACe;AAAd,UA3Ia,cAAA,CA2Ib;EAAO,WAAA,EAAA,MAAA;EAQC,eAAA,EAAA,MAAe;EAAA;EAAW,QAAA,EAAA,MAAA;EACF;EAAG,MAAA,EAAA,MAAA;AAArB;AAAP;AAAM;AACf;AAW0B;AAaN;AACX;AACJ;AACG;AACA,UAhKO,gBAAA,CAgKP;EACE,MAAA,EAAA,MAAA;EAAgB,OAAA,EAAA,MAAA;AAAA;AAwB5B;AAA4B;AAAW;AACtC;AAAiC;AAAR,KAhLrB,WAAA,GAAc,MAgLO,CAAA,KAAA,EAAA,KAAA,CAAA;AAAmB;AAAkB;AAiB/D;AAA2B;AACd;AACH;AAAG;AAAmB;AAA9B;AAGE;AACY;AAAG,KA1Ld,SA0Lc,CAAA,CAAA,CAAA,GAAA,CA1LE,CA0LF,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CAxLf,CAwLe,CAAA,SAAA,CAAA;EAAmB,OAAA,EAAA,KAAA;AAA9B,CAAA,CAAA,GAAA,KAAA,GAAA,CAtLH,CAsLG,CAAA,SAAA,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CApLF,CAoLE,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAlLD,CAkLC,CAAA,SAAA,CAAA;EAAqC,OAAA,EAAA,IAAA;AAAa,CAAA,CAAA,GAAA,IAAA,GAAA,CAhLlD,CAgLkD,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AACjD;AAAgB,KA5KpB,OA4KoB,CAAA,CAAA,CAAA,GAAA,CAAA,MA5KA,CA4KA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAa;AAAG;AAAa;AAC7C;AACA;AAAa;AAAC;AAIvB;AAAgC;AAiCzB,KAxMF,UAwME,CAAA,UAxMmB,MAwMnB,CAAA,GAAA,CAxM8B,WAwM9B,CAxM0C,CAwM1C,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAtMJ,WAsMI,CAtMQ,CAsMR,CAAA,SAAA,CAAA,CAAA,SAAA;EAqBA,OAAA,EAAA,KAAO,EAAA;AAAU,CAAA,GA1NpB,OA0NoB,CA1NZ,WA0NY,CA1NA,CA0NA,CAAA,CAAA,GAAA,KAAA;AA0BxB;AAA8B;AAAiB;AACtC;AACC;AACS;AAAR;AAAR;AAAO;AAslBV,KAj0BK,WAi0BmB,CAAA,UAj0BG,MAi0BH,CAAA,GAAA,CAj0Bc,WAi0Bd,CAj0B0B,CAi0B1B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA/zBrB,WA+zBqB,CA/zBT,CA+zBS,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,SAAA,EAAA,KAAA,EAAA;AAAiB,CAAA,GA9zBrC,SA8zBqC,CA9zB3B,WA8zB2B,CA9zBf,CA8zBe,CAAA,CAAA,GAAA,KAAA;AAAgB;AAAY;AAAR;AAAO;AACpE;AAAwB;AACP;AACiB;AAAjB;AACP;AAAkB;AAAsB;AAAhB;AAAe;AACjC,KAlzBJ,OAkzBY,CAAA,UAlzBM,MAkzBN,GAlzBe,MAkzBf,CAAA,GAAA;EAAA,QAAA,EAjzBb,eAizBa;EACP;AACe;AAAf;AACP;EAAU,MAAA,CAAA,EA/yBV,aA+yBU;AAAY,CAAA,GAAA,CA9yB3B,SA8yB2B,CA9yBjB,WA8yBiB,CA9yBL,CA8yBK,CAAA,MAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAR,IAAA,EA7yBb,WA6yBa;AAA6B,CAAA,GA5yBlD,WA4yBkD,CAAA,GAAA,CA3yBnD,SA2yBmD,CA3yBzC,WA2yByC,CA3yB7B,CA2yB6B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAG,OAAA,EA1yBzC,cA0yByC;AAAnB,CAAA,GAzyBjC,WAyyBiC,CAAA,GAAA,CAxyBnC,UAwyBmC,CAxyBxB,CAwyBwB,CAAA,SAAA,IAAA,GAAA;EAAe,OAAA,EAxyBV,cAwyBU;AAwOpD,CAAA,GAhhC6D,WAghC7C,CAAS,GAAA,CA/gCvB,WA+gCuB,CA/gCX,CA+gCW,CAAA,SAAA,IAAA,GAAA;EAAA,SAAA,EA9gCR,gBA8gCQ;AAAc,CAAA,GA7gCnC,WA6gCmC,CAAA;AAAR;AAAkB,KA1gC5C,kBA0gC4C,CAAA,UA1gCf,MA0gCe,CAAA,GAzgChD,WAygCgD,CAzgCpC,CAygCoC,CAAA,SAAA,CAAA,CAAA,SAAA;EAAM,SAAA,EAAA,KAAA,EAAA;IAtgCnD,IACA;;KAGQ,yBAAyB,UAAU,cACxC,mBAAmB;;KAKrB,4BACM,4BAEP,gBAAgB,mBAAmB,KACpC,YAAY,mBAAmB,GAAG;;IACjC,cAAc;;;;;KAQN,0BAA0B;YAC3B,OAAO,kBAAkB,GAAG;;;;;;;;;UAY7B,kBAAA;;;;;;;;UAaA,YAAA;YACC;QACJ;WACG;WACA;aACE;;;UAIF,YAAA;;;;;;;;;;;;;;;;;;;KAoBE,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;QAqBA,MAAA,CAAO;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BQ,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAslBH,yBAAyB,gBAAgB,IAAI,QAAQ;iBACrD,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB;iBAClC,yBACC,wBACA,eAAe,YACtB,UAAU,IAAI,QAAQ,KAAK,gBAAgB,GAAG;;;;;;;;;;;;iBAwOxC,SAAA,MAAe,QAAQ,UAAU"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@neondatabase/env",
3
- "version": "0.11.5",
3
+ "version": "0.11.6",
4
4
  "description": "Resolve and inject Neon connection strings for the branch selected by your neon.ts policy. fetchEnv / parseEnv plus a `neon-env` CLI with `run` and `export`.",
5
5
  "keywords": [
6
6
  "neon",
@@ -45,12 +45,12 @@
45
45
  "tsdown": "^0.14.1",
46
46
  "typescript": "^5.9.0",
47
47
  "vitest": "^3.0.9",
48
- "@neon/sdk": "1.2.0"
48
+ "@neon/sdk": "1.3.0"
49
49
  },
50
50
  "dependencies": {
51
51
  "zod": "^4.4.3",
52
52
  "yargs": "^18.0.0",
53
- "@neon/config": "0.9.5"
53
+ "@neon/config": "0.9.6"
54
54
  },
55
55
  "engines": {
56
56
  "node": ">=20.19.0"