@neondatabase/env 0.11.8 → 0.12.0

package/dist/lib/env.d.ts

@@ -1,5 +1,6 @@
-import { Config } from "../config/dist/lib/types.js";
-import { NeonApi } from "../config/dist/lib/neon-api.js";
+import { Config, CredentialScope, ResolvedPreviewConfig } from "../config/dist/lib/types.js";
+import { NeonApi, NeonBranchSnapshot } from "../config/dist/lib/neon-api.js";
+import { resolveConfig } from "../config/dist/lib/define-config.js";
 import "../config/dist/v1.js";
 
 //#region src/lib/env.d.ts
@@ -239,6 +240,7 @@ type NeonFunctionEnv<C extends Config, S extends string> = {
  */
 interface EnvKeysByNamespace {
   postgres: "DATABASE_URL" | "DATABASE_URL_UNPOOLED";
+  branch: "NEON_BRANCH";
   auth: "NEON_AUTH_BASE_URL" | "NEON_AUTH_JWKS_URL";
   dataApi: "NEON_DATA_API_URL";
   storage: "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_ENDPOINT_URL_S3" | "AWS_REGION";
@@ -247,6 +249,7 @@ interface EnvKeysByNamespace {
 /** The {@link NeonEnv} namespace interface backing each namespace key. */
 interface NamespaceEnv {
   postgres: NeonPostgresEnv;
+  branch: NeonBranchEnv;
   auth: NeonAuthEnv;
   dataApi: NeonDataApiEnv;
   storage: NeonStorageEnv;
@@ -256,6 +259,7 @@ interface NamespaceEnv {
 interface EnvKeyToProp {
   DATABASE_URL: "databaseUrl";
   DATABASE_URL_UNPOOLED: "databaseUrlUnpooled";
+  NEON_BRANCH: "name";
   NEON_AUTH_BASE_URL: "baseUrl";
   NEON_AUTH_JWKS_URL: "jwksUrl";
   NEON_DATA_API_URL: "url";
@@ -339,11 +343,6 @@ interface FetchEnvOptions {
    * the branch has no databases or the requested `databaseName` does not exist.
    */
   databaseName?: string;
-  /**
-   * Env source used for one-time Auth keys that cannot be refetched after integration
-   * creation. Defaults to `process.env`; callers may layer values from `.env.local`.
-   */
-  env?: NodeJS.ProcessEnv;
 }
 /**
  * Resolve the project + branch this process should target, then fetch live Neon
@@ -366,9 +365,74 @@ interface FetchEnvOptions {
  * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
  * ```
  *
- * The package does **not** mutate `process.env` or the filesystem itself.
+ * Pass `keys` to fetch only some of them — see the overload below.
+ *
+ * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything
+ * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret
+ * issued to a previous call) is minted afresh rather than recovered. Callers that hold
+ * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides
+ * what is still valid and narrows this call's `keys` accordingly.
  */
+declare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, options: FetchEnvOptions & {
+  /**
+   * Fetch only these OS-level env vars, instead of everything the policy enables. The
+   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is
+   * narrowed to match ({@link FilteredNeonEnv}).
+   *
+   * The point is not just a smaller result: **work is skipped too.** Leave out
+   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch
+   * credential is minted at all, so a caller that already holds valid secrets can refresh
+   * everything else without issuing a new one. The non-secret vars of the same features
+   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not
+   * credential-backed and stay available on their own.
+   *
+   * The selection **intersects** with the policy rather than overriding it: naming a var
+   * the branch policy does not enable is not an error, it simply yields nothing.
+   */
+  keys: readonly K[];
+}): Promise<FilteredNeonEnv<K>>;
 declare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions): Promise<NeonEnv<C>>;
+/**
+ * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
+ * narrowing. Exists for callers that compute the selection at runtime — notably
+ * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
+ * branch — since the public overload's `keys` is bound to a literal union those callers cannot
+ * produce without asserting.
+ *
+ * `keys === null` selects everything the policy enables.
+ */
+declare function fetchEnvKeys(config: Config, options: FetchEnvOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;
+/**
+ * Resolve the target branch and evaluate the policy against it — the first thing any
+ * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}
+ * so the two agree on which branch they're talking about and what it has enabled.
+ */
+declare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, "projectId" | "branch" | "branchId">, api: NeonApi): Promise<{
+  branch: NeonBranchSnapshot;
+  desired: ReturnType<typeof resolveConfig>;
+}>;
+/**
+ * Scopes the branch credential should carry for a resolved branch policy. Only object storage
+ * and the AI Gateway *require* a credential; functions never force one (they have no credential
+ * of their own), but `functions:invoke` is added to the scope set when a credential is already
+ * being minted for storage / the AI Gateway, so the one credential can invoke the branch's
+ * functions too. Returns `[]` only when nothing credential-bearing is enabled.
+ */
+declare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined): CredentialScope[];
+/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */
+declare function credentialName(branchName: string): string;
+/** The env-var keys a branch credential's secrets surface under, in emit order. */
+declare function credentialEnvKeys(flags: {
+  storage: boolean;
+  aiGateway: boolean;
+}): string[];
+/**
+ * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller
+ * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without
+ * re-deriving which vars a policy implies.
+ */
+declare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];
+declare function createApiFromOptions(options: FetchEnvOptions): NeonApi;
 /**
  * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates
  * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the
@@ -432,7 +496,14 @@ declare function parseEnv<const C extends Config, const K extends SelectableEnvK
  * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which
  * conditional namespaces are present.
  */
-declare function toEntries(env: NeonEnv<Config>): Record<string, string>;
+declare function toEntries(env: ResolvedNeonEnv): Record<string, string>;
+/**
+ * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed
+ * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and
+ * property is optional so a filtered result — which legitimately carries only what was asked
+ * for — projects to exactly the vars it holds instead of failing to type-check.
+ */
+type ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };
 //#endregion
-export { FetchEnvOptions, FilteredNeonEnv, FunctionSlugOf, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionEnv, NeonPostgresEnv, NeonStorageEnv, NoFunctionScopeHint, SelectableEnvKey, fetchEnv, parseEnv, toEntries };
+export { FetchEnvOptions, FilteredNeonEnv, FunctionSlugOf, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionEnv, NeonPostgresEnv, NeonStorageEnv, NoFunctionScopeHint, ResolvedNeonEnv, SelectableEnvKey, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, parseEnv, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };
 //# sourceMappingURL=env.d.ts.map

package/dist/lib/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","names":[],"sources":["../../src/lib/env.ts"],"mappings":";;;;;cAqDa;;;;AAAb;AAkDA;EAKiB,SAAA,MAAA,EAAA;IAuBA,SAAA,IAAW,EAAA,aAAA;EAOX,CAAA;EAeA,SAAA,QAAc,EAAA;IAiBd,SAAA,WAAgB,EAAA,cAAA;IAU5B,SAAA,mBAAoB,EAAA,uBAAA;EAapB,CAAA;EAAS,SAAA,IAAA,EAAA;IAAO,SAAA,OAAA,EAAA,oBAAA;IAEjB,SAAA,OAAA,EAAA,oBAAA;EAEC,CAAA;EAEC,SAAA,OAAA,EAAA;IAEC,SAAA,GAAA,EAAA,mBAAA;EAEC,CAAA;EAAC;AAAA;AAKiB;AAWX;AAAW;EAAuB,SAAA,OAAA,EAAA;IAAZ,SAAA,WAAA,EAAA,mBAAA;IAEtB,SAAA,eAAA,EAAA,uBAAA;IAAZ,SAAA,QAAA,EAAA,qBAAA;IACqB,SAAA,MAAA,EAAA,YAAA;EAAZ,CAAA;EAAR;AAAO;AAAA;AAYK;AAAW;AAAuB;AAAZ;EAEvB,SAAA,SAAA,EAAA;IAAZ,SAAA,MAAA,EAAA,uBAAA;IACuB,SAAA,OAAA,EAAA,0BAAA;EAAZ,CAAA;AAAV,CAAA;AAAS;AAiBb;AAAmB;AAAW;AAAS;AAC5B;AAKD,UA7JO,aAAA,CA6JP;EACiB,IAAA,EAAA,MAAA;AAAZ;AAAV;AACM,UA1JM,eAAA,CA0JN;EACR;AACqB;AAAZ;AAAV;EACa,WAAA,EAAA,MAAA;EACX;AACS;AAAX;AAAwC;AAAmB;EAC/C,mBAAA,EAAA,MAAA;AAAZ;AACe;AACb;AAAW;AAAE;AAGM;AAAW;AACrB;AAAZ;AAGG;AACA,UAnJa,WAAA,CAmJb;EAAM,OAAA,EAAA,MAAA;EAGE;EAAc,OAAA,EAAA,MAAA;AAAW;AACX;AAAnB,UAhJU,cAAA,CAgJV;EADwC,GAAA,EAAA,MAAA;AAAO;AAetD;AACyK;AASlJ;AAAW;AAClB;AAAf;AAEE;AACA;AAAC;AAAA;AAGkB;AACX,UAjKM,cAAA,CAiKN;EAEP,WAAA,EAAA,MAAA;EAAmC,eAAA,EAAA,MAAA;EAAnB;EACc,QAAA,EAAA,MAAA;EAAnB;EAAsB,MAAA,EAAA,MAAA;AAAlC;AACe;AAAd;AAAO;AAQX;AAA2B;AAAW;AACF;AAAG;AAArB,UA7JD,gBAAA,CA6JC;EAAP,MAAA,EAAA,MAAA;EAAM,OAAA,EAAA,MAAA;AACf;AAW0B;AAaN;AACX;AACJ;AACG;AACA,KAhLL,WAAA,GAAc,MAgLT,CAAA,KAAA,EAAA,KAAA,CAAA;AACE;AAAgB;AAAA;AAwB5B;AAA4B;AAAW;AACtC;AAAiC;AAAR;AAAmB;AAAkB;AAiB/D,KA9MK,SA8MO,CAAA,CAAA,CAAA,GAAA,CA9MS,CA8MM,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CA5MvB,CA4MuB,CAAA,SAAA,CAAA;EAAA,OAAA,EAAA,KAAA;AACd,CAAA,CAAA,GAAA,KAAA,GAAA,CA3MR,CA2MQ,CAAA,SAAA,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CAzMP,CAyMO,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAvMN,CAuMM,CAAA,SAAA,CAAA;EACH,OAAA,EAAA,IAAA;AAAG,CAAA,CAAA,GAAA,IAAA,GAAA,CAtML,CAsMK,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AAAmB;AAA9B,KAjMG,OAiMH,CAAA,CAAA,CAAA,GAAA,CAAA,MAjMuB,CAiMvB,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAGE;AACY;AAAG;AAAmB;AAA9B;AAAqC;AAAa;AACjD;AAAgB;AAAa,KA3LjC,UA2LiC,CAAA,UA3LZ,MA2LY,CAAA,GAAA,CA3LD,WA2LC,CA3LW,CA2LX,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAzLnC,WAyLmC,CAzLvB,CAyLuB,CAAA,SAAA,CAAA,CAAA,SAAA;EAAG,OAAA,EAAA,KAAA,EAAA;AAAa,CAAA,GAxLlD,OAwLkD,CAxL1C,WAwL0C,CAxL9B,CAwL8B,CAAA,CAAA,GAAA,KAAA;AAC7C;AACA;AAAa;AAAC;AAIvB;AAAgC;AAiCzB;AAqBA;AAAiB;AA0BxB,KAlQK,WAkQyB,CAAA,UAlQH,MAkQG,CAAA,GAAA,CAlQQ,WAkQR,CAlQoB,CAkQpB,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAhQ3B,WAgQ2B,CAhQf,CAgQe,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,SAAA,EAAA,KAAA,EAAA;AAAiB,CAAA,GA/P3C,SA+P2C,CA/PjC,WA+PiC,CA/PrB,CA+PqB,CAAA,CAAA,GAAA,KAAA;AACtC;AACC;AACS;AAAR;AAAR;AAAO;AAulBV;AAAwB;AAAiB;AAAgB;AAAY;AAAR;AAAO;AASpE;AAAwB,KAj1BZ,OAi1BY,CAAA,UAj1BM,MAi1BN,GAj1Be,MAi1Bf,CAAA,GAAA;EACP,QAAA,EAj1BN,eAi1BM;EACe;AAAf;AAER;AACkB;EAAG,MAAA,CAAA,EAh1BpB,aAg1BoB;AAAtB,CAAA,GAAA,CA/0BH,SA+0BG,CA/0BO,WA+0BP,CA/0BmB,CA+0BnB,CAAA,MAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EACG,IAAA,EA/0BA,WA+0BA;AAAR,CAAA,GA90BA,WA80BA,CAAA,GAAA,CA70BD,SA60BC,CA70BS,WA60BT,CA70BqB,CA60BrB,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAA6B,OAAA,EA50BjB,cA40BiB;AAAG,CAAA,GA30B/B,WA20B+B,CAAA,GAAA,CA10BjC,UA00BiC,CA10BtB,CA00BsB,CAAA,SAAA,IAAA,GAAA;EAAnB,OAAA,EA10B0B,cA00B1B;AAAe,CAAA,GA10B8B,WA00B9B,CAAA,GAAA,CAz0B7B,WAy0B6B,CAz0BjB,CAy0BiB,CAAA,SAAA,IAAA,GAAA;EACf,SAAA,EAz0BC,gBAy0BO;AAAA,CAAA,GAx0BpB,WAw0BoB,CAAA;AACP;AACiB,KAv0B7B,kBAu0B6B,CAAA,UAv0BA,MAu0BA,CAAA,GAt0BjC,WAs0BiC,CAt0BrB,CAs0BqB,CAAA,SAAA,CAAA,CAAA,SAAA;EAAjB,SAAA,EAAA,KAAA,EAAA;AACP,CAAA,GAp0BN,CAo0BM,GAn0BN,MAm0BM,CAAA,KAAA,EAAA,KAAA,CAAA;AAAkB;AAAsB,KAh0BtC,cAg0BsC,CAAA,UAh0Bb,MAg0Ba,CAAA,GAh0BH,OAg0BG,CAAA,MA/zB3C,kBA+zB2C,CA/zBxB,CA+zBwB,CAAA,EAAA,MAAA,CAAA;AAAhB;AAAe;AAwOjD;AAAyB;AAAc;AAAR;AAAkB;AAAM;KAzhC3C,mBAAA;;;;;;;;KAUP,6BAA6B,6BACjC,eAAe,sBAEb,sBACA;;KAGE,4BACM,4BAEP,gBAAgB,mBAAmB,KACpC,YAAY,mBAAmB,GAAG;;IACjC,cAAc;;;;;KAQN,0BAA0B;YAC3B,OAAO,kBAAkB,GAAG;;;;;;;;;UAY7B,kBAAA;;;;;;;;UAaA,YAAA;YACC;QACJ;WACG;WACA;aACE;;;UAIF,YAAA;;;;;;;;;;;;;;;;;;;KAoBE,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;QAqBA,MAAA,CAAO;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BQ,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAulBH,yBAAyB,gBAAgB,IAAI,QAAQ;iBASrD,yBACC,wBACA,eAAe,YAEvB,UACD,mBAAmB,GAAG,KAC3B,QAAQ,KAAK,gBAAgB,GAAG;iBACnB,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB;;;;;;;;;;;;iBAwOlC,SAAA,MAAe,QAAQ,UAAU"}
+{"version":3,"file":"env.d.ts","names":[],"sources":["../../src/lib/env.ts"],"mappings":";;;;;;cAsDa;;;;;AAAb;EAkDiB,SAAA,MAAA,EAAa;IAKb,SAAA,IAAA,EAAe,aAAA;EAuBf,CAAA;EAOA,SAAA,QAAc,EAAA;IAed,SAAA,WAAc,EAAA,cAAA;IAiBd,SAAA,mBAAgB,EAAA,uBAAA;EAU5B,CAAA;EAaA,SAAA,IAAS,EAAA;IAAA,SAAA,OAAA,EAAA,oBAAA;IAAO,SAAA,OAAA,EAAA,oBAAA;EAEjB,CAAA;EAEC,SAAA,OAAA,EAAA;IAEC,SAAA,GAAA,EAAA,mBAAA;EAEC,CAAA;EAEC;AAAC;AAAA;AAKiB;AAWX;EAAW,SAAA,OAAA,EAAA;IAAuB,SAAA,WAAA,EAAA,mBAAA;IAAZ,SAAA,eAAA,EAAA,uBAAA;IAEtB,SAAA,QAAA,EAAA,qBAAA;IAAZ,SAAA,MAAA,EAAA,YAAA;EACqB,CAAA;EAAZ;AAAR;AAAO;AAAA;AAYK;AAAW;AAAuB;EAAZ,SAAA,SAAA,EAAA;IAEvB,SAAA,MAAA,EAAA,uBAAA;IAAZ,SAAA,OAAA,EAAA,0BAAA;EACuB,CAAA;AAAZ,CAAA;AAAV;AAAS;AAiBb;AAAmB;AAAW;AAAS;AAC5B,UAxJM,aAAA,CAwJN;EAKD,IAAA,EAAA,MAAA;AACiB;AAAZ;AAAV,UAzJY,eAAA,CAyJZ;EACM;AACR;AACqB;AAAZ;EAAV,WAAA,EAAA,MAAA;EACa;AACX;AACS;AAAX;AAAwC;EAAmB,mBAAA,EAAA,MAAA;AAC/C;AAAZ;AACe;AACb;AAAW;AAAE;AAGM;AAAW;AACrB;AAAZ;AAGG,UAlJa,WAAA,CAkJb;EACA,OAAA,EAAA,MAAA;EAAM;EAGE,OAAA,EAAA,MAAA;AAAc;AAAW;AACX,UAhJT,cAAA,CAgJS;EAAnB,GAAA,EAAA,MAAA;AADwC;AAAO;AAetD;AACyK;AASlJ;AAAW;AAClB;AAAf;AAEE;AACA;AAAC;AAAA;AAGkB,UAhKL,cAAA,CAgKK;EACX,WAAA,EAAA,MAAA;EAEP,eAAA,EAAA,MAAA;EAAmC;EAAnB,QAAA,EAAA,MAAA;EACc;EAAnB,MAAA,EAAA,MAAA;AAAsB;AAAlC;AACe;AAAd;AAAO;AAQX;AAA2B;AAAW;AACF;AAAG,UA7JtB,gBAAA,CA6JsB;EAArB,MAAA,EAAA,MAAA;EAAP,OAAA,EAAA,MAAA;AAAM;AACf;AAW0B;AAcN;AACX;AACF;AACF,KAhLF,WAAA,GAAc,MAgLZ,CAAA,KAAA,EAAA,KAAA,CAAA;AACG;AACA;AACE;AAAgB;AAAA;AAyB5B;AAA4B;AAAW;AACtC;AAAiC;AAAR;AAAmB,KAhMxC,SAgMwC,CAAA,CAAA,CAAA,GAAA,CAhMxB,CAgMwB,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CA9LzC,CA8LyC,CAAA,SAAA,CAAA;EAAkB,OAAA,EAAA,KAAA;AAiB/D,CAAA,CAAA,GAAY,KAAA,GAAA,CA7MP,CA6MO,CAAA,SAAe,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CA3MrB,CA2MqB,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAzMpB,CAyMoB,CAAA,SAAA,CAAA;EAAA,OAAA,EAAA,IAAA;AACd,CAAA,CAAA,GAAA,IAAA,GAAA,CAxML,CAwMK,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AACH;AAAG,KApMR,OAoMQ,CAAA,CAAA,CAAA,GAAA,CAAA,MApMY,CAoMZ,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAmB;AAA9B;AAGE;AACY;AAAG;AAAmB;AAA9B;AAAqC;AAAa;AACjD,KA9LJ,UA8LI,CAAA,UA9LiB,MA8LjB,CAAA,GAAA,CA9L4B,WA8L5B,CA9LwC,CA8LxC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA5LN,WA4LM,CA5LM,CA4LN,CAAA,SAAA,CAAA,CAAA,SAAA;EAAgB,OAAA,EAAA,KAAA,EAAA;AAAa,CAAA,GA3LlC,OA2LkC,CA3L1B,WA2L0B,CA3Ld,CA2Lc,CAAA,CAAA,GAAA,KAAA;AAAG;AAAa;AAC7C;AACA;AAAa;AAAC;AAIvB;AAiFA;AAA8B;AACb,KAvQZ,WAuQY,CAAA,UAvQU,MAuQV,CAAA,GAAA,CAvQqB,WAuQrB,CAvQiC,CAuQjC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GArQd,WAqQc,CArQF,CAqQE,CAAA,SAAA,CAAA,CAAA,SAAA;EACiB,SAAA,EAAA,KAAA,EAAA;AAAjB,CAAA,GArQb,SAqQa,CArQH,WAqQG,CArQS,CAqQT,CAAA,CAAA,GAAA,KAAA;AAER;AACC;AAgBO;AAEU;AAAhB;AAAR;AAAO;AACV;AAA8B;AAAiB;AACtC;AACC;AACS;AAAR;AAAR,KA7QS,OA6QT,CAAA,UA7Q2B,MA6Q3B,GA7QoC,MA6QpC,CAAA,GAAA;EAAO,QAAA,EA5QC,eA4QD;EAiBY;AAAY;AACzB;AACC;EAEC,MAAA,CAAA,EA5RD,aA4RC;AAAR,CAAA,GAAA,CA3RE,SA2RF,CA3RY,WA2RZ,CA3RwB,CA2RxB,CAAA,MAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAO,IAAA,EA1RC,WA0RD;AAuMV,CAAA,GAheG,WAgemB,CAAA,GAAA,CA/dpB,SA+duC,CA/d7B,WA+d6B,CA/djB,CA+diB,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EA9d1B,cA8d0B;AAChC,CAAA,GA9dL,WA8dK,CAAA,GAAA,CA7dP,UA6dO,CA7dI,CA6dJ,CAAA,SAAA,IAAA,GAAA;EACM,OAAA,EA9d2B,cA8d3B;AAAL,CAAA,GA9dmD,WA8dnD,CAAA,GAAA,CA7dR,WA6dQ,CA7dI,CA6dJ,CAAA,SAAA,IAAA,GAAA;EACJ,SAAA,EA7dW,gBA6dX;AAEG,CAAA,GA9dL,WA8dK,CAAA;AACmB;AAAlB,KA5dL,kBA4dK,CAAA,UA5dwB,MA4dxB,CAAA,GA3dT,WA2dS,CA3dG,CA2dH,CAAA,SAAA,CAAA,CAAA,SAAA;EAFP,SAAA,EAAA,KAAA,EAAA;AAAO,CAAA,GAtdN,CAsdM,GArdN,MAqdM,CAAA,KAAA,EAAA,KAAA,CAAA;AAgDV;AAAuC,KAlgB3B,cAkgB2B,CAAA,UAlgBF,MAkgBE,CAAA,GAlgBQ,OAkgBR,CAAA,MAjgBhC,kBAigBgC,CAjgBb,CAigBa,CAAA,EAAA,MAAA,CAAA;AAC7B;AACP;AAAe;AAalB;AAKA;AAoBA;AAA6B;AACD;AAAlB,KA5hBE,mBAAA,GA4hBF,uKAAA;AAAU;AA0FpB;AAAoC;AAAU;AAAkB;AAAO;AA4RvE;AAAwB,KAx4BnB,kBAw4BmB,CAAA,UAx4BU,MAw4BV,EAAA,UAAA,MAAA,CAAA,GAAA,CAv4BvB,cAu4BwC,CAv4BzB,CAu4ByB,CAAA,CAAgB,SAAA,CAAA,KAAA,CAAA,GAr4BtD,mBAq4BsD,GAp4BtD,CAo4BsD;AAAY;AAAR,KAj4BxD,iBAi4BwD,CAAA,UAh4BlD,MAg4BkD,EAAA,UAAA,MAAA,CAAA,GA93BzD,CA83ByD,SAAA,MA93BzC,kBA83ByC,CA93BtB,CA83BsB,CAAA,GA73B1D,WA63B0D,CA73B9C,kBA63B8C,CA73B3B,CA63B2B,CAAA,CA73BxB,CA63BwB,CAAA,CAAA,SAAA;EAAO,GAAA,EAAA,KAAA,EAAA;AASpE,CAAA,GAr4BI,OAq4BY,CAAA,MAr4BE,CAq4BM,EAAA,MAAA,CAAA,GAAA,KAAA,GAAA,KAAA;AAAA;AACP;AACe;AAAf;AAER,KAj4BG,eAi4BH,CAAA,UAj4B6B,MAi4B7B,EAAA,UAAA,MAAA,CAAA,GAAA;EACkB,QAAA,EAj4BhB,MAi4BgB,CAj4BT,iBAi4BS,CAj4BS,CAi4BT,EAj4BY,CAi4BZ,CAAA,EAAA,MAAA,CAAA;AAAG,CAAA;AAAtB;AACG;AAAR;AAA6B;AAAG;AAAnB;AAAe;AAC/B,UAv3BU,kBAAA,CAu3Bc;EAAA,QAAA,EAAA,cAAA,GAAA,uBAAA;EACP,MAAA,EAAA,aAAA;EACiB,IAAA,EAAA,oBAAA,GAAA,oBAAA;EAAjB,OAAA,EAAA,mBAAA;EACP,OAAA,EAAA,mBAAA,GAAA,uBAAA,GAAA,qBAAA,GAAA,YAAA;EAAkB,SAAA,EAAA,uBAAA,GAAA,0BAAA;AAAsB;AAAhB;AAAe,UA52BvC,YAAA,CA42BuC;EAyOjC,QAAA,EAplCL,eAolCc;EAAA,MAAA,EAnlChB,aAmlCgB;EAAM,IAAA,EAllCxB,WAklCwB;EAAkB,OAAA,EAjlCvC,cAilCuC;EAAM,OAAA,EAhlC7C,cAglC6C;EA8B3C,SAAA,EA7mCA,gBA6mCe;AAAA;AACd;AAAwB,UA1mC3B,YAAA,CA0mC2B;EAAa,YAAA,EAAA,aAAA;EAArB,qBAAA,EAAA,qBAAA;EAAO,WAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;KArlCxB,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDe,yBACL,wBACA,iBAAiB,YAEzB,YACC;;;;;;;;;;;;;;;;iBAgBO;IAEd,QAAQ,gBAAgB;iBACL,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;iBAiBG,YAAA,SACb,iBACC,kDAEP,QAAQ;;;;;;iBAuMW,mBAAA,SACb,iBACC,KAAK,4DACT,UACH;UACM;WACC,kBAAkB;;;;;;;;;iBA8CZ,uBAAA,UACN,oCACP;;iBAaa,cAAA;;iBAKA,iBAAA;;;;;;;;;iBAoBA,aAAA,UACN,kBAAkB;iBA0FZ,oBAAA,UAA8B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4RhD,yBAAyB,gBAAgB,IAAI,QAAQ;iBASrD,yBACC,wBACA,eAAe,YAEvB,UACD,mBAAmB,GAAG,KAC3B,QAAQ,KAAK,gBAAgB,GAAG;iBACnB,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB;;;;;;;;;;;;iBAyOlC,SAAA,MAAe,kBAAkB;;;;;;;KA8BrC,eAAA,iBACC,gBAAgB,QAAQ,aAAa"}

package/dist/lib/env.js

@@ -73,51 +73,31 @@ const NEON_ENV_VAR_KEYS = {
 		baseUrl: "NEON_AI_GATEWAY_BASE_URL"
 	}
 };
+async function fetchEnv(config, options) {
+	return fetchEnvKeys(config, options, options.keys ?? null);
+}
 /**
-* Resolve the project + branch this process should target, then fetch live Neon
-* connection strings for that branch over the network. Async — calls the Neon API.
-*
-* Use this from build scripts and the `neon-env run` command, where top-level await is
-* fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle
-* config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use
-* {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against
-* `process.env`.
-*
-* Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)
-* explicitly (resolve them in your CLI, e.g. neonctl).
+* The {@link fetchEnv} body, with the key selection as a plain argument and no generic
+* narrowing. Exists for callers that compute the selection at runtime — notably
+* {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
+* branch — since the public overload's `keys` is bound to a literal union those callers cannot
+* produce without asserting.
 *
-* ```ts
-* import config from "../neon";
-* import { fetchEnv } from "@neon/env";
-*
-* const env = await fetchEnv(config, { projectId: "patient-art-12345", branch: "main" });
-* const db = drizzle(neon(env.postgres.databaseUrl), { schema });
-* ```
-*
-* The package does **not** mutate `process.env` or the filesystem itself.
+* `keys === null` selects everything the policy enables.
 */
-async function fetchEnv(config, options) {
+async function fetchEnvKeys(config, options, keys) {
 	const api = options.api ?? createApiFromOptions(options);
 	const projectId = options.projectId;
-	const branches = await api.listBranches(projectId);
-	if (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, "Deploy your neon.ts policy (or create a branch) first, or pick a different project id."].join(" "), { details: { projectId } });
-	const branchRef = options.branch ?? options.branchId;
-	if (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, ["fetchEnv: no branch provided.", "Pass `branch` with a branch name (e.g. `main`) or id (`br-…`)."].join(" "), { details: { projectId } });
-	const branch = resolveBranch(branchRef, branches);
-	const desired = resolveConfig(config, {
-		name: branch.name,
-		id: branch.id,
-		exists: true,
-		...branch.parentId ? { parentId: branch.parentId } : {},
-		isDefault: branch.isDefault,
-		isProtected: branch.protected,
-		...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
-	});
+	const { branch, desired } = await resolveBranchPolicy(config, options, api);
+	const selection = keys ? new Set(keys) : null;
+	const wants = (key) => selection === null || selection.has(key);
+	const result = {};
 	const [roles, databases] = await Promise.all([api.listBranchRoles(projectId, branch.id), api.listBranchDatabases(projectId, branch.id)]);
 	const roleName = pickRoleName(roles, branch, options.roleName);
 	const databaseName = pickDatabaseName(databases, branch, options.databaseName);
-	const wantsAuth = desired.authEnabled;
-	const wantsDataApi = desired.dataApiEnabled;
+	const K = NEON_ENV_VAR_KEYS;
+	const wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));
+	const wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);
 	const [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([
 		api.getConnectionUri(projectId, {
 			branchId: branch.id,
@@ -134,23 +114,20 @@ async function fetchEnv(config, options) {
 		wantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),
 		wantsDataApi ? api.getNeonDataApi(projectId, branch.id, databaseName) : Promise.resolve(null)
 	]);
-	const result = {
-		postgres: {
-			databaseUrl: pooled.uri,
-			databaseUrlUnpooled: unpooled.uri
-		},
-		branch: { name: branch.name }
-	};
+	const postgres = {};
+	if (wants(K.postgres.databaseUrl)) postgres.databaseUrl = pooled.uri;
+	if (wants(K.postgres.databaseUrlUnpooled)) postgres.databaseUrlUnpooled = unpooled.uri;
+	if (Object.keys(postgres).length > 0) result.postgres = postgres;
+	if (wants(K.branch.name)) result.branch = { name: branch.name };
 	if (wantsAuth) {
 		if (!authSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or `npx neonctl …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false."].join(" "), { details: {
 			projectId,
 			branchId: branch.id
 		} });
-		const envSource = options.env ?? process.env;
-		result.auth = {
-			baseUrl: resolveAuthBaseUrl(authSnapshot.baseUrl, envSource),
-			jwksUrl: resolveAuthJwksUrl(authSnapshot.jwksUrl, envSource)
-		};
+		const auth = {};
+		if (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? "";
+		if (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? "";
+		result.auth = auth;
 	}
 	if (wantsDataApi) {
 		if (!dataApiSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${databaseName}.`, "Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false."].join(" "), { details: {
@@ -160,40 +137,70 @@ async function fetchEnv(config, options) {
 		} });
 		result.dataApi = { url: dataApiSnapshot.url };
 	}
-	const wantsStorage = (desired.preview?.buckets.length ?? 0) > 0;
-	const wantsAiGateway = desired.preview?.aiGatewayEnabled ?? false;
-	if (wantsStorage || wantsAiGateway) {
-		const secrets = await resolveCredentialSecrets({
-			api,
-			projectId,
-			branchId: branch.id,
-			branchName: branch.name,
-			scopes: previewCredentialScopes(desired.preview),
-			env: options.env ?? process.env,
-			needStorage: wantsStorage,
-			needApiToken: wantsAiGateway
-		});
+	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
+	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
+	const wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));
+	const wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));
+	const wantsCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey)) || gatewayEnabled && wants(K.aiGateway.apiKey);
+	if (wantsStorage || wantsGateway) {
+		let storage = null;
 		if (wantsStorage) {
-			const storage = await api.getProjectBranchStorage(projectId, branch.id);
+			storage = await api.getProjectBranchStorage(projectId, branch.id);
 			if (!storage) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`, "Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets."].join(" "), { details: {
 				projectId,
 				branchId: branch.id
 			} });
-			result.storage = {
-				accessKeyId: secrets.accessKeyId,
-				secretAccessKey: secrets.secretAccessKey,
-				endpoint: storage.s3Endpoint,
-				region: storage.region
-			};
 		}
-		if (wantsAiGateway) result.aiGateway = {
-			apiKey: secrets.apiToken,
-			baseUrl: aiGatewayBaseUrl(branch.id, unpooled.uri)
-		};
+		const secrets = wantsCredential ? await mintBranchCredential({
+			api,
+			projectId,
+			branchId: branch.id,
+			branchName: branch.name,
+			scopes: previewCredentialScopes(desired.preview)
+		}) : null;
+		if (storage) {
+			const storageEnv = {};
+			if (secrets && wants(K.storage.accessKeyId)) storageEnv.accessKeyId = secrets.accessKeyId;
+			if (secrets && wants(K.storage.secretAccessKey)) storageEnv.secretAccessKey = secrets.secretAccessKey;
+			if (wants(K.storage.endpoint)) storageEnv.endpoint = storage.s3Endpoint;
+			if (wants(K.storage.region)) storageEnv.region = storage.region;
+			result.storage = storageEnv;
+		}
+		if (wantsGateway) {
+			const gateway = {};
+			if (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;
+			if (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, unpooled.uri);
+			result.aiGateway = gateway;
+		}
 	}
 	return result;
 }
 /**
+* Resolve the target branch and evaluate the policy against it — the first thing any
+* branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}
+* so the two agree on which branch they're talking about and what it has enabled.
+*/
+async function resolveBranchPolicy(config, options, api) {
+	const projectId = options.projectId;
+	const branches = await api.listBranches(projectId);
+	if (branches.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: project ${projectId} has no branches.`, "Deploy your neon.ts policy (or create a branch) first, or pick a different project id."].join(" "), { details: { projectId } });
+	const branchRef = options.branch ?? options.branchId;
+	if (!branchRef) throw new PlatformError(ErrorCode.BranchNotFound, ["fetchEnv: no branch provided.", "Pass `branch` with a branch name (e.g. `main`) or id (`br-…`)."].join(" "), { details: { projectId } });
+	const branch = resolveBranch(branchRef, branches);
+	return {
+		branch,
+		desired: resolveConfig(config, {
+			name: branch.name,
+			id: branch.id,
+			exists: true,
+			...branch.parentId ? { parentId: branch.parentId } : {},
+			isDefault: branch.isDefault,
+			isProtected: branch.protected,
+			...branch.expiresAt ? { expiresAt: branch.expiresAt } : {}
+		})
+	};
+}
+/**
 * Scopes the branch credential should carry for a resolved branch policy. Only object storage
 * and the AI Gateway *require* a credential; functions never force one (they have no credential
 * of their own), but `functions:invoke` is added to the scope set when a credential is already
@@ -211,29 +218,50 @@ function previewCredentialScopes(preview) {
 		functions: preview.functions.length > 0
 	});
 }
+/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */
+function credentialName(branchName) {
+	return `neon-env ${branchName}`;
+}
+/** The env-var keys a branch credential's secrets surface under, in emit order. */
+function credentialEnvKeys(flags) {
+	return [...flags.storage ? [NEON_ENV_VAR_KEYS.storage.accessKeyId, NEON_ENV_VAR_KEYS.storage.secretAccessKey] : [], ...flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []];
+}
 /**
-* Resolve the branch credential's secrets, reusing the ones already in the env source when
-* present and minting a fresh `user` credential otherwise. The Neon API returns `api_token` /
-* `s3_secret_access_key` exactly once at mint time, so the persisted copies (e.g. in
-* `.env.local`, surfaced as `NEON_AI_GATEWAY_TOKEN` / `AWS_SECRET_ACCESS_KEY`) are the only way to
-* recover them — exactly how one-time Auth keys are round-tripped. Reuse is presence-based
-* (no extra bookkeeping vars): if every secret the enabled features need is already present,
-* reuse it; otherwise mint one credential covering all currently-needed scopes.
+* Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller
+* subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without
+* re-deriving which vars a policy implies.
 */
-async function resolveCredentialSecrets(args) {
-	const sKeys = NEON_ENV_VAR_KEYS.storage;
-	const aKeys = NEON_ENV_VAR_KEYS.aiGateway;
-	const haveStorage = !args.needStorage || Boolean(args.env[sKeys.accessKeyId] && args.env[sKeys.secretAccessKey]);
-	const haveApiToken = !args.needApiToken || Boolean(args.env[aKeys.apiKey]);
-	if (haveStorage && haveApiToken) return {
-		accessKeyId: args.env[sKeys.accessKeyId] ?? "",
-		secretAccessKey: args.env[sKeys.secretAccessKey] ?? "",
-		apiToken: args.env[aKeys.apiKey] ?? ""
-	};
+function policyEnvKeys(desired) {
+	const K = NEON_ENV_VAR_KEYS;
+	return [
+		K.postgres.databaseUrl,
+		K.postgres.databaseUrlUnpooled,
+		K.branch.name,
+		...desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : [],
+		...desired.dataApiEnabled ? [K.dataApi.url] : [],
+		...(desired.preview?.buckets.length ?? 0) > 0 ? [
+			K.storage.accessKeyId,
+			K.storage.secretAccessKey,
+			K.storage.endpoint,
+			K.storage.region
+		] : [],
+		...desired.preview?.aiGatewayEnabled ? [K.aiGateway.apiKey, K.aiGateway.baseUrl] : []
+	];
+}
+/**
+* Mint the branch credential backing object storage / the AI Gateway.
+*
+* `api_token` and `s3_secret_access_key` come back **exactly once** — they are not stored
+* server-side and the list endpoint returns metadata only — so the caller's copy is the only
+* copy. That is why {@link fetchEnv} mints rather than fetches: there is nothing to fetch. A
+* caller that already holds a valid copy should leave the secret keys out of `keys` (see
+* {@link fetchEnvReusingSecrets}) instead of minting one it will discard.
+*/
+async function mintBranchCredential(args) {
 	const minted = await args.api.createCredential(args.projectId, args.branchId, {
 		scopes: args.scopes,
 		principalType: "user",
-		name: `neon-env ${args.branchName}`
+		name: credentialName(args.branchName)
 	});
 	return {
 		accessKeyId: minted.tokenId,
@@ -263,25 +291,6 @@ function aiGatewayHost(branchId, connectionUri) {
 function aiGatewayBaseUrl(branchId, connectionUri) {
 	return `https://${aiGatewayHost(branchId, connectionUri)}`;
 }
-/**
-* Resolve the Neon Auth base URL to surface in `env.auth`. Prefer the value returned by
-* the integration (`getNeonAuth` includes it); fall back to whatever is already in the
-* caller's env source so older integrations created before `base_url` was returned still
-* round-trip through `env run`.
-*/
-function resolveAuthBaseUrl(snapshotBaseUrl, source) {
-	if (snapshotBaseUrl && snapshotBaseUrl !== "") return snapshotBaseUrl;
-	return source[NEON_ENV_VAR_KEYS.auth.baseUrl] ?? "";
-}
-/**
-* Resolve the Neon Auth JWKS URL to surface in `env.auth`. Prefer the value returned by the
-* integration (`getNeonAuth` always includes `jwks_url`); fall back to the caller's env
-* source so the value still round-trips through `env run` if a snapshot ever omits it.
-*/
-function resolveAuthJwksUrl(snapshotJwksUrl, source) {
-	if (snapshotJwksUrl && snapshotJwksUrl !== "") return snapshotJwksUrl;
-	return source[NEON_ENV_VAR_KEYS.auth.jwksUrl] ?? "";
-}
 function createApiFromOptions(options) {
 	return createNeonApiFromOptions("fetchEnv", {
 		...options.apiKey ? { apiKey: options.apiKey } : {},
@@ -471,6 +480,7 @@ function parseEnv(config, scopeOrKeys) {
 const FILTERABLE_ENV_KEYS = {
 	DATABASE_URL: ["postgres", "databaseUrl"],
 	DATABASE_URL_UNPOOLED: ["postgres", "databaseUrlUnpooled"],
+	NEON_BRANCH: ["branch", "name"],
 	NEON_AUTH_BASE_URL: ["auth", "baseUrl"],
 	NEON_AUTH_JWKS_URL: ["auth", "jwksUrl"],
 	NEON_DATA_API_URL: ["dataApi", "url"],
@@ -532,37 +542,26 @@ function parseFilteredEnv(source, keys) {
 * conditional namespaces are present.
 */
 function toEntries(env) {
-	const out = {
-		[NEON_ENV_VAR_KEYS.postgres.databaseUrl]: env.postgres.databaseUrl,
-		[NEON_ENV_VAR_KEYS.postgres.databaseUrlUnpooled]: env.postgres.databaseUrlUnpooled
+	const out = {};
+	const put = (key, value) => {
+		if (value !== void 0) out[key] = value;
 	};
-	if (env.branch) out[NEON_ENV_VAR_KEYS.branch.name] = env.branch.name;
-	const withAuth = env;
-	if (withAuth.auth) {
-		out[NEON_ENV_VAR_KEYS.auth.baseUrl] = withAuth.auth.baseUrl;
-		out[NEON_ENV_VAR_KEYS.auth.jwksUrl] = withAuth.auth.jwksUrl;
-	}
-	const withDataApi = env;
-	if (withDataApi.dataApi) out[NEON_ENV_VAR_KEYS.dataApi.url] = withDataApi.dataApi.url;
-	const withStorage = env;
-	if (withStorage.storage) {
-		const s = withStorage.storage;
-		const keys = NEON_ENV_VAR_KEYS.storage;
-		out[keys.accessKeyId] = s.accessKeyId;
-		out[keys.secretAccessKey] = s.secretAccessKey;
-		out[keys.endpoint] = s.endpoint;
-		out[keys.region] = s.region;
-	}
-	const withAiGateway = env;
-	if (withAiGateway.aiGateway) {
-		const keys = NEON_ENV_VAR_KEYS.aiGateway;
-		const ai = withAiGateway.aiGateway;
-		out[keys.apiKey] = ai.apiKey;
-		out[keys.baseUrl] = ai.baseUrl;
-	}
+	const K = NEON_ENV_VAR_KEYS;
+	put(K.postgres.databaseUrl, env.postgres?.databaseUrl);
+	put(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);
+	put(K.branch.name, env.branch?.name);
+	put(K.auth.baseUrl, env.auth?.baseUrl);
+	put(K.auth.jwksUrl, env.auth?.jwksUrl);
+	put(K.dataApi.url, env.dataApi?.url);
+	put(K.storage.accessKeyId, env.storage?.accessKeyId);
+	put(K.storage.secretAccessKey, env.storage?.secretAccessKey);
+	put(K.storage.endpoint, env.storage?.endpoint);
+	put(K.storage.region, env.storage?.region);
+	put(K.aiGateway.apiKey, env.aiGateway?.apiKey);
+	put(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);
 	return out;
 }
 //#endregion
-export { NEON_ENV_VAR_KEYS, fetchEnv, parseEnv, toEntries };
+export { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, parseEnv, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };
 
 //# sourceMappingURL=env.js.map