@neondatabase/env 0.15.0 → 1.0.1

package/dist/lib/env.d.ts

@@ -1,509 +0,0 @@
-import { Config, CredentialScope, ResolvedPreviewConfig } from "../config/dist/lib/types.js";
-import { NeonApi, NeonBranchSnapshot } from "../config/dist/lib/neon-api.js";
-import { resolveConfig } from "../config/dist/lib/define-config.js";
-import "../config/dist/v1.js";
-
-//#region src/lib/env.d.ts
-declare const NEON_ENV_VAR_KEYS: {
-  /**
-   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
-   * Neon Functions runtime on every branch (including the default) by default. `env pull` /
-   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.
-   */
-  readonly branch: {
-    readonly name: "NEON_BRANCH";
-  };
-  readonly postgres: {
-    readonly databaseUrl: "DATABASE_URL";
-    readonly databaseUrlUnpooled: "DATABASE_URL_UNPOOLED";
-  };
-  readonly auth: {
-    readonly baseUrl: "NEON_AUTH_BASE_URL";
-    readonly jwksUrl: "NEON_AUTH_JWKS_URL";
-  };
-  readonly dataApi: {
-    readonly url: "NEON_DATA_API_URL";
-  };
-  /**
-   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so
-   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.
-   * `region` is injected under the SDK-standard `AWS_REGION`.
-   */
-  readonly storage: {
-    readonly accessKeyId: "AWS_ACCESS_KEY_ID";
-    readonly secretAccessKey: "AWS_SECRET_ACCESS_KEY";
-    readonly endpoint: "AWS_ENDPOINT_URL_S3";
-    readonly region: "AWS_REGION";
-  };
-  /**
-   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions
-   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)
-   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,
-   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the
-   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).
-   */
-  readonly aiGateway: {
-    readonly apiKey: "NEON_AI_GATEWAY_TOKEN";
-    readonly baseUrl: "NEON_AI_GATEWAY_BASE_URL";
-  };
-};
-/**
- * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch
- * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was
- * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /
- * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).
- */
-interface NeonBranchEnv {
-  name: string;
-}
-/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */
-interface NeonPostgresEnv {
-  /**
-   * Pooled connection string (via Neon's PgBouncer pooler). The right default for
-   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).
-   */
-  databaseUrl: string;
-  /**
-   * Direct (unpooled) connection string. Use this when you need session-level
-   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions
-   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.
-   */
-  databaseUrlUnpooled: string;
-}
-/**
- * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`
- * when the branch policy enables `auth`.
- *
- * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and
- * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live
- * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /
- * `NEON_AUTH_JWKS_URL`).
- */
-interface NeonAuthEnv {
-  baseUrl: string;
-  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */
-  jwksUrl: string;
-}
-/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */
-interface NeonDataApiEnv {
-  url: string;
-}
-/**
- * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only
- * when the policy declares `preview.buckets`. Combines a minted branch credential's access
- * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the
- * storage gateway authenticates against; `secretAccessKey` = its
- * `s3_secret_access_key`) with the branch's non-secret connection details
- * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's
- * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,
- * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always
- * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.
- */
-interface NeonStorageEnv {
-  accessKeyId: string;
-  secretAccessKey: string;
-  /** S3-compatible endpoint URL for the branch. */
-  endpoint: string;
-  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */
-  region: string;
-}
-/**
- * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy
- * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);
- * `baseUrl` is the bare branch-scoped gateway host
- * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env
- * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`
- * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.
- */
-interface NeonAiGatewayEnv {
-  apiKey: string;
-  baseUrl: string;
-}
-/**
- * Empty record alias used as the "false" branch of the conditional namespace adds below.
- * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,
- * which biome rejects (it means "any non-null", not "empty object").
- */
-type NoNamespace = Record<never, never>;
-/**
- * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a
- * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution
- * so a union/`undefined` is checked as one unit:
- *
- * - `false` / `{ enabled: false }` / `undefined` → `false`
- * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`
- *   (a present toggle defaults to enabled)
- * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal
- *   info) → `false`, so an untyped policy yields just `{ postgres }`.
- */
-type ServiceOn<T> = [T] extends [false] ? false : [T] extends [{
-  enabled: false;
-}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{
-  enabled: true;
-}] ? true : [T] extends [object] ? true : false;
-/** True when `T` has at least one known key; `false` for `{}` / `never`. */
-type HasKeys<T> = [keyof T] extends [never] ? false : true;
-/**
- * Whether the policy's **static** `preview` block declares at least one object-storage bucket
- * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.
- *
- * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,
- * `NonNullable<C["preview"]>` is `never`, and without the guard the `extends { … }` probe
- * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`
- * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.
- */
-type HasBuckets<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
-  buckets: infer B;
-} ? HasKeys<NonNullable<B>> : false;
-/**
- * Whether the policy's **static** `preview` block enables the AI Gateway
- * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.
- *
- * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when
- * a policy has no `preview`, `NonNullable<C["preview"]>` is `never`, and a naked `never` in the
- * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`
- * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.
- */
-type AiGatewayOn<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
-  aiGateway: infer A;
-} ? ServiceOn<NonNullable<A>> : false;
-/**
- * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the
- * {@link Config} so the type system knows which optional namespaces are present.
- *
- * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /
- * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct
- * read of those fields — no union-across-branches, no default-config escape hatch:
- *
- * - `postgres` is always present.
- * - `auth` is added iff `config.auth` is statically enabled.
- * - `dataApi` is added iff `config.dataApi` is statically enabled.
- * - `storage` is added iff `config.preview.buckets` declares at least one bucket.
- * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.
- */
-type NeonEnv<C extends Config = Config> = {
-  postgres: NeonPostgresEnv;
-  /**
-   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the
-   * var was injected; `fetchEnv` always populates it.
-   */
-  branch?: NeonBranchEnv;
-} & (ServiceOn<NonNullable<C["auth"]>> extends true ? {
-  auth: NeonAuthEnv;
-} : NoNamespace) & (ServiceOn<NonNullable<C["dataApi"]>> extends true ? {
-  dataApi: NeonDataApiEnv;
-} : NoNamespace) & (HasBuckets<C> extends true ? {
-  storage: NeonStorageEnv;
-} : NoNamespace) & (AiGatewayOn<C> extends true ? {
-  aiGateway: NeonAiGatewayEnv;
-} : NoNamespace);
-/** The static `preview.functions` record of a config, or an empty record when absent. */
-type PreviewFunctionsOf<C extends Config> = NonNullable<C["preview"]> extends {
-  functions: infer F;
-} ? F : Record<never, never>;
-/** The declared function slugs of a config (record keys), as a string union. */
-type FunctionSlugOf<C extends Config> = Extract<keyof PreviewFunctionsOf<C>, string>;
-/**
- * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when
- * the policy declares no functions at all. Without it the argument's expected type is the bare
- * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '"x"' is not
- * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the
- * editor offers it as the single completion, so the empty completion list is explained rather
- * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.
- */
-type NoFunctionScopeHint = "this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env";
-/**
- * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug
- * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no
- * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes
- * the returned `function` namespace exact — it stays the one function's env keys instead of
- * widening to every declared function's.
- */
-type FunctionScopeField<C extends Config, S extends string> = [FunctionSlugOf<C>] extends [never] ? NoFunctionScopeHint : S;
-/** The declared env-var keys of one function `S`, as a string union. */
-type FunctionEnvKeysOf<C extends Config, S extends string> = S extends keyof PreviewFunctionsOf<C> ? NonNullable<PreviewFunctionsOf<C>[S]> extends {
-  env: infer E;
-} ? Extract<keyof E, string> : never : never;
-/**
- * The extra `function` namespace added to `parseEnv`'s result when called with a function
- * slug scope: the declared env-var keys for that function, each resolved to a `string`.
- */
-type NeonFunctionEnv<C extends Config, S extends string> = {
-  function: Record<FunctionEnvKeysOf<C, S>, string>;
-};
-/**
- * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the
- * **input** vars `parseEnv` validates are listed — the output-only aliases in
- * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they
- * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with
- * {@link EnvKeyToProp}.
- */
-interface EnvKeysByNamespace {
-  postgres: "DATABASE_URL" | "DATABASE_URL_UNPOOLED";
-  branch: "NEON_BRANCH";
-  auth: "NEON_AUTH_BASE_URL" | "NEON_AUTH_JWKS_URL";
-  dataApi: "NEON_DATA_API_URL";
-  storage: "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_ENDPOINT_URL_S3" | "AWS_REGION";
-  aiGateway: "NEON_AI_GATEWAY_TOKEN" | "NEON_AI_GATEWAY_BASE_URL";
-}
-/** The {@link NeonEnv} namespace interface backing each namespace key. */
-interface NamespaceEnv {
-  postgres: NeonPostgresEnv;
-  branch: NeonBranchEnv;
-  auth: NeonAuthEnv;
-  dataApi: NeonDataApiEnv;
-  storage: NeonStorageEnv;
-  aiGateway: NeonAiGatewayEnv;
-}
-/** OS-level env-var key → the camelCase property it sets on its namespace object. */
-interface EnvKeyToProp {
-  DATABASE_URL: "databaseUrl";
-  DATABASE_URL_UNPOOLED: "databaseUrlUnpooled";
-  NEON_BRANCH: "name";
-  NEON_AUTH_BASE_URL: "baseUrl";
-  NEON_AUTH_JWKS_URL: "jwksUrl";
-  NEON_DATA_API_URL: "url";
-  AWS_ACCESS_KEY_ID: "accessKeyId";
-  AWS_SECRET_ACCESS_KEY: "secretAccessKey";
-  AWS_ENDPOINT_URL_S3: "endpoint";
-  AWS_REGION: "region";
-  NEON_AI_GATEWAY_TOKEN: "apiKey";
-  NEON_AI_GATEWAY_BASE_URL: "baseUrl";
-}
-/**
- * The OS-level env-var keys selectable for a given policy: the union of input vars across
- * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the
- * `keys` filter — selecting a var from a namespace the policy does not enable is a type error
- * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).
- */
-type SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];
-/**
- * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced
- * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no
- * selected key are dropped, and within a kept namespace only the selected properties survive
- * — selecting just `["DATABASE_URL"]` yields `{ postgres: { databaseUrl: string } }`, with no
- * `databaseUrlUnpooled`.
- *
- * The policy gating lives on the `parseEnv` overload (which binds `K` to
- * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare
- * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops
- * any namespace whose intersection with the selection is empty (`[…] extends [never]`,
- * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its
- * camelCase property and looks the value type up on the canonical namespace interface, so it
- * stays correct if a field ever stops being a plain `string`.
- */
-type FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };
-interface FetchEnvOptions {
-  /**
-   * Neon project id. **Required** — the management API addresses branches through their
-   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.
-   */
-  projectId: string;
-  /**
-   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the
-   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by
-   * id first, then by name, so either form works.
-   */
-  branch?: string;
-  /**
-   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts
-   * a branch name or id. Still honored for backward compatibility; ignored when `branch`
-   * is set.
-   */
-  branchId?: string;
-  /**
-   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →
-   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`
-   * is supplied.
-   */
-  apiKey?: string;
-  /**
-   * Neon **management** API base URL (not the Auth base URL). Falls back to
-   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.
-   */
-  apiHost?: string;
-  /**
-   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely
-   * on the default real adapter built from `apiKey`.
-   */
-  api?: NeonApi;
-  /**
-   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:
-   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the
-   * single role left after dropping the managed Auth/Data API roles
-   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with
-   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.
-   */
-  roleName?: string;
-  /**
-   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,
-   * else the only database on the branch. Throws {@link PlatformError} with
-   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is
-   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when
-   * the branch has no databases or the requested `databaseName` does not exist.
-   */
-  databaseName?: string;
-}
-/**
- * Resolve the project + branch this process should target, then fetch live Neon
- * connection strings for that branch over the network. Async — calls the Neon API.
- *
- * Use this from build scripts and the `neon-env run` command, where top-level await is
- * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle
- * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use
- * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against
- * `process.env`.
- *
- * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)
- * explicitly (resolve them in your CLI, e.g. neonctl).
- *
- * ```ts
- * import config from "../neon";
- * import { fetchEnv } from "@neon/env";
- *
- * const env = await fetchEnv(config, { projectId: "patient-art-12345", branch: "main" });
- * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
- * ```
- *
- * Pass `keys` to fetch only some of them — see the overload below.
- *
- * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything
- * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret
- * issued to a previous call) is minted afresh rather than recovered. Callers that hold
- * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides
- * what is still valid and narrows this call's `keys` accordingly.
- */
-declare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, options: FetchEnvOptions & {
-  /**
-   * Fetch only these OS-level env vars, instead of everything the policy enables. The
-   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is
-   * narrowed to match ({@link FilteredNeonEnv}).
-   *
-   * The point is not just a smaller result: **work is skipped too.** Leave out
-   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch
-   * credential is minted at all, so a caller that already holds valid secrets can refresh
-   * everything else without issuing a new one. The non-secret vars of the same features
-   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not
-   * credential-backed and stay available on their own.
-   *
-   * The selection **intersects** with the policy rather than overriding it: naming a var
-   * the branch policy does not enable is not an error, it simply yields nothing.
-   */
-  keys: readonly K[];
-}): Promise<FilteredNeonEnv<K>>;
-declare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions): Promise<NeonEnv<C>>;
-/**
- * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
- * narrowing. Exists for callers that compute the selection at runtime — notably
- * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
- * branch — since the public overload's `keys` is bound to a literal union those callers cannot
- * produce without asserting.
- *
- * `keys === null` selects everything the policy enables.
- */
-declare function fetchEnvKeys(config: Config, options: FetchEnvOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;
-/**
- * Resolve the target branch and evaluate the policy against it — the first thing any
- * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}
- * so the two agree on which branch they're talking about and what it has enabled.
- */
-declare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, "projectId" | "branch" | "branchId">, api: NeonApi): Promise<{
-  branch: NeonBranchSnapshot;
-  desired: ReturnType<typeof resolveConfig>;
-}>;
-/**
- * Scopes the branch credential should carry for a resolved branch policy. Only object storage
- * and the AI Gateway *require* a credential; functions never force one (they have no credential
- * of their own), but `functions:invoke` is added to the scope set when a credential is already
- * being minted for storage / the AI Gateway, so the one credential can invoke the branch's
- * functions too. Returns `[]` only when nothing credential-bearing is enabled.
- */
-declare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined): CredentialScope[];
-/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */
-declare function credentialName(branchName: string): string;
-/** The env-var keys a branch credential's secrets surface under, in emit order. */
-declare function credentialEnvKeys(flags: {
-  storage: boolean;
-  aiGateway: boolean;
-}): string[];
-/**
- * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller
- * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without
- * re-deriving which vars a policy implies.
- */
-declare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];
-declare function createApiFromOptions(options: FetchEnvOptions): NeonApi;
-/**
- * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates
- * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the
- * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed
- * `process.env.DATABASE_URL` lookups.
- *
- * Designed for the **"env-vars-already-injected"** path:
- * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.
- * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.
- * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.
- *
- * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now
- * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without
- * evaluating the per-branch closure.
- *
- * The second argument is a **scope** or a **key filter**:
- * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the
- *   full `{ postgres, auth?, dataApi?, … }` the policy enables.
- * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are
- *   running inside that function. Returns the same branch secrets **plus** a typed
- *   `function` namespace with the function's declared env-var keys. The slug autocompletes
- *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.
- * - an **array of OS-level env-var keys** (e.g. `["DATABASE_URL", "NEON_AUTH_BASE_URL"]`) —
- *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced
- *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only
- *   pick vars the policy actually enables. Use this when a process needs just a subset (a
- *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't
- *   want `parseEnv` to throw over vars you never use.
- *
- * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env
- * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.
- *
- * ```ts
- * import config from "../neon";
- * import { parseEnv } from "@neon/env";
- *
- * // External (app / build):
- * const env = parseEnv(config);
- * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
- *
- * // Inside the "hello" function:
- * const env = parseEnv(config, "hello");
- * env.function.resendApiKey; // typed from hello's declared env keys
- *
- * // Filtered: only enforce + return the pooled URL.
- * const { postgres } = parseEnv(config, ["DATABASE_URL"]);
- * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent
- * ```
- */
-declare function parseEnv<const C extends Config>(config: C): NeonEnv<C>;
-declare function parseEnv<const C extends Config, const S extends FunctionSlugOf<C>>(config: C, scope: FunctionScopeField<C, S>): NeonEnv<C> & NeonFunctionEnv<C, S>;
-declare function parseEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;
-/**
- * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used
- * for cross-process transport. Named after the web-platform `.entries()` convention
- * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an
- * iterator of tuples since that's the shape env injection needs (wrap with
- * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`
- * to inject the vars into a subprocess's `process.env`.
- *
- * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which
- * conditional namespaces are present.
- */
-declare function toEntries(env: ResolvedNeonEnv): Record<string, string>;
-/**
- * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed
- * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and
- * property is optional so a filtered result — which legitimately carries only what was asked
- * for — projects to exactly the vars it holds instead of failing to type-check.
- */
-type ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };
-//#endregion
-export { FetchEnvOptions, FilteredNeonEnv, FunctionSlugOf, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonFunctionEnv, NeonPostgresEnv, NeonStorageEnv, NoFunctionScopeHint, ResolvedNeonEnv, SelectableEnvKey, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, parseEnv, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };
-//# sourceMappingURL=env.d.ts.map

package/dist/lib/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","names":[],"sources":["../../src/lib/env.ts"],"mappings":";;;;;;cAsDa;;;;;AAAb;EAkDiB,SAAA,MAAA,EAAa;IAKb,SAAA,IAAA,EAAe,aAAA;EAuBf,CAAA;EAOA,SAAA,QAAc,EAAA;IAed,SAAA,WAAc,EAAA,cAAA;IAiBd,SAAA,mBAAgB,EAAA,uBAAA;EAU5B,CAAA;EAaA,SAAA,IAAS,EAAA;IAAA,SAAA,OAAA,EAAA,oBAAA;IAAO,SAAA,OAAA,EAAA,oBAAA;EAEjB,CAAA;EAEC,SAAA,OAAA,EAAA;IAEC,SAAA,GAAA,EAAA,mBAAA;EAEC,CAAA;EAEC;AAAC;AAAA;AAKiB;AAWX;EAAW,SAAA,OAAA,EAAA;IAAuB,SAAA,WAAA,EAAA,mBAAA;IAAZ,SAAA,eAAA,EAAA,uBAAA;IAEtB,SAAA,QAAA,EAAA,qBAAA;IAAZ,SAAA,MAAA,EAAA,YAAA;EACqB,CAAA;EAAZ;AAAR;AAAO;AAAA;AAYK;AAAW;AAAuB;EAAZ,SAAA,SAAA,EAAA;IAEvB,SAAA,MAAA,EAAA,uBAAA;IAAZ,SAAA,OAAA,EAAA,0BAAA;EACuB,CAAA;AAAZ,CAAA;AAAV;AAAS;AAiBb;AAAmB;AAAW;AAAS;AAC5B,UAxJM,aAAA,CAwJN;EAKD,IAAA,EAAA,MAAA;AACiB;AAAZ;AAAV,UAzJY,eAAA,CAyJZ;EACM;AACR;AACqB;AAAZ;EAAV,WAAA,EAAA,MAAA;EACa;AACX;AACS;AAAX;AAAwC;EAAmB,mBAAA,EAAA,MAAA;AAC/C;AAAZ;AACe;AACb;AAAW;AAAE;AAGM;AAAW;AACrB;AAAZ;AAGG,UAlJa,WAAA,CAkJb;EACA,OAAA,EAAA,MAAA;EAAM;EAGE,OAAA,EAAA,MAAA;AAAc;AAAW;AACX,UAhJT,cAAA,CAgJS;EAAnB,GAAA,EAAA,MAAA;AADwC;AAAO;AAetD;AACyK;AASlJ;AAAW;AAClB;AAAf;AAEE;AACA;AAAC;AAAA;AAGkB,UAhKL,cAAA,CAgKK;EACX,WAAA,EAAA,MAAA;EAEP,eAAA,EAAA,MAAA;EAAmC;EAAnB,QAAA,EAAA,MAAA;EACc;EAAnB,MAAA,EAAA,MAAA;AAAsB;AAAlC;AACe;AAAd;AAAO;AAQX;AAA2B;AAAW;AACF;AAAG,UA7JtB,gBAAA,CA6JsB;EAArB,MAAA,EAAA,MAAA;EAAP,OAAA,EAAA,MAAA;AAAM;AACf;AAW0B;AAcN;AACX;AACF;AACF,KAhLF,WAAA,GAAc,MAgLZ,CAAA,KAAA,EAAA,KAAA,CAAA;AACG;AACA;AACE;AAAgB;AAAA;AAyB5B;AAA4B;AAAW;AACtC;AAAiC;AAAR;AAAmB,KAhMxC,SAgMwC,CAAA,CAAA,CAAA,GAAA,CAhMxB,CAgMwB,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CA9LzC,CA8LyC,CAAA,SAAA,CAAA;EAAkB,OAAA,EAAA,KAAA;AAiB/D,CAAA,CAAA,GAAY,KAAA,GAAA,CA7MP,CA6MO,CAAA,SAAe,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CA3MrB,CA2MqB,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAzMpB,CAyMoB,CAAA,SAAA,CAAA;EAAA,OAAA,EAAA,IAAA;AACd,CAAA,CAAA,GAAA,IAAA,GAAA,CAxML,CAwMK,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AACH;AAAG,KApMR,OAoMQ,CAAA,CAAA,CAAA,GAAA,CAAA,MApMY,CAoMZ,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAmB;AAA9B;AAGE;AACY;AAAG;AAAmB;AAA9B;AAAqC;AAAa;AACjD,KA9LJ,UA8LI,CAAA,UA9LiB,MA8LjB,CAAA,GAAA,CA9L4B,WA8L5B,CA9LwC,CA8LxC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA5LN,WA4LM,CA5LM,CA4LN,CAAA,SAAA,CAAA,CAAA,SAAA;EAAgB,OAAA,EAAA,KAAA,EAAA;AAAa,CAAA,GA3LlC,OA2LkC,CA3L1B,WA2L0B,CA3Ld,CA2Lc,CAAA,CAAA,GAAA,KAAA;AAAG;AAAa;AAC7C;AACA;AAAa;AAAC;AAIvB;AAiFA;AAA8B;AACb,KAvQZ,WAuQY,CAAA,UAvQU,MAuQV,CAAA,GAAA,CAvQqB,WAuQrB,CAvQiC,CAuQjC,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GArQd,WAqQc,CArQF,CAqQE,CAAA,SAAA,CAAA,CAAA,SAAA;EACiB,SAAA,EAAA,KAAA,EAAA;AAAjB,CAAA,GArQb,SAqQa,CArQH,WAqQG,CArQS,CAqQT,CAAA,CAAA,GAAA,KAAA;AAER;AACC;AAgBO;AAEU;AAAhB;AAAR;AAAO;AACV;AAA8B;AAAiB;AACtC;AACC;AACS;AAAR;AAAR,KA7QS,OA6QT,CAAA,UA7Q2B,MA6Q3B,GA7QoC,MA6QpC,CAAA,GAAA;EAAO,QAAA,EA5QC,eA4QD;EAiBY;AAAY;AACzB;AACC;EAEC,MAAA,CAAA,EA5RD,aA4RC;AAAR,CAAA,GAAA,CA3RE,SA2RF,CA3RY,WA2RZ,CA3RwB,CA2RxB,CAAA,MAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAO,IAAA,EA1RC,WA0RD;AAuMV,CAAA,GAheG,WAgemB,CAAA,GAAA,CA/dpB,SA+duC,CA/d7B,WA+d6B,CA/djB,CA+diB,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EA9d1B,cA8d0B;AAChC,CAAA,GA9dL,WA8dK,CAAA,GAAA,CA7dP,UA6dO,CA7dI,CA6dJ,CAAA,SAAA,IAAA,GAAA;EACM,OAAA,EA9d2B,cA8d3B;AAAL,CAAA,GA9dmD,WA8dnD,CAAA,GAAA,CA7dR,WA6dQ,CA7dI,CA6dJ,CAAA,SAAA,IAAA,GAAA;EACJ,SAAA,EA7dW,gBA6dX;AAEG,CAAA,GA9dL,WA8dK,CAAA;AACmB;AAAlB,KA5dL,kBA4dK,CAAA,UA5dwB,MA4dxB,CAAA,GA3dT,WA2dS,CA3dG,CA2dH,CAAA,SAAA,CAAA,CAAA,SAAA;EAFP,SAAA,EAAA,KAAA,EAAA;AAAO,CAAA,GAtdN,CAsdM,GArdN,MAqdM,CAAA,KAAA,EAAA,KAAA,CAAA;AAgDV;AAAuC,KAlgB3B,cAkgB2B,CAAA,UAlgBF,MAkgBE,CAAA,GAlgBQ,OAkgBR,CAAA,MAjgBhC,kBAigBgC,CAjgBb,CAigBa,CAAA,EAAA,MAAA,CAAA;AAC7B;AACP;AAAe;AAalB;AAKA;AAoBA;AAA6B;AACD;AAAlB,KA5hBE,mBAAA,GA4hBF,uKAAA;AAAU;AA0FpB;AAAoC;AAAU;AAAkB;AAAO;AA4RvE;AAAwB,KAx4BnB,kBAw4BmB,CAAA,UAx4BU,MAw4BV,EAAA,UAAA,MAAA,CAAA,GAAA,CAv4BvB,cAu4BwC,CAv4BzB,CAu4ByB,CAAA,CAAgB,SAAA,CAAA,KAAA,CAAA,GAr4BtD,mBAq4BsD,GAp4BtD,CAo4BsD;AAAY;AAAR,KAj4BxD,iBAi4BwD,CAAA,UAh4BlD,MAg4BkD,EAAA,UAAA,MAAA,CAAA,GA93BzD,CA83ByD,SAAA,MA93BzC,kBA83ByC,CA93BtB,CA83BsB,CAAA,GA73B1D,WA63B0D,CA73B9C,kBA63B8C,CA73B3B,CA63B2B,CAAA,CA73BxB,CA63BwB,CAAA,CAAA,SAAA;EAAO,GAAA,EAAA,KAAA,EAAA;AASpE,CAAA,GAr4BI,OAq4BY,CAAA,MAr4BE,CAq4BM,EAAA,MAAA,CAAA,GAAA,KAAA,GAAA,KAAA;AAAA;AACP;AACe;AAAf;AAER,KAj4BG,eAi4BH,CAAA,UAj4B6B,MAi4B7B,EAAA,UAAA,MAAA,CAAA,GAAA;EACkB,QAAA,EAj4BhB,MAi4BgB,CAj4BT,iBAi4BS,CAj4BS,CAi4BT,EAj4BY,CAi4BZ,CAAA,EAAA,MAAA,CAAA;AAAG,CAAA;AAAtB;AACG;AAAR;AAA6B;AAAG;AAAnB;AAAe;AAC/B,UAv3BU,kBAAA,CAu3Bc;EAAA,QAAA,EAAA,cAAA,GAAA,uBAAA;EACP,MAAA,EAAA,aAAA;EACiB,IAAA,EAAA,oBAAA,GAAA,oBAAA;EAAjB,OAAA,EAAA,mBAAA;EACP,OAAA,EAAA,mBAAA,GAAA,uBAAA,GAAA,qBAAA,GAAA,YAAA;EAAkB,SAAA,EAAA,uBAAA,GAAA,0BAAA;AAAsB;AAAhB;AAAe,UA52BvC,YAAA,CA42BuC;EAyOjC,QAAA,EAplCL,eAolCc;EAAA,MAAA,EAnlChB,aAmlCgB;EAAM,IAAA,EAllCxB,WAklCwB;EAAkB,OAAA,EAjlCvC,cAilCuC;EAAM,OAAA,EAhlC7C,cAglC6C;EA8B3C,SAAA,EA7mCA,gBA6mCe;AAAA;AACd;AAAwB,UA1mC3B,YAAA,CA0mC2B;EAAa,YAAA,EAAA,aAAA;EAArB,qBAAA,EAAA,qBAAA;EAAO,WAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;KArlCxB,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDe,yBACL,wBACA,iBAAiB,YAEzB,YACC;;;;;;;;;;;;;;;;iBAgBO;IAEd,QAAQ,gBAAgB;iBACL,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;iBAiBG,YAAA,SACb,iBACC,kDAEP,QAAQ;;;;;;iBAuMW,mBAAA,SACb,iBACC,KAAK,4DACT,UACH;UACM;WACC,kBAAkB;;;;;;;;;iBA8CZ,uBAAA,UACN,oCACP;;iBAaa,cAAA;;iBAKA,iBAAA;;;;;;;;;iBAoBA,aAAA,UACN,kBAAkB;iBA0FZ,oBAAA,UAA8B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4RhD,yBAAyB,gBAAgB,IAAI,QAAQ;iBASrD,yBACC,wBACA,eAAe,YAEvB,UACD,mBAAmB,GAAG,KAC3B,QAAQ,KAAK,gBAAgB,GAAG;iBACnB,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB;;;;;;;;;;;;iBAyOlC,SAAA,MAAe,kBAAkB;;;;;;;KA8BrC,eAAA,iBACC,gBAAgB,QAAQ,aAAa"}