@neondatabase/env 0.15.0 → 1.0.1

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NoNamespace","Record","ServiceOn","T","HasKeys","HasBuckets","C","NonNullable","B","AiGatewayOn","A","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","FilteredNeonEnv","K","N","Extract","P","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","ResolvedNeonEnv","resolveBranchPolicy","Pick","ReturnType","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","createApiFromOptions","toEntries","Partial"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/**\n * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only\n * when the policy declares `preview.buckets`. Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy\n * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\n/**\n * Whether the policy's **static** `preview` block declares at least one object-storage bucket\n * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\n/**\n * Whether the policy's **static** `preview` block enables the AI Gateway\n * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n *\n * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when\n * a policy has no `preview`, `NonNullable<C[\"preview\"]>` is `never`, and a naked `never` in the\n * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`\n * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.\n */\ntype AiGatewayOn<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.preview.buckets` declares at least one bucket.\n * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi): Promise<{\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n}>;\n/**\n * Scopes the branch credential should carry for a resolved branch policy and optional key\n * selection. Only object storage and the AI Gateway *require* a credential; functions never\n * force one, but `functions:invoke` rides along when another selected feature mints one.\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };\n//#endregion\nexport { FetchEnvOptions, FilteredNeonEnv, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AA8CC,cA1CaM,iBAiDS,EAAA;EAAA;AAIE;AAsBJ;AAMG;AAcA;EAgBE,SASrBO,MAAAA,EAAW;IAYXE,SAAAA,IAAS,EAAA,aAAA;EAAA,CAAA;EAAOC,SAAAA,QAAAA,EAAAA;IAA8BA,SAAAA,WAAAA,EAAAA,cAAAA;IAErCA,SAAAA,mBAAAA,EAAAA,uBAAAA;EAAkCA,CAAAA;EAA4BA,SAAAA,IAAAA,EAAAA;IAE/DA,SAAAA,OAAAA,EAAAA,oBAAAA;IAAC,SAAA,OAAA,EAAA,oBAAA;EAAA,CAAA;EAEY,SAUrBE,OAAU,EAAA;IAAA,SAAA,GAAA,EAAA,mBAAA;EAAWlB,CAAAA;EAAuBmB;AAAZC;AAAiED;AAAZC;AAElEC;EAAZD,SAAAA,OAAAA,EAAAA;IAARH,SAAAA,WAAAA,EAAAA,mBAAAA;IAAO,SAAA,eAAA,EAAA,uBAAA;IAUNK,SAAAA,QAAW,EAAA,qBAAA;IAAA,SAAA,MAAA,EAAA,YAAA;EAAWtB,CAAAA;EAAuBmB;AAAZC;AAAiED;AAAZC;AAEjEG;AAAZH;AAAVL;EAAS,SAAA,SAAA,EAAA;IAeRS,SAAAA,MAAO,EAAA,uBAAA;IAAA,SAAA,OAAA,EAAA,0BAAA;EAAWxB,CAAAA;AAASA,CAAAA;AACpBQ;AAKDD;AACgBY;AAAZC;AAAVL;AACGN;AACJI,UAzIMN,aAAAA,CAyINM;EAAsCM,IAAAA,EAAAA,MAAAA;AAAZC;AAAVL;AACTL,UAtIDF,eAAAA,CAsICE;EACPG;AAA2BM;AAAXD;AACTP;EACPE,WAAAA,EAAAA,MAAAA;EAA4BM;AAAZG;AACPV;AACTC;AAAW;EAAA,mBAQLY,EAAAA,MAAkB;AAAA;AASN;AACVjB;AACFD;AACFE;AACGC;AACAC;AACEC;AAAgB;AAAA;AAGP,UA/IZH,WAAAA,CAmKLmB;EAAgB,OAAA,EAAA,MAAA;EAAW5B;EAAUyB,OAAAA,EAAAA,MAAAA;AAAiCN;AAARK;AAAmBC,UA7J5Ef,cAAAA,CA6J4Ee;EAAkB,GAAA,EAAA,MAAA;AAAA;AAgBpF;AAAmCA;AAA+BK;AAAGL;AAAmBM;AAA9BC;AAA6DD;AAAoBD;AAAGL;AAAmBM;AAA9BC;AAAqCL,UA/JlLhB,cAAAA,CA+JkLgB;EAAaM,WAAAA,EAAAA,MAAAA;EAAUN,eAAAA,EAAAA,MAAAA;EAAgBD;EAAaK,QAAAA,EAAAA,MAAAA;EAAGJ;EAAaM,MAAAA,EAAAA,MAAAA;AAAUN;AAAsBD;AAAaK;AAAC;AAAA;AAMlR;AAAmCN;AAA+BK;AAAGL;AAAmBM,UArJ1GnB,gBAAAA,CAqJ0GmB;EAA9BC,MAAAA,EAAAA,MAAAA;EAA6DD,OAAAA,EAAAA,MAAAA;AAAqBD;AAAGL;AAAmBM;AAA9BC;AAAqCL;AAAaM;AAAUN,KA5IvNd,WAAAA,GAAcC,MA4IyMa,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAiBD;AAAaK;AAAGJ;AAAaM;AAAUN;AAAsBD;AAAaK;AAAC;AAAA;AAE5S;AAAYf;AAAKA,KAlIxBD,SAkIwBC,CAAAA,CAAAA,CAAAA,GAAAA,CAlIRA,CAkIQA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAlIsBA,CAkItBA,CAAAA,SAAAA,CAAAA;EAAUoB,OAAAA,EAAAA,KAAAA;AAASA,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhIlCpB,CAgIkCoB,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhIApB,CAgIAoB,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CAhI4BpB,CAgI5BoB,CAAAA,SAAAA,CAAAA;EAAgBpB,OAAAA,EAAAA,IAAAA;AAAC,CAAA,CAAA,GAAA,IAAA,GAAA,CA9HpDA,CA8HoD,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AAAA;AAE/C,KA9HbC,OA8Ha,CAAA,CAAA,CAAA,GAAA,CAAA,MA9HOD,CA8HP,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAiCA;AAAgCA;AAAiGsB;AAARH;AAAqCI;AAAdF;AAAa;AAAA;AAS5L;AAAmCI,KA7HlDvB,UA6HkDuB,CAAAA,UA7H7BzC,MA6H6ByC,CAAAA,GAAAA,CA7HlBrB,WA6HkBqB,CA7HNtB,CA6HMsB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA7HmCrB,WA6HnCqB,CA7H+CtB,CA6H/CsB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAgDA,OAAAA,EAAAA,KAAAA,EAAAA;AAAyCA,CAAAA,GA3H5IxB,OA2H4IwB,CA3HpIrB,WA2HoIqB,CA3HxHpB,CA2HwHoB,CAAAA,CAAAA,GAAAA,KAAAA;AAAxBP;AAAsDO;AAAdJ;AAA2DI;AAAxBP;AAAwDO;AAAhBZ;AAAe;AAAA;AAC9N,KAlHvBP,WAmHAqB,CAAAA,UAnHsB3C,MAmHH,CAAA,GAAA,CAnHcoB,WAmHd,CAnH0BD,CAmH1B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAnHmEC,WAmHnE,CAnH+ED,CAmH/E,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,SAGnByB,EAAAA,KAAAA,EAAAA;AAAuB,CAAA,GApHxB7B,SAoHwB,CApHdK,WAoHc,CApHFG,CAoHE,CAAA,CAAA,GAAA,KAAA;AAAuDkB;AAA8FH;AAAeO;AAAsCN;AAAMM;AAA9BD;AAAuB;AAAA;AAC9L;AAA2DH;AAAxBG;AAA0FH;AAAxBG;AAAuB;AAAA,KAtG9JpB,OA2GAuB,CAAAA,UA3GkB/C,MA2GI,GA3GKA,MA2GL,CAAA,GAAA;EAAA,QAAA,EA1GfQ,eA0Ge;EAAmCiC;AAAsCA;AAAkCA;AAAcC;EAAtBV,MAAAA,CAAAA,EArGnHzB,aAqGmHyB;AAA6GS,CAAAA,GAAAA,CApGtO1B,SAoGsO0B,CApG5NrB,WAoG4NqB,CApGhNtB,CAoGgNsB,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAnCK,IAAAA,EAnGhMrC,WAmGgMqC;AAAgEL,CAAAA,GAlGpQ5B,WAkGoQ4B,CAAAA,GAAAA,CAlGpP1B,SAkGoP0B,CAlG1OrB,WAkG0OqB,CAlG9NtB,CAkG8NsB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAI,OAAA,EAjGjQ/B,cAiGiQ;AAAA,CAAA,GAhGxQG,WAiGCmC,CAAAA,GAAAA,CAjGe9B,UAiGf8B,CAjG0B7B,CAiGF,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EAhGlBR,cAgGkB;AAA2D8B,CAAAA,GA/FpF5B,WA+FoF4B,CAAAA,GAAAA,CA/FpEnB,WA+FoEmB,CA/FxDtB,CA+FwDsB,CAAAA,SAAAA,IAAAA,GAAAA;EAAvBM,SAAAA,EA9FpDnC,gBA8FoDmC;AAA0DJ,CAAAA,GA7FvH9B,WA6FuH8B,CAAAA;AAAmB;AAAA;AACrH;AAAoCO;AAEzDT;AAAI;AAAA;AACyB,UAzFvBhB,kBAAAA,CAyFuB;EAAkFyB,QAAAA,EAAAA,cAAAA,GAAAA,uBAAAA;EAArBD,MAAAA,EAAAA,aAAAA;EAAzBD,IAAAA,EAAAA,oBAAAA,GAAAA,oBAAAA;EAAwB,OAAA,EAAA,mBAAA;EAAA,OAExFI,EAAAA,mBAAAA,GAAyB,uBAAA,GAAA,qBAAA,GAAA,YAAA;EAAA,SAAA,EAAA,uBAAA,GAAA,0BAAA;AAA8BtB;AAAGY;AAAXV,UAlF1CN,YAAAA,CAkF0CM;EAAiEU,QAAAA,EAjFzGlC,eAiFyGkC;EAAgCZ,MAAAA,EAhF3IvB,aAgF2IuB;EAAca,IAAAA,EA/E3JlC,WA+E2JkC;EAAmB,OAAA,EA9E3KjC,cA8E2K;EAAA,OAC5K2C,EA9EC1C,cA8Ec;EAiCV,SA+CE2C,EA7JJ1C,gBA6JY;AAAA;AAAiBZ;AAA8CqD,UA1J9E1B,YAAAA,CA0J8E0B;EAkBtDlC,YAAAA,EAAAA,aAAAA;EAAjBS,qBAAAA,EAAAA,qBAAAA;EACLT,WAAAA,EAAAA,MAAAA;EAAY+B,kBAAAA,EAAAA,SAAAA;EAA4CA,kBAAAA,EAAAA,SAAAA;EAARK,iBAAAA,EAAAA,KAAAA;EAA7BJ,iBAAAA,EAAAA,aAAAA;EAAmGD,qBAAAA,EAAAA,iBAAAA;EAARK,mBAAAA,EAAAA,UAAAA;EAArBN,UAAAA,EAAAA,QAAAA;EAAhBT,qBAAAA,EAAAA,QAAAA;EAARgB,wBAAAA,EAAAA,SAAAA;AAAO;AAAA;AAC3D;AAAiBxD;AAAyCmB;AAAjBS;AAAqCT;AAAqBW,KA1JvHF,gBA0JuHE,CAAAA,UA1J5F9B,MA0J4F8B,CAAAA,GA1JlFL,kBA0JkFK,CAAAA,MA1JzDN,OA0JyDM,CA1JjDX,CA0JiDW,CAAAA,GAAAA,MA1JtCL,kBA0JsCK,CAAAA;AAARyB;AAAsCF;AACjIvB;AAARyB;AACqBzB;AAARyB;AAA1BH;AAAwEtB;AAARyB;AAAhB1B;AAAR2B;AAAO;AAAA;AAC1B;AAAiBxD;AAAgBmB,KA7IrDU,eA6IqDV,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MA7IHM,kBA6IGN,IAAAA,CA7IoBa,OA6IpBb,CA7I4BW,CA6I5BX,EA7I+BM,kBA6I/BN,CA7IkDY,CA6IlDZ,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA7IiFY,CA6IjFZ,GAAAA,QA7I6Fa,OA6I7Fb,CA7IqGW,CA6IrGX,EA7IwGM,kBA6IxGN,CA7I2HY,CA6I3HZ,CAAAA,CAAAA,IA7IkIQ,YA6IlIR,CA7I+Ic,CA6I/Id,GAAAA,MA7IyJQ,YA6IzJR,CAAAA,GA7IyKO,YA6IzKP,CA7IsLY,CA6ItLZ,CAAAA,CA7IyLQ,YA6IzLR,CA7IsMc,CA6ItMd,GAAAA,MA7IgNQ,YA6IhNR,CAAAA,GAAAA,MA7IsOO,YA6ItOP,CA7ImPY,CA6InPZ,CAAAA,CAAAA,EAAAA,EAAAA;AAAYkC;AAElDlC;AAARK;AAARgC;AAAO;AAAA,KAzINtB,uBA2IoB,CAAA,UAAA,MAAA,CAAA,GAAA,QAAA,MA3IsCT,kBA2ItC,IAAA,CA3I6DO,OA2I7D,CA3IqEF,CA2IrE,EA3IwEL,kBA2IxE,CA3I2FM,CA2I3F,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA3I0HA,CA2I1H,IAAA,QA3IuIC,OA2IvI,CA3I+IF,CA2I/I,EA3IkJL,kBA2IlJ,CA3IqKM,CA2IrK,CAAA,CAAA,IA3I4KJ,YA2I5K,CA3IyLM,CA2IzL,GAAA,MA3ImMN,YA2InM,CAAA,IA3IoND,YA2IpN,CA3IiOK,CA2IjO,CAAA,CA3IoOJ,YA2IpO,CA3IiPM,CA2IjP,GAAA,MA3I2PN,YA2I3P,CAAA,GAAA,MA3IiRD,YA2IjR,CA3I8RK,CA2I9R,CAAA,CAAA,EAAA,EAAA;AAAA;AAAiB/B,KAzIrCmC,OAyIqCnC,CAAAA,CAAAA,EAAAA,QAzIlBgB,CAyIkBhB,CAAAA,GAzIbgB,CAyIahB,SAzIHoC,KAyIGpC,GAAAA,CAzIMoC,KAyINpC,CAAAA,SAAAA,CAzIsBgB,CAyItBhB,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAqDmB;AAAjBS,KAvIzES,aAuIyET,CAAAA,UAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAvI3BZ,CAuI2BY,SAAAA,SAAAA,EAAAA,GAAAA,KAAAA,GAvIKZ,CAuILY,SAAAA,SAAAA,CAAAA,KAAAA,KAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,SAvI8FO,OAuI9FP,CAvIsGU,IAuItGV,CAAAA,GAAAA,IAAAA,GAvIqHS,aAuIrHT,CAvImIW,IAuInIX,CAAAA,GAAAA,IAAAA;AAA+BT;AAAYkC;AACjHZ;AACJE;AAAsBa;AAAO;AA0CuC;AAY9C;AAAME,KAtL3BlB,eAsL2BkB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAtLuBjB,IAsLvBiB,SAAAA,SAAAA,MAAAA,EAAAA,GAAAA,MAAAA,SAtLuEjB,IAsLvEiB,CAAAA,QAAAA,CAAAA,GAtLwFxB,uBAsLxFwB,CAtLgHjB,IAsLhHiB,CAAAA,MAAAA,CAAAA,CAAAA,GAtLgIrB,aAsLhIqB,CAtL8IjB,IAsL9IiB,CAAAA,SAAAA,IAAAA,GAtLmKxB,uBAsLnKwB,CAtL2LjB,IAsL3LiB,CAAAA,MAAAA,CAAAA,CAAAA,GAtL2M7B,eAsL3M6B,CAtL2NjB,IAsL3NiB,CAAAA,MAAAA,CAAAA,CAAAA,GAAAA,KAAAA;AAAkB5C,KArL7C4B,uBAAAA,GAqL6C5B,mBAAAA,GAAAA,uBAAAA;AAAM,KApLnD6B,mBAAAA,GAoLmD;EAAA,SAOnDe,iFAAe,EAAA,KAAA;AAAA,CAAA;AAAiBhC,KAxLhCkB,uBAwLgClB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,EAAAA,YAAAA,MAAAA,CAAAA,GAxL8Ce,IAwL9Cf,SAAAA,SAAAA,CAAAA,KAAAA,cAAAA,MAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAxL4IY,IAwL5IZ,CAAAA,SAAAA,CAxL2JmB,GAwL3JnB,CAAAA,GAAAA,IAAAA,GAxLyKkB,uBAwLzKlB,CAxLiMa,IAwLjMb,EAxLuMmB,GAwLvMnB,CAAAA,GAAAA,KAAAA;AAAwBA,KAvLxDoB,kCAuLwDpB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAvLakB,uBAuLblB,CAvLqCe,IAuLrCf,EAAAA,mBAAAA,CAAAA,SAAAA,IAAAA,GAvL+EkB,uBAuL/ElB,CAvLuGe,IAuLvGf,EAAAA,uBAAAA,CAAAA,SAAAA,IAAAA,GAAAA,IAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAaK;AAArBqC;AAAO;;KAlLvDrB,yDAAyDN,sCAAsCA,0BAA0BT,QAAQS,cAAcC,oDAAoDI,mCAAmCL,6BAA6BA;KACnQO,4DAA4DD,uBAAuBN,mCAAmCE;ACtQrF,KDuQjCM,oBCnQkB,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GDmQsCC,ICnQtC,CAAA,CAAA,CAAA,SAAA;EAAA,IAAA,EAAA,KAAA,cAAA,SAAA,MAAA,EAAA;AAAW,CAAA,GDqQ9BT,ICrQ8B,GAAA,KAAA;AACrB,KDqQRU,4BCrQQ,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GDqQwDH,wBCrQxD,CDqQiFC,oBCrQjF,CDqQsGC,ICrQtG,CAAA,CAAA;AAAZ;AAGG,KDoQCE,yBCpQD,CAAA,UAAA,MAAA,CAAA,GAAA,CDoQgDpB,OCpQhD,CDoQwDF,CCpQxD,EDoQ2DY,uBCpQ3D,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,OAAA,GDoQiHA,uBCpQjH,SDoQiJZ,CCpQjJ,GAAA,OAAA,GDoQ+Ja,mBCpQ/J;AACA,UDoQMU,eAAAA,CCpQN;EAAM;AAGV;AAA0B;AAAW;EACX,SAAA,EAAA,MAAA;EAAnB;AADwC;AAAO;AAetD;AACyK;EASlJ,MAAA,CAAA,EAAA,MAAA;EAAW;AAClB;AAAf;AAEE;AACA;EAAC,QAAA,CAAA,EAAA,MAAA;EAAA;AAGkB;AACX;AAEP;AAAmC;EAAnB,MAAA,CAAA,EAAA,MAAA;EACc;AAAnB;AAAsB;AAAlC;EACe,OAAA,CAAA,EAAA,MAAA;EAAd;AAAO;AAQX;AAA2B;EAAW,GAAA,CAAA,EDqP9BnD,OCrP8B;EACF;AAAG;AAArB;AAAP;AAAM;AAiIjB;AAAwB;EAAiB,QAAA,CAAA,EAAA,MAAA;EAAgB;AAAY;AAAR;AAAO;AASpE;AAAwB;AACP;EACe,YAAA,CAAA,EAAA,MAAA;AAAf;AAER;AACkB;AAAG;AAAtB;AACG;AAAR;AAA6B;AAAG;AAAnB;AAAe;AAC/B;AAAwB;AACP;AACiB;AAAjB;AACP;AAAkB;AAAsB;AAAhB;AAAe;;;;;;;;;;iBD+IhCoD,yBAAyBtD,8CAA8CqD;;;;;;;;;;;;;;;;;;iBAkBvEzB,iBAAiBT;YACtBA,YAAY+B,OAAOC,6BAA6BI,QAAQL,SAASM,QAAQhB,gBAAgBS,qBAAqBM,QAAQL;iBACjHI,yBAAyBtD,wBAAwB4B,iBAAiBT,oBAAoBA,aAAaoC,QAAQzB,8BAA8BuB;iBACzIE,QAAQzB;IACrBsB,0BAA0BG,QAAQzB,MAAM0B,QAAQ3B,gBAAgB0B,QAAQzB;iBAC3DwB,yBAAyBtD,gBAAgBmB,YAAYkC;;IAElEG,QAAQhC,QAAQL;;iBAEHmC,yBAAyBtD,oCAAoC4B,iBAAiBT,cAAcA,YAAYkC;QACjHZ;IACJE,sBAAsBa;;;;;;;;;;;;;;;;;;;;;;iBAsDTW,SAAAA,MAAeT,kBAAkB5C;;;;;;;KAO7C4C,eAAAA,iBAAgChC,gBAAgB0C,QAAQ1C,aAAaK;;;;AAtVjD;AAYX,KCzGT,kBDyGS,CAAA,UCzGoB,MDyGpB,CAAA,GCxGb,WDwGa,CCxGD,CDwGC,CAAA,SAAA,CAAA,CAAA,SAAA;EAAOf,SAAAA,EAAAA,KAAAA,EAAAA;AAA8BA,CAAAA,GCrG/C,CDqG+CA,GCpG/C,MDoG+CA,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAErCA;AAAkCA,KCnGpC,cDmGoCA,CAAAA,UCnGX,MDmGWA,CAAAA,GCnGD,ODmGCA,CAAAA,MClGzC,kBDkGyCA,CClGtB,CDkGsBA,CAAAA,EAAAA,MAAAA,CAAAA;AAA4BA;AAE/DA;AAAC;AAAA;AAEY;AAUX;AAAWhB;AAAuBmB;AAAZC,KClGzB,mBAAA,GDkGyBA,uKAAAA;AAAiED;AAAZC;AAElEC;AAAZD;AAARH;AAAO;AAAA;AAUK,KCpGX,kBDoGW,CAAA,UCpGkB,MDoGlB,EAAA,UAAA,MAAA,CAAA,GAAA,CCnGf,cDmG0BjB,CCnGX,CDmGWA,CAAAA,CAAuBmB,SAAAA,CAAAA,KAAAA,CAAAA,GCjG/C,mBDiG+CA,GChG/C,CDgG+CA;AAAZC;AAAiED,KC7FlG,iBD6FkGA,CAAAA,UC5F5F,MD4F4FA,EAAAA,UAAAA,MAAAA,CAAAA,GC1FnG,CD0FmGA,SAAAA,MC1FnF,kBD0FmFA,CC1FhE,CD0FgEA,CAAAA,GCzFpG,WDyFoGA,CCzFxF,kBDyFwFA,CCzFrE,CDyFqEA,CAAAA,CCzFlE,CDyFkEA,CAAAA,CAAAA,SAAAA;EAAZC,GAAAA,EAAAA,KAAAA,EAAAA;AAEjEG,CAAAA,GC1FtB,OD0FsBA,CAAAA,MC1FR,CD0FQA,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAZH;AAAVL;AAAS;AAAA;AAeD,KCjGA,eDiGA,CAAA,UCjG0B,MDiG1B,EAAA,UAAA,MAAA,CAAA,GAAA;EAAWf,QAAAA,EChGZ,MDgGYA,CChGL,iBDgGKA,CChGa,CDgGbA,EChGgB,CDgGhBA,CAAAA,EAAAA,MAAAA,CAAAA;AAASA,CAAAA;AACpBQ;AAKDD;AACgBY;AAAZC;AAAVL;AACGN;AACJI;AAAsCM;AAAZC;AAAVL;AACTL;AACPG;AAA2BM;AAAXD;AACTP;AACPE;AAA4BM;AAAZG;AACPV;AACTC;AAAW;AAAA;AAQa;AASN;AACVL;AACFD;AACFE;AACGC;AACAC;AACEC;AAAgB;AAAA;AAGP;AAoBD;AAAWZ;AAAUyB;AAAiCN;AAARK;AAAmBC;AAAkB;AAAA;AAgBpF;AAAmCA;AAA+BK;AAAGL;AAAmBM;AAA9BC;AAA6DD;AAAoBD;AAAGL,iBC5ClJ,QD4CkJA,CAAAA,gBC5CzH,MD4CyHA,CAAAA,CAAAA,MAAAA,EC5CzG,CD4CyGA,CAAAA,EC5CrG,OD4CqGA,CC5C7F,CD4C6FA,CAAAA;AAAmBM,iBCnCrK,QDmCqKA,CAAAA,gBClCpK,MDkCoKA,EAAAA,gBCjCpK,cDiCoKA,CCjCrJ,CDiCqJA,CAAAA,CAAAA,CAAAA,MAAAA,EC/B5K,CD+B4KA,EAAAA,KAAAA,EC9B7K,kBD8B6KA,CC9B1J,CD8B0JA,EC9BvJ,CD8BuJA,CAAAA,CAAAA,EC7BlL,OD6BkLA,CC7B1K,CD6B0KA,CAAAA,GC7BrK,eD6BqKA,CC7BrJ,CD6BqJA,EC7BlJ,CD6BkJA,CAAAA;AAA9BC,iBC5BvI,QD4BuIA,CAAAA,gBC3BtI,MD2BsIA,EAAAA,gBC1BtI,gBD0BsIA,CC1BrH,CD0BqHA,CAAAA,CAAAA,CAAAA,MAAAA,ECzB7I,CDyB6IA,EAAAA,IAAAA,EAAAA,SCzB3H,CDyB2HA,EAAAA,CAAAA,ECzBrH,eDyBqHA,CCzBrG,CDyBqGA,CAAAA"}

package/dist/index.js

@@ -1,2 +1,198 @@
-import { NEON_ENV_VAR_KEYS, fetchEnv, parseEnv, toEntries } from "./lib/env.js";
+import { a as fetchEnv, t as NEON_ENV_VAR_KEYS, u as toEntries } from "./env.js";
+import { ErrorCode, PlatformError } from "@neon/config/v1";
+import { z } from "zod";
+//#region src/lib/parse-env.ts
+/**
+* `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars
+* already injected into `process.env`, validate them against the policy, and return them in the
+* same namespaced shape.
+*
+* Lives in this package rather than in `@neon-internals/env-core` because nothing else needs
+* it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping
+* it here also keeps `zod` out of that package, and so out of every consumer that bundles it.
+*/
+/**
+* Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from
+* `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.
+*
+* `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include
+* URL-illegal characters in the password (rare but legal in Neon's connection-string
+* format) fail the WHATWG `URL` parse, so we settle for "non-empty string".
+*/
+const postgresEnvSchema = z.object({
+	DATABASE_URL: z.string({ message: "DATABASE_URL is missing" }).min(1, "DATABASE_URL must not be empty"),
+	DATABASE_URL_UNPOOLED: z.string({ message: "DATABASE_URL_UNPOOLED is missing" }).min(1, "DATABASE_URL_UNPOOLED must not be empty")
+});
+const authEnvSchema = z.object({
+	NEON_AUTH_BASE_URL: z.string({ message: "NEON_AUTH_BASE_URL is missing" }).min(1, "NEON_AUTH_BASE_URL must not be empty"),
+	NEON_AUTH_JWKS_URL: z.string({ message: "NEON_AUTH_JWKS_URL is missing" }).min(1, "NEON_AUTH_JWKS_URL must not be empty")
+});
+const dataApiEnvSchema = z.object({ NEON_DATA_API_URL: z.string({ message: "NEON_DATA_API_URL is missing" }).min(1, "NEON_DATA_API_URL must not be empty") });
+const storageEnvSchema = z.object({
+	AWS_ACCESS_KEY_ID: z.string({ message: "AWS_ACCESS_KEY_ID is missing" }).min(1, "AWS_ACCESS_KEY_ID must not be empty"),
+	AWS_SECRET_ACCESS_KEY: z.string({ message: "AWS_SECRET_ACCESS_KEY is missing" }).min(1, "AWS_SECRET_ACCESS_KEY must not be empty"),
+	AWS_ENDPOINT_URL_S3: z.string({ message: "AWS_ENDPOINT_URL_S3 is missing" }).min(1, "AWS_ENDPOINT_URL_S3 must not be empty"),
+	AWS_REGION: z.string({ message: "AWS_REGION is missing" }).min(1, "AWS_REGION must not be empty")
+});
+const aiGatewayEnvSchema = z.object({
+	NEON_AI_GATEWAY_TOKEN: z.string({ message: "NEON_AI_GATEWAY_TOKEN is missing" }).min(1, "NEON_AI_GATEWAY_TOKEN must not be empty"),
+	NEON_AI_GATEWAY_BASE_URL: z.string({ message: "NEON_AI_GATEWAY_BASE_URL is missing" }).min(1, "NEON_AI_GATEWAY_BASE_URL must not be empty")
+});
+/** Whether a **static** policy declares object storage (`preview.buckets`). No network. */
+function configWantsStorage(config) {
+	return Object.keys(config.preview?.buckets ?? {}).length > 0;
+}
+/** Whether a **static** policy enables the AI Gateway (`preview.aiGateway`). No network. */
+function configWantsAiGateway(config) {
+	return isServiceEnabledInput(config.preview?.aiGateway);
+}
+/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */
+function isServiceEnabledInput(toggle) {
+	if (toggle === void 0) return false;
+	if (typeof toggle === "boolean") return toggle;
+	return toggle.enabled !== false;
+}
+function parseEnv(config, scopeOrKeys) {
+	const source = process.env;
+	if (Array.isArray(scopeOrKeys)) return parseFilteredEnv(source, scopeOrKeys);
+	const scope = typeof scopeOrKeys === "string" ? scopeOrKeys : void 0;
+	const issues = [];
+	const result = {};
+	const pg = postgresEnvSchema.safeParse({
+		DATABASE_URL: source.DATABASE_URL,
+		DATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED
+	});
+	if (pg.success) result.postgres = {
+		databaseUrl: pg.data.DATABASE_URL,
+		databaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED
+	};
+	else for (const issue of pg.error.issues) issues.push(issue.message);
+	const branchName = source[NEON_ENV_VAR_KEYS.branch.name];
+	if (branchName !== void 0 && branchName !== "") result.branch = { name: branchName };
+	if (isServiceEnabledInput(config.auth)) {
+		const auth = authEnvSchema.safeParse({
+			NEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,
+			NEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL
+		});
+		if (auth.success) result.auth = {
+			baseUrl: auth.data.NEON_AUTH_BASE_URL,
+			jwksUrl: auth.data.NEON_AUTH_JWKS_URL
+		};
+		else for (const issue of auth.error.issues) issues.push(issue.message);
+	}
+	if (isServiceEnabledInput(config.dataApi)) {
+		const dataApi = dataApiEnvSchema.safeParse({ NEON_DATA_API_URL: source.NEON_DATA_API_URL });
+		if (dataApi.success) result.dataApi = { url: dataApi.data.NEON_DATA_API_URL };
+		else for (const issue of dataApi.error.issues) issues.push(issue.message);
+	}
+	if (configWantsStorage(config)) {
+		const storage = storageEnvSchema.safeParse({
+			AWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,
+			AWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,
+			AWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,
+			AWS_REGION: source.AWS_REGION
+		});
+		if (storage.success) result.storage = {
+			accessKeyId: storage.data.AWS_ACCESS_KEY_ID,
+			secretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,
+			endpoint: storage.data.AWS_ENDPOINT_URL_S3,
+			region: storage.data.AWS_REGION
+		};
+		else for (const issue of storage.error.issues) issues.push(issue.message);
+	}
+	if (configWantsAiGateway(config)) {
+		const aiGateway = aiGatewayEnvSchema.safeParse({
+			NEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,
+			NEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL
+		});
+		if (aiGateway.success) result.aiGateway = {
+			apiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,
+			baseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL
+		};
+		else for (const issue of aiGateway.error.issues) issues.push(issue.message);
+	}
+	if (scope !== void 0) {
+		const fn = config.preview?.functions?.[scope];
+		if (!fn) throw new PlatformError(ErrorCode.EnvNotInjected, [`parseEnv: no function "${scope}" is declared in this policy's preview.functions.`, "Pass a declared function slug (or omit the scope to read external env)."].join("\n"), { details: { scope } });
+		const envOut = {};
+		for (const key of Object.keys(fn.env ?? {})) {
+			const value = source[key];
+			if (value === void 0) issues.push(`${key} is missing (function "${scope}")`);
+			else envOut[key] = value;
+		}
+		result.function = envOut;
+	}
+	if (issues.length > 0) throw new PlatformError(ErrorCode.EnvNotInjected, [
+		"parseEnv: the required Neon env variables are not present in process.env.",
+		...issues.map((i) => `  - ${i}`),
+		"Inject them via one of:",
+		"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)",
+		"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)",
+		"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.",
+		"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O."
+	].join("\n"), { details: { missing: issues } });
+	return result;
+}
+/**
+* Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`
+* in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /
+* {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only
+* aliases).
+*/
+const FILTERABLE_ENV_KEYS = {
+	DATABASE_URL: ["postgres", "databaseUrl"],
+	DATABASE_URL_UNPOOLED: ["postgres", "databaseUrlUnpooled"],
+	NEON_BRANCH: ["branch", "name"],
+	NEON_AUTH_BASE_URL: ["auth", "baseUrl"],
+	NEON_AUTH_JWKS_URL: ["auth", "jwksUrl"],
+	NEON_DATA_API_URL: ["dataApi", "url"],
+	AWS_ACCESS_KEY_ID: ["storage", "accessKeyId"],
+	AWS_SECRET_ACCESS_KEY: ["storage", "secretAccessKey"],
+	AWS_ENDPOINT_URL_S3: ["storage", "endpoint"],
+	AWS_REGION: ["storage", "region"],
+	NEON_AI_GATEWAY_TOKEN: ["aiGateway", "apiKey"],
+	NEON_AI_GATEWAY_BASE_URL: ["aiGateway", "baseUrl"]
+};
+/**
+* Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly
+* selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike
+* the full reader it never consults the policy — the selection alone decides what's required —
+* so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without
+* throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.
+*/
+function parseFilteredEnv(source, keys) {
+	const issues = [];
+	const result = {};
+	for (const key of keys) {
+		if (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {
+			issues.push(`${key} is not a selectable Neon env variable`);
+			continue;
+		}
+		const value = source[key];
+		if (value === void 0) {
+			issues.push(`${key} is missing`);
+			continue;
+		}
+		if (value === "") {
+			issues.push(`${key} must not be empty`);
+			continue;
+		}
+		const [namespace, property] = FILTERABLE_ENV_KEYS[key];
+		const bucket = result[namespace] ?? {};
+		bucket[property] = value;
+		result[namespace] = bucket;
+	}
+	if (issues.length > 0) throw new PlatformError(ErrorCode.EnvNotInjected, [
+		"parseEnv: the required Neon env variables are not present in process.env.",
+		...issues.map((i) => `  - ${i}`),
+		"Inject them via one of:",
+		"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)",
+		"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)",
+		"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O."
+	].join("\n"), { details: { missing: issues } });
+	return result;
+}
+//#endregion
 export { NEON_ENV_VAR_KEYS, fetchEnv, parseEnv, toEntries };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/lib/parse-env.ts"],"sourcesContent":["/**\n * `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars\n * already injected into `process.env`, validate them against the policy, and return them in the\n * same namespaced shape.\n *\n * Lives in this package rather than in `@neon-internals/env-core` because nothing else needs\n * it. The `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping\n * it here also keeps `zod` out of that package, and so out of every consumer that bundles it.\n */\n\nimport {\n\ttype Config,\n\tErrorCode,\n\tPlatformError,\n\ttype ServiceToggleInput,\n} from \"@neon/config/v1\";\nimport {\n\ttype FilteredNeonEnv,\n\tNEON_ENV_VAR_KEYS,\n\ttype NeonAiGatewayEnv,\n\ttype NeonAuthEnv,\n\ttype NeonBranchEnv,\n\ttype NeonDataApiEnv,\n\ttype NeonEnv,\n\ttype NeonPostgresEnv,\n\ttype NeonStorageEnv,\n\ttype SelectableEnvKey,\n} from \"@neon-internals/env-core/env\";\nimport { z } from \"zod\";\n\n/** The static `preview.functions` record of a config, or an empty record when absent. */\ntype PreviewFunctionsOf<C extends Config> =\n\tNonNullable<C[\"preview\"]> extends {\n\t\tfunctions: infer F;\n\t}\n\t\t? F\n\t\t: Record<never, never>;\n\n/** The declared function slugs of a config (record keys), as a string union. */\nexport type FunctionSlugOf<C extends Config> = Extract<\n\tkeyof PreviewFunctionsOf<C>,\n\tstring\n>;\n\n/**\n * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when\n * the policy declares no functions at all. Without it the argument's expected type is the bare\n * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '\"x\"' is not\n * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the\n * editor offers it as the single completion, so the empty completion list is explained rather\n * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.\n */\n// Exported (type-only) for the type tests in `env.test-d.ts`; intentionally not re-exported\n// from `index.ts`, so it stays an internal implementation detail.\nexport type NoFunctionScopeHint =\n\t\"this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env\";\n\n/**\n * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug\n * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no\n * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes\n * the returned `function` namespace exact — it stays the one function's env keys instead of\n * widening to every declared function's.\n */\ntype FunctionScopeField<C extends Config, S extends string> = [\n\tFunctionSlugOf<C>,\n] extends [never]\n\t? NoFunctionScopeHint\n\t: S;\n\n/** The declared env-var keys of one function `S`, as a string union. */\ntype FunctionEnvKeysOf<\n\tC extends Config,\n\tS extends string,\n> = S extends keyof PreviewFunctionsOf<C>\n\t? NonNullable<PreviewFunctionsOf<C>[S]> extends { env: infer E }\n\t\t? Extract<keyof E, string>\n\t\t: never\n\t: never;\n\n/**\n * The extra `function` namespace added to `parseEnv`'s result when called with a function\n * slug scope: the declared env-var keys for that function, each resolved to a `string`.\n */\nexport type NeonFunctionEnv<C extends Config, S extends string> = {\n\tfunction: Record<FunctionEnvKeysOf<C, S>, string>;\n};\n\n// ───────────────────────── parseEnv ─────────────────────────\n\n/**\n * Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from\n * `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.\n *\n * `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include\n * URL-illegal characters in the password (rare but legal in Neon's connection-string\n * format) fail the WHATWG `URL` parse, so we settle for \"non-empty string\".\n */\nconst postgresEnvSchema = z.object({\n\tDATABASE_URL: z\n\t\t.string({ message: \"DATABASE_URL is missing\" })\n\t\t.min(1, \"DATABASE_URL must not be empty\"),\n\tDATABASE_URL_UNPOOLED: z\n\t\t.string({ message: \"DATABASE_URL_UNPOOLED is missing\" })\n\t\t.min(1, \"DATABASE_URL_UNPOOLED must not be empty\"),\n});\n\nconst authEnvSchema = z.object({\n\tNEON_AUTH_BASE_URL: z\n\t\t.string({ message: \"NEON_AUTH_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_BASE_URL must not be empty\"),\n\tNEON_AUTH_JWKS_URL: z\n\t\t.string({ message: \"NEON_AUTH_JWKS_URL is missing\" })\n\t\t.min(1, \"NEON_AUTH_JWKS_URL must not be empty\"),\n});\n\nconst dataApiEnvSchema = z.object({\n\tNEON_DATA_API_URL: z\n\t\t.string({ message: \"NEON_DATA_API_URL is missing\" })\n\t\t.min(1, \"NEON_DATA_API_URL must not be empty\"),\n});\n\nconst storageEnvSchema = z.object({\n\tAWS_ACCESS_KEY_ID: z\n\t\t.string({ message: \"AWS_ACCESS_KEY_ID is missing\" })\n\t\t.min(1, \"AWS_ACCESS_KEY_ID must not be empty\"),\n\tAWS_SECRET_ACCESS_KEY: z\n\t\t.string({ message: \"AWS_SECRET_ACCESS_KEY is missing\" })\n\t\t.min(1, \"AWS_SECRET_ACCESS_KEY must not be empty\"),\n\tAWS_ENDPOINT_URL_S3: z\n\t\t.string({ message: \"AWS_ENDPOINT_URL_S3 is missing\" })\n\t\t.min(1, \"AWS_ENDPOINT_URL_S3 must not be empty\"),\n\tAWS_REGION: z\n\t\t.string({ message: \"AWS_REGION is missing\" })\n\t\t.min(1, \"AWS_REGION must not be empty\"),\n});\n\nconst aiGatewayEnvSchema = z.object({\n\tNEON_AI_GATEWAY_TOKEN: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_TOKEN is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_TOKEN must not be empty\"),\n\tNEON_AI_GATEWAY_BASE_URL: z\n\t\t.string({ message: \"NEON_AI_GATEWAY_BASE_URL is missing\" })\n\t\t.min(1, \"NEON_AI_GATEWAY_BASE_URL must not be empty\"),\n});\n\n/** Whether a **static** policy declares object storage (`preview.buckets`). No network. */\nfunction configWantsStorage(config: Config): boolean {\n\treturn Object.keys(config.preview?.buckets ?? {}).length > 0;\n}\n\n/** Whether a **static** policy enables the AI Gateway (`preview.aiGateway`). No network. */\nfunction configWantsAiGateway(config: Config): boolean {\n\treturn isServiceEnabledInput(config.preview?.aiGateway);\n}\n\n/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */\nfunction isServiceEnabledInput(\n\ttoggle: ServiceToggleInput | undefined,\n): boolean {\n\tif (toggle === undefined) return false;\n\tif (typeof toggle === \"boolean\") return toggle;\n\treturn toggle.enabled !== false;\n}\n\n/**\n * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates\n * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the\n * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed\n * `process.env.DATABASE_URL` lookups.\n *\n * Designed for the **\"env-vars-already-injected\"** path:\n * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.\n * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.\n * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.\n *\n * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now\n * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without\n * evaluating the per-branch closure.\n *\n * The second argument is a **scope** or a **key filter**:\n * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the\n *   full `{ postgres, auth?, dataApi?, … }` the policy enables.\n * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are\n *   running inside that function. Returns the same branch secrets **plus** a typed\n *   `function` namespace with the function's declared env-var keys. The slug autocompletes\n *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.\n * - an **array of OS-level env-var keys** (e.g. `[\"DATABASE_URL\", \"NEON_AUTH_BASE_URL\"]`) —\n *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced\n *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only\n *   pick vars the policy actually enables. Use this when a process needs just a subset (a\n *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't\n *   want `parseEnv` to throw over vars you never use.\n *\n * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env\n * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.\n *\n * ```ts\n * import config from \"../neon\";\n * import { parseEnv } from \"@neon/env\";\n *\n * // External (app / build):\n * const env = parseEnv(config);\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n *\n * // Inside the \"hello\" function:\n * const env = parseEnv(config, \"hello\");\n * env.function.resendApiKey; // typed from hello's declared env keys\n *\n * // Filtered: only enforce + return the pooled URL.\n * const { postgres } = parseEnv(config, [\"DATABASE_URL\"]);\n * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent\n * ```\n */\nexport function parseEnv<const C extends Config>(config: C): NeonEnv<C>;\n// Overload order is load-bearing for **editor autocomplete**, not for type checking: when the\n// argument is a half-typed string literal the call resolves against no signature, and the\n// editor takes its string-literal completions from the first candidate overload. With the\n// `keys` overload listed first, the expected type of `parseEnv(config, \"…\")` is read as\n// `readonly K[]` — an array has no literal completions, so typing a function slug offered\n// nothing. Keep the slug overload ahead of the array one: `env.completions.test.ts` asserts the\n// completions through the language service, and `env.test-d.ts` locks the order itself (the\n// last overload is observable as `Parameters<typeof parseEnv>`), so `tsc` fails on a reorder.\nexport function parseEnv<\n\tconst C extends Config,\n\tconst S extends FunctionSlugOf<C>,\n>(\n\tconfig: C,\n\tscope: FunctionScopeField<C, S>,\n): NeonEnv<C> & NeonFunctionEnv<C, S>;\nexport function parseEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;\nexport function parseEnv(\n\tconfig: Config,\n\tscopeOrKeys?: string | readonly string[],\n): unknown {\n\tconst source = process.env;\n\tif (Array.isArray(scopeOrKeys)) {\n\t\treturn parseFilteredEnv(source, scopeOrKeys);\n\t}\n\t// `Array.isArray` doesn't narrow a `readonly string[]` out of the union, so re-derive the\n\t// function-slug scope from the remaining `string` shape explicitly.\n\tconst scope = typeof scopeOrKeys === \"string\" ? scopeOrKeys : undefined;\n\tconst issues: string[] = [];\n\tconst result: Record<string, unknown> = {};\n\n\tconst pg = postgresEnvSchema.safeParse({\n\t\tDATABASE_URL: source.DATABASE_URL,\n\t\tDATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED,\n\t});\n\tif (pg.success) {\n\t\tresult.postgres = {\n\t\t\tdatabaseUrl: pg.data.DATABASE_URL,\n\t\t\tdatabaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED,\n\t\t} satisfies NeonPostgresEnv;\n\t} else {\n\t\tfor (const issue of pg.error.issues) issues.push(issue.message);\n\t}\n\n\t// Branch identity is optional: the Functions runtime injects `NEON_BRANCH` on every\n\t// branch by default and `neon dev` / `neon-env run` / `env pull` emit it too, but older\n\t// runtimes and platform integrations may not, so a missing value is not an error — we\n\t// just omit the namespace rather than failing the whole parse.\n\tconst branchName = source[NEON_ENV_VAR_KEYS.branch.name];\n\tif (branchName !== undefined && branchName !== \"\") {\n\t\tresult.branch = { name: branchName } satisfies NeonBranchEnv;\n\t}\n\n\tif (isServiceEnabledInput(config.auth)) {\n\t\tconst auth = authEnvSchema.safeParse({\n\t\t\tNEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,\n\t\t\tNEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL,\n\t\t});\n\t\tif (auth.success) {\n\t\t\tresult.auth = {\n\t\t\t\tbaseUrl: auth.data.NEON_AUTH_BASE_URL,\n\t\t\t\tjwksUrl: auth.data.NEON_AUTH_JWKS_URL,\n\t\t\t} satisfies NeonAuthEnv;\n\t\t} else {\n\t\t\tfor (const issue of auth.error.issues) issues.push(issue.message);\n\t\t}\n\t}\n\n\tif (isServiceEnabledInput(config.dataApi)) {\n\t\tconst dataApi = dataApiEnvSchema.safeParse({\n\t\t\tNEON_DATA_API_URL: source.NEON_DATA_API_URL,\n\t\t});\n\t\tif (dataApi.success) {\n\t\t\tresult.dataApi = {\n\t\t\t\turl: dataApi.data.NEON_DATA_API_URL,\n\t\t\t} satisfies NeonDataApiEnv;\n\t\t} else {\n\t\t\tfor (const issue of dataApi.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsStorage(config)) {\n\t\tconst storage = storageEnvSchema.safeParse({\n\t\t\tAWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,\n\t\t\tAWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,\n\t\t\tAWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,\n\t\t\tAWS_REGION: source.AWS_REGION,\n\t\t});\n\t\tif (storage.success) {\n\t\t\tresult.storage = {\n\t\t\t\taccessKeyId: storage.data.AWS_ACCESS_KEY_ID,\n\t\t\t\tsecretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,\n\t\t\t\tendpoint: storage.data.AWS_ENDPOINT_URL_S3,\n\t\t\t\tregion: storage.data.AWS_REGION,\n\t\t\t} satisfies NeonStorageEnv;\n\t\t} else {\n\t\t\tfor (const issue of storage.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (configWantsAiGateway(config)) {\n\t\tconst aiGateway = aiGatewayEnvSchema.safeParse({\n\t\t\tNEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,\n\t\t\tNEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL,\n\t\t});\n\t\tif (aiGateway.success) {\n\t\t\tresult.aiGateway = {\n\t\t\t\tapiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,\n\t\t\t\tbaseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL,\n\t\t\t} satisfies NeonAiGatewayEnv;\n\t\t} else {\n\t\t\tfor (const issue of aiGateway.error.issues)\n\t\t\t\tissues.push(issue.message);\n\t\t}\n\t}\n\n\tif (scope !== undefined) {\n\t\tconst fn = config.preview?.functions?.[scope];\n\t\tif (!fn) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.EnvNotInjected,\n\t\t\t\t[\n\t\t\t\t\t`parseEnv: no function \"${scope}\" is declared in this policy's preview.functions.`,\n\t\t\t\t\t\"Pass a declared function slug (or omit the scope to read external env).\",\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t{ details: { scope } },\n\t\t\t);\n\t\t}\n\t\tconst envOut: Record<string, string> = {};\n\t\tfor (const key of Object.keys(fn.env ?? {})) {\n\t\t\tconst value = source[key];\n\t\t\t// Only a truly *unset* var is \"not injected\". Function env values carry no\n\t\t\t// non-empty constraint (unlike DATABASE_URL / NEON_AUTH_BASE_URL), so a\n\t\t\t// deliberately empty value is a present, valid value and is passed through.\n\t\t\tif (value === undefined) {\n\t\t\t\tissues.push(`${key} is missing (function \"${scope}\")`);\n\t\t\t} else {\n\t\t\t\tenvOut[key] = value;\n\t\t\t}\n\t\t}\n\t\tresult.function = envOut;\n\t}\n\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t\"Inject them via one of:\",\n\t\t\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t\t\t\t\"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.\",\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\n\treturn result;\n}\n\n/**\n * Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`\n * in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /\n * {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only\n * aliases).\n */\nconst FILTERABLE_ENV_KEYS: Record<string, readonly [string, string]> = {\n\tDATABASE_URL: [\"postgres\", \"databaseUrl\"],\n\tDATABASE_URL_UNPOOLED: [\"postgres\", \"databaseUrlUnpooled\"],\n\tNEON_BRANCH: [\"branch\", \"name\"],\n\tNEON_AUTH_BASE_URL: [\"auth\", \"baseUrl\"],\n\tNEON_AUTH_JWKS_URL: [\"auth\", \"jwksUrl\"],\n\tNEON_DATA_API_URL: [\"dataApi\", \"url\"],\n\tAWS_ACCESS_KEY_ID: [\"storage\", \"accessKeyId\"],\n\tAWS_SECRET_ACCESS_KEY: [\"storage\", \"secretAccessKey\"],\n\tAWS_ENDPOINT_URL_S3: [\"storage\", \"endpoint\"],\n\tAWS_REGION: [\"storage\", \"region\"],\n\tNEON_AI_GATEWAY_TOKEN: [\"aiGateway\", \"apiKey\"],\n\tNEON_AI_GATEWAY_BASE_URL: [\"aiGateway\", \"baseUrl\"],\n};\n\n/**\n * Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly\n * selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike\n * the full reader it never consults the policy — the selection alone decides what's required —\n * so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without\n * throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.\n */\nfunction parseFilteredEnv(\n\tsource: NodeJS.ProcessEnv,\n\tkeys: readonly string[],\n): Record<string, Record<string, string>> {\n\tconst issues: string[] = [];\n\tconst result: Record<string, Record<string, string>> = {};\n\tfor (const key of keys) {\n\t\t// Unknown keys are blocked at the type level; a runtime caller bypassing the types\n\t\t// gets a clear error rather than a silently-dropped selection.\n\t\tif (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {\n\t\t\tissues.push(`${key} is not a selectable Neon env variable`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst value = source[key];\n\t\tif (value === undefined) {\n\t\t\tissues.push(`${key} is missing`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (value === \"\") {\n\t\t\tissues.push(`${key} must not be empty`);\n\t\t\tcontinue;\n\t\t}\n\t\tconst [namespace, property] = FILTERABLE_ENV_KEYS[key];\n\t\tconst bucket = result[namespace] ?? {};\n\t\tbucket[property] = value;\n\t\tresult[namespace] = bucket;\n\t}\n\tif (issues.length > 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.EnvNotInjected,\n\t\t\t[\n\t\t\t\t\"parseEnv: the required Neon env variables are not present in process.env.\",\n\t\t\t\t...issues.map((i) => `  - ${i}`),\n\t\t\t\t\"Inject them via one of:\",\n\t\t\t\t\"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)\",\n\t\t\t\t\"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)\",\n\t\t\t\t\"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O.\",\n\t\t\t].join(\"\\n\"),\n\t\t\t{ details: { missing: issues } },\n\t\t);\n\t}\n\treturn result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkGA,MAAM,oBAAoB,EAAE,OAAO;CAClC,cAAc,EACZ,OAAO,EAAE,SAAS,0BAA0B,CAAC,CAAC,CAC9C,IAAI,GAAG,gCAAgC;CACzC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;AACnD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC9B,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;CAC/C,oBAAoB,EAClB,OAAO,EAAE,SAAS,gCAAgC,CAAC,CAAC,CACpD,IAAI,GAAG,sCAAsC;AAChD,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,EACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC,EAC/C,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;CACjC,mBAAmB,EACjB,OAAO,EAAE,SAAS,+BAA+B,CAAC,CAAC,CACnD,IAAI,GAAG,qCAAqC;CAC9C,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,qBAAqB,EACnB,OAAO,EAAE,SAAS,iCAAiC,CAAC,CAAC,CACrD,IAAI,GAAG,uCAAuC;CAChD,YAAY,EACV,OAAO,EAAE,SAAS,wBAAwB,CAAC,CAAC,CAC5C,IAAI,GAAG,8BAA8B;AACxC,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CACnC,uBAAuB,EACrB,OAAO,EAAE,SAAS,mCAAmC,CAAC,CAAC,CACvD,IAAI,GAAG,yCAAyC;CAClD,0BAA0B,EACxB,OAAO,EAAE,SAAS,sCAAsC,CAAC,CAAC,CAC1D,IAAI,GAAG,4CAA4C;AACtD,CAAC;;AAGD,SAAS,mBAAmB,QAAyB;CACpD,OAAO,OAAO,KAAK,OAAO,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,qBAAqB,QAAyB;CACtD,OAAO,sBAAsB,OAAO,SAAS,SAAS;AACvD;;AAGA,SAAS,sBACR,QACU;CACV,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO,OAAO,YAAY;AAC3B;AAuEA,SAAgB,SACf,QACA,aACU;CACV,MAAM,SAAS,QAAQ;CACvB,IAAI,MAAM,QAAQ,WAAW,GAC5B,OAAO,iBAAiB,QAAQ,WAAW;CAI5C,MAAM,QAAQ,OAAO,gBAAgB,WAAW,cAAc,KAAA;CAC9D,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAkC,CAAC;CAEzC,MAAM,KAAK,kBAAkB,UAAU;EACtC,cAAc,OAAO;EACrB,uBAAuB,OAAO;CAC/B,CAAC;CACD,IAAI,GAAG,SACN,OAAO,WAAW;EACjB,aAAa,GAAG,KAAK;EACrB,qBAAqB,GAAG,KAAK;CAC9B;MAEA,KAAK,MAAM,SAAS,GAAG,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAO/D,MAAM,aAAa,OAAO,kBAAkB,OAAO;CACnD,IAAI,eAAe,KAAA,KAAa,eAAe,IAC9C,OAAO,SAAS,EAAE,MAAM,WAAW;CAGpC,IAAI,sBAAsB,OAAO,IAAI,GAAG;EACvC,MAAM,OAAO,cAAc,UAAU;GACpC,oBAAoB,OAAO;GAC3B,oBAAoB,OAAO;EAC5B,CAAC;EACD,IAAI,KAAK,SACR,OAAO,OAAO;GACb,SAAS,KAAK,KAAK;GACnB,SAAS,KAAK,KAAK;EACpB;OAEA,KAAK,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,OAAO;CAElE;CAEA,IAAI,sBAAsB,OAAO,OAAO,GAAG;EAC1C,MAAM,UAAU,iBAAiB,UAAU,EAC1C,mBAAmB,OAAO,kBAC3B,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU,EAChB,KAAK,QAAQ,KAAK,kBACnB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,mBAAmB,MAAM,GAAG;EAC/B,MAAM,UAAU,iBAAiB,UAAU;GAC1C,mBAAmB,OAAO;GAC1B,uBAAuB,OAAO;GAC9B,qBAAqB,OAAO;GAC5B,YAAY,OAAO;EACpB,CAAC;EACD,IAAI,QAAQ,SACX,OAAO,UAAU;GAChB,aAAa,QAAQ,KAAK;GAC1B,iBAAiB,QAAQ,KAAK;GAC9B,UAAU,QAAQ,KAAK;GACvB,QAAQ,QAAQ,KAAK;EACtB;OAEA,KAAK,MAAM,SAAS,QAAQ,MAAM,QACjC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,qBAAqB,MAAM,GAAG;EACjC,MAAM,YAAY,mBAAmB,UAAU;GAC9C,uBAAuB,OAAO;GAC9B,0BAA0B,OAAO;EAClC,CAAC;EACD,IAAI,UAAU,SACb,OAAO,YAAY;GAClB,QAAQ,UAAU,KAAK;GACvB,SAAS,UAAU,KAAK;EACzB;OAEA,KAAK,MAAM,SAAS,UAAU,MAAM,QACnC,OAAO,KAAK,MAAM,OAAO;CAE5B;CAEA,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,KAAK,OAAO,SAAS,YAAY;EACvC,IAAI,CAAC,IACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,0BAA0B,MAAM,oDAChC,yEACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;EAED,MAAM,SAAiC,CAAC;EACxC,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG;GAC5C,MAAM,QAAQ,OAAO;GAIrB,IAAI,UAAU,KAAA,GACb,OAAO,KAAK,GAAG,IAAI,yBAAyB,MAAM,GAAG;QAErD,OAAO,OAAO;EAEhB;EACA,OAAO,WAAW;CACnB;CAEA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B;EACA;EACA;EACA;EACA;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAGD,OAAO;AACR;;;;;;;AAQA,MAAM,sBAAiE;CACtE,cAAc,CAAC,YAAY,aAAa;CACxC,uBAAuB,CAAC,YAAY,qBAAqB;CACzD,aAAa,CAAC,UAAU,MAAM;CAC9B,oBAAoB,CAAC,QAAQ,SAAS;CACtC,oBAAoB,CAAC,QAAQ,SAAS;CACtC,mBAAmB,CAAC,WAAW,KAAK;CACpC,mBAAmB,CAAC,WAAW,aAAa;CAC5C,uBAAuB,CAAC,WAAW,iBAAiB;CACpD,qBAAqB,CAAC,WAAW,UAAU;CAC3C,YAAY,CAAC,WAAW,QAAQ;CAChC,uBAAuB,CAAC,aAAa,QAAQ;CAC7C,0BAA0B,CAAC,aAAa,SAAS;AAClD;;;;;;;;AASA,SAAS,iBACR,QACA,MACyC;CACzC,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAiD,CAAC;CACxD,KAAK,MAAM,OAAO,MAAM;EAGvB,IAAI,CAAC,OAAO,OAAO,qBAAqB,GAAG,GAAG;GAC7C,OAAO,KAAK,GAAG,IAAI,uCAAuC;GAC1D;EACD;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GAAW;GACxB,OAAO,KAAK,GAAG,IAAI,YAAY;GAC/B;EACD;EACA,IAAI,UAAU,IAAI;GACjB,OAAO,KAAK,GAAG,IAAI,mBAAmB;GACtC;EACD;EACA,MAAM,CAAC,WAAW,YAAY,oBAAoB;EAClD,MAAM,SAAS,OAAO,cAAc,CAAC;EACrC,OAAO,YAAY;EACnB,OAAO,aAAa;CACrB;CACA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,cACT,UAAU,gBACV;EACC;EACA,GAAG,OAAO,KAAK,MAAM,OAAO,GAAG;EAC/B;EACA;EACA;EACA;CACD,CAAC,CAAC,KAAK,IAAI,GACX,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAChC;CAED,OAAO;AACR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neondatabase/env",
-  "version": "0.15.0",
+  "version": "1.0.1",
   "description": "Resolve and inject Neon connection strings for the branch selected by your neon.ts policy. fetchEnv / parseEnv plus a `neon-env` CLI with `run` and `export`.",
   "keywords": [
     "neon",
@@ -30,11 +30,6 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    },
-    "./runtime": {
-      "types": "./dist/runtime.d.ts",
-      "import": "./dist/runtime.js",
-      "default": "./dist/runtime.js"
     }
   },
   "files": [
@@ -50,13 +45,15 @@
     "tsdown": "^0.14.1",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon/sdk": "1.5.0",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.0",
+    "@neon/e2e-harness": "0.0.0",
+    "@neon/sdk": "2.0.0"
   },
   "dependencies": {
     "zod": "^4.4.3",
     "yargs": "^18.0.0",
-    "@neon/config": "0.14.1"
+    "@neon/config": "1.0.0"
   },
   "engines": {
     "node": ">=20.19.0"
@@ -65,11 +62,11 @@
     "provenance": false
   },
   "scripts": {
-    "build": "node ../../scripts/sync-shared.mjs . && tsc --noEmit && tsdown",
-    "test": "node ../../scripts/sync-shared.mjs . && pnpm --filter @neon/env... build && vitest --passWithNoTests",
-    "test:ci": "node ../../scripts/sync-shared.mjs . && vitest run --passWithNoTests",
-    "test:types": "node ../../scripts/sync-shared.mjs . && vitest run --typecheck.enabled --typecheck.only",
-    "test:e2e": "node ../../scripts/sync-shared.mjs . && vitest run --config vitest.e2e.config.ts",
+    "build": "tsc --noEmit && tsdown",
+    "test": "pnpm --filter @neon/env... build && vitest --passWithNoTests",
+    "test:ci": "vitest run --passWithNoTests",
+    "test:types": "vitest run --typecheck.enabled --typecheck.only",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "tsc": "tsc"
   }
 }

package/dist/_shared/auth_selection.js

@@ -1,76 +0,0 @@
-import "./profiles.js";
-//#region src/_shared/auth_selection.ts
-/**
-* # Which credential an invocation authenticates with
-*
-* Four inputs can each answer "who am I": the `--api-key` flag, `NEON_API_KEY`, the
-* `--profile` flag, and `NEON_PROFILE`. This module decides between them, and it is pure so
-* the decision can be tested without a filesystem, a network, or a config directory.
-*
-* ## The rule
-*
-* **An explicit flag beats an ambient environment variable.** That single rule fixes the bug
-* this module exists for: before it, any API key — including one merely exported into the
-* shell — silently voided `--profile`, so `neon --profile work …` would quietly run as
-* whoever `NEON_API_KEY` belonged to and say nothing about it.
-*
-* | Given | What runs |
-* | --- | --- |
-* | `--api-key` and `--profile` | neither: contradictory explicit flags, so this throws |
-* | `--api-key` and `NEON_PROFILE` | the flag's key |
-* | `--profile` and `NEON_API_KEY` | the profile |
-* | `NEON_API_KEY` and `NEON_PROFILE` | the key, and the ignored profile is named in a warning |
-* | `--profile` or `NEON_PROFILE` alone | that profile |
-* | nothing | `DEFAULT` |
-*
-* Two explicit flags throw rather than picking a winner. They express different intents —
-* `--api-key` supplies a credential, `--profile` selects a stored one — so there is no
-* reading of the command that makes both true, and guessing is how the original bug behaved.
-*
-* When both are merely ambient, the key wins. That keeps CI exactly as it was: a pipeline
-* that injects `NEON_API_KEY` must not change behaviour because a `NEON_PROFILE` leaked into
-* the environment. It warns instead of staying silent, because a disregarded account
-* selection is precisely what nobody noticed last time.
-*
-* `auth` and the `profile` subcommands do not use any of this. They read the same flags with
-* different meanings — `neon auth --profile work` names where to *write* a credential, and
-* `neon profile create work --api-key …` names one to *store* — so their callers skip
-* selection entirely rather than passing exemptions down here.
-*/
-const selectCredential = ({ apiKeyFlag, profileFlag, apiKeyEnv, profileEnv }) => {
-	const flagKey = nonEmpty(apiKeyFlag);
-	const flagProfile = nonEmpty(profileFlag);
-	if (flagKey !== void 0 && flagProfile !== void 0) throw new Error("Pass either --api-key or --profile, not both. --api-key supplies a credential directly; --profile selects a stored one.");
-	if (flagKey !== void 0) return {
-		source: "explicit-api-key",
-		apiKey: flagKey
-	};
-	if (flagProfile !== void 0) return {
-		source: "profile",
-		profile: flagProfile,
-		explicit: true
-	};
-	const envKey = nonEmpty(apiKeyEnv);
-	const envProfile = nonEmpty(profileEnv);
-	if (envKey !== void 0) return {
-		source: "ambient-api-key",
-		apiKey: envKey,
-		...envProfile !== void 0 ? { ignoredProfile: envProfile } : {}
-	};
-	return {
-		source: "profile",
-		profile: envProfile ?? "DEFAULT",
-		explicit: envProfile !== void 0
-	};
-};
-/** The warning for an ambient key that displaced an ambient profile, or `null`. */
-const displacedProfileWarning = (selection) => selection.source === "ambient-api-key" && selection.ignoredProfile !== void 0 ? `NEON_API_KEY is set, so profile "${selection.ignoredProfile}" from NEON_PROFILE was ignored. Pass --profile ${selection.ignoredProfile} to use it instead.` : null;
-function nonEmpty(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-//#endregion
-export { displacedProfileWarning, selectCredential };
-
-//# sourceMappingURL=auth_selection.js.map

package/dist/_shared/auth_selection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth_selection.js","names":[],"sources":["../../src/_shared/auth_selection.ts"],"sourcesContent":["/**\n * # Which credential an invocation authenticates with\n *\n * Four inputs can each answer \"who am I\": the `--api-key` flag, `NEON_API_KEY`, the\n * `--profile` flag, and `NEON_PROFILE`. This module decides between them, and it is pure so\n * the decision can be tested without a filesystem, a network, or a config directory.\n *\n * ## The rule\n *\n * **An explicit flag beats an ambient environment variable.** That single rule fixes the bug\n * this module exists for: before it, any API key — including one merely exported into the\n * shell — silently voided `--profile`, so `neon --profile work …` would quietly run as\n * whoever `NEON_API_KEY` belonged to and say nothing about it.\n *\n * | Given | What runs |\n * | --- | --- |\n * | `--api-key` and `--profile` | neither: contradictory explicit flags, so this throws |\n * | `--api-key` and `NEON_PROFILE` | the flag's key |\n * | `--profile` and `NEON_API_KEY` | the profile |\n * | `NEON_API_KEY` and `NEON_PROFILE` | the key, and the ignored profile is named in a warning |\n * | `--profile` or `NEON_PROFILE` alone | that profile |\n * | nothing | `DEFAULT` |\n *\n * Two explicit flags throw rather than picking a winner. They express different intents —\n * `--api-key` supplies a credential, `--profile` selects a stored one — so there is no\n * reading of the command that makes both true, and guessing is how the original bug behaved.\n *\n * When both are merely ambient, the key wins. That keeps CI exactly as it was: a pipeline\n * that injects `NEON_API_KEY` must not change behaviour because a `NEON_PROFILE` leaked into\n * the environment. It warns instead of staying silent, because a disregarded account\n * selection is precisely what nobody noticed last time.\n *\n * `auth` and the `profile` subcommands do not use any of this. They read the same flags with\n * different meanings — `neon auth --profile work` names where to *write* a credential, and\n * `neon profile create work --api-key …` names one to *store* — so their callers skip\n * selection entirely rather than passing exemptions down here.\n */\n\nimport { DEFAULT_PROFILE } from \"./profiles.js\";\n\nexport type CredentialSelection =\n\t/** `--api-key`. Used as given; no profile is consulted and no stored file is touched. */\n\t| { source: \"explicit-api-key\"; apiKey: string }\n\t/** `NEON_API_KEY`, with the profile it displaced when there was one. */\n\t| { source: \"ambient-api-key\"; apiKey: string; ignoredProfile?: string }\n\t/** A profile, whose file decides whether that means an API key or OAuth. */\n\t| { source: \"profile\"; profile: string; explicit: boolean };\n\nexport type SelectionInput = {\n\t/** The `--api-key` flag, before any environment fallback has been folded into it. */\n\tapiKeyFlag?: string;\n\t/** The `--profile` flag. */\n\tprofileFlag?: string;\n\t/** `NEON_API_KEY`. */\n\tapiKeyEnv?: string;\n\t/** `NEON_PROFILE`. */\n\tprofileEnv?: string;\n};\n\n/**\n * What the four credential inputs were for this invocation, captured by\n * `resolveApiKeyFromEnv` — which is the one place that reads the environment.\n *\n * Two reasons this is module state rather than fields on the parsed arguments, the same two\n * that put `auth_context` here: an extra key on `args` is rejected by every command calling\n * `.strict()`, and a hidden option to carry it would be a second undocumented way to pass a\n * credential. One process is one invocation, so there is nothing to get out of step.\n *\n * Capturing the environment here rather than reading it inside {@link selectCredential} keeps\n * the selection a function of its arguments. That is not tidiness: `ensureAuth` is called\n * directly by tests, and reading `process.env` down in the decision made those tests depend on\n * whether the developer running them happened to have `NEON_API_KEY` exported.\n */\nexport type CredentialInputs = {\n\tapiKeyFlag: string;\n\tapiKeyEnv: string;\n\tprofileEnv: string;\n};\n\nconst NO_INPUTS: CredentialInputs = {\n\tapiKeyFlag: \"\",\n\tapiKeyEnv: \"\",\n\tprofileEnv: \"\",\n};\n\nlet inputs: CredentialInputs = NO_INPUTS;\n\nexport const recordCredentialInputs = (recorded: CredentialInputs): void => {\n\tinputs = recorded;\n};\n\nexport const credentialInputs = (): CredentialInputs => inputs;\n\nexport const selectCredential = ({\n\tapiKeyFlag,\n\tprofileFlag,\n\tapiKeyEnv,\n\tprofileEnv,\n}: SelectionInput): CredentialSelection => {\n\tconst flagKey = nonEmpty(apiKeyFlag);\n\tconst flagProfile = nonEmpty(profileFlag);\n\n\tif (flagKey !== undefined && flagProfile !== undefined) {\n\t\tthrow new Error(\n\t\t\t\"Pass either --api-key or --profile, not both. --api-key supplies a credential directly; --profile selects a stored one.\",\n\t\t);\n\t}\n\n\tif (flagKey !== undefined) {\n\t\treturn { source: \"explicit-api-key\", apiKey: flagKey };\n\t}\n\n\tif (flagProfile !== undefined) {\n\t\treturn { source: \"profile\", profile: flagProfile, explicit: true };\n\t}\n\n\tconst envKey = nonEmpty(apiKeyEnv);\n\tconst envProfile = nonEmpty(profileEnv);\n\n\tif (envKey !== undefined) {\n\t\treturn {\n\t\t\tsource: \"ambient-api-key\",\n\t\t\tapiKey: envKey,\n\t\t\t...(envProfile !== undefined ? { ignoredProfile: envProfile } : {}),\n\t\t};\n\t}\n\n\treturn {\n\t\tsource: \"profile\",\n\t\tprofile: envProfile ?? DEFAULT_PROFILE,\n\t\texplicit: envProfile !== undefined,\n\t};\n};\n\n/** The warning for an ambient key that displaced an ambient profile, or `null`. */\nexport const displacedProfileWarning = (\n\tselection: CredentialSelection,\n): string | null =>\n\tselection.source === \"ambient-api-key\" &&\n\tselection.ignoredProfile !== undefined\n\t\t? `NEON_API_KEY is set, so profile \"${selection.ignoredProfile}\" from NEON_PROFILE was ignored. Pass --profile ${selection.ignoredProfile} to use it instead.`\n\t\t: null;\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst trimmed = value.trim();\n\treturn trimmed === \"\" ? undefined : trimmed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FA,MAAa,oBAAoB,EAChC,YACA,aACA,WACA,iBAC0C;CAC1C,MAAM,UAAU,SAAS,UAAU;CACnC,MAAM,cAAc,SAAS,WAAW;CAExC,IAAI,YAAY,KAAA,KAAa,gBAAgB,KAAA,GAC5C,MAAM,IAAI,MACT,yHACD;CAGD,IAAI,YAAY,KAAA,GACf,OAAO;EAAE,QAAQ;EAAoB,QAAQ;CAAQ;CAGtD,IAAI,gBAAgB,KAAA,GACnB,OAAO;EAAE,QAAQ;EAAW,SAAS;EAAa,UAAU;CAAK;CAGlE,MAAM,SAAS,SAAS,SAAS;CACjC,MAAM,aAAa,SAAS,UAAU;CAEtC,IAAI,WAAW,KAAA,GACd,OAAO;EACN,QAAQ;EACR,QAAQ;EACR,GAAI,eAAe,KAAA,IAAY,EAAE,gBAAgB,WAAW,IAAI,CAAC;CAClE;CAGD,OAAO;EACN,QAAQ;EACR,SAAS,cAAA;EACT,UAAU,eAAe,KAAA;CAC1B;AACD;;AAGA,MAAa,2BACZ,cAEA,UAAU,WAAW,qBACrB,UAAU,mBAAmB,KAAA,IAC1B,oCAAoC,UAAU,eAAe,kDAAkD,UAAU,eAAe,uBACxI;AAEJ,SAAS,SAAS,OAA+C;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,YAAY,KAAK,KAAA,IAAY;AACrC"}

package/dist/_shared/credentials.js

@@ -1,131 +0,0 @@
-import { readFileSync } from "node:fs";
-//#region src/_shared/credentials.ts
-/**
-* # Stored credentials — one file per account, two kinds
-*
-* A profile points at exactly one credentials file (see `./profiles.ts`), and that file says
-* what kind of credential it holds. Adding API-key support this way rather than adding a
-* second pointer to `profiles.json` keeps a profile what it already was — one name, one path
-* — and means `profiles.json` needs no schema change at all.
-*
-* ```json
-* // oauth: every file written before this existed. An absent `type` means this.
-* { "access_token": "…", "refresh_token": "…", "expires_at": 1786…, "user_id": "…" }
-*
-* // api_key, stored by `neon profile create --api-key`
-* { "type": "api_key", "api_key": "napi_…", "user_id": "…" }
-*
-* // api_key minted by `--mint --org-id`, which records the scope it was issued at
-* { "type": "api_key", "api_key": "napi_…", "key_id": 123, "org_id": "org-…" }
-* ```
-*
-* ## One profile, one kind
-*
-* A credentials file holds an API key or an OAuth session, never both, and `type` states
-* which. An earlier draft let the two coexist — the idea being that a key could keep the
-* session it was minted from and so rotate without a browser. It did not survive review, for
-* two reasons that are worth recording so nobody rebuilds it:
-*
-* 1. **It never worked.** The resolver returned the key without testing it, so a revoked key
-*    failed to mint and never fell back to the session sitting beside it.
-* 2. **It could mix accounts.** Nothing compared the identity of the credential being written
-*    with the one already there, so a profile could hold one account's session and another's
-*    key, told apart only by a single string. Flip or lose `type` and the profile silently
-*    becomes a different person.
-*
-* Recovery from a dead key is therefore one browser login — `neon profile create <name>
-* --mint --force` — which is what the retained session was supposed to save and never did.
-*
-* ## Older releases
-*
-* A CLI predating this reads the pointer, finds no `type` it understands, ignores it, and
-* looks for `access_token`. An `api_key` profile has none, so an older release falls through
-* to its browser login rather than crashing. That it does not crash is why `credentials`
-* stays a required pointer: an entry without one makes 2.41 and 2.42 throw
-* `ERR_INVALID_ARG_TYPE` from `resolveEntryPath`.
-*/
-const OAUTH = "oauth";
-const API_KEY = "api_key";
-/**
-* Which credential in this file authenticates, by declaration alone.
-*
-* An unrecognised `type` throws rather than falling back to `oauth`. A file we cannot
-* interpret is a misconfiguration the user has to see: treating it as OAuth would send them
-* to a browser login that silently replaces a credential they meant to keep, and treating it
-* as an API key would authenticate with whatever `api_key` happened to be there.
-*
-* This deliberately does not check that an `api_key` file has a key — `neon profile list`
-* needs the kind of a file it is not about to authenticate with, and must be able to report a
-* broken one rather than throwing halfway through a table.
-*/
-const credentialKind = (credentials, at) => {
-	const declared = credentials.type;
-	if (declared === void 0 || declared === "oauth") return OAUTH;
-	if (declared === "api_key") return API_KEY;
-	throw new Error(`${at.path} declares a "type" this version does not understand. Expected "${OAUTH}" or "${API_KEY}". ${repair(at)}`);
-};
-/**
-* The way out of a credentials file that cannot be read.
-*
-* One sentence, shared by every such error, because they all have the same two answers: write
-* a new credential over it, or delete it and start again.
-*/
-const repair = (at) => `Replace it deliberately with \`neon profile create ${at.profile} --force\`, or delete the file.`;
-/**
-* Resolve what to authenticate with, validating that the declared kind is actually usable.
-*
-* An `api_key` file with no key is a hard error rather than a fall-through to OAuth: the user
-* asked for a key, and quietly opening a browser instead would replace the credential they
-* were trying to fix.
-*/
-const interpretCredentials = (credentials, at) => {
-	if (credentialKind(credentials, at) === "oauth") return { kind: OAUTH };
-	const apiKey = nonEmpty(credentials.api_key);
-	if (apiKey === void 0) throw new Error(`${at.path} declares "type": "${API_KEY}" but has no "api_key" value. ${repair(at)}`);
-	return {
-		kind: API_KEY,
-		apiKey
-	};
-};
-/**
-* Read and classify a credentials file, without deciding what to do about it.
-*
-* A permission or I/O error still throws: there may be a perfectly good credential here that
-* we cannot see, and treating that as absent would send the user to a browser login that
-* overwrites it.
-*/
-const inspectCredentials = (path) => {
-	let contents;
-	try {
-		contents = readFileSync(path, "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return { kind: "absent" };
-		throw err;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(contents);
-	} catch {
-		return {
-			kind: "unusable",
-			reason: `${path} is not valid JSON, so the credential in it cannot be read`
-		};
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {
-		kind: "unusable",
-		reason: `${path} does not contain a credentials object`
-	};
-	return {
-		kind: "ok",
-		credentials: parsed
-	};
-};
-function nonEmpty(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-//#endregion
-export { API_KEY, OAUTH, credentialKind, inspectCredentials, interpretCredentials };
-
-//# sourceMappingURL=credentials.js.map