@neondatabase/env 0.8.1 → 0.10.0

package/README.md

@@ -1,27 +1,29 @@
-# @neondatabase/env
+# @neon/env
 
 Resolve and inject Neon connection strings for the branch selected by your `neon.ts` policy. Exposes `fetchEnv` / `parseEnv` functions plus a `neon-env` CLI with `run` (inject env into a command) and `export` (print env to stdout).
 
-Builds on [`@neondatabase/config`](../config) — it reuses the `Config` policy type and the Neon API client.
+Builds on [`@neon/config`](../config) — it reuses the `Config` policy type and the Neon API client.
 
 ## Install
 
 ```bash
-npm install @neondatabase/env
+npm install @neon/env
 ```
 
+> **Requirements:** Node.js >= 20.19.
+
 ## Functions
 
-The library functions are **filesystem- and env-agnostic**: `fetchEnv` requires an explicit `projectId` + `branchId`. (The `neon-env` CLI does the `.neon`/`NEON_*` resolution and passes these in.)
+The library functions are **filesystem- and env-agnostic**: `fetchEnv` requires an explicit `projectId` + `branch` (a branch **name** like `main`, or a `br-…` id). (The `neon-env` CLI does the `.neon`/`NEON_*` resolution and passes these in.)
 
 > `parseEnv` takes **no branch name**: the secret set is static (top-level `config.auth` / `config.dataApi`), so it reads those toggles directly without evaluating the per-branch closure. Its optional second argument is a **scope** _or_ a **key filter** — omit it for the full external (app/build) env, pass a **function slug** when running inside that deployed function (adds a typed `function` namespace of its declared env keys), or pass an **array of OS-level env-var keys** to require + return only that subset.
 
 ```ts
 import config from "../neon";
-import { fetchEnv, parseEnv } from "@neondatabase/env";
+import { fetchEnv, parseEnv } from "@neon/env";
 
 // Async — calls the Neon API for live connection strings. Use in build scripts / top-level await.
-const env = await fetchEnv(config, { projectId: "patient-art-12345", branchId: "br-…" });
+const env = await fetchEnv(config, { projectId: "patient-art-12345", branch: "main" });
 const db = drizzle(neon(env.postgres.databaseUrl), { schema });
 
 // Sync — reads already-injected process.env and validates it (no network).
@@ -43,7 +45,7 @@ Both return the same namespaced `NeonEnv` shape: `postgres` is always present; `
 
 | Function | Description |
 | --- | --- |
-| `fetchEnv(config, { projectId, branchId, ... })` | Async. Calls the Neon API for the given project + branch and returns live connection strings (and Auth/Data API values when enabled). `projectId` and `branchId` are required (`branchId` is a `br-…` id). |
+| `fetchEnv(config, { projectId, branch, ... })` | Async. Calls the Neon API for the given project + branch and returns live connection strings (and Auth/Data API values when enabled). `projectId` and `branch` are required; `branch` accepts a branch **name** (e.g. `main`) or a `br-…` id. (The legacy id-only `branchId` option still works.) |
 | `parseEnv(config)` / `parseEnv(config, slug)` / `parseEnv(config, keys)` | Sync. Reads/validates the Neon env vars already present in `process.env` against the static policy toggles. With a function `slug`, also returns a typed `function` namespace of that function's declared env keys. With a `keys` array (e.g. `["DATABASE_URL"]`), only those vars are required and returned, as a narrowed namespaced shape — the keys are typesafe against the policy. Throws `PlatformError(EnvNotInjected)` listing missing vars when the env isn't populated. |
 | `toEntries(env)` | Project a resolved `NeonEnv` into `{ KEY: value }` pairs for cross-process transport (named after the web `.entries()` convention; returns a `Record`). |
 
@@ -58,7 +60,7 @@ neon-env run -- npm run dev
 neon-env run -- pnpm dev
 ```
 
-`run` loads `neon.ts`, resolves the branch (via `--branch`, `NEON_BRANCH_ID`, or `.neon[/project.json]`), fetches the connection strings from Neon, and spawns the command with `NEON_BRANCH` / `DATABASE_URL` / `DATABASE_URL_UNPOOLED` (and `NEON_AUTH_BASE_URL` / `NEON_AUTH_JWKS_URL` / `NEON_DATA_API_URL` when the policy enables them) injected on top of the inherited environment. Stdio is inherited so interactive dev servers keep working, and the parent exits with the child's exit code.
+`run` loads `neon.ts`, resolves the branch (via `--branch`, `NEON_BRANCH` / `NEON_BRANCH_ID`, or the `branch` field in `.neon[/project.json]` — by name or id), fetches the connection strings from Neon, and spawns the command with `NEON_BRANCH` / `DATABASE_URL` / `DATABASE_URL_UNPOOLED` (and `NEON_AUTH_BASE_URL` / `NEON_AUTH_JWKS_URL` / `NEON_DATA_API_URL` when the policy enables them) injected on top of the inherited environment. Stdio is inherited so interactive dev servers keep working, and the parent exits with the child's exit code.
 
 ### `export` — print env to stdout
 
@@ -91,6 +93,6 @@ Flags (both commands): `--config <path>`, `--project-id`, `--branch`, `--api-key
 
 ## Resolution
 
-The **CLI** (`neon-env run`) resolves project + branch itself: `--project-id` / `--branch` flag → `NEON_PROJECT_ID` / `NEON_BRANCH_ID` env → `.neon[/project.json]` walked up from the working directory. The API key resolves via `--api-key` → `NEON_API_KEY` → `~/.config/neonctl/credentials.json`.
+The **CLI** (`neon-env run`) resolves project + branch itself: `--project-id` / `--branch` flag → `NEON_PROJECT_ID` / `NEON_BRANCH` (name) / `NEON_BRANCH_ID` (legacy id) env → `.neon[/project.json]` walked up from the working directory (its `branch` field, name or id; legacy `branchId` still read). The API key resolves via `--api-key` → `NEON_API_KEY` → `~/.config/neonctl/credentials.json`.
 
-The **library functions** do none of this — pass `projectId` / `branchId` explicitly. This keeps `.neon` parsing in one place (the CLI / neonctl) and the functions pure.
+The **library functions** do none of this — pass `projectId` / `branch` explicitly. This keeps `.neon` parsing in one place (the CLI / neonctl) and the functions pure.

package/dist/cli.js

@@ -18,7 +18,7 @@ const argv = yargs(hideBin(process.argv)).scriptName("neon-env").usage("$0 <comm
 	describe: "Override the .neon/project.json projectId"
 }).option("branch", {
 	type: "string",
-	describe: "Override the .neon/project.json branchId / NEON_BRANCH_ID"
+	describe: "Branch name or id to target (overrides .neon / NEON_BRANCH / NEON_BRANCH_ID)"
 }).option("api-key", {
 	type: "string",
 	describe: "Neon API key (defaults to NEON_API_KEY)"
@@ -34,7 +34,7 @@ const argv = yargs(hideBin(process.argv)).scriptName("neon-env").usage("$0 <comm
 	describe: "Override the .neon/project.json projectId"
 }).option("branch", {
 	type: "string",
-	describe: "Override the .neon/project.json branchId / NEON_BRANCH_ID"
+	describe: "Branch name or id to target (overrides .neon / NEON_BRANCH / NEON_BRANCH_ID)"
 }).option("api-key", {
 	type: "string",
 	describe: "Neon API key (defaults to NEON_API_KEY)"

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\nimport {\n\ttype CommandResult,\n\trunEnvExport,\n\trunEnvRun,\n} from \"./lib/cli/commands.js\";\n\nconst pkgVersion = readPackageVersion();\n\nconst argv = yargs(hideBin(process.argv))\n\t.scriptName(\"neon-env\")\n\t.usage(\"$0 <command> [options]\")\n\t.parserConfiguration({ \"populate--\": true })\n\t.option(\"debug\", {\n\t\ttype: \"boolean\",\n\t\tdefault: false,\n\t\tdescribe:\n\t\t\t\"Print stack traces and structured error details when something fails\",\n\t})\n\t.command(\n\t\t\"run\",\n\t\t\"Run a command with Neon env vars (from your neon.ts policy) injected into its environment. Use `--` to separate the command: `neon-env run -- npm run dev`.\",\n\t\t(y) =>\n\t\t\ty\n\t\t\t\t.option(\"config\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Path to neon.ts (defaults to walking up from cwd)\",\n\t\t\t\t})\n\t\t\t\t.option(\"project-id\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Override the .neon/project.json projectId\",\n\t\t\t\t})\n\t\t\t\t.option(\"branch\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Override the .neon/project.json branchId / NEON_BRANCH_ID\",\n\t\t\t\t})\n\t\t\t\t.option(\"api-key\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Neon API key (defaults to NEON_API_KEY)\",\n\t\t\t\t}),\n\t)\n\t.command(\n\t\t\"export\",\n\t\t\"Print the branch's Neon env vars (from your neon.ts policy) to stdout, as dotenv lines or JSON. Useful for piping into other env tools, e.g. `neon-env export --format json`.\",\n\t\t(y) =>\n\t\t\ty\n\t\t\t\t.option(\"format\", {\n\t\t\t\t\tchoices: [\"dotenv\", \"json\"] as const,\n\t\t\t\t\tdefault: \"dotenv\",\n\t\t\t\t\tdescribe: \"Output format: dotenv (KEY=value lines) or json\",\n\t\t\t\t})\n\t\t\t\t.option(\"config\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Path to neon.ts (defaults to walking up from cwd)\",\n\t\t\t\t})\n\t\t\t\t.option(\"project-id\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Override the .neon/project.json projectId\",\n\t\t\t\t})\n\t\t\t\t.option(\"branch\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Override the .neon/project.json branchId / NEON_BRANCH_ID\",\n\t\t\t\t})\n\t\t\t\t.option(\"api-key\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Neon API key (defaults to NEON_API_KEY)\",\n\t\t\t\t}),\n\t)\n\t.demandCommand(1, \"Run `neon-env --help` to see the available commands.\")\n\t.strict()\n\t.help()\n\t.version(pkgVersion)\n\t.parseSync();\n\nconst command = String(argv._[0]);\nconst cwd = process.cwd();\n\nlet result: CommandResult;\nswitch (command) {\n\tcase \"run\": {\n\t\tconst passthrough = Array.isArray(argv[\"--\"])\n\t\t\t? argv[\"--\"].map(String)\n\t\t\t: [];\n\t\tresult = await runEnvRun(\n\t\t\t{\n\t\t\t\tcommand: passthrough,\n\t\t\t\t...(typeof argv.config === \"string\"\n\t\t\t\t\t? { configPath: argv.config }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"project-id\"] === \"string\"\n\t\t\t\t\t? { projectId: argv[\"project-id\"] }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv.branch === \"string\"\n\t\t\t\t\t? { branch: argv.branch }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"api-key\"] === \"string\"\n\t\t\t\t\t? { apiKey: argv[\"api-key\"] }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t\t{ cwd },\n\t\t);\n\t\tbreak;\n\t}\n\tcase \"export\": {\n\t\tresult = await runEnvExport(\n\t\t\t{\n\t\t\t\tformat: argv.format === \"json\" ? \"json\" : \"dotenv\",\n\t\t\t\t...(typeof argv.config === \"string\"\n\t\t\t\t\t? { configPath: argv.config }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"project-id\"] === \"string\"\n\t\t\t\t\t? { projectId: argv[\"project-id\"] }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv.branch === \"string\"\n\t\t\t\t\t? { branch: argv.branch }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"api-key\"] === \"string\"\n\t\t\t\t\t? { apiKey: argv[\"api-key\"] }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t\t{ cwd },\n\t\t);\n\t\tbreak;\n\t}\n\tdefault:\n\t\tresult = {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: `Unknown command: ${command}\\n`,\n\t\t};\n}\n\nif (result.stdout) process.stdout.write(result.stdout);\nif (result.stderr) process.stderr.write(result.stderr);\nif (argv.debug && result.exitCode !== 0 && result.debugInfo) {\n\tprocess.stderr.write(`\\n--- debug ---\\n${result.debugInfo}\\n`);\n}\nprocess.exit(result.exitCode);\n\nfunction readPackageVersion(): string {\n\t// The built CLI lives at `dist/cli.js`, so `package.json` is one directory up. When\n\t// running from source (tsx, vitest), the file lives at `src/cli.ts` and `package.json`\n\t// is again one directory up. Single resolution covers both layouts.\n\ttry {\n\t\tconst pkgUrl = new URL(\"../package.json\", import.meta.url);\n\t\tconst raw = readFileSync(fileURLToPath(pkgUrl), \"utf-8\");\n\t\tconst parsed = JSON.parse(raw) as { version?: unknown };\n\t\treturn typeof parsed.version === \"string\" ? parsed.version : \"0.0.0\";\n\t} catch {\n\t\treturn \"0.0.0\";\n\t}\n}\n"],"mappings":";;;;;;;AAYA,MAAM,aAAa,mBAAmB;AAEtC,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,CACvC,WAAW,UAAU,CAAC,CACtB,MAAM,wBAAwB,CAAC,CAC/B,oBAAoB,EAAE,cAAc,KAAK,CAAC,CAAC,CAC3C,OAAO,SAAS;CAChB,MAAM;CACN,SAAS;CACT,UACC;AACF,CAAC,CAAC,CACD,QACA,OACA,gKACC,MACA,EACE,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,cAAc;CACrB,MAAM;CACN,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,WAAW;CAClB,MAAM;CACN,UAAU;AACX,CAAC,CACJ,CAAC,CACA,QACA,UACA,kLACC,MACA,EACE,OAAO,UAAU;CACjB,SAAS,CAAC,UAAU,MAAM;CAC1B,SAAS;CACT,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,cAAc;CACrB,MAAM;CACN,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,WAAW;CAClB,MAAM;CACN,UAAU;AACX,CAAC,CACJ,CAAC,CACA,cAAc,GAAG,sDAAsD,CAAC,CACxE,OAAO,CAAC,CACR,KAAK,CAAC,CACN,QAAQ,UAAU,CAAC,CACnB,UAAU;AAEZ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE;AAChC,MAAM,MAAM,QAAQ,IAAI;AAExB,IAAI;AACJ,QAAQ,SAAR;CACC,KAAK;EAIJ,SAAS,MAAM,UACd;GACC,SALkB,MAAM,QAAQ,KAAK,KAAK,IACzC,KAAK,KAAK,CAAC,IAAI,MAAM,IACrB,CAAC;GAIF,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,YAAY,KAAK,OAAO,IAC1B,CAAC;GACJ,GAAI,OAAO,KAAK,kBAAkB,WAC/B,EAAE,WAAW,KAAK,cAAc,IAChC,CAAC;GACJ,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,QAAQ,KAAK,OAAO,IACtB,CAAC;GACJ,GAAI,OAAO,KAAK,eAAe,WAC5B,EAAE,QAAQ,KAAK,WAAW,IAC1B,CAAC;EACL,GACA,EAAE,IAAI,CACP;EACA;CAED,KAAK;EACJ,SAAS,MAAM,aACd;GACC,QAAQ,KAAK,WAAW,SAAS,SAAS;GAC1C,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,YAAY,KAAK,OAAO,IAC1B,CAAC;GACJ,GAAI,OAAO,KAAK,kBAAkB,WAC/B,EAAE,WAAW,KAAK,cAAc,IAChC,CAAC;GACJ,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,QAAQ,KAAK,OAAO,IACtB,CAAC;GACJ,GAAI,OAAO,KAAK,eAAe,WAC5B,EAAE,QAAQ,KAAK,WAAW,IAC1B,CAAC;EACL,GACA,EAAE,IAAI,CACP;EACA;CAED,SACC,SAAS;EACR,UAAU;EACV,QAAQ;EACR,QAAQ,oBAAoB,QAAQ;CACrC;AACF;AAEA,IAAI,OAAO,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM;AACrD,IAAI,OAAO,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM;AACrD,IAAI,KAAK,SAAS,OAAO,aAAa,KAAK,OAAO,WACjD,QAAQ,OAAO,MAAM,oBAAoB,OAAO,UAAU,GAAG;AAE9D,QAAQ,KAAK,OAAO,QAAQ;AAE5B,SAAS,qBAA6B;CAIrC,IAAI;EAEH,MAAM,MAAM,aAAa,cAAc,IADpB,IAAI,mBAAmB,OAAO,KAAK,GACV,CAAC,GAAG,OAAO;EACvD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,OAAO,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;CAC9D,QAAQ;EACP,OAAO;CACR;AACD"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport yargs from \"yargs\";\nimport { hideBin } from \"yargs/helpers\";\nimport {\n\ttype CommandResult,\n\trunEnvExport,\n\trunEnvRun,\n} from \"./lib/cli/commands.js\";\n\nconst pkgVersion = readPackageVersion();\n\nconst argv = yargs(hideBin(process.argv))\n\t.scriptName(\"neon-env\")\n\t.usage(\"$0 <command> [options]\")\n\t.parserConfiguration({ \"populate--\": true })\n\t.option(\"debug\", {\n\t\ttype: \"boolean\",\n\t\tdefault: false,\n\t\tdescribe:\n\t\t\t\"Print stack traces and structured error details when something fails\",\n\t})\n\t.command(\n\t\t\"run\",\n\t\t\"Run a command with Neon env vars (from your neon.ts policy) injected into its environment. Use `--` to separate the command: `neon-env run -- npm run dev`.\",\n\t\t(y) =>\n\t\t\ty\n\t\t\t\t.option(\"config\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Path to neon.ts (defaults to walking up from cwd)\",\n\t\t\t\t})\n\t\t\t\t.option(\"project-id\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Override the .neon/project.json projectId\",\n\t\t\t\t})\n\t\t\t\t.option(\"branch\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Branch name or id to target (overrides .neon / NEON_BRANCH / NEON_BRANCH_ID)\",\n\t\t\t\t})\n\t\t\t\t.option(\"api-key\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Neon API key (defaults to NEON_API_KEY)\",\n\t\t\t\t}),\n\t)\n\t.command(\n\t\t\"export\",\n\t\t\"Print the branch's Neon env vars (from your neon.ts policy) to stdout, as dotenv lines or JSON. Useful for piping into other env tools, e.g. `neon-env export --format json`.\",\n\t\t(y) =>\n\t\t\ty\n\t\t\t\t.option(\"format\", {\n\t\t\t\t\tchoices: [\"dotenv\", \"json\"] as const,\n\t\t\t\t\tdefault: \"dotenv\",\n\t\t\t\t\tdescribe: \"Output format: dotenv (KEY=value lines) or json\",\n\t\t\t\t})\n\t\t\t\t.option(\"config\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Path to neon.ts (defaults to walking up from cwd)\",\n\t\t\t\t})\n\t\t\t\t.option(\"project-id\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Override the .neon/project.json projectId\",\n\t\t\t\t})\n\t\t\t\t.option(\"branch\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe:\n\t\t\t\t\t\t\"Branch name or id to target (overrides .neon / NEON_BRANCH / NEON_BRANCH_ID)\",\n\t\t\t\t})\n\t\t\t\t.option(\"api-key\", {\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\tdescribe: \"Neon API key (defaults to NEON_API_KEY)\",\n\t\t\t\t}),\n\t)\n\t.demandCommand(1, \"Run `neon-env --help` to see the available commands.\")\n\t.strict()\n\t.help()\n\t.version(pkgVersion)\n\t.parseSync();\n\nconst command = String(argv._[0]);\nconst cwd = process.cwd();\n\nlet result: CommandResult;\nswitch (command) {\n\tcase \"run\": {\n\t\tconst passthrough = Array.isArray(argv[\"--\"])\n\t\t\t? argv[\"--\"].map(String)\n\t\t\t: [];\n\t\tresult = await runEnvRun(\n\t\t\t{\n\t\t\t\tcommand: passthrough,\n\t\t\t\t...(typeof argv.config === \"string\"\n\t\t\t\t\t? { configPath: argv.config }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"project-id\"] === \"string\"\n\t\t\t\t\t? { projectId: argv[\"project-id\"] }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv.branch === \"string\"\n\t\t\t\t\t? { branch: argv.branch }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"api-key\"] === \"string\"\n\t\t\t\t\t? { apiKey: argv[\"api-key\"] }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t\t{ cwd },\n\t\t);\n\t\tbreak;\n\t}\n\tcase \"export\": {\n\t\tresult = await runEnvExport(\n\t\t\t{\n\t\t\t\tformat: argv.format === \"json\" ? \"json\" : \"dotenv\",\n\t\t\t\t...(typeof argv.config === \"string\"\n\t\t\t\t\t? { configPath: argv.config }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"project-id\"] === \"string\"\n\t\t\t\t\t? { projectId: argv[\"project-id\"] }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv.branch === \"string\"\n\t\t\t\t\t? { branch: argv.branch }\n\t\t\t\t\t: {}),\n\t\t\t\t...(typeof argv[\"api-key\"] === \"string\"\n\t\t\t\t\t? { apiKey: argv[\"api-key\"] }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t\t{ cwd },\n\t\t);\n\t\tbreak;\n\t}\n\tdefault:\n\t\tresult = {\n\t\t\texitCode: 1,\n\t\t\tstdout: \"\",\n\t\t\tstderr: `Unknown command: ${command}\\n`,\n\t\t};\n}\n\nif (result.stdout) process.stdout.write(result.stdout);\nif (result.stderr) process.stderr.write(result.stderr);\nif (argv.debug && result.exitCode !== 0 && result.debugInfo) {\n\tprocess.stderr.write(`\\n--- debug ---\\n${result.debugInfo}\\n`);\n}\nprocess.exit(result.exitCode);\n\nfunction readPackageVersion(): string {\n\t// The built CLI lives at `dist/cli.js`, so `package.json` is one directory up. When\n\t// running from source (tsx, vitest), the file lives at `src/cli.ts` and `package.json`\n\t// is again one directory up. Single resolution covers both layouts.\n\ttry {\n\t\tconst pkgUrl = new URL(\"../package.json\", import.meta.url);\n\t\tconst raw = readFileSync(fileURLToPath(pkgUrl), \"utf-8\");\n\t\tconst parsed = JSON.parse(raw) as { version?: unknown };\n\t\treturn typeof parsed.version === \"string\" ? parsed.version : \"0.0.0\";\n\t} catch {\n\t\treturn \"0.0.0\";\n\t}\n}\n"],"mappings":";;;;;;;AAYA,MAAM,aAAa,mBAAmB;AAEtC,MAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,CACvC,WAAW,UAAU,CAAC,CACtB,MAAM,wBAAwB,CAAC,CAC/B,oBAAoB,EAAE,cAAc,KAAK,CAAC,CAAC,CAC3C,OAAO,SAAS;CAChB,MAAM;CACN,SAAS;CACT,UACC;AACF,CAAC,CAAC,CACD,QACA,OACA,gKACC,MACA,EACE,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,cAAc;CACrB,MAAM;CACN,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,WAAW;CAClB,MAAM;CACN,UAAU;AACX,CAAC,CACJ,CAAC,CACA,QACA,UACA,kLACC,MACA,EACE,OAAO,UAAU;CACjB,SAAS,CAAC,UAAU,MAAM;CAC1B,SAAS;CACT,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,cAAc;CACrB,MAAM;CACN,UAAU;AACX,CAAC,CAAC,CACD,OAAO,UAAU;CACjB,MAAM;CACN,UACC;AACF,CAAC,CAAC,CACD,OAAO,WAAW;CAClB,MAAM;CACN,UAAU;AACX,CAAC,CACJ,CAAC,CACA,cAAc,GAAG,sDAAsD,CAAC,CACxE,OAAO,CAAC,CACR,KAAK,CAAC,CACN,QAAQ,UAAU,CAAC,CACnB,UAAU;AAEZ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE;AAChC,MAAM,MAAM,QAAQ,IAAI;AAExB,IAAI;AACJ,QAAQ,SAAR;CACC,KAAK;EAIJ,SAAS,MAAM,UACd;GACC,SALkB,MAAM,QAAQ,KAAK,KAAK,IACzC,KAAK,KAAK,CAAC,IAAI,MAAM,IACrB,CAAC;GAIF,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,YAAY,KAAK,OAAO,IAC1B,CAAC;GACJ,GAAI,OAAO,KAAK,kBAAkB,WAC/B,EAAE,WAAW,KAAK,cAAc,IAChC,CAAC;GACJ,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,QAAQ,KAAK,OAAO,IACtB,CAAC;GACJ,GAAI,OAAO,KAAK,eAAe,WAC5B,EAAE,QAAQ,KAAK,WAAW,IAC1B,CAAC;EACL,GACA,EAAE,IAAI,CACP;EACA;CAED,KAAK;EACJ,SAAS,MAAM,aACd;GACC,QAAQ,KAAK,WAAW,SAAS,SAAS;GAC1C,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,YAAY,KAAK,OAAO,IAC1B,CAAC;GACJ,GAAI,OAAO,KAAK,kBAAkB,WAC/B,EAAE,WAAW,KAAK,cAAc,IAChC,CAAC;GACJ,GAAI,OAAO,KAAK,WAAW,WACxB,EAAE,QAAQ,KAAK,OAAO,IACtB,CAAC;GACJ,GAAI,OAAO,KAAK,eAAe,WAC5B,EAAE,QAAQ,KAAK,WAAW,IAC1B,CAAC;EACL,GACA,EAAE,IAAI,CACP;EACA;CAED,SACC,SAAS;EACR,UAAU;EACV,QAAQ;EACR,QAAQ,oBAAoB,QAAQ;CACrC;AACF;AAEA,IAAI,OAAO,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM;AACrD,IAAI,OAAO,QAAQ,QAAQ,OAAO,MAAM,OAAO,MAAM;AACrD,IAAI,KAAK,SAAS,OAAO,aAAa,KAAK,OAAO,WACjD,QAAQ,OAAO,MAAM,oBAAoB,OAAO,UAAU,GAAG;AAE9D,QAAQ,KAAK,OAAO,QAAQ;AAE5B,SAAS,qBAA6B;CAIrC,IAAI;EAEH,MAAM,MAAM,aAAa,cAAc,IADpB,IAAI,mBAAmB,OAAO,KAAK,GACV,CAAC,GAAG,OAAO;EACvD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,OAAO,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;CAC9D,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/config/dist/lib/neon-api.d.ts

@@ -0,0 +1,375 @@
+import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from "./types.js";
+
+//#region ../config/dist/lib/neon-api.d.ts
+
+//#region src/lib/neon-api.d.ts
+/**
+ * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream
+ * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream
+ * shape — keeping the surface narrow makes the in-memory fake practical to maintain.
+ */
+interface NeonProjectSnapshot {
+  id: string;
+  name: string;
+  regionId: string;
+  pgVersion: number;
+  orgId?: string;
+  defaultEndpointSettings?: ComputeSettings;
+}
+interface NeonBranchSnapshot {
+  id: string;
+  name: string;
+  parentId?: string;
+  isDefault: boolean;
+  /** Whether the branch is marked protected on Neon. */
+  protected: boolean;
+  expiresAt?: string;
+}
+interface NeonEndpointSnapshot {
+  id: string;
+  branchId: string;
+  type: "read_only" | "read_write";
+  autoscalingLimitMinCu: ComputeSettings["autoscalingLimitMinCu"];
+  autoscalingLimitMaxCu: ComputeSettings["autoscalingLimitMaxCu"];
+  suspendTimeout: ComputeSettings["suspendTimeout"];
+}
+interface CreateProjectInput {
+  name: string;
+  regionId: string;
+  pgVersion?: number;
+  orgId?: string;
+  defaultEndpointSettings?: ComputeSettings;
+  /**
+   * Optional name for the project's auto-created default branch. When omitted, Neon
+   * uses its own default (`main`).
+   */
+  defaultBranchName?: string;
+}
+interface CreateBranchInput {
+  name: string;
+  parentId?: string;
+  expiresAt?: string;
+  /** When `true`, the branch is created with the `protected` flag set on Neon. */
+  protected?: boolean;
+  computeSettings?: ComputeSettings;
+}
+interface UpdateBranchInput {
+  name?: string;
+  expiresAt?: string | null;
+  /** When set, toggles the branch's `protected` flag on Neon. */
+  protected?: boolean;
+}
+/**
+ * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by
+ * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI
+ * with the role's password baked in.
+ */
+interface NeonRoleSnapshot {
+  name: string;
+  branchId: string;
+  /** Whether the role is system-protected (cannot be deleted). */
+  protected: boolean;
+}
+/**
+ * A database on a Neon branch (e.g. `neondb`).
+ */
+interface NeonDatabaseSnapshot {
+  name: string;
+  branchId: string;
+  /** The role that owns the database (one role can own multiple databases). */
+  ownerName: string;
+}
+/**
+ * Bits of a Neon Auth integration. The key fields are optional because the Neon API only
+ * includes them on create / rotate responses; `GET /auth` returns the public fields.
+ */
+interface NeonAuthSnapshot {
+  /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */
+  projectId: string;
+  /** Public client key (`pub_client_key`), only present on create / rotate responses. */
+  publishableClientKey?: string;
+  /** Secret server key (`secret_server_key`), only present on create / rotate responses. */
+  secretServerKey?: string;
+  /** JWKS URL for verifying tokens issued by Neon Auth. */
+  jwksUrl: string;
+  /** Optional base URL of the Neon Auth deployment. */
+  baseUrl?: string;
+}
+/**
+ * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of
+ * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed
+ * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing
+ * when present and ignored when absent.
+ */
+interface NeonDataApiSnapshot {
+  /** REST endpoint URL. */
+  url: string;
+  /** Deployment status (e.g. `"ready"`), when reported. */
+  status?: string;
+  /** Current runtime settings (SubZero only); `null`/absent when not reported. */
+  settings?: DataApiSettings | null;
+}
+/**
+ * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data
+ * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the
+ * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).
+ * `authProvider` is the friendly `"neon"` / `"external"` value (mapped to the API's
+ * `neon_auth` / `external` by the adapter).
+ */
+interface EnableDataApiInput {
+  authProvider?: DataApiAuthProvider;
+  jwksUrl?: string;
+  providerName?: string;
+  jwtAudience?: string;
+  settings?: DataApiSettings;
+}
+/**
+ * A branchable object-storage bucket (Preview). Backed by the Neon Platform
+ * branchable-storage service.
+ */
+interface NeonBucketSnapshot {
+  name: string;
+  accessLevel: BucketAccessLevel;
+}
+/**
+ * S3-compatible connection details for a branch's object storage (Preview) — the
+ * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it
+ * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from
+ * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's
+ * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the
+ * path).
+ */
+interface NeonBranchStorageSnapshot {
+  /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */
+  s3Endpoint: string;
+  /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */
+  region: string;
+  /** Whether the S3 client must use path-style addressing (always `true` today). */
+  forcePathStyle: boolean;
+}
+/**
+ * Input for creating a bucket on a branch.
+ */
+interface CreateBucketInput {
+  name: string;
+  accessLevel?: BucketAccessLevel;
+}
+/**
+ * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:
+ * the immutable `slug`, the display `name`, and the active deployment id when one exists.
+ */
+interface NeonFunctionSnapshot {
+  /** Opaque, stable function identifier. */
+  id: string;
+  /** Branch-unique slug (the invocation path segment). Immutable. */
+  slug: string;
+  /** Free-form display name. */
+  name: string;
+  /** URL at which the function is invoked. */
+  invocationUrl: string;
+  /** Id (platform version number) of the active deployment, when any code is deployed. */
+  activeDeploymentId?: number;
+}
+/**
+ * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the
+ * function source — building it (esbuild + zip) is an imperative step performed by the
+ * caller, not by the {@link NeonApi} adapter.
+ */
+interface DeployFunctionInput {
+  bundle: Uint8Array;
+  runtime: FunctionRuntime;
+  environment: Record<string, string>;
+}
+/**
+ * A function deployment (Preview).
+ */
+interface NeonFunctionDeploymentSnapshot {
+  /** The deployment id (monotonic per function). */
+  id: number;
+  status: "pending" | "building" | "completed" | "failed";
+}
+/**
+ * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`
+ * (`POST .../credentials`, `x-stability-level: beta`):
+ *
+ * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's
+ *   enabled Preview features, never hand-authored).
+ * - `principalType` — `user` (developer/app) or `function` (a deployed function).
+ * - `functionId` — required when `principalType === "function"`.
+ * - `name` — optional free-form label echoed back on the response.
+ */
+interface CreateCredentialInput {
+  scopes: CredentialScope[];
+  principalType: CredentialPrincipalType;
+  functionId?: string;
+  name?: string;
+}
+/**
+ * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API
+ * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly
+ * once** (they are not stored server-side), so the caller must persist them immediately;
+ * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`
+ * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles
+ * as the S3 access-key id.
+ */
+interface NeonCredentialSecret {
+  tokenId: string;
+  tokenIdShort: string;
+  name?: string;
+  /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */
+  apiToken: string;
+  /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */
+  s3SecretAccessKey: string;
+  scopes: CredentialScope[];
+  branchId: string;
+  createdAt: string;
+  /** When the credential expires; absent means it never expires. */
+  expiresAt?: string;
+}
+/**
+ * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by
+ * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.
+ */
+interface NeonCredentialMeta {
+  tokenId: string;
+  tokenIdShort: string;
+  name?: string;
+  scopes: CredentialScope[];
+  principalType: CredentialPrincipalType;
+  functionId?: string;
+  branchId?: string;
+  createdAt: string;
+  lastUsedAt?: string;
+  revokedAt?: string;
+  expiresAt?: string;
+}
+/**
+ * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`
+ * are optional — when omitted, the API uses the project's default branch and that
+ * branch's read-write endpoint, respectively.
+ */
+interface GetConnectionUriInput {
+  branchId?: string;
+  endpointId?: string;
+  databaseName: string;
+  roleName: string;
+  /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */
+  pooled?: boolean;
+}
+/**
+ * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`
+ * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us
+ * inject a real in-memory fake during tests without resorting to module mocks.
+ */
+interface NeonApi {
+  listProjects(filter: {
+    orgId?: string;
+  }): Promise<NeonProjectSnapshot[]>;
+  getProject(projectId: string): Promise<NeonProjectSnapshot>;
+  createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;
+  updateProject(projectId: string, input: {
+    name?: string;
+    defaultEndpointSettings?: ComputeSettings;
+  }): Promise<NeonProjectSnapshot>;
+  listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;
+  createBranch(projectId: string, input: CreateBranchInput): Promise<{
+    branch: NeonBranchSnapshot;
+    endpoints: NeonEndpointSnapshot[];
+  }>;
+  updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;
+  listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;
+  updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;
+  /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */
+  listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;
+  /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */
+  listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;
+  /**
+   * Fetch a Postgres connection URI for the given role + database on a branch.
+   * Returns the same string the Neon Console shows under "Connection Details".
+   */
+  getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{
+    uri: string;
+  }>;
+  /**
+   * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when
+   * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`
+   * namespace can be populated.
+   */
+  getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;
+  /**
+   * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration
+   * is already enabled, the existing snapshot is returned unchanged. Used by
+   * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.
+   */
+  enableNeonAuth(projectId: string, branchId: string, input?: {
+    databaseName?: string;
+  }): Promise<NeonAuthSnapshot>;
+  /**
+   * Fetch the Neon Data API integration attached to a specific branch + database.
+   * Returns `null` when no integration is enabled — used by `fetchEnv` to decide
+   * whether the `env.dataApi` namespace can be populated.
+   */
+  getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;
+  /**
+   * Enable the Neon Data API integration on a specific branch + database. Idempotent:
+   * if an integration is already enabled, the existing snapshot is returned unchanged.
+   * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The
+   * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial
+   * settings; omit it for an all-defaults, Neon-Auth integration.
+   */
+  enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;
+  /**
+   * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration
+   * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only
+   * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at
+   * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.
+   */
+  updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;
+  /** List branchable object-storage buckets visible on a branch. */
+  listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;
+  /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */
+  createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;
+  /** Delete a bucket from a branch. */
+  deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;
+  /**
+   * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,
+   * path-style). Returns `null` when storage is not enabled for the branch (the API's 404
+   * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env
+   * alongside the minted credential's access keys.
+   */
+  getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;
+  /** List functions on a branch. */
+  listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;
+  /** Delete a function (by slug) from a branch. */
+  deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;
+  /**
+   * Deploy a built bundle to a function, creating the function if it does not yet exist —
+   * Neon has no separate create endpoint, so the first deployment to a slug creates the
+   * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)
+   * by the caller and passed in as bytes.
+   */
+  deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;
+  /**
+   * Mint a new scoped service credential on a branch (`POST .../credentials`). The
+   * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`
+   * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the
+   * unified credential for the branch's enabled Preview features (object storage, AI
+   * Gateway, Functions).
+   */
+  createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;
+  /**
+   * List the secret-free metadata for credentials issued on a branch
+   * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)
+   * and to verify a persisted credential still exists / isn't revoked.
+   */
+  listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;
+  /**
+   * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).
+   * Idempotent.
+   */
+  revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;
+}
+//#endregion
+//#endregion
+export { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };
+//# sourceMappingURL=neon-api.d.ts.map

package/dist/config/dist/lib/neon-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon-api.d.ts","names":["BucketAccessLevel","ComputeSettings","CredentialPrincipalType","CredentialScope","DataApiAuthProvider","DataApiSettings","FunctionRuntime","NeonProjectSnapshot","NeonBranchSnapshot","NeonEndpointSnapshot","CreateProjectInput","CreateBranchInput","UpdateBranchInput","NeonRoleSnapshot","NeonDatabaseSnapshot","NeonAuthSnapshot","NeonDataApiSnapshot","EnableDataApiInput","NeonBucketSnapshot","NeonBranchStorageSnapshot","CreateBucketInput","NeonFunctionSnapshot","DeployFunctionInput","Uint8Array","Record","NeonFunctionDeploymentSnapshot","CreateCredentialInput","NeonCredentialSecret","NeonCredentialMeta","GetConnectionUriInput","NeonApi","Promise"],"sources":["../../../../../config/dist/lib/neon-api.d.ts"],"sourcesContent":["import { BucketAccessLevel, ComputeSettings, CredentialPrincipalType, CredentialScope, DataApiAuthProvider, DataApiSettings, FunctionRuntime } from \"./types.js\";\n\n//#region src/lib/neon-api.d.ts\n\n/**\n * Snapshot of a Neon project field set we care about. Maps onto a subset of the upstream\n * `@neondatabase/api-client` `Project` type. We do **not** widen this to the full upstream\n * shape — keeping the surface narrow makes the in-memory fake practical to maintain.\n */\ninterface NeonProjectSnapshot {\n  id: string;\n  name: string;\n  regionId: string;\n  pgVersion: number;\n  orgId?: string;\n  defaultEndpointSettings?: ComputeSettings;\n}\ninterface NeonBranchSnapshot {\n  id: string;\n  name: string;\n  parentId?: string;\n  isDefault: boolean;\n  /** Whether the branch is marked protected on Neon. */\n  protected: boolean;\n  expiresAt?: string;\n}\ninterface NeonEndpointSnapshot {\n  id: string;\n  branchId: string;\n  type: \"read_only\" | \"read_write\";\n  autoscalingLimitMinCu: ComputeSettings[\"autoscalingLimitMinCu\"];\n  autoscalingLimitMaxCu: ComputeSettings[\"autoscalingLimitMaxCu\"];\n  suspendTimeout: ComputeSettings[\"suspendTimeout\"];\n}\ninterface CreateProjectInput {\n  name: string;\n  regionId: string;\n  pgVersion?: number;\n  orgId?: string;\n  defaultEndpointSettings?: ComputeSettings;\n  /**\n   * Optional name for the project's auto-created default branch. When omitted, Neon\n   * uses its own default (`main`).\n   */\n  defaultBranchName?: string;\n}\ninterface CreateBranchInput {\n  name: string;\n  parentId?: string;\n  expiresAt?: string;\n  /** When `true`, the branch is created with the `protected` flag set on Neon. */\n  protected?: boolean;\n  computeSettings?: ComputeSettings;\n}\ninterface UpdateBranchInput {\n  name?: string;\n  expiresAt?: string | null;\n  /** When set, toggles the branch's `protected` flag on Neon. */\n  protected?: boolean;\n}\n/**\n * A role on a Neon branch (e.g. `neondb_owner`). Passwords are never returned by\n * {@link NeonApi.listBranchRoles}; use {@link NeonApi.getConnectionUri} to fetch a URI\n * with the role's password baked in.\n */\ninterface NeonRoleSnapshot {\n  name: string;\n  branchId: string;\n  /** Whether the role is system-protected (cannot be deleted). */\n  protected: boolean;\n}\n/**\n * A database on a Neon branch (e.g. `neondb`).\n */\ninterface NeonDatabaseSnapshot {\n  name: string;\n  branchId: string;\n  /** The role that owns the database (one role can own multiple databases). */\n  ownerName: string;\n}\n/**\n * Bits of a Neon Auth integration. The key fields are optional because the Neon API only\n * includes them on create / rotate responses; `GET /auth` returns the public fields.\n */\ninterface NeonAuthSnapshot {\n  /** The Neon Auth project id (`auth_provider_project_id` on the Neon API). */\n  projectId: string;\n  /** Public client key (`pub_client_key`), only present on create / rotate responses. */\n  publishableClientKey?: string;\n  /** Secret server key (`secret_server_key`), only present on create / rotate responses. */\n  secretServerKey?: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth. */\n  jwksUrl: string;\n  /** Optional base URL of the Neon Auth deployment. */\n  baseUrl?: string;\n}\n/**\n * Public, fetchable bits of a Neon Data API integration on a specific branch — the subset of\n * the Neon API `DataAPIReponse` we model. `settings` is only populated for SubZero-backed\n * integrations (the API returns `null` otherwise), so it is used for settings-drift diffing\n * when present and ignored when absent.\n */\ninterface NeonDataApiSnapshot {\n  /** REST endpoint URL. */\n  url: string;\n  /** Deployment status (e.g. `\"ready\"`), when reported. */\n  status?: string;\n  /** Current runtime settings (SubZero only); `null`/absent when not reported. */\n  settings?: DataApiSettings | null;\n}\n/**\n * Input for {@link NeonApi.enableProjectBranchDataApi} — the create-time wiring for a Data\n * API integration (the subset of the Neon API `DataAPICreateRequest` we expose; the\n * `add_default_grants` / `skip_auth_schema` create flags are intentionally not modeled).\n * `authProvider` is the friendly `\"neon\"` / `\"external\"` value (mapped to the API's\n * `neon_auth` / `external` by the adapter).\n */\ninterface EnableDataApiInput {\n  authProvider?: DataApiAuthProvider;\n  jwksUrl?: string;\n  providerName?: string;\n  jwtAudience?: string;\n  settings?: DataApiSettings;\n}\n/**\n * A branchable object-storage bucket (Preview). Backed by the Neon Platform\n * branchable-storage service.\n */\ninterface NeonBucketSnapshot {\n  name: string;\n  accessLevel: BucketAccessLevel;\n}\n/**\n * S3-compatible connection details for a branch's object storage (Preview) — the\n * `BranchStorage` shape from `GET /projects/{id}/branches/{id}/storage`. Non-secret: it\n * carries the endpoint/region/addressing the S3 SDK needs, while the access keys come from\n * a minted {@link NeonCredentialSecret}. `forcePathStyle` is always `true` today (Neon's\n * wildcard TLS cert puts the branch id in the subdomain, so the bucket must travel in the\n * path).\n */\ninterface NeonBranchStorageSnapshot {\n  /** S3-compatible endpoint URL, e.g. `https://br-….storage.<suffix>`. */\n  s3Endpoint: string;\n  /** AWS region string, normalized server-side (e.g. `us-east-2`, `us-east-1`). */\n  region: string;\n  /** Whether the S3 client must use path-style addressing (always `true` today). */\n  forcePathStyle: boolean;\n}\n/**\n * Input for creating a bucket on a branch.\n */\ninterface CreateBucketInput {\n  name: string;\n  accessLevel?: BucketAccessLevel;\n}\n/**\n * A Neon Function on a branch (Preview). Mirrors the subset of the Functions API we model:\n * the immutable `slug`, the display `name`, and the active deployment id when one exists.\n */\ninterface NeonFunctionSnapshot {\n  /** Opaque, stable function identifier. */\n  id: string;\n  /** Branch-unique slug (the invocation path segment). Immutable. */\n  slug: string;\n  /** Free-form display name. */\n  name: string;\n  /** URL at which the function is invoked. */\n  invocationUrl: string;\n  /** Id (platform version number) of the active deployment, when any code is deployed. */\n  activeDeploymentId?: number;\n}\n/**\n * Input for deploying code to a function. `bundle` is the already-built ZIP archive of the\n * function source — building it (esbuild + zip) is an imperative step performed by the\n * caller, not by the {@link NeonApi} adapter.\n */\ninterface DeployFunctionInput {\n  bundle: Uint8Array;\n  runtime: FunctionRuntime;\n  environment: Record<string, string>;\n}\n/**\n * A function deployment (Preview).\n */\ninterface NeonFunctionDeploymentSnapshot {\n  /** The deployment id (monotonic per function). */\n  id: number;\n  status: \"pending\" | \"building\" | \"completed\" | \"failed\";\n}\n/**\n * Input for {@link NeonApi.createCredential}. Mirrors the Neon API `CreateCredentialRequest`\n * (`POST .../credentials`, `x-stability-level: beta`):\n *\n * - `scopes` — 1–16 capabilities the credential may exercise (derived from the policy's\n *   enabled Preview features, never hand-authored).\n * - `principalType` — `user` (developer/app) or `function` (a deployed function).\n * - `functionId` — required when `principalType === \"function\"`.\n * - `name` — optional free-form label echoed back on the response.\n */\ninterface CreateCredentialInput {\n  scopes: CredentialScope[];\n  principalType: CredentialPrincipalType;\n  functionId?: string;\n  name?: string;\n}\n/**\n * The secret-bearing result of {@link NeonApi.createCredential} — the Neon API\n * `CreateCredentialResponse`. `apiToken` and `s3SecretAccessKey` are returned **exactly\n * once** (they are not stored server-side), so the caller must persist them immediately;\n * they can never be re-fetched (the list endpoint returns metadata only). `tokenIdShort`\n * is the public identifier embedded in `apiToken` (`nt_live_<tokenIdShort>_…`) and doubles\n * as the S3 access-key id.\n */\ninterface NeonCredentialSecret {\n  tokenId: string;\n  tokenIdShort: string;\n  name?: string;\n  /** Bearer token (`nt_live_…`); returned once. Used for AI Gateway / Functions invoke. */\n  apiToken: string;\n  /** 64-char hex S3 secret access key; returned once. Paired with `tokenIdShort` as the access-key id. */\n  s3SecretAccessKey: string;\n  scopes: CredentialScope[];\n  branchId: string;\n  createdAt: string;\n  /** When the credential expires; absent means it never expires. */\n  expiresAt?: string;\n}\n/**\n * Secret-free metadata for an issued credential — the Neon API `CredentialMeta` returned by\n * {@link NeonApi.listCredentials}. Never includes `apiToken` / `s3SecretAccessKey`.\n */\ninterface NeonCredentialMeta {\n  tokenId: string;\n  tokenIdShort: string;\n  name?: string;\n  scopes: CredentialScope[];\n  principalType: CredentialPrincipalType;\n  functionId?: string;\n  branchId?: string;\n  createdAt: string;\n  lastUsedAt?: string;\n  revokedAt?: string;\n  expiresAt?: string;\n}\n/**\n * Parameters accepted by {@link NeonApi.getConnectionUri}. `branchId` and `endpointId`\n * are optional — when omitted, the API uses the project's default branch and that\n * branch's read-write endpoint, respectively.\n */\ninterface GetConnectionUriInput {\n  branchId?: string;\n  endpointId?: string;\n  databaseName: string;\n  roleName: string;\n  /** When `true`, returns the pooled (PgBouncer) URI instead of the direct URI. */\n  pooled?: boolean;\n}\n/**\n * Narrow façade over the Neon management API. `pullConfig`, `pushConfig`, and `fetchEnv`\n * depend on this interface — *not* on `@neondatabase/api-client` directly — which lets us\n * inject a real in-memory fake during tests without resorting to module mocks.\n */\ninterface NeonApi {\n  listProjects(filter: {\n    orgId?: string;\n  }): Promise<NeonProjectSnapshot[]>;\n  getProject(projectId: string): Promise<NeonProjectSnapshot>;\n  createProject(input: CreateProjectInput): Promise<NeonProjectSnapshot>;\n  updateProject(projectId: string, input: {\n    name?: string;\n    defaultEndpointSettings?: ComputeSettings;\n  }): Promise<NeonProjectSnapshot>;\n  listBranches(projectId: string): Promise<NeonBranchSnapshot[]>;\n  createBranch(projectId: string, input: CreateBranchInput): Promise<{\n    branch: NeonBranchSnapshot;\n    endpoints: NeonEndpointSnapshot[];\n  }>;\n  updateBranch(projectId: string, branchId: string, input: UpdateBranchInput): Promise<NeonBranchSnapshot>;\n  listEndpoints(projectId: string): Promise<NeonEndpointSnapshot[]>;\n  updateEndpoint(projectId: string, endpointId: string, settings: ComputeSettings): Promise<NeonEndpointSnapshot>;\n  /** List roles on a branch. Used by {@link fetchEnv} to auto-pick the role when only one exists. */\n  listBranchRoles(projectId: string, branchId: string): Promise<NeonRoleSnapshot[]>;\n  /** List databases on a branch. Used by {@link fetchEnv} to auto-pick the database when only one exists. */\n  listBranchDatabases(projectId: string, branchId: string): Promise<NeonDatabaseSnapshot[]>;\n  /**\n   * Fetch a Postgres connection URI for the given role + database on a branch.\n   * Returns the same string the Neon Console shows under \"Connection Details\".\n   */\n  getConnectionUri(projectId: string, input: GetConnectionUriInput): Promise<{\n    uri: string;\n  }>;\n  /**\n   * Fetch the Neon Auth integration attached to a specific branch. Returns `null` when\n   * no integration is enabled — used by `fetchEnv` to decide whether the `env.auth`\n   * namespace can be populated.\n   */\n  getNeonAuth(projectId: string, branchId: string): Promise<NeonAuthSnapshot | null>;\n  /**\n   * Enable the Neon Auth integration on a specific branch. Idempotent: if an integration\n   * is already enabled, the existing snapshot is returned unchanged. Used by\n   * `pushConfig` and `branch` to honour branch policy `auth: {}` / `auth.enabled: true`.\n   */\n  enableNeonAuth(projectId: string, branchId: string, input?: {\n    databaseName?: string;\n  }): Promise<NeonAuthSnapshot>;\n  /**\n   * Fetch the Neon Data API integration attached to a specific branch + database.\n   * Returns `null` when no integration is enabled — used by `fetchEnv` to decide\n   * whether the `env.dataApi` namespace can be populated.\n   */\n  getNeonDataApi(projectId: string, branchId: string, databaseName: string): Promise<NeonDataApiSnapshot | null>;\n  /**\n   * Enable the Neon Data API integration on a specific branch + database. Idempotent:\n   * if an integration is already enabled, the existing snapshot is returned unchanged.\n   * Used by `pushConfig` to honour branch policy `dataApi: {}` / `dataApi: { … }`. The\n   * optional {@link EnableDataApiInput} carries the create-time auth wiring + initial\n   * settings; omit it for an all-defaults, Neon-Auth integration.\n   */\n  enableProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, input?: EnableDataApiInput): Promise<NeonDataApiSnapshot>;\n  /**\n   * Update the runtime {@link DataApiSettings} of an already-enabled Data API integration\n   * (the Neon API `PATCH .../data-api/{db}`; always refreshes the schema cache). Only\n   * `settings` are mutable post-create — the auth provider / JWKS wiring is fixed at\n   * enable time. Used by `pushConfig` to reconcile settings drift under `updateExisting`.\n   */\n  updateProjectBranchDataApi(projectId: string, branchId: string, databaseName: string, settings: DataApiSettings): Promise<NeonDataApiSnapshot>;\n  /** List branchable object-storage buckets visible on a branch. */\n  listBranchBuckets(projectId: string, branchId: string): Promise<NeonBucketSnapshot[]>;\n  /** Create a bucket on a branch. Used by `pushConfig` to honour `preview.buckets`. */\n  createBranchBucket(projectId: string, branchId: string, input: CreateBucketInput): Promise<NeonBucketSnapshot>;\n  /** Delete a bucket from a branch. */\n  deleteBranchBucket(projectId: string, branchId: string, bucketName: string): Promise<void>;\n  /**\n   * Fetch the branch's S3-compatible object-storage connection details (endpoint, region,\n   * path-style). Returns `null` when storage is not enabled for the branch (the API's 404\n   * `BranchStorageNotEnabled`). Used by `fetchEnv` to populate the `AWS_*` storage env\n   * alongside the minted credential's access keys.\n   */\n  getProjectBranchStorage(projectId: string, branchId: string): Promise<NeonBranchStorageSnapshot | null>;\n  /** List functions on a branch. */\n  listBranchFunctions(projectId: string, branchId: string): Promise<NeonFunctionSnapshot[]>;\n  /** Delete a function (by slug) from a branch. */\n  deleteBranchFunction(projectId: string, branchId: string, slug: string): Promise<void>;\n  /**\n   * Deploy a built bundle to a function, creating the function if it does not yet exist —\n   * Neon has no separate create endpoint, so the first deployment to a slug creates the\n   * function. The newest deployment becomes active. The `bundle` is built (esbuild + zip)\n   * by the caller and passed in as bytes.\n   */\n  deployBranchFunction(projectId: string, branchId: string, slug: string, input: DeployFunctionInput): Promise<NeonFunctionDeploymentSnapshot>;\n  /**\n   * Mint a new scoped service credential on a branch (`POST .../credentials`). The\n   * returned {@link NeonCredentialSecret} carries `apiToken` + `s3SecretAccessKey`\n   * **once** — persist them immediately. Used by `fetchEnv` / `env pull` to issue the\n   * unified credential for the branch's enabled Preview features (object storage, AI\n   * Gateway, Functions).\n   */\n  createCredential(projectId: string, branchId: string, input: CreateCredentialInput): Promise<NeonCredentialSecret>;\n  /**\n   * List the secret-free metadata for credentials issued on a branch\n   * (`GET .../credentials`). Used to report issued credentials (e.g. `config status`)\n   * and to verify a persisted credential still exists / isn't revoked.\n   */\n  listCredentials(projectId: string, branchId: string): Promise<NeonCredentialMeta[]>;\n  /**\n   * Revoke (soft-delete) a credential by its `tokenId` (`DELETE .../credentials/{id}`).\n   * Idempotent.\n   */\n  revokeCredential(projectId: string, branchId: string, tokenId: string): Promise<void>;\n}\n//#endregion\nexport { CreateBranchInput, CreateBucketInput, CreateCredentialInput, CreateProjectInput, DeployFunctionInput, EnableDataApiInput, GetConnectionUriInput, NeonApi, NeonAuthSnapshot, NeonBranchSnapshot, NeonBranchStorageSnapshot, NeonBucketSnapshot, NeonCredentialMeta, NeonCredentialSecret, NeonDataApiSnapshot, NeonDatabaseSnapshot, NeonEndpointSnapshot, NeonFunctionDeploymentSnapshot, NeonFunctionSnapshot, NeonProjectSnapshot, NeonRoleSnapshot, UpdateBranchInput };\n//# sourceMappingURL=neon-api.d.ts.map"],"mappings":";;;;;AAe2C;AAEf;;;;UARlBO,mBAAAA,CAuBQN;EAAe,EAAA,EAAA,MAAA;EAAA,IAEvBS,EAAAA,MAAAA;EAKiC,QAOjCC,EAAAA,MAAAA;EAMyB,SAEzBC,EAAAA,MAAAA;EAAiB,KAWjBC,CAAAA,EAAAA,MAAAA;EAAgB,uBAShBC,CAAAA,EA3DkBb,eA2DE;AAAA;AAUJ,UAnEhBO,kBAAAA,CAqFmB;EAMD,EASlBS,EAAAA,MAAAA;EAAkB,IAAA,EAAA,MAAA;UACXb,CAAAA,EAAAA,MAAAA;WAIJC,EAAAA,OAAAA;EAAe;EAAA,SAMlBa,EAAAA,OAAAA;EAEsB,SAUtBC,CAAAA,EAAAA,MAAAA;AAAyB;AAaF,UA/HvBV,oBAAAA,CAqIoB;EAAA,EAiBpBa,EAAAA,MAAAA;EAAmB,QAAA,EAAA,MAAA;QACnBC,WAAAA,GAAAA,YAAAA;uBACCjB,EApJcL,eAoJdK,CAAAA,uBAAAA,CAAAA;uBACIkB,EApJUvB,eAoJVuB,CAAAA,uBAAAA,CAAAA;EAAM,cAAA,EAnJHvB,eAmJG,CAAA,gBAAA,CAAA;AAAA;AAKmB,UAtJ9BS,kBAAAA,CAqKqB;EAAA,IAAA,EAAA,MAAA;UACrBP,EAAAA,MAAAA;WACOD,CAAAA,EAAAA,MAAAA;EAAuB,KAAA,CAAA,EAAA,MAAA;EAAA,uBAY9ByB,CAAAA,EA9KkB1B,eAsLlBE;EAAe;;;;EAee,iBAAA,CAAA,EAAA,MAAA;AAAA;AAaT,UA3MrBQ,iBAAAA,CAwNO;EAAA,IAAA,EAAA,MAAA;UAGHJ,CAAAA,EAAAA,MAAAA;WAARwB,CAAAA,EAAAA,MAAAA;;WAC2BA,CAAAA,EAAAA,OAAAA;iBACVrB,CAAAA,EAvNHT,eAuNGS;;UArNbE,iBAAAA,CAqNkCmB;OAGd9B,EAAAA,MAAAA;WAChBM,CAAAA,EAAAA,MAAAA,GAAAA,IAAAA;;WAC6BC,CAAAA,EAAAA,OAAAA;;;;;;;UA/MjCK,gBAAAA,CAoN6EL;QAARuB,MAAAA;UACnCtB,EAAAA,MAAAA;;WACsBR,EAAAA,OAAAA;;;;;UA7MxDa,oBAAAA,CAiN0DA;QAARiB,MAAAA;UAKfF,EAAAA,MAAAA;;WAQed,EAAAA,MAAAA;;;;;;UApNlDA,gBAAAA,CA0OsFE;;WAAqBc,EAAAA,MAAAA;;sBAOOf,CAAAA,EAAAA,MAAAA;;iBAE1DE,CAAAA,EAAAA,MAAAA;;SAEDE,EAAAA,MAAAA;;SAAoBW,CAAAA,EAAAA,MAAAA;;;;;;;;UAnO3Ef,mBAAAA,CAuPqGS;;OAQhDC,MAAAA;;QAAwBK,CAAAA,EAAAA,MAAAA;;UAM/BA,CAAAA,EA/P3C1B,eA+P2C0B,GAAAA,IAAAA;;AAKyB;;;;;;;UA3PvEd,kBAAAA;iBACOb;;;;aAIJC;;;;;;UAMHa,kBAAAA;;eAEKlB;;;;;;;;;;UAULmB,yBAAAA;;;;;;;;;;;UAWAC,iBAAAA;;gBAEMpB;;;;;;UAMNqB,oBAAAA;;;;;;;;;;;;;;;;;UAiBAC,mBAAAA;UACAC;WACCjB;eACIkB;;;;;UAKLC,8BAAAA;;;;;;;;;;;;;;;UAeAC,qBAAAA;UACAvB;iBACOD;;;;;;;;;;;;UAYPyB,oBAAAA;;;;;;;;UAQAxB;;;;;;;;;;UAUAyB,kBAAAA;;;;UAIAzB;iBACOD;;;;;;;;;;;;;UAaP2B,qBAAAA;;;;;;;;;;;;;UAaAC,OAAAA;;;MAGJC,QAAQxB;iCACmBwB,QAAQxB;uBAClBG,qBAAqBqB,QAAQxB;;;8BAGtBN;MACxB8B,QAAQxB;mCACqBwB,QAAQvB;yCACFG,oBAAoBoB;YACjDvB;eACGC;;2DAE4CG,oBAAoBmB,QAAQvB;oCACnDuB,QAAQtB;kEACsBR,kBAAkB8B,QAAQtB;;wDAEpCsB,QAAQlB;;4DAEJkB,QAAQjB;;;;;6CAKvBe,wBAAwBE;;;;;;;;oDAQjBA,QAAQhB;;;;;;;;MAQtDgB,QAAQhB;;;;;;6EAM+DgB,QAAQf;;;;;;;;gGAQWC,qBAAqBc,QAAQf;;;;;;;kGAO3BX,kBAAkB0B,QAAQf;;0DAElEe,QAAQb;;iEAEDE,oBAAoBW,QAAQb;;+EAEda;;;;;;;gEAOfA,QAAQZ;;4DAEZY,QAAQV;;2EAEOU;;;;;;;iFAOMT,sBAAsBS,QAAQN;;;;;;;;+DAQhDC,wBAAwBK,QAAQJ;;;;;;wDAMvCI,QAAQH;;;;;0EAKUG"}