@neondatabase/env 1.0.0 → 1.0.1

package/dist/lib/cli/resolve-context.js

@@ -1,88 +0,0 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { homedir } from "node:os";
-//#region src/lib/cli/resolve-context.ts
-/**
-* Resolve `projectId` and `branch` for a CLI invocation. Precedence (each wins over the
-* next): explicit flag → `NEON_*` env var → `.neon[/project.json]` walked up from `cwd`.
-*
-* Returns the resolved values plus a list of human-readable reasons for any field that
-* could not be resolved (so the caller can render one combined error).
-*/
-function resolveContext(options) {
-	const env = options.env ?? process.env;
-	const file = findNeonFile(options.cwd);
-	const projectId = nonEmpty(options.projectId) ?? nonEmpty(env.NEON_PROJECT_ID) ?? file?.projectId;
-	const branch = nonEmpty(options.branch) ?? nonEmpty(env.NEON_BRANCH) ?? nonEmpty(env.NEON_BRANCH_ID) ?? file?.branch;
-	const missing = [];
-	if (!projectId) missing.push("project id — pass `--project-id`, set `NEON_PROJECT_ID`, or add `projectId` to `.neon` (run `npx neon link`).");
-	if (!branch) missing.push("branch — pass `--branch`, set `NEON_BRANCH`/`NEON_BRANCH_ID`, or add `branch` to `.neon` (run `npx neon link` / `neon checkout <branch>`).");
-	if (!projectId || !branch) return {
-		ok: false,
-		missing
-	};
-	return {
-		ok: true,
-		context: {
-			projectId,
-			branch
-		}
-	};
-}
-/**
-* Walk up from `cwd` looking for `.neon/project.json` (preferred) or `.neon` (neonctl
-* convention). Stops at the first `.git` directory or the home directory. Read-only.
-*/
-function findNeonFile(cwd) {
-	let current = resolve(cwd);
-	const stop = resolve(homedir());
-	let lastSeen = null;
-	while (true) {
-		const parsed = readNeonFileAt(resolve(current, ".neon", "project.json")) ?? readNeonFileAt(resolve(current, ".neon"));
-		if (parsed) return parsed;
-		if (current === stop) return null;
-		if (existsSync(resolve(current, ".git"))) return null;
-		const parent = dirname(current);
-		if (parent === current || parent === lastSeen) return null;
-		lastSeen = current;
-		current = parent;
-	}
-}
-function readNeonFileAt(path) {
-	if (!isFile(path)) return null;
-	let raw;
-	try {
-		raw = readFileSync(path, "utf-8");
-	} catch {
-		return null;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(raw);
-	} catch {
-		return null;
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const obj = parsed;
-	const out = {};
-	if (typeof obj.projectId === "string" && obj.projectId !== "") out.projectId = obj.projectId;
-	const branch = typeof obj.branch === "string" && obj.branch !== "" ? obj.branch : typeof obj.branchId === "string" && obj.branchId !== "" ? obj.branchId : void 0;
-	if (branch) out.branch = branch;
-	return out;
-}
-function isFile(path) {
-	try {
-		return statSync(path).isFile();
-	} catch {
-		return false;
-	}
-}
-function nonEmpty(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-//#endregion
-export { resolveContext };
-
-//# sourceMappingURL=resolve-context.js.map

package/dist/lib/cli/resolve-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-context.js","names":[],"sources":["../../../src/lib/cli/resolve-context.ts"],"sourcesContent":["import { existsSync, readFileSync, statSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\n\n/**\n * Resolved project + branch context for the `neon-env` CLI. The CLI owns this resolution\n * (flags → `NEON_*` env → `.neon[/project.json]` file) so the `@neon/env` library\n * functions can stay filesystem- and env-agnostic.\n */\nexport interface ResolvedContext {\n\tprojectId: string;\n\t/** Branch ref — a name (preferred for readability) or an id (`br-…`). */\n\tbranch: string;\n}\n\nexport interface ResolveContextOptions {\n\tprojectId?: string;\n\tbranch?: string;\n\tcwd: string;\n\tenv?: NodeJS.ProcessEnv;\n}\n\n/**\n * Resolve `projectId` and `branch` for a CLI invocation. Precedence (each wins over the\n * next): explicit flag → `NEON_*` env var → `.neon[/project.json]` walked up from `cwd`.\n *\n * Returns the resolved values plus a list of human-readable reasons for any field that\n * could not be resolved (so the caller can render one combined error).\n */\nexport function resolveContext(\n\toptions: ResolveContextOptions,\n): { ok: true; context: ResolvedContext } | { ok: false; missing: string[] } {\n\tconst env = options.env ?? process.env;\n\tconst file = findNeonFile(options.cwd);\n\n\tconst projectId =\n\t\tnonEmpty(options.projectId) ??\n\t\tnonEmpty(env.NEON_PROJECT_ID) ??\n\t\tfile?.projectId;\n\n\t// A branch ref — name (preferred) or id. `NEON_BRANCH` carries the name; `NEON_BRANCH_ID`\n\t// is the legacy id-only var. The `.neon` file pins `branch` (name) via `neonctl link`,\n\t// with legacy `branchId` still honored. fetchEnv resolves either form by name or id.\n\tconst branch =\n\t\tnonEmpty(options.branch) ??\n\t\tnonEmpty(env.NEON_BRANCH) ??\n\t\tnonEmpty(env.NEON_BRANCH_ID) ??\n\t\tfile?.branch;\n\n\tconst missing: string[] = [];\n\tif (!projectId) {\n\t\tmissing.push(\n\t\t\t\"project id — pass `--project-id`, set `NEON_PROJECT_ID`, or add `projectId` to `.neon` (run `npx neon link`).\",\n\t\t);\n\t}\n\tif (!branch) {\n\t\tmissing.push(\n\t\t\t\"branch — pass `--branch`, set `NEON_BRANCH`/`NEON_BRANCH_ID`, or add `branch` to `.neon` (run `npx neon link` / `neon checkout <branch>`).\",\n\t\t);\n\t}\n\tif (!projectId || !branch) return { ok: false, missing };\n\n\treturn {\n\t\tok: true,\n\t\tcontext: { projectId, branch },\n\t};\n}\n\ninterface NeonFile {\n\tprojectId?: string;\n\t/** Branch ref — name (preferred) or id. Reads `branch`, falling back to legacy `branchId`. */\n\tbranch?: string;\n}\n\n/**\n * Walk up from `cwd` looking for `.neon/project.json` (preferred) or `.neon` (neonctl\n * convention). Stops at the first `.git` directory or the home directory. Read-only.\n */\nfunction findNeonFile(cwd: string): NeonFile | null {\n\tlet current = resolve(cwd);\n\tconst stop = resolve(homedir());\n\tlet lastSeen: string | null = null;\n\n\twhile (true) {\n\t\tconst parsed =\n\t\t\treadNeonFileAt(resolve(current, \".neon\", \"project.json\")) ??\n\t\t\treadNeonFileAt(resolve(current, \".neon\"));\n\t\tif (parsed) return parsed;\n\n\t\tif (current === stop) return null;\n\t\tif (existsSync(resolve(current, \".git\"))) return null;\n\n\t\tconst parent = dirname(current);\n\t\tif (parent === current || parent === lastSeen) return null;\n\t\tlastSeen = current;\n\t\tcurrent = parent;\n\t}\n}\n\nfunction readNeonFileAt(path: string): NeonFile | null {\n\tif (!isFile(path)) return null;\n\tlet raw: string;\n\ttry {\n\t\traw = readFileSync(path, \"utf-8\");\n\t} catch {\n\t\treturn null;\n\t}\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\treturn null;\n\t}\n\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed))\n\t\treturn null;\n\tconst obj = parsed as Record<string, unknown>;\n\tconst out: NeonFile = {};\n\tif (typeof obj.projectId === \"string\" && obj.projectId !== \"\")\n\t\tout.projectId = obj.projectId;\n\t// Prefer the `branch` field (name or id, written by `neonctl link`); fall back to the\n\t// legacy id-only `branchId`.\n\tconst branch =\n\t\ttypeof obj.branch === \"string\" && obj.branch !== \"\"\n\t\t\t? obj.branch\n\t\t\t: typeof obj.branchId === \"string\" && obj.branchId !== \"\"\n\t\t\t\t? obj.branchId\n\t\t\t\t: undefined;\n\tif (branch) out.branch = branch;\n\treturn out;\n}\n\nfunction isFile(path: string): boolean {\n\ttry {\n\t\treturn statSync(path).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst trimmed = value.trim();\n\treturn trimmed === \"\" ? undefined : trimmed;\n}\n"],"mappings":";;;;;;;;;;;AA6BA,SAAgB,eACf,SAC4E;CAC5E,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,OAAO,aAAa,QAAQ,GAAG;CAErC,MAAM,YACL,SAAS,QAAQ,SAAS,KAC1B,SAAS,IAAI,eAAe,KAC5B,MAAM;CAKP,MAAM,SACL,SAAS,QAAQ,MAAM,KACvB,SAAS,IAAI,WAAW,KACxB,SAAS,IAAI,cAAc,KAC3B,MAAM;CAEP,MAAM,UAAoB,CAAC;CAC3B,IAAI,CAAC,WACJ,QAAQ,KACP,+GACD;CAED,IAAI,CAAC,QACJ,QAAQ,KACP,4IACD;CAED,IAAI,CAAC,aAAa,CAAC,QAAQ,OAAO;EAAE,IAAI;EAAO;CAAQ;CAEvD,OAAO;EACN,IAAI;EACJ,SAAS;GAAE;GAAW;EAAO;CAC9B;AACD;;;;;AAYA,SAAS,aAAa,KAA8B;CACnD,IAAI,UAAU,QAAQ,GAAG;CACzB,MAAM,OAAO,QAAQ,QAAQ,CAAC;CAC9B,IAAI,WAA0B;CAE9B,OAAO,MAAM;EACZ,MAAM,SACL,eAAe,QAAQ,SAAS,SAAS,cAAc,CAAC,KACxD,eAAe,QAAQ,SAAS,OAAO,CAAC;EACzC,IAAI,QAAQ,OAAO;EAEnB,IAAI,YAAY,MAAM,OAAO;EAC7B,IAAI,WAAW,QAAQ,SAAS,MAAM,CAAC,GAAG,OAAO;EAEjD,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,WAAW,WAAW,UAAU,OAAO;EACtD,WAAW;EACX,UAAU;CACX;AACD;AAEA,SAAS,eAAe,MAA+B;CACtD,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO;CAC1B,IAAI;CACJ,IAAI;EACH,MAAM,aAAa,MAAM,OAAO;CACjC,QAAQ;EACP,OAAO;CACR;CACA,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,GAAG;CACxB,QAAQ;EACP,OAAO;CACR;CACA,IAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GACxE,OAAO;CACR,MAAM,MAAM;CACZ,MAAM,MAAgB,CAAC;CACvB,IAAI,OAAO,IAAI,cAAc,YAAY,IAAI,cAAc,IAC1D,IAAI,YAAY,IAAI;CAGrB,MAAM,SACL,OAAO,IAAI,WAAW,YAAY,IAAI,WAAW,KAC9C,IAAI,SACJ,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,KACpD,IAAI,WACJ,KAAA;CACL,IAAI,QAAQ,IAAI,SAAS;CACzB,OAAO;AACR;AAEA,SAAS,OAAO,MAAuB;CACtC,IAAI;EACH,OAAO,SAAS,IAAI,CAAC,CAAC,OAAO;CAC9B,QAAQ;EACP,OAAO;CACR;AACD;AAEA,SAAS,SAAS,OAA+C;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,YAAY,KAAK,KAAA,IAAY;AACrC"}

package/dist/lib/parse-env.d.ts

@@ -1,95 +0,0 @@
-import { Config } from "../config/dist/lib/types.js";
-import "../config/dist/v1.js";
-import { FilteredNeonEnv, NeonEnv, SelectableEnvKey } from "../_shared/env-core/env.js";
-
-//#region src/lib/parse-env.d.ts
-
-/** The static `preview.functions` record of a config, or an empty record when absent. */
-type PreviewFunctionsOf<C extends Config> = NonNullable<C["preview"]> extends {
-  functions: infer F;
-} ? F : Record<never, never>;
-/** The declared function slugs of a config (record keys), as a string union. */
-type FunctionSlugOf<C extends Config> = Extract<keyof PreviewFunctionsOf<C>, string>;
-/**
- * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when
- * the policy declares no functions at all. Without it the argument's expected type is the bare
- * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '"x"' is not
- * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the
- * editor offers it as the single completion, so the empty completion list is explained rather
- * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.
- */
-type NoFunctionScopeHint = "this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env";
-/**
- * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug
- * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no
- * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes
- * the returned `function` namespace exact — it stays the one function's env keys instead of
- * widening to every declared function's.
- */
-type FunctionScopeField<C extends Config, S extends string> = [FunctionSlugOf<C>] extends [never] ? NoFunctionScopeHint : S;
-/** The declared env-var keys of one function `S`, as a string union. */
-type FunctionEnvKeysOf<C extends Config, S extends string> = S extends keyof PreviewFunctionsOf<C> ? NonNullable<PreviewFunctionsOf<C>[S]> extends {
-  env: infer E;
-} ? Extract<keyof E, string> : never : never;
-/**
- * The extra `function` namespace added to `parseEnv`'s result when called with a function
- * slug scope: the declared env-var keys for that function, each resolved to a `string`.
- */
-type NeonFunctionEnv<C extends Config, S extends string> = {
-  function: Record<FunctionEnvKeysOf<C, S>, string>;
-};
-/**
- * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates
- * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the
- * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed
- * `process.env.DATABASE_URL` lookups.
- *
- * Designed for the **"env-vars-already-injected"** path:
- * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.
- * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.
- * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.
- *
- * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now
- * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without
- * evaluating the per-branch closure.
- *
- * The second argument is a **scope** or a **key filter**:
- * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the
- *   full `{ postgres, auth?, dataApi?, … }` the policy enables.
- * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are
- *   running inside that function. Returns the same branch secrets **plus** a typed
- *   `function` namespace with the function's declared env-var keys. The slug autocompletes
- *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.
- * - an **array of OS-level env-var keys** (e.g. `["DATABASE_URL", "NEON_AUTH_BASE_URL"]`) —
- *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced
- *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only
- *   pick vars the policy actually enables. Use this when a process needs just a subset (a
- *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't
- *   want `parseEnv` to throw over vars you never use.
- *
- * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env
- * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.
- *
- * ```ts
- * import config from "../neon";
- * import { parseEnv } from "@neon/env";
- *
- * // External (app / build):
- * const env = parseEnv(config);
- * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
- *
- * // Inside the "hello" function:
- * const env = parseEnv(config, "hello");
- * env.function.resendApiKey; // typed from hello's declared env keys
- *
- * // Filtered: only enforce + return the pooled URL.
- * const { postgres } = parseEnv(config, ["DATABASE_URL"]);
- * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent
- * ```
- */
-declare function parseEnv<const C extends Config>(config: C): NeonEnv<C>;
-declare function parseEnv<const C extends Config, const S extends FunctionSlugOf<C>>(config: C, scope: FunctionScopeField<C, S>): NeonEnv<C> & NeonFunctionEnv<C, S>;
-declare function parseEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;
-//#endregion
-export { FunctionSlugOf, NeonFunctionEnv, NoFunctionScopeHint, parseEnv };
-//# sourceMappingURL=parse-env.d.ts.map

package/dist/lib/parse-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parse-env.d.ts","names":[],"sources":["../../src/lib/parse-env.ts"],"mappings":";;;;;;AAqCI;AAAM,KALL,kBAKK,CAAA,UALwB,MAKxB,CAAA,GAJT,WAIS,CAJG,CAIH,CAAA,SAAA,CAAA,CAAA,SAAA;EAGE,SAAA,EAAA,KAAc,EAAA;AAAA,CAAA,GAJtB,CAIsB,GAHtB,MAGsB,CAAA,KAAA,EAAA,KAAA,CAAA;AAAW;AACX,KADd,cACc,CAAA,UADW,MACX,CAAA,GADqB,OACrB,CAAA,MAAnB,kBAAmB,CAAA,CAAA,CAAA,EAAA,MAAA,CAAA;AAAnB;AADwC;AAAO;AAetD;AACyK;AASlJ;AAAW;AAClB;AAAf,KAXW,mBAAA,GAWX,uKAAA;AAEE;AACA;AAAC;AAAA;AAGkB;AACX;AAEP;AAAmC,KAVlC,kBAUkC,CAAA,UAVL,MAUK,EAAA,UAAA,MAAA,CAAA,GAAA,CATtC,cASmB,CATJ,CASI,CAAA,CACc,SAAA,CAAA,KAAA,CAAA,GAR/B,mBAQ+B,GAP/B,CAO+B;AAAnB;AAAsB,KAJhC,iBAIgC,CAAA,UAH1B,MAG0B,EAAA,UAAA,MAAA,CAAA,GADjC,CACiC,SAAA,MADjB,kBACiB,CADE,CACF,CAAA,GAAlC,WAAkC,CAAtB,kBAAsB,CAAH,CAAG,CAAA,CAAA,CAAA,CAAA,CAAA,SAAA;EAAlC,GAAA,EAAA,KAAA,EAAA;AACe,CAAA,GAAd,OAAc,CAAA,MAAA,CAAA,EAAA,MAAA,CAAA,GAAA,KAAA,GAAA,KAAA;AAAd;AAAO;AAQX;AAA2B;AAAW,KAA1B,eAA0B,CAAA,UAAA,MAAA,EAAA,UAAA,MAAA,CAAA,GAAA;EACF,QAAA,EAAzB,MAAyB,CAAlB,iBAAkB,CAAA,CAAA,EAAG,CAAH,CAAA,EAAA,MAAA,CAAA;AAAG,CAAA;AAArB;AAAP;AAAM;AAiIjB;AAAwB;AAAiB;AAAgB;AAAY;AAAR;AAAO;AASpE;AAAwB;AACP;AACe;AAAf;AAER;AACkB;AAAG;AAAtB;AACG;AAAR;AAA6B;AAAG;AAAnB;AAAe;AAC/B;AAAwB;AACP;AACiB;AAAjB;AACP;AAAkB;AAAsB;AAAhB;AAAe;;;;;;;;;;;;;;;iBAnBjC,yBAAyB,gBAAgB,IAAI,QAAQ;iBASrD,yBACC,wBACA,eAAe,YAEvB,UACD,mBAAmB,GAAG,KAC3B,QAAQ,KAAK,gBAAgB,GAAG;iBACnB,yBACC,wBACA,iBAAiB,YACxB,kBAAkB,MAAM,gBAAgB"}

package/dist/lib/parse-env.js

@@ -1,198 +0,0 @@
-import { NEON_ENV_VAR_KEYS } from "../_shared/env-core/env.js";
-import { ErrorCode, PlatformError } from "@neon/config/v1";
-import { z } from "zod";
-//#region src/lib/parse-env.ts
-/**
-* `parseEnv` — the synchronous, network-free counterpart to `fetchEnv`: read the Neon env vars
-* already injected into `process.env`, validate them against the policy, and return them in the
-* same namespaced shape.
-*
-* Lives in this package rather than in `shared/env-core` because nothing else needs it. The
-* `neon` CLI resolves env from the API and injects it; it never reads it back. Keeping it here
-* also keeps `zod` out of the shared tree, and so out of every consumer that copies it.
-*/
-/**
-* Per-namespace zod schemas. Each defines exactly the OS-level keys parsed from
-* `process.env` for its namespace. Keep in sync with {@link NEON_ENV_VAR_KEYS}.
-*
-* `z.string().url()` would be tighter than `min(1)` but Postgres URIs that include
-* URL-illegal characters in the password (rare but legal in Neon's connection-string
-* format) fail the WHATWG `URL` parse, so we settle for "non-empty string".
-*/
-const postgresEnvSchema = z.object({
-	DATABASE_URL: z.string({ message: "DATABASE_URL is missing" }).min(1, "DATABASE_URL must not be empty"),
-	DATABASE_URL_UNPOOLED: z.string({ message: "DATABASE_URL_UNPOOLED is missing" }).min(1, "DATABASE_URL_UNPOOLED must not be empty")
-});
-const authEnvSchema = z.object({
-	NEON_AUTH_BASE_URL: z.string({ message: "NEON_AUTH_BASE_URL is missing" }).min(1, "NEON_AUTH_BASE_URL must not be empty"),
-	NEON_AUTH_JWKS_URL: z.string({ message: "NEON_AUTH_JWKS_URL is missing" }).min(1, "NEON_AUTH_JWKS_URL must not be empty")
-});
-const dataApiEnvSchema = z.object({ NEON_DATA_API_URL: z.string({ message: "NEON_DATA_API_URL is missing" }).min(1, "NEON_DATA_API_URL must not be empty") });
-const storageEnvSchema = z.object({
-	AWS_ACCESS_KEY_ID: z.string({ message: "AWS_ACCESS_KEY_ID is missing" }).min(1, "AWS_ACCESS_KEY_ID must not be empty"),
-	AWS_SECRET_ACCESS_KEY: z.string({ message: "AWS_SECRET_ACCESS_KEY is missing" }).min(1, "AWS_SECRET_ACCESS_KEY must not be empty"),
-	AWS_ENDPOINT_URL_S3: z.string({ message: "AWS_ENDPOINT_URL_S3 is missing" }).min(1, "AWS_ENDPOINT_URL_S3 must not be empty"),
-	AWS_REGION: z.string({ message: "AWS_REGION is missing" }).min(1, "AWS_REGION must not be empty")
-});
-const aiGatewayEnvSchema = z.object({
-	NEON_AI_GATEWAY_TOKEN: z.string({ message: "NEON_AI_GATEWAY_TOKEN is missing" }).min(1, "NEON_AI_GATEWAY_TOKEN must not be empty"),
-	NEON_AI_GATEWAY_BASE_URL: z.string({ message: "NEON_AI_GATEWAY_BASE_URL is missing" }).min(1, "NEON_AI_GATEWAY_BASE_URL must not be empty")
-});
-/** Whether a **static** policy declares object storage (`preview.buckets`). No network. */
-function configWantsStorage(config) {
-	return Object.keys(config.preview?.buckets ?? {}).length > 0;
-}
-/** Whether a **static** policy enables the AI Gateway (`preview.aiGateway`). No network. */
-function configWantsAiGateway(config) {
-	return isServiceEnabledInput(config.preview?.aiGateway);
-}
-/** Static-toggle helper mirroring `config`'s `isServiceEnabled` for the env reader. */
-function isServiceEnabledInput(toggle) {
-	if (toggle === void 0) return false;
-	if (typeof toggle === "boolean") return toggle;
-	return toggle.enabled !== false;
-}
-function parseEnv(config, scopeOrKeys) {
-	const source = process.env;
-	if (Array.isArray(scopeOrKeys)) return parseFilteredEnv(source, scopeOrKeys);
-	const scope = typeof scopeOrKeys === "string" ? scopeOrKeys : void 0;
-	const issues = [];
-	const result = {};
-	const pg = postgresEnvSchema.safeParse({
-		DATABASE_URL: source.DATABASE_URL,
-		DATABASE_URL_UNPOOLED: source.DATABASE_URL_UNPOOLED
-	});
-	if (pg.success) result.postgres = {
-		databaseUrl: pg.data.DATABASE_URL,
-		databaseUrlUnpooled: pg.data.DATABASE_URL_UNPOOLED
-	};
-	else for (const issue of pg.error.issues) issues.push(issue.message);
-	const branchName = source[NEON_ENV_VAR_KEYS.branch.name];
-	if (branchName !== void 0 && branchName !== "") result.branch = { name: branchName };
-	if (isServiceEnabledInput(config.auth)) {
-		const auth = authEnvSchema.safeParse({
-			NEON_AUTH_BASE_URL: source.NEON_AUTH_BASE_URL,
-			NEON_AUTH_JWKS_URL: source.NEON_AUTH_JWKS_URL
-		});
-		if (auth.success) result.auth = {
-			baseUrl: auth.data.NEON_AUTH_BASE_URL,
-			jwksUrl: auth.data.NEON_AUTH_JWKS_URL
-		};
-		else for (const issue of auth.error.issues) issues.push(issue.message);
-	}
-	if (isServiceEnabledInput(config.dataApi)) {
-		const dataApi = dataApiEnvSchema.safeParse({ NEON_DATA_API_URL: source.NEON_DATA_API_URL });
-		if (dataApi.success) result.dataApi = { url: dataApi.data.NEON_DATA_API_URL };
-		else for (const issue of dataApi.error.issues) issues.push(issue.message);
-	}
-	if (configWantsStorage(config)) {
-		const storage = storageEnvSchema.safeParse({
-			AWS_ACCESS_KEY_ID: source.AWS_ACCESS_KEY_ID,
-			AWS_SECRET_ACCESS_KEY: source.AWS_SECRET_ACCESS_KEY,
-			AWS_ENDPOINT_URL_S3: source.AWS_ENDPOINT_URL_S3,
-			AWS_REGION: source.AWS_REGION
-		});
-		if (storage.success) result.storage = {
-			accessKeyId: storage.data.AWS_ACCESS_KEY_ID,
-			secretAccessKey: storage.data.AWS_SECRET_ACCESS_KEY,
-			endpoint: storage.data.AWS_ENDPOINT_URL_S3,
-			region: storage.data.AWS_REGION
-		};
-		else for (const issue of storage.error.issues) issues.push(issue.message);
-	}
-	if (configWantsAiGateway(config)) {
-		const aiGateway = aiGatewayEnvSchema.safeParse({
-			NEON_AI_GATEWAY_TOKEN: source.NEON_AI_GATEWAY_TOKEN,
-			NEON_AI_GATEWAY_BASE_URL: source.NEON_AI_GATEWAY_BASE_URL
-		});
-		if (aiGateway.success) result.aiGateway = {
-			apiKey: aiGateway.data.NEON_AI_GATEWAY_TOKEN,
-			baseUrl: aiGateway.data.NEON_AI_GATEWAY_BASE_URL
-		};
-		else for (const issue of aiGateway.error.issues) issues.push(issue.message);
-	}
-	if (scope !== void 0) {
-		const fn = config.preview?.functions?.[scope];
-		if (!fn) throw new PlatformError(ErrorCode.EnvNotInjected, [`parseEnv: no function "${scope}" is declared in this policy's preview.functions.`, "Pass a declared function slug (or omit the scope to read external env)."].join("\n"), { details: { scope } });
-		const envOut = {};
-		for (const key of Object.keys(fn.env ?? {})) {
-			const value = source[key];
-			if (value === void 0) issues.push(`${key} is missing (function "${scope}")`);
-			else envOut[key] = value;
-		}
-		result.function = envOut;
-	}
-	if (issues.length > 0) throw new PlatformError(ErrorCode.EnvNotInjected, [
-		"parseEnv: the required Neon env variables are not present in process.env.",
-		...issues.map((i) => `  - ${i}`),
-		"Inject them via one of:",
-		"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)",
-		"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)",
-		"  - for the `function` namespace: deploy the function (`neon deploy` / `config apply`) so its env is uploaded.",
-		"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O."
-	].join("\n"), { details: { missing: issues } });
-	return result;
-}
-/**
-* Runtime reverse map for filtered `parseEnv`: OS-level env-var key → `[namespace, property]`
-* in the {@link NeonEnv} shape. The compile-time mirror is {@link EnvKeysByNamespace} /
-* {@link EnvKeyToProp}; keep all three in sync. Only input vars appear (no output-only
-* aliases).
-*/
-const FILTERABLE_ENV_KEYS = {
-	DATABASE_URL: ["postgres", "databaseUrl"],
-	DATABASE_URL_UNPOOLED: ["postgres", "databaseUrlUnpooled"],
-	NEON_BRANCH: ["branch", "name"],
-	NEON_AUTH_BASE_URL: ["auth", "baseUrl"],
-	NEON_AUTH_JWKS_URL: ["auth", "jwksUrl"],
-	NEON_DATA_API_URL: ["dataApi", "url"],
-	AWS_ACCESS_KEY_ID: ["storage", "accessKeyId"],
-	AWS_SECRET_ACCESS_KEY: ["storage", "secretAccessKey"],
-	AWS_ENDPOINT_URL_S3: ["storage", "endpoint"],
-	AWS_REGION: ["storage", "region"],
-	NEON_AI_GATEWAY_TOKEN: ["aiGateway", "apiKey"],
-	NEON_AI_GATEWAY_BASE_URL: ["aiGateway", "baseUrl"]
-};
-/**
-* Filtered counterpart to the {@link parseEnv} body: validate and return only the explicitly
-* selected OS-level env-var keys, projected back into the narrowed namespaced shape. Unlike
-* the full reader it never consults the policy — the selection alone decides what's required —
-* so vars the caller didn't ask for (e.g. `DATABASE_URL_UNPOOLED`) can be absent without
-* throwing. Mirrors the same non-empty constraint and {@link PlatformError} aggregation.
-*/
-function parseFilteredEnv(source, keys) {
-	const issues = [];
-	const result = {};
-	for (const key of keys) {
-		if (!Object.hasOwn(FILTERABLE_ENV_KEYS, key)) {
-			issues.push(`${key} is not a selectable Neon env variable`);
-			continue;
-		}
-		const value = source[key];
-		if (value === void 0) {
-			issues.push(`${key} is missing`);
-			continue;
-		}
-		if (value === "") {
-			issues.push(`${key} must not be empty`);
-			continue;
-		}
-		const [namespace, property] = FILTERABLE_ENV_KEYS[key];
-		const bucket = result[namespace] ?? {};
-		bucket[property] = value;
-		result[namespace] = bucket;
-	}
-	if (issues.length > 0) throw new PlatformError(ErrorCode.EnvNotInjected, [
-		"parseEnv: the required Neon env variables are not present in process.env.",
-		...issues.map((i) => `  - ${i}`),
-		"Inject them via one of:",
-		"  - `neon dev` / `neon-env run -- <your dev command>` (wraps the command with the vars injected)",
-		"  - your hosting platform's Neon integration (Vercel, Fly, Railway, …)",
-		"Or switch the call to `await fetchEnv(config, …)` if you're in a context that can do async I/O."
-	].join("\n"), { details: { missing: issues } });
-	return result;
-}
-//#endregion
-export { parseEnv };
-
-//# sourceMappingURL=parse-env.js.map