@neondatabase/env 1.0.0 → 1.0.1

package/dist/index.d.ts

@@ -1,3 +1,528 @@
-import { FetchEnvOptions, FilteredNeonEnv, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, fetchEnv, toEntries } from "./_shared/env-core/env.js";
-import { FunctionSlugOf, NeonFunctionEnv, parseEnv } from "./lib/parse-env.js";
-export { type FetchEnvOptions, type FilteredNeonEnv, type FunctionSlugOf, NEON_ENV_VAR_KEYS, type NeonAiGatewayEnv, type NeonAuthEnv, type NeonBranchEnv, type NeonDataApiEnv, type NeonEnv, type NeonFunctionEnv, type NeonPostgresEnv, type NeonStorageEnv, type ResolvedNeonEnv, type SelectableEnvKey, fetchEnv, parseEnv, toEntries };
+import { Config, NeonApi, resolveConfig } from "@neon/config/v1";
+
+//#region ../../internals/env-core/dist/env.d.ts
+
+//#region src/env.d.ts
+declare const NEON_ENV_VAR_KEYS: {
+  /**
+   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
+   * Neon Functions runtime on every branch (including the default) by default. `env pull` /
+   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.
+   */
+  readonly branch: {
+    readonly name: "NEON_BRANCH";
+  };
+  readonly postgres: {
+    readonly databaseUrl: "DATABASE_URL";
+    readonly databaseUrlUnpooled: "DATABASE_URL_UNPOOLED";
+  };
+  readonly auth: {
+    readonly baseUrl: "NEON_AUTH_BASE_URL";
+    readonly jwksUrl: "NEON_AUTH_JWKS_URL";
+  };
+  readonly dataApi: {
+    readonly url: "NEON_DATA_API_URL";
+  };
+  /**
+   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so
+   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.
+   * `region` is injected under the SDK-standard `AWS_REGION`.
+   */
+  readonly storage: {
+    readonly accessKeyId: "AWS_ACCESS_KEY_ID";
+    readonly secretAccessKey: "AWS_SECRET_ACCESS_KEY";
+    readonly endpoint: "AWS_ENDPOINT_URL_S3";
+    readonly region: "AWS_REGION";
+  };
+  /**
+   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions
+   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)
+   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,
+   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the
+   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).
+   */
+  readonly aiGateway: {
+    readonly apiKey: "NEON_AI_GATEWAY_TOKEN";
+    readonly baseUrl: "NEON_AI_GATEWAY_BASE_URL";
+  };
+};
+/**
+ * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch
+ * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was
+ * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /
+ * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).
+ */
+interface NeonBranchEnv {
+  name: string;
+}
+/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */
+interface NeonPostgresEnv {
+  /**
+   * Pooled connection string (via Neon's PgBouncer pooler). The right default for
+   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).
+   */
+  databaseUrl: string;
+  /**
+   * Direct (unpooled) connection string. Use this when you need session-level
+   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions
+   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.
+   */
+  databaseUrlUnpooled: string;
+}
+/**
+ * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`
+ * when the branch policy enables `auth`.
+ *
+ * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and
+ * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live
+ * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /
+ * `NEON_AUTH_JWKS_URL`).
+ */
+interface NeonAuthEnv {
+  baseUrl: string;
+  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */
+  jwksUrl: string;
+}
+/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */
+interface NeonDataApiEnv {
+  url: string;
+}
+/**
+ * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only
+ * when the policy declares `preview.buckets`. Combines a minted branch credential's access
+ * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the
+ * storage gateway authenticates against; `secretAccessKey` = its
+ * `s3_secret_access_key`) with the branch's non-secret connection details
+ * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's
+ * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,
+ * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always
+ * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.
+ */
+interface NeonStorageEnv {
+  accessKeyId: string;
+  secretAccessKey: string;
+  /** S3-compatible endpoint URL for the branch. */
+  endpoint: string;
+  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */
+  region: string;
+}
+/**
+ * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy
+ * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);
+ * `baseUrl` is the bare branch-scoped gateway host
+ * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env
+ * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`
+ * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.
+ */
+interface NeonAiGatewayEnv {
+  apiKey: string;
+  baseUrl: string;
+}
+/**
+ * Empty record alias used as the "false" branch of the conditional namespace adds below.
+ * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,
+ * which biome rejects (it means "any non-null", not "empty object").
+ */
+type NoNamespace = Record<never, never>;
+/**
+ * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a
+ * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution
+ * so a union/`undefined` is checked as one unit:
+ *
+ * - `false` / `{ enabled: false }` / `undefined` → `false`
+ * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`
+ *   (a present toggle defaults to enabled)
+ * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal
+ *   info) → `false`, so an untyped policy yields just `{ postgres }`.
+ */
+type ServiceOn<T> = [T] extends [false] ? false : [T] extends [{
+  enabled: false;
+}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{
+  enabled: true;
+}] ? true : [T] extends [object] ? true : false;
+/** True when `T` has at least one known key; `false` for `{}` / `never`. */
+type HasKeys<T> = [keyof T] extends [never] ? false : true;
+/**
+ * Whether the policy's **static** `preview` block declares at least one object-storage bucket
+ * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.
+ *
+ * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,
+ * `NonNullable<C["preview"]>` is `never`, and without the guard the `extends { … }` probe
+ * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`
+ * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.
+ */
+type HasBuckets<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+  buckets: infer B;
+} ? HasKeys<NonNullable<B>> : false;
+/**
+ * Whether the policy's **static** `preview` block enables the AI Gateway
+ * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.
+ *
+ * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when
+ * a policy has no `preview`, `NonNullable<C["preview"]>` is `never`, and a naked `never` in the
+ * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`
+ * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.
+ */
+type AiGatewayOn<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
+  aiGateway: infer A;
+} ? ServiceOn<NonNullable<A>> : false;
+/**
+ * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the
+ * {@link Config} so the type system knows which optional namespaces are present.
+ *
+ * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /
+ * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct
+ * read of those fields — no union-across-branches, no default-config escape hatch:
+ *
+ * - `postgres` is always present.
+ * - `auth` is added iff `config.auth` is statically enabled.
+ * - `dataApi` is added iff `config.dataApi` is statically enabled.
+ * - `storage` is added iff `config.preview.buckets` declares at least one bucket.
+ * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.
+ */
+type NeonEnv<C extends Config = Config> = {
+  postgres: NeonPostgresEnv;
+  /**
+   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the
+   * var was injected; `fetchEnv` always populates it.
+   */
+  branch?: NeonBranchEnv;
+} & (ServiceOn<NonNullable<C["auth"]>> extends true ? {
+  auth: NeonAuthEnv;
+} : NoNamespace) & (ServiceOn<NonNullable<C["dataApi"]>> extends true ? {
+  dataApi: NeonDataApiEnv;
+} : NoNamespace) & (HasBuckets<C> extends true ? {
+  storage: NeonStorageEnv;
+} : NoNamespace) & (AiGatewayOn<C> extends true ? {
+  aiGateway: NeonAiGatewayEnv;
+} : NoNamespace);
+/**
+ * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the
+ * **input** vars `parseEnv` validates are listed — the output-only aliases in
+ * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they
+ * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with
+ * {@link EnvKeyToProp}.
+ */
+interface EnvKeysByNamespace {
+  postgres: "DATABASE_URL" | "DATABASE_URL_UNPOOLED";
+  branch: "NEON_BRANCH";
+  auth: "NEON_AUTH_BASE_URL" | "NEON_AUTH_JWKS_URL";
+  dataApi: "NEON_DATA_API_URL";
+  storage: "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_ENDPOINT_URL_S3" | "AWS_REGION";
+  aiGateway: "NEON_AI_GATEWAY_TOKEN" | "NEON_AI_GATEWAY_BASE_URL";
+}
+/** The {@link NeonEnv} namespace interface backing each namespace key. */
+interface NamespaceEnv {
+  postgres: NeonPostgresEnv;
+  branch: NeonBranchEnv;
+  auth: NeonAuthEnv;
+  dataApi: NeonDataApiEnv;
+  storage: NeonStorageEnv;
+  aiGateway: NeonAiGatewayEnv;
+}
+/** OS-level env-var key → the camelCase property it sets on its namespace object. */
+interface EnvKeyToProp {
+  DATABASE_URL: "databaseUrl";
+  DATABASE_URL_UNPOOLED: "databaseUrlUnpooled";
+  NEON_BRANCH: "name";
+  NEON_AUTH_BASE_URL: "baseUrl";
+  NEON_AUTH_JWKS_URL: "jwksUrl";
+  NEON_DATA_API_URL: "url";
+  AWS_ACCESS_KEY_ID: "accessKeyId";
+  AWS_SECRET_ACCESS_KEY: "secretAccessKey";
+  AWS_ENDPOINT_URL_S3: "endpoint";
+  AWS_REGION: "region";
+  NEON_AI_GATEWAY_TOKEN: "apiKey";
+  NEON_AI_GATEWAY_BASE_URL: "baseUrl";
+}
+/**
+ * The OS-level env-var keys selectable for a given policy: the union of input vars across
+ * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the
+ * `keys` filter — selecting a var from a namespace the policy does not enable is a type error
+ * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).
+ */
+type SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];
+/**
+ * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced
+ * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no
+ * selected key are dropped, and within a kept namespace only the selected properties survive
+ * — selecting just `["DATABASE_URL"]` yields `{ postgres: { databaseUrl: string } }`, with no
+ * `databaseUrlUnpooled`.
+ *
+ * The policy gating lives on the `parseEnv` overload (which binds `K` to
+ * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare
+ * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops
+ * any namespace whose intersection with the selection is empty (`[…] extends [never]`,
+ * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its
+ * camelCase property and looks the value type up on the canonical namespace interface, so it
+ * stays correct if a field ever stops being a plain `string`.
+ */
+type FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };
+/**
+ * A filtered result when the exact runtime contents of a key array are unknown. Both the
+ * namespace and its selected properties are optional because the array may omit any member of
+ * its element union, or be empty.
+ */
+type OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };
+/** Whether `T` is a union rather than one concrete type. */
+type IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;
+/** Whether any fixed tuple position can hold more than one key at runtime. */
+type TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;
+/**
+ * The sound result of selecting an array of OS-level env-var keys.
+ *
+ * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose
+ * value is a union are conservative because their runtime contents may be any subset of the
+ * element type. The leading conditional distributes unions of whole literal tuples, preserving
+ * each exact alternative.
+ */
+type SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys["length"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;
+type StorageCredentialEnvKey = "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY";
+type StorageKeyPairError = {
+  readonly "fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together": never;
+};
+type TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;
+type TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, "AWS_ACCESS_KEY_ID"> extends true ? TupleDefinitelyContains<Keys, "AWS_SECRET_ACCESS_KEY"> extends true ? true : false : false;
+/**
+ * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic
+ * arrays are checked at runtime because their contents are not known to TypeScript.
+ */
+type InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys["length"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;
+type StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;
+type FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {
+  keys: infer Keys extends readonly string[];
+} ? Keys : never;
+type StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;
+/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */
+type StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;
+interface FetchEnvOptions {
+  /**
+   * Neon project id. **Required** — the management API addresses branches through their
+   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.
+   */
+  projectId: string;
+  /**
+   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the
+   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by
+   * id first, then by name, so either form works.
+   */
+  branch?: string;
+  /**
+   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts
+   * a branch name or id. Still honored for backward compatibility; ignored when `branch`
+   * is set.
+   */
+  branchId?: string;
+  /**
+   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →
+   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`
+   * is supplied.
+   */
+  apiKey?: string;
+  /**
+   * Neon **management** API base URL (not the Auth base URL). Falls back to
+   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.
+   */
+  apiHost?: string;
+  /**
+   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely
+   * on the default real adapter built from `apiKey`.
+   */
+  api?: NeonApi;
+  /**
+   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:
+   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the
+   * single role left after dropping the managed Auth/Data API roles
+   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with
+   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.
+   */
+  roleName?: string;
+  /**
+   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,
+   * else the only database on the branch. Throws {@link PlatformError} with
+   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is
+   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when
+   * the branch has no databases or the requested `databaseName` does not exist.
+   */
+  databaseName?: string;
+}
+/**
+ * Resolve the project + branch this process should target, then fetch live Neon
+ * connection strings for that branch over the network. Async — calls the Neon API.
+ *
+ * Use this from build scripts and the `neon-env run` command, where top-level await is
+ * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle
+ * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use
+ * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against
+ * `process.env`.
+ *
+ * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)
+ * explicitly (resolve them in your CLI, e.g. neonctl).
+ *
+ * ```ts
+ * import config from "../neon";
+ * import { fetchEnv } from "@neon/env";
+ *
+ * const env = await fetchEnv(config, { projectId: "patient-art-12345", branch: "main" });
+ * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
+ * ```
+ *
+ * Pass `keys` to fetch only some of them — see the overload below.
+ *
+ * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything
+ * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret
+ * issued to a previous call) is minted afresh rather than recovered. Callers that hold
+ * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides
+ * what is still valid and narrows this call's `keys` accordingly.
+ */
+declare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {
+  /**
+   * Fetch only these OS-level env vars, instead of everything the policy enables. The
+   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is
+   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact
+   * result; runtime-built arrays make their possible namespaces and properties optional.
+   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.
+   *
+   * The point is not just a smaller result: **work is skipped too.** Leave out
+   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch
+   * credential is minted at all, so a caller that already holds valid secrets can refresh
+   * everything else without issuing a new one. The non-secret vars of the same features
+   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not
+   * credential-backed and stay available on their own.
+   *
+   * The selection **intersects** with the policy rather than overriding it: naming a var
+   * the branch policy does not enable is not an error, it simply yields nothing.
+   */
+  keys: readonly SelectableEnvKey<C>[];
+}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;
+declare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {
+  keys: readonly NoInfer<K>[];
+} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;
+declare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {
+  keys?: never;
+}): Promise<NeonEnv<C>>;
+/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */
+declare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {
+  keys: Keys;
+} & StorageKeyPairError): Promise<never>;
+/**
+ * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
+ * narrowing. Exists for callers that compute the selection at runtime — notably
+ * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
+ * branch — since the public overload's `keys` is bound to a literal union those callers cannot
+ * produce without asserting.
+ *
+ * `keys === null` selects everything the policy enables.
+ */
+
+/**
+ * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used
+ * for cross-process transport. Named after the web-platform `.entries()` convention
+ * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an
+ * iterator of tuples since that's the shape env injection needs (wrap with
+ * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`
+ * to inject the vars into a subprocess's `process.env`.
+ *
+ * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which
+ * conditional namespaces are present.
+ */
+declare function toEntries(env: ResolvedNeonEnv): Record<string, string>;
+/**
+ * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed
+ * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and
+ * property is optional so a filtered result — which legitimately carries only what was asked
+ * for — projects to exactly the vars it holds instead of failing to type-check.
+ */
+type ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };
+//#endregion
+//#endregion
+//#region src/lib/parse-env.d.ts
+/** The static `preview.functions` record of a config, or an empty record when absent. */
+type PreviewFunctionsOf<C extends Config> = NonNullable<C["preview"]> extends {
+  functions: infer F;
+} ? F : Record<never, never>;
+/** The declared function slugs of a config (record keys), as a string union. */
+type FunctionSlugOf<C extends Config> = Extract<keyof PreviewFunctionsOf<C>, string>;
+/**
+ * Human-readable hint surfaced as the **expected type** of `parseEnv`'s `scope` argument when
+ * the policy declares no functions at all. Without it the argument's expected type is the bare
+ * `never` {@link FunctionSlugOf} yields, and TypeScript reports the opaque `Type '"x"' is not
+ * assignable to type 'never'`; the literal turns that into a sentence naming the fix (and the
+ * editor offers it as the single completion, so the empty completion list is explained rather
+ * than just empty). Mirrors `NeonAuthRequiredHint` in `@neon/config`.
+ */
+type NoFunctionScopeHint = "this policy declares no `preview.functions`, so there is no function scope to read. Declare the function in `neon.ts` first, or omit the scope to read the branch env";
+/**
+ * The expected type of `parseEnv`'s function-slug `scope` argument: the caller's inferred slug
+ * `S` normally, and the {@link NoFunctionScopeHint} message when the policy declares no
+ * functions. Keeping `S` (rather than `FunctionSlugOf<C>`) in the enabled branch is what makes
+ * the returned `function` namespace exact — it stays the one function's env keys instead of
+ * widening to every declared function's.
+ */
+type FunctionScopeField<C extends Config, S extends string> = [FunctionSlugOf<C>] extends [never] ? NoFunctionScopeHint : S;
+/** The declared env-var keys of one function `S`, as a string union. */
+type FunctionEnvKeysOf<C extends Config, S extends string> = S extends keyof PreviewFunctionsOf<C> ? NonNullable<PreviewFunctionsOf<C>[S]> extends {
+  env: infer E;
+} ? Extract<keyof E, string> : never : never;
+/**
+ * The extra `function` namespace added to `parseEnv`'s result when called with a function
+ * slug scope: the declared env-var keys for that function, each resolved to a `string`.
+ */
+type NeonFunctionEnv<C extends Config, S extends string> = {
+  function: Record<FunctionEnvKeysOf<C, S>, string>;
+};
+/**
+ * Synchronous, network-free counterpart to {@link fetchEnv}. Reads `process.env`, validates
+ * the required Neon env vars with zod, and returns the same {@link NeonEnv} shape — so the
+ * rest of your app touches `env.postgres.databaseUrl` instead of stringly-typed
+ * `process.env.DATABASE_URL` lookups.
+ *
+ * Designed for the **"env-vars-already-injected"** path:
+ * - You wrapped your dev command with `neon-env run -- <cmd>` or `neon dev`.
+ * - Your platform (Vercel, Fly, Railway, …) injected the vars via its own integration.
+ * - You are **inside a deployed Neon Function**, whose env was uploaded at `config apply`.
+ *
+ * Unlike the old API, `parseEnv` does **not** take a branch name: the secret set is now
+ * static (top-level `config.auth` / `config.dataApi`), so it reads those directly without
+ * evaluating the per-branch closure.
+ *
+ * The second argument is a **scope** or a **key filter**:
+ * - omitted — *external* scope (app bootstrap, build scripts, your dev machine). Returns the
+ *   full `{ postgres, auth?, dataApi?, … }` the policy enables.
+ * - a **function slug** (a key of `config.preview.functions`) — *function* scope: you are
+ *   running inside that function. Returns the same branch secrets **plus** a typed
+ *   `function` namespace with the function's declared env-var keys. The slug autocompletes
+ *   from the policy ({@link FunctionSlugOf}) and an undeclared one is a type error.
+ * - an **array of OS-level env-var keys** (e.g. `["DATABASE_URL", "NEON_AUTH_BASE_URL"]`) —
+ *   *filtered* mode: only those vars are required and returned, as a narrowed namespaced
+ *   shape. The keys autocomplete from the policy ({@link SelectableEnvKey}), so you can only
+ *   pick vars the policy actually enables. Use this when a process needs just a subset (a
+ *   Next.js app that reads `DATABASE_URL` but not `DATABASE_URL_UNPOOLED`, say) and you don't
+ *   want `parseEnv` to throw over vars you never use.
+ *
+ * Throws `PlatformError(EnvNotInjected)` listing every missing/invalid var when the env
+ * isn't fully populated, with a fix hint pointing back at `neon dev` / `neon-env run`.
+ *
+ * ```ts
+ * import config from "../neon";
+ * import { parseEnv } from "@neon/env";
+ *
+ * // External (app / build):
+ * const env = parseEnv(config);
+ * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
+ *
+ * // Inside the "hello" function:
+ * const env = parseEnv(config, "hello");
+ * env.function.resendApiKey; // typed from hello's declared env keys
+ *
+ * // Filtered: only enforce + return the pooled URL.
+ * const { postgres } = parseEnv(config, ["DATABASE_URL"]);
+ * postgres.databaseUrl; // string — `databaseUrlUnpooled` is absent
+ * ```
+ */
+declare function parseEnv<const C extends Config>(config: C): NeonEnv<C>;
+declare function parseEnv<const C extends Config, const S extends FunctionSlugOf<C>>(config: C, scope: FunctionScopeField<C, S>): NeonEnv<C> & NeonFunctionEnv<C, S>;
+declare function parseEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, keys: readonly K[]): FilteredNeonEnv<K>;
+//#endregion
+export { type FetchEnvOptions, type FilteredNeonEnv, type FunctionSlugOf, NEON_ENV_VAR_KEYS, type NeonAiGatewayEnv, type NeonAuthEnv, type NeonBranchEnv, type NeonDataApiEnv, type NeonEnv, type NeonFunctionEnv, type NeonPostgresEnv, type NeonStorageEnv, type ResolvedNeonEnv, type SelectableEnvKey, type SelectedNeonEnv, fetchEnv, parseEnv, toEntries };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":["Config","CredentialScope","NeonApi","NeonBranchSnapshot","ResolvedPreviewConfig","resolveConfig","NEON_ENV_VAR_KEYS","NeonBranchEnv","NeonPostgresEnv","NeonAuthEnv","NeonDataApiEnv","NeonStorageEnv","NeonAiGatewayEnv","NoNamespace","Record","ServiceOn","T","HasKeys","HasBuckets","C","NonNullable","B","AiGatewayOn","A","NeonEnv","EnvKeysByNamespace","NamespaceEnv","EnvKeyToProp","SelectableEnvKey","FilteredNeonEnv","K","N","Extract","P","OptionalFilteredNeonEnv","IsUnion","Whole","TupleHasUnion","Head","Tail","SelectedNeonEnv","Keys","StorageCredentialEnvKey","StorageKeyPairError","TupleDefinitelyContains","Key","TupleDefinitelyContainsStoragePair","InvalidStorageKeyTuple","StorageKeyPairConstraint","FetchEnvKeysFromArgs","Args","StorageKeyPairArgsConstraint","StorageKeyUnionConstraint","FetchEnvOptions","fetchEnv","NoInfer","Promise","fetchEnvKeys","ResolvedNeonEnv","resolveBranchPolicy","Pick","ReturnType","previewCredentialScopes","credentialName","credentialEnvKeys","policyEnvKeys","createApiFromOptions","toEntries","Partial"],"sources":["../../../internals/env-core/dist/env.d.ts","../src/lib/parse-env.ts"],"sourcesContent":["import { Config, CredentialScope, NeonApi, NeonBranchSnapshot, ResolvedPreviewConfig, resolveConfig } from \"@neon/config/v1\";\n\n//#region src/env.d.ts\n\ndeclare const NEON_ENV_VAR_KEYS: {\n  /**\n   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n   * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n   */\n  readonly branch: {\n    readonly name: \"NEON_BRANCH\";\n  };\n  readonly postgres: {\n    readonly databaseUrl: \"DATABASE_URL\";\n    readonly databaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\";\n  };\n  readonly auth: {\n    readonly baseUrl: \"NEON_AUTH_BASE_URL\";\n    readonly jwksUrl: \"NEON_AUTH_JWKS_URL\";\n  };\n  readonly dataApi: {\n    readonly url: \"NEON_DATA_API_URL\";\n  };\n  /**\n   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n   * `region` is injected under the SDK-standard `AWS_REGION`.\n   */\n  readonly storage: {\n    readonly accessKeyId: \"AWS_ACCESS_KEY_ID\";\n    readonly secretAccessKey: \"AWS_SECRET_ACCESS_KEY\";\n    readonly endpoint: \"AWS_ENDPOINT_URL_S3\";\n    readonly region: \"AWS_REGION\";\n  };\n  /**\n   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n   */\n  readonly aiGateway: {\n    readonly apiKey: \"NEON_AI_GATEWAY_TOKEN\";\n    readonly baseUrl: \"NEON_AI_GATEWAY_BASE_URL\";\n  };\n};\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\ninterface NeonBranchEnv {\n  name: string;\n}\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\ninterface NeonPostgresEnv {\n  /**\n   * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n   */\n  databaseUrl: string;\n  /**\n   * Direct (unpooled) connection string. Use this when you need session-level\n   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n   */\n  databaseUrlUnpooled: string;\n}\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\ninterface NeonAuthEnv {\n  baseUrl: string;\n  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n  jwksUrl: string;\n}\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\ninterface NeonDataApiEnv {\n  url: string;\n}\n/**\n * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only\n * when the policy declares `preview.buckets`. Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\ninterface NeonStorageEnv {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** S3-compatible endpoint URL for the branch. */\n  endpoint: string;\n  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n  region: string;\n}\n/**\n * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy\n * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\ninterface NeonAiGatewayEnv {\n  apiKey: string;\n  baseUrl: string;\n}\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false] ? false : [T] extends [{\n  enabled: false;\n}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{\n  enabled: true;\n}] ? true : [T] extends [object] ? true : false;\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\n/**\n * Whether the policy's **static** `preview` block declares at least one object-storage bucket\n * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  buckets: infer B;\n} ? HasKeys<NonNullable<B>> : false;\n/**\n * Whether the policy's **static** `preview` block enables the AI Gateway\n * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n *\n * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when\n * a policy has no `preview`, `NonNullable<C[\"preview\"]>` is `never`, and a naked `never` in the\n * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`\n * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.\n */\ntype AiGatewayOn<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never] ? false : NonNullable<C[\"preview\"]> extends {\n  aiGateway: infer A;\n} ? ServiceOn<NonNullable<A>> : false;\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.preview.buckets` declares at least one bucket.\n * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.\n */\ntype NeonEnv<C extends Config = Config> = {\n  postgres: NeonPostgresEnv;\n  /**\n   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n   * var was injected; `fetchEnv` always populates it.\n   */\n  branch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true ? {\n  auth: NeonAuthEnv;\n} : NoNamespace) & (ServiceOn<NonNullable<C[\"dataApi\"]>> extends true ? {\n  dataApi: NeonDataApiEnv;\n} : NoNamespace) & (HasBuckets<C> extends true ? {\n  storage: NeonStorageEnv;\n} : NoNamespace) & (AiGatewayOn<C> extends true ? {\n  aiGateway: NeonAiGatewayEnv;\n} : NoNamespace);\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n  postgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n  branch: \"NEON_BRANCH\";\n  auth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n  dataApi: \"NEON_DATA_API_URL\";\n  storage: \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\" | \"AWS_ENDPOINT_URL_S3\" | \"AWS_REGION\";\n  aiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n  postgres: NeonPostgresEnv;\n  branch: NeonBranchEnv;\n  auth: NeonAuthEnv;\n  dataApi: NeonDataApiEnv;\n  storage: NeonStorageEnv;\n  aiGateway: NeonAiGatewayEnv;\n}\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n  DATABASE_URL: \"databaseUrl\";\n  DATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n  NEON_BRANCH: \"name\";\n  NEON_AUTH_BASE_URL: \"baseUrl\";\n  NEON_AUTH_JWKS_URL: \"jwksUrl\";\n  NEON_DATA_API_URL: \"url\";\n  AWS_ACCESS_KEY_ID: \"accessKeyId\";\n  AWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n  AWS_ENDPOINT_URL_S3: \"endpoint\";\n  AWS_REGION: \"region\";\n  NEON_AI_GATEWAY_TOKEN: \"apiKey\";\n  NEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\ntype SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\ntype FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };\n/**\n * A filtered result when the exact runtime contents of a key array are unknown. Both the\n * namespace and its selected properties are optional because the array may omit any member of\n * its element union, or be empty.\n */\ntype OptionalFilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]?: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]?: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };\n/** Whether `T` is a union rather than one concrete type. */\ntype IsUnion<T, Whole = T> = T extends Whole ? [Whole] extends [T] ? false : true : never;\n/** Whether any fixed tuple position can hold more than one key at runtime. */\ntype TupleHasUnion<T extends readonly unknown[]> = T extends readonly [] ? false : T extends readonly [infer Head, ...infer Tail extends readonly unknown[]] ? true extends IsUnion<Head> ? true : TupleHasUnion<Tail> : true;\n/**\n * The sound result of selecting an array of OS-level env-var keys.\n *\n * Inline literal tuples remain exact. Widened arrays, rest tuples, and tuple positions whose\n * value is a union are conservative because their runtime contents may be any subset of the\n * element type. The leading conditional distributes unions of whole literal tuples, preserving\n * each exact alternative.\n */\ntype SelectedNeonEnv<Keys extends readonly string[]> = Keys extends readonly string[] ? number extends Keys[\"length\"] ? OptionalFilteredNeonEnv<Keys[number]> : TupleHasUnion<Keys> extends true ? OptionalFilteredNeonEnv<Keys[number]> : FilteredNeonEnv<Keys[number]> : never;\ntype StorageCredentialEnvKey = \"AWS_ACCESS_KEY_ID\" | \"AWS_SECRET_ACCESS_KEY\";\ntype StorageKeyPairError = {\n  readonly \"fetchEnv keys must include AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY together\": never;\n};\ntype TupleDefinitelyContains<Keys extends readonly string[], Key extends string> = Keys extends readonly [infer Head extends string, ...infer Tail extends readonly string[]] ? [Head] extends [Key] ? true : TupleDefinitelyContains<Tail, Key> : false;\ntype TupleDefinitelyContainsStoragePair<Keys extends readonly string[]> = TupleDefinitelyContains<Keys, \"AWS_ACCESS_KEY_ID\"> extends true ? TupleDefinitelyContains<Keys, \"AWS_SECRET_ACCESS_KEY\"> extends true ? true : false : false;\n/**\n * Reject a fixed key tuple that contains only one half of the storage credential. Dynamic\n * arrays are checked at runtime because their contents are not known to TypeScript.\n */\ntype InvalidStorageKeyTuple<Keys extends readonly string[]> = Keys extends unknown ? number extends Keys[\"length\"] ? never : [Extract<Keys[number], StorageCredentialEnvKey>] extends [never] ? never : TupleDefinitelyContainsStoragePair<Keys> extends true ? never : Keys : never;\ntype StorageKeyPairConstraint<Keys extends readonly string[]> = [InvalidStorageKeyTuple<Keys>] extends [never] ? unknown : StorageKeyPairError;\ntype FetchEnvKeysFromArgs<Args extends readonly unknown[]> = Args[0] extends {\n  keys: infer Keys extends readonly string[];\n} ? Keys : never;\ntype StorageKeyPairArgsConstraint<Args extends readonly unknown[]> = StorageKeyPairConstraint<FetchEnvKeysFromArgs<Args>>;\n/** Preserve the same pair rule for callers that explicitly provide the legacy `K` generic. */\ntype StorageKeyUnionConstraint<K extends string> = [Extract<K, StorageCredentialEnvKey>] extends [never] ? unknown : StorageCredentialEnvKey extends K ? unknown : StorageKeyPairError;\ninterface FetchEnvOptions {\n  /**\n   * Neon project id. **Required** — the management API addresses branches through their\n   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n   */\n  projectId: string;\n  /**\n   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n   * id first, then by name, so either form works.\n   */\n  branch?: string;\n  /**\n   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n   * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n   * is set.\n   */\n  branchId?: string;\n  /**\n   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n   * is supplied.\n   */\n  apiKey?: string;\n  /**\n   * Neon **management** API base URL (not the Auth base URL). Falls back to\n   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n   */\n  apiHost?: string;\n  /**\n   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n   * on the default real adapter built from `apiKey`.\n   */\n  api?: NeonApi;\n  /**\n   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n   * single role left after dropping the managed Auth/Data API roles\n   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n   */\n  roleName?: string;\n  /**\n   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n   * else the only database on the branch. Throws {@link PlatformError} with\n   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n   * the branch has no databases or the requested `databaseName` does not exist.\n   */\n  databaseName?: string;\n}\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\ndeclare function fetchEnv<const C extends Config, const Args extends readonly [options: FetchEnvOptions & {\n  /**\n   * Fetch only these OS-level env vars, instead of everything the policy enables. The\n   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n   * narrowed to match ({@link SelectedNeonEnv}). Inline literal arrays produce an exact\n   * result; runtime-built arrays make their possible namespaces and properties optional.\n   * `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` must be selected together.\n   *\n   * The point is not just a smaller result: **work is skipped too.** Leave out\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n   * credential is minted at all, so a caller that already holds valid secrets can refresh\n   * everything else without issuing a new one. The non-secret vars of the same features\n   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n   * credential-backed and stay available on their own.\n   *\n   * The selection **intersects** with the policy rather than overriding it: naming a var\n   * the branch policy does not enable is not an error, it simply yields nothing.\n   */\n  keys: readonly SelectableEnvKey<C>[];\n}]>(config: C, ...args: Args & StorageKeyPairArgsConstraint<NoInfer<Args>>): Promise<SelectedNeonEnv<FetchEnvKeysFromArgs<NoInfer<Args>>>>;\ndeclare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C> = never>(config: C, options: [NoInfer<K>] extends [never] ? never : FetchEnvOptions & {\n  keys: readonly NoInfer<K>[];\n} & StorageKeyUnionConstraint<NoInfer<K>>): Promise<FilteredNeonEnv<NoInfer<K>>>;\ndeclare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions & {\n  keys?: never;\n}): Promise<NeonEnv<C>>;\n/** Diagnostic-only fallback: valid keyed calls resolve through the exact overload above. */\ndeclare function fetchEnv<const C extends Config, const Keys extends readonly SelectableEnvKey<C>[]>(config: C, options: FetchEnvOptions & {\n  keys: Keys;\n} & StorageKeyPairError): Promise<never>;\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\ndeclare function fetchEnvKeys(config: Config, options: FetchEnvOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\ndeclare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">, api: NeonApi): Promise<{\n  branch: NeonBranchSnapshot;\n  desired: ReturnType<typeof resolveConfig>;\n}>;\n/**\n * Scopes the branch credential should carry for a resolved branch policy and optional key\n * selection. Only object storage and the AI Gateway *require* a credential; functions never\n * force one, but `functions:invoke` rides along when another selected feature mints one.\n */\ndeclare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined, selected?: {\n  storage: boolean;\n  aiGateway: boolean;\n}): CredentialScope[];\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\ndeclare function credentialName(branchName: string): string;\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\ndeclare function credentialEnvKeys(flags: {\n  storage: boolean;\n  aiGateway: boolean;\n}): string[];\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\ndeclare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];\ndeclare function createApiFromOptions(options: FetchEnvOptions): NeonApi;\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\ndeclare function toEntries(env: ResolvedNeonEnv): Record<string, string>;\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\ntype ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };\n//#endregion\nexport { FetchEnvOptions, FilteredNeonEnv, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, SelectedNeonEnv, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };\n//# sourceMappingURL=env.d.ts.map",null],"mappings":";;;;;AA8CC,cA1CaM,iBAiDS,EAAA;EAAA;AAIE;AAsBJ;AAMG;AAcA;EAgBE,SASrBO,MAAAA,EAAW;IAYXE,SAAAA,IAAS,EAAA,aAAA;EAAA,CAAA;EAAOC,SAAAA,QAAAA,EAAAA;IAA8BA,SAAAA,WAAAA,EAAAA,cAAAA;IAErCA,SAAAA,mBAAAA,EAAAA,uBAAAA;EAAkCA,CAAAA;EAA4BA,SAAAA,IAAAA,EAAAA;IAE/DA,SAAAA,OAAAA,EAAAA,oBAAAA;IAAC,SAAA,OAAA,EAAA,oBAAA;EAAA,CAAA;EAEY,SAUrBE,OAAU,EAAA;IAAA,SAAA,GAAA,EAAA,mBAAA;EAAWlB,CAAAA;EAAuBmB;AAAZC;AAAiED;AAAZC;AAElEC;EAAZD,SAAAA,OAAAA,EAAAA;IAARH,SAAAA,WAAAA,EAAAA,mBAAAA;IAAO,SAAA,eAAA,EAAA,uBAAA;IAUNK,SAAAA,QAAW,EAAA,qBAAA;IAAA,SAAA,MAAA,EAAA,YAAA;EAAWtB,CAAAA;EAAuBmB;AAAZC;AAAiED;AAAZC;AAEjEG;AAAZH;AAAVL;EAAS,SAAA,SAAA,EAAA;IAeRS,SAAAA,MAAO,EAAA,uBAAA;IAAA,SAAA,OAAA,EAAA,0BAAA;EAAWxB,CAAAA;AAASA,CAAAA;AACpBQ;AAKDD;AACgBY;AAAZC;AAAVL;AACGN;AACJI,UAzIMN,aAAAA,CAyINM;EAAsCM,IAAAA,EAAAA,MAAAA;AAAZC;AAAVL;AACTL,UAtIDF,eAAAA,CAsICE;EACPG;AAA2BM;AAAXD;AACTP;EACPE,WAAAA,EAAAA,MAAAA;EAA4BM;AAAZG;AACPV;AACTC;AAAW;EAAA,mBAQLY,EAAAA,MAAkB;AAAA;AASN;AACVjB;AACFD;AACFE;AACGC;AACAC;AACEC;AAAgB;AAAA;AAGP,UA/IZH,WAAAA,CAmKLmB;EAAgB,OAAA,EAAA,MAAA;EAAW5B;EAAUyB,OAAAA,EAAAA,MAAAA;AAAiCN;AAARK;AAAmBC,UA7J5Ef,cAAAA,CA6J4Ee;EAAkB,GAAA,EAAA,MAAA;AAAA;AAgBpF;AAAmCA;AAA+BK;AAAGL;AAAmBM;AAA9BC;AAA6DD;AAAoBD;AAAGL;AAAmBM;AAA9BC;AAAqCL,UA/JlLhB,cAAAA,CA+JkLgB;EAAaM,WAAAA,EAAAA,MAAAA;EAAUN,eAAAA,EAAAA,MAAAA;EAAgBD;EAAaK,QAAAA,EAAAA,MAAAA;EAAGJ;EAAaM,MAAAA,EAAAA,MAAAA;AAAUN;AAAsBD;AAAaK;AAAC;AAAA;AAMlR;AAAmCN;AAA+BK;AAAGL;AAAmBM,UArJ1GnB,gBAAAA,CAqJ0GmB;EAA9BC,MAAAA,EAAAA,MAAAA;EAA6DD,OAAAA,EAAAA,MAAAA;AAAqBD;AAAGL;AAAmBM;AAA9BC;AAAqCL;AAAaM;AAAUN,KA5IvNd,WAAAA,GAAcC,MA4IyMa,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAAiBD;AAAaK;AAAGJ;AAAaM;AAAUN;AAAsBD;AAAaK;AAAC;AAAA;AAE5S;AAAYf;AAAKA,KAlIxBD,SAkIwBC,CAAAA,CAAAA,CAAAA,GAAAA,CAlIRA,CAkIQA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAlIsBA,CAkItBA,CAAAA,SAAAA,CAAAA;EAAUoB,OAAAA,EAAAA,KAAAA;AAASA,CAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhIlCpB,CAgIkCoB,CAAAA,SAAAA,CAAAA,SAAAA,CAAAA,GAAAA,KAAAA,GAAAA,CAhIApB,CAgIAoB,CAAAA,SAAAA,CAAAA,IAAAA,CAAAA,GAAAA,IAAAA,GAAAA,CAhI4BpB,CAgI5BoB,CAAAA,SAAAA,CAAAA;EAAgBpB,OAAAA,EAAAA,IAAAA;AAAC,CAAA,CAAA,GAAA,IAAA,GAAA,CA9HpDA,CA8HoD,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AAAA;AAE/C,KA9HbC,OA8Ha,CAAA,CAAA,CAAA,GAAA,CAAA,MA9HOD,CA8HP,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAiCA;AAAgCA;AAAiGsB;AAARH;AAAqCI;AAAdF;AAAa;AAAA;AAS5L;AAAmCI,KA7HlDvB,UA6HkDuB,CAAAA,UA7H7BzC,MA6H6ByC,CAAAA,GAAAA,CA7HlBrB,WA6HkBqB,CA7HNtB,CA6HMsB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA7HmCrB,WA6HnCqB,CA7H+CtB,CA6H/CsB,CAAAA,SAAAA,CAAAA,CAAAA,SAAAA;EAAgDA,OAAAA,EAAAA,KAAAA,EAAAA;AAAyCA,CAAAA,GA3H5IxB,OA2H4IwB,CA3HpIrB,WA2HoIqB,CA3HxHpB,CA2HwHoB,CAAAA,CAAAA,GAAAA,KAAAA;AAAxBP;AAAsDO;AAAdJ;AAA2DI;AAAxBP;AAAwDO;AAAhBZ;AAAe;AAAA;AAC9N,KAlHvBP,WAmHAqB,CAAAA,UAnHsB3C,MAmHH,CAAA,GAAA,CAnHcoB,WAmHd,CAnH0BD,CAmH1B,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAnHmEC,WAmHnE,CAnH+ED,CAmH/E,CAAA,SAAA,CAAA,CAAA,SAAA;EAAA,SAGnByB,EAAAA,KAAAA,EAAAA;AAAuB,CAAA,GApHxB7B,SAoHwB,CApHdK,WAoHc,CApHFG,CAoHE,CAAA,CAAA,GAAA,KAAA;AAAuDkB;AAA8FH;AAAeO;AAAsCN;AAAMM;AAA9BD;AAAuB;AAAA;AAC9L;AAA2DH;AAAxBG;AAA0FH;AAAxBG;AAAuB;AAAA,KAtG9JpB,OA2GAuB,CAAAA,UA3GkB/C,MA2GI,GA3GKA,MA2GL,CAAA,GAAA;EAAA,QAAA,EA1GfQ,eA0Ge;EAAmCiC;AAAsCA;AAAkCA;AAAcC;EAAtBV,MAAAA,CAAAA,EArGnHzB,aAqGmHyB;AAA6GS,CAAAA,GAAAA,CApGtO1B,SAoGsO0B,CApG5NrB,WAoG4NqB,CApGhNtB,CAoGgNsB,CAAAA,MAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAnCK,IAAAA,EAnGhMrC,WAmGgMqC;AAAgEL,CAAAA,GAlGpQ5B,WAkGoQ4B,CAAAA,GAAAA,CAlGpP1B,SAkGoP0B,CAlG1OrB,WAkG0OqB,CAlG9NtB,CAkG8NsB,CAAAA,SAAAA,CAAAA,CAAAA,CAAAA,SAAAA,IAAAA,GAAAA;EAAI,OAAA,EAjGjQ/B,cAiGiQ;AAAA,CAAA,GAhGxQG,WAiGCmC,CAAAA,GAAAA,CAjGe9B,UAiGf8B,CAjG0B7B,CAiGF,CAAA,SAAA,IAAA,GAAA;EAAA,OAAA,EAhGlBR,cAgGkB;AAA2D8B,CAAAA,GA/FpF5B,WA+FoF4B,CAAAA,GAAAA,CA/FpEnB,WA+FoEmB,CA/FxDtB,CA+FwDsB,CAAAA,SAAAA,IAAAA,GAAAA;EAAvBM,SAAAA,EA9FpDnC,gBA8FoDmC;AAA0DJ,CAAAA,GA7FvH9B,WA6FuH8B,CAAAA;AAAmB;AAAA;AACrH;AAAoCO;AAEzDT;AAAI;AAAA;AACyB,UAzFvBhB,kBAAAA,CAyFuB;EAAkFyB,QAAAA,EAAAA,cAAAA,GAAAA,uBAAAA;EAArBD,MAAAA,EAAAA,aAAAA;EAAzBD,IAAAA,EAAAA,oBAAAA,GAAAA,oBAAAA;EAAwB,OAAA,EAAA,mBAAA;EAAA,OAExFI,EAAAA,mBAAAA,GAAyB,uBAAA,GAAA,qBAAA,GAAA,YAAA;EAAA,SAAA,EAAA,uBAAA,GAAA,0BAAA;AAA8BtB;AAAGY;AAAXV,UAlF1CN,YAAAA,CAkF0CM;EAAiEU,QAAAA,EAjFzGlC,eAiFyGkC;EAAgCZ,MAAAA,EAhF3IvB,aAgF2IuB;EAAca,IAAAA,EA/E3JlC,WA+E2JkC;EAAmB,OAAA,EA9E3KjC,cA8E2K;EAAA,OAC5K2C,EA9EC1C,cA8Ec;EAiCV,SA+CE2C,EA7JJ1C,gBA6JY;AAAA;AAAiBZ;AAA8CqD,UA1J9E1B,YAAAA,CA0J8E0B;EAkBtDlC,YAAAA,EAAAA,aAAAA;EAAjBS,qBAAAA,EAAAA,qBAAAA;EACLT,WAAAA,EAAAA,MAAAA;EAAY+B,kBAAAA,EAAAA,SAAAA;EAA4CA,kBAAAA,EAAAA,SAAAA;EAARK,iBAAAA,EAAAA,KAAAA;EAA7BJ,iBAAAA,EAAAA,aAAAA;EAAmGD,qBAAAA,EAAAA,iBAAAA;EAARK,mBAAAA,EAAAA,UAAAA;EAArBN,UAAAA,EAAAA,QAAAA;EAAhBT,qBAAAA,EAAAA,QAAAA;EAARgB,wBAAAA,EAAAA,SAAAA;AAAO;AAAA;AAC3D;AAAiBxD;AAAyCmB;AAAjBS;AAAqCT;AAAqBW,KA1JvHF,gBA0JuHE,CAAAA,UA1J5F9B,MA0J4F8B,CAAAA,GA1JlFL,kBA0JkFK,CAAAA,MA1JzDN,OA0JyDM,CA1JjDX,CA0JiDW,CAAAA,GAAAA,MA1JtCL,kBA0JsCK,CAAAA;AAARyB;AAAsCF;AACjIvB;AAARyB;AACqBzB;AAARyB;AAA1BH;AAAwEtB;AAARyB;AAAhB1B;AAAR2B;AAAO;AAAA;AAC1B;AAAiBxD;AAAgBmB,KA7IrDU,eA6IqDV,CAAAA,UAAAA,MAAAA,CAAAA,GAAAA,QAAAA,MA7IHM,kBA6IGN,IAAAA,CA7IoBa,OA6IpBb,CA7I4BW,CA6I5BX,EA7I+BM,kBA6I/BN,CA7IkDY,CA6IlDZ,CAAAA,CAAAA,CAAAA,SAAAA,CAAAA,KAAAA,CAAAA,GAAAA,KAAAA,GA7IiFY,CA6IjFZ,GAAAA,QA7I6Fa,OA6I7Fb,CA7IqGW,CA6IrGX,EA7IwGM,kBA6IxGN,CA7I2HY,CA6I3HZ,CAAAA,CAAAA,IA7IkIQ,YA6IlIR,CA7I+Ic,CA6I/Id,GAAAA,MA7IyJQ,YA6IzJR,CAAAA,GA7IyKO,YA6IzKP,CA7IsLY,CA6ItLZ,CAAAA,CA7IyLQ,YA6IzLR,CA7IsMc,CA6ItMd,GAAAA,MA7IgNQ,YA6IhNR,CAAAA,GAAAA,MA7IsOO,YA6ItOP,CA7ImPY,CA6InPZ,CAAAA,CAAAA,EAAAA,EAAAA;AAAYkC;AAElDlC;AAARK;AAARgC;AAAO;AAAA,KAzINtB,uBA2IoB,CAAA,UAAA,MAAA,CAAA,GAAA,QAAA,MA3IsCT,kBA2ItC,IAAA,CA3I6DO,OA2I7D,CA3IqEF,CA2IrE,EA3IwEL,kBA2IxE,CA3I2FM,CA2I3F,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA3I0HA,CA2I1H,IAAA,QA3IuIC,OA2IvI,CA3I+IF,CA2I/I,EA3IkJL,kBA2IlJ,CA3IqKM,CA2IrK,CAAA,CAAA,IA3I4KJ,YA2I5K,CA3IyLM,CA2IzL,GAAA,MA3ImMN,YA2InM,CAAA,IA3IoND,YA2IpN,CA3IiOK,CA2IjO,CAAA,CA3IoOJ,YA2IpO,CA3IiPM,CA2IjP,GAAA,MA3I2PN,YA2I3P,CAAA,GAAA,MA3IiRD,YA2IjR,CA3I8RK,CA2I9R,CAAA,CAAA,EAAA,EAAA;AAAA;AAAiB/B,KAzIrCmC,OAyIqCnC,CAAAA,CAAAA,EAAAA,QAzIlBgB,CAyIkBhB,CAAAA,GAzIbgB,CAyIahB,SAzIHoC,KAyIGpC,GAAAA,CAzIMoC,KAyINpC,CAAAA,SAAAA,CAzIsBgB,CAyItBhB,CAAAA,GAAAA,KAAAA,GAAAA,IAAAA,GAAAA,KAAAA;AAAqDmB;AAAjBS,KAvIzES,aAuIyET,CAAAA,UAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAvI3BZ,CAuI2BY,SAAAA,SAAAA,EAAAA,GAAAA,KAAAA,GAvIKZ,CAuILY,SAAAA,SAAAA,CAAAA,KAAAA,KAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,OAAAA,EAAAA,CAAAA,GAAAA,IAAAA,SAvI8FO,OAuI9FP,CAvIsGU,IAuItGV,CAAAA,GAAAA,IAAAA,GAvIqHS,aAuIrHT,CAvImIW,IAuInIX,CAAAA,GAAAA,IAAAA;AAA+BT;AAAYkC;AACjHZ;AACJE;AAAsBa;AAAO;AA0CuC;AAY9C;AAAME,KAtL3BlB,eAsL2BkB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAtLuBjB,IAsLvBiB,SAAAA,SAAAA,MAAAA,EAAAA,GAAAA,MAAAA,SAtLuEjB,IAsLvEiB,CAAAA,QAAAA,CAAAA,GAtLwFxB,uBAsLxFwB,CAtLgHjB,IAsLhHiB,CAAAA,MAAAA,CAAAA,CAAAA,GAtLgIrB,aAsLhIqB,CAtL8IjB,IAsL9IiB,CAAAA,SAAAA,IAAAA,GAtLmKxB,uBAsLnKwB,CAtL2LjB,IAsL3LiB,CAAAA,MAAAA,CAAAA,CAAAA,GAtL2M7B,eAsL3M6B,CAtL2NjB,IAsL3NiB,CAAAA,MAAAA,CAAAA,CAAAA,GAAAA,KAAAA;AAAkB5C,KArL7C4B,uBAAAA,GAqL6C5B,mBAAAA,GAAAA,uBAAAA;AAAM,KApLnD6B,mBAAAA,GAoLmD;EAAA,SAOnDe,iFAAe,EAAA,KAAA;AAAA,CAAA;AAAiBhC,KAxLhCkB,uBAwLgClB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,EAAAA,YAAAA,MAAAA,CAAAA,GAxL8Ce,IAwL9Cf,SAAAA,SAAAA,CAAAA,KAAAA,cAAAA,MAAAA,EAAAA,GAAAA,KAAAA,cAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAAAA,CAxL4IY,IAwL5IZ,CAAAA,SAAAA,CAxL2JmB,GAwL3JnB,CAAAA,GAAAA,IAAAA,GAxLyKkB,uBAwLzKlB,CAxLiMa,IAwLjMb,EAxLuMmB,GAwLvMnB,CAAAA,GAAAA,KAAAA;AAAwBA,KAvLxDoB,kCAuLwDpB,CAAAA,aAAAA,SAAAA,MAAAA,EAAAA,CAAAA,GAvLakB,uBAuLblB,CAvLqCe,IAuLrCf,EAAAA,mBAAAA,CAAAA,SAAAA,IAAAA,GAvL+EkB,uBAuL/ElB,CAvLuGe,IAuLvGf,EAAAA,uBAAAA,CAAAA,SAAAA,IAAAA,GAAAA,IAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAaK;AAArBqC;AAAO;;KAlLvDrB,yDAAyDN,sCAAsCA,0BAA0BT,QAAQS,cAAcC,oDAAoDI,mCAAmCL,6BAA6BA;KACnQO,4DAA4DD,uBAAuBN,mCAAmCE;ACtQrF,KDuQjCM,oBCnQkB,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GDmQsCC,ICnQtC,CAAA,CAAA,CAAA,SAAA;EAAA,IAAA,EAAA,KAAA,cAAA,SAAA,MAAA,EAAA;AAAW,CAAA,GDqQ9BT,ICrQ8B,GAAA,KAAA;AACrB,KDqQRU,4BCrQQ,CAAA,aAAA,SAAA,OAAA,EAAA,CAAA,GDqQwDH,wBCrQxD,CDqQiFC,oBCrQjF,CDqQsGC,ICrQtG,CAAA,CAAA;AAAZ;AAGG,KDoQCE,yBCpQD,CAAA,UAAA,MAAA,CAAA,GAAA,CDoQgDpB,OCpQhD,CDoQwDF,CCpQxD,EDoQ2DY,uBCpQ3D,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,OAAA,GDoQiHA,uBCpQjH,SDoQiJZ,CCpQjJ,GAAA,OAAA,GDoQ+Ja,mBCpQ/J;AACA,UDoQMU,eAAAA,CCpQN;EAAM;AAGV;AAA0B;AAAW;EACX,SAAA,EAAA,MAAA;EAAnB;AADwC;AAAO;AAetD;AACyK;EASlJ,MAAA,CAAA,EAAA,MAAA;EAAW;AAClB;AAAf;AAEE;AACA;EAAC,QAAA,CAAA,EAAA,MAAA;EAAA;AAGkB;AACX;AAEP;AAAmC;EAAnB,MAAA,CAAA,EAAA,MAAA;EACc;AAAnB;AAAsB;AAAlC;EACe,OAAA,CAAA,EAAA,MAAA;EAAd;AAAO;AAQX;AAA2B;EAAW,GAAA,CAAA,EDqP9BnD,OCrP8B;EACF;AAAG;AAArB;AAAP;AAAM;AAiIjB;AAAwB;EAAiB,QAAA,CAAA,EAAA,MAAA;EAAgB;AAAY;AAAR;AAAO;AASpE;AAAwB;AACP;EACe,YAAA,CAAA,EAAA,MAAA;AAAf;AAER;AACkB;AAAG;AAAtB;AACG;AAAR;AAA6B;AAAG;AAAnB;AAAe;AAC/B;AAAwB;AACP;AACiB;AAAjB;AACP;AAAkB;AAAsB;AAAhB;AAAe;;;;;;;;;;iBD+IhCoD,yBAAyBtD,8CAA8CqD;;;;;;;;;;;;;;;;;;iBAkBvEzB,iBAAiBT;YACtBA,YAAY+B,OAAOC,6BAA6BI,QAAQL,SAASM,QAAQhB,gBAAgBS,qBAAqBM,QAAQL;iBACjHI,yBAAyBtD,wBAAwB4B,iBAAiBT,oBAAoBA,aAAaoC,QAAQzB,8BAA8BuB;iBACzIE,QAAQzB;IACrBsB,0BAA0BG,QAAQzB,MAAM0B,QAAQ3B,gBAAgB0B,QAAQzB;iBAC3DwB,yBAAyBtD,gBAAgBmB,YAAYkC;;IAElEG,QAAQhC,QAAQL;;iBAEHmC,yBAAyBtD,oCAAoC4B,iBAAiBT,cAAcA,YAAYkC;QACjHZ;IACJE,sBAAsBa;;;;;;;;;;;;;;;;;;;;;;iBAsDTW,SAAAA,MAAeT,kBAAkB5C;;;;;;;KAO7C4C,eAAAA,iBAAgChC,gBAAgB0C,QAAQ1C,aAAaK;;;;AAtVjD;AAYX,KCzGT,kBDyGS,CAAA,UCzGoB,MDyGpB,CAAA,GCxGb,WDwGa,CCxGD,CDwGC,CAAA,SAAA,CAAA,CAAA,SAAA;EAAOf,SAAAA,EAAAA,KAAAA,EAAAA;AAA8BA,CAAAA,GCrG/C,CDqG+CA,GCpG/C,MDoG+CA,CAAAA,KAAAA,EAAAA,KAAAA,CAAAA;AAErCA;AAAkCA,KCnGpC,cDmGoCA,CAAAA,UCnGX,MDmGWA,CAAAA,GCnGD,ODmGCA,CAAAA,MClGzC,kBDkGyCA,CClGtB,CDkGsBA,CAAAA,EAAAA,MAAAA,CAAAA;AAA4BA;AAE/DA;AAAC;AAAA;AAEY;AAUX;AAAWhB;AAAuBmB;AAAZC,KClGzB,mBAAA,GDkGyBA,uKAAAA;AAAiED;AAAZC;AAElEC;AAAZD;AAARH;AAAO;AAAA;AAUK,KCpGX,kBDoGW,CAAA,UCpGkB,MDoGlB,EAAA,UAAA,MAAA,CAAA,GAAA,CCnGf,cDmG0BjB,CCnGX,CDmGWA,CAAAA,CAAuBmB,SAAAA,CAAAA,KAAAA,CAAAA,GCjG/C,mBDiG+CA,GChG/C,CDgG+CA;AAAZC;AAAiED,KC7FlG,iBD6FkGA,CAAAA,UC5F5F,MD4F4FA,EAAAA,UAAAA,MAAAA,CAAAA,GC1FnG,CD0FmGA,SAAAA,MC1FnF,kBD0FmFA,CC1FhE,CD0FgEA,CAAAA,GCzFpG,WDyFoGA,CCzFxF,kBDyFwFA,CCzFrE,CDyFqEA,CAAAA,CCzFlE,CDyFkEA,CAAAA,CAAAA,SAAAA;EAAZC,GAAAA,EAAAA,KAAAA,EAAAA;AAEjEG,CAAAA,GC1FtB,OD0FsBA,CAAAA,MC1FR,CD0FQA,EAAAA,MAAAA,CAAAA,GAAAA,KAAAA,GAAAA,KAAAA;AAAZH;AAAVL;AAAS;AAAA;AAeD,KCjGA,eDiGA,CAAA,UCjG0B,MDiG1B,EAAA,UAAA,MAAA,CAAA,GAAA;EAAWf,QAAAA,EChGZ,MDgGYA,CChGL,iBDgGKA,CChGa,CDgGbA,EChGgB,CDgGhBA,CAAAA,EAAAA,MAAAA,CAAAA;AAASA,CAAAA;AACpBQ;AAKDD;AACgBY;AAAZC;AAAVL;AACGN;AACJI;AAAsCM;AAAZC;AAAVL;AACTL;AACPG;AAA2BM;AAAXD;AACTP;AACPE;AAA4BM;AAAZG;AACPV;AACTC;AAAW;AAAA;AAQa;AASN;AACVL;AACFD;AACFE;AACGC;AACAC;AACEC;AAAgB;AAAA;AAGP;AAoBD;AAAWZ;AAAUyB;AAAiCN;AAARK;AAAmBC;AAAkB;AAAA;AAgBpF;AAAmCA;AAA+BK;AAAGL;AAAmBM;AAA9BC;AAA6DD;AAAoBD;AAAGL,iBC5ClJ,QD4CkJA,CAAAA,gBC5CzH,MD4CyHA,CAAAA,CAAAA,MAAAA,EC5CzG,CD4CyGA,CAAAA,EC5CrG,OD4CqGA,CC5C7F,CD4C6FA,CAAAA;AAAmBM,iBCnCrK,QDmCqKA,CAAAA,gBClCpK,MDkCoKA,EAAAA,gBCjCpK,cDiCoKA,CCjCrJ,CDiCqJA,CAAAA,CAAAA,CAAAA,MAAAA,EC/B5K,CD+B4KA,EAAAA,KAAAA,EC9B7K,kBD8B6KA,CC9B1J,CD8B0JA,EC9BvJ,CD8BuJA,CAAAA,CAAAA,EC7BlL,OD6BkLA,CC7B1K,CD6B0KA,CAAAA,GC7BrK,eD6BqKA,CC7BrJ,CD6BqJA,EC7BlJ,CD6BkJA,CAAAA;AAA9BC,iBC5BvI,QD4BuIA,CAAAA,gBC3BtI,MD2BsIA,EAAAA,gBC1BtI,gBD0BsIA,CC1BrH,CD0BqHA,CAAAA,CAAAA,CAAAA,MAAAA,ECzB7I,CDyB6IA,EAAAA,IAAAA,EAAAA,SCzB3H,CDyB2HA,EAAAA,CAAAA,ECzBrH,eDyBqHA,CCzBrG,CDyBqGA,CAAAA"}