@neondatabase/env 1.0.0 → 1.1.0

package/dist/_shared/env-core/env.d.ts

@@ -1,424 +0,0 @@
-import { Config, CredentialScope, ResolvedPreviewConfig } from "../../config/dist/lib/types.js";
-import { NeonApi, NeonBranchSnapshot } from "../../config/dist/lib/neon-api.js";
-import { resolveConfig } from "../../config/dist/lib/define-config.js";
-import "../../config/dist/v1.js";
-
-//#region src/_shared/env-core/env.d.ts
-
-declare const NEON_ENV_VAR_KEYS: {
-  /**
-   * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
-   * Neon Functions runtime on every branch (including the default) by default. `env pull` /
-   * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.
-   */
-  readonly branch: {
-    readonly name: "NEON_BRANCH";
-  };
-  readonly postgres: {
-    readonly databaseUrl: "DATABASE_URL";
-    readonly databaseUrlUnpooled: "DATABASE_URL_UNPOOLED";
-  };
-  readonly auth: {
-    readonly baseUrl: "NEON_AUTH_BASE_URL";
-    readonly jwksUrl: "NEON_AUTH_JWKS_URL";
-  };
-  readonly dataApi: {
-    readonly url: "NEON_DATA_API_URL";
-  };
-  /**
-   * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so
-   * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.
-   * `region` is injected under the SDK-standard `AWS_REGION`.
-   */
-  readonly storage: {
-    readonly accessKeyId: "AWS_ACCESS_KEY_ID";
-    readonly secretAccessKey: "AWS_SECRET_ACCESS_KEY";
-    readonly endpoint: "AWS_ENDPOINT_URL_S3";
-    readonly region: "AWS_REGION";
-  };
-  /**
-   * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions
-   * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)
-   * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,
-   * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the
-   * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).
-   */
-  readonly aiGateway: {
-    readonly apiKey: "NEON_AI_GATEWAY_TOKEN";
-    readonly baseUrl: "NEON_AI_GATEWAY_BASE_URL";
-  };
-};
-/**
- * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch
- * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was
- * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /
- * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).
- */
-interface NeonBranchEnv {
-  name: string;
-}
-/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */
-interface NeonPostgresEnv {
-  /**
-   * Pooled connection string (via Neon's PgBouncer pooler). The right default for
-   * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).
-   */
-  databaseUrl: string;
-  /**
-   * Direct (unpooled) connection string. Use this when you need session-level
-   * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions
-   * spanning round-trips) that PgBouncer's transaction-mode pooling drops.
-   */
-  databaseUrlUnpooled: string;
-}
-/**
- * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`
- * when the branch policy enables `auth`.
- *
- * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and
- * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live
- * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /
- * `NEON_AUTH_JWKS_URL`).
- */
-interface NeonAuthEnv {
-  baseUrl: string;
-  /** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */
-  jwksUrl: string;
-}
-/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */
-interface NeonDataApiEnv {
-  url: string;
-}
-/**
- * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only
- * when the policy declares `preview.buckets`. Combines a minted branch credential's access
- * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the
- * storage gateway authenticates against; `secretAccessKey` = its
- * `s3_secret_access_key`) with the branch's non-secret connection details
- * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's
- * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,
- * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always
- * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.
- */
-interface NeonStorageEnv {
-  accessKeyId: string;
-  secretAccessKey: string;
-  /** S3-compatible endpoint URL for the branch. */
-  endpoint: string;
-  /** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */
-  region: string;
-}
-/**
- * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy
- * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);
- * `baseUrl` is the bare branch-scoped gateway host
- * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env
- * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`
- * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.
- */
-interface NeonAiGatewayEnv {
-  apiKey: string;
-  baseUrl: string;
-}
-/**
- * Empty record alias used as the "false" branch of the conditional namespace adds below.
- * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,
- * which biome rejects (it means "any non-null", not "empty object").
- */
-type NoNamespace = Record<never, never>;
-/**
- * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a
- * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution
- * so a union/`undefined` is checked as one unit:
- *
- * - `false` / `{ enabled: false }` / `undefined` → `false`
- * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`
- *   (a present toggle defaults to enabled)
- * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal
- *   info) → `false`, so an untyped policy yields just `{ postgres }`.
- */
-type ServiceOn<T> = [T] extends [false] ? false : [T] extends [{
-  enabled: false;
-}] ? false : [T] extends [undefined] ? false : [T] extends [true] ? true : [T] extends [{
-  enabled: true;
-}] ? true : [T] extends [object] ? true : false;
-/** True when `T` has at least one known key; `false` for `{}` / `never`. */
-type HasKeys<T> = [keyof T] extends [never] ? false : true;
-/**
- * Whether the policy's **static** `preview` block declares at least one object-storage bucket
- * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.
- *
- * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,
- * `NonNullable<C["preview"]>` is `never`, and without the guard the `extends { … }` probe
- * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`
- * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.
- */
-type HasBuckets<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
-  buckets: infer B;
-} ? HasKeys<NonNullable<B>> : false;
-/**
- * Whether the policy's **static** `preview` block enables the AI Gateway
- * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.
- *
- * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when
- * a policy has no `preview`, `NonNullable<C["preview"]>` is `never`, and a naked `never` in the
- * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`
- * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.
- */
-type AiGatewayOn<C extends Config> = [NonNullable<C["preview"]>] extends [never] ? false : NonNullable<C["preview"]> extends {
-  aiGateway: infer A;
-} ? ServiceOn<NonNullable<A>> : false;
-/**
- * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the
- * {@link Config} so the type system knows which optional namespaces are present.
- *
- * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /
- * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct
- * read of those fields — no union-across-branches, no default-config escape hatch:
- *
- * - `postgres` is always present.
- * - `auth` is added iff `config.auth` is statically enabled.
- * - `dataApi` is added iff `config.dataApi` is statically enabled.
- * - `storage` is added iff `config.preview.buckets` declares at least one bucket.
- * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.
- */
-type NeonEnv<C extends Config = Config> = {
-  postgres: NeonPostgresEnv;
-  /**
-   * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the
-   * var was injected; `fetchEnv` always populates it.
-   */
-  branch?: NeonBranchEnv;
-} & (ServiceOn<NonNullable<C["auth"]>> extends true ? {
-  auth: NeonAuthEnv;
-} : NoNamespace) & (ServiceOn<NonNullable<C["dataApi"]>> extends true ? {
-  dataApi: NeonDataApiEnv;
-} : NoNamespace) & (HasBuckets<C> extends true ? {
-  storage: NeonStorageEnv;
-} : NoNamespace) & (AiGatewayOn<C> extends true ? {
-  aiGateway: NeonAiGatewayEnv;
-} : NoNamespace);
-/**
- * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the
- * **input** vars `parseEnv` validates are listed — the output-only aliases in
- * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they
- * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with
- * {@link EnvKeyToProp}.
- */
-interface EnvKeysByNamespace {
-  postgres: "DATABASE_URL" | "DATABASE_URL_UNPOOLED";
-  branch: "NEON_BRANCH";
-  auth: "NEON_AUTH_BASE_URL" | "NEON_AUTH_JWKS_URL";
-  dataApi: "NEON_DATA_API_URL";
-  storage: "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_ENDPOINT_URL_S3" | "AWS_REGION";
-  aiGateway: "NEON_AI_GATEWAY_TOKEN" | "NEON_AI_GATEWAY_BASE_URL";
-}
-/** The {@link NeonEnv} namespace interface backing each namespace key. */
-interface NamespaceEnv {
-  postgres: NeonPostgresEnv;
-  branch: NeonBranchEnv;
-  auth: NeonAuthEnv;
-  dataApi: NeonDataApiEnv;
-  storage: NeonStorageEnv;
-  aiGateway: NeonAiGatewayEnv;
-}
-/** OS-level env-var key → the camelCase property it sets on its namespace object. */
-interface EnvKeyToProp {
-  DATABASE_URL: "databaseUrl";
-  DATABASE_URL_UNPOOLED: "databaseUrlUnpooled";
-  NEON_BRANCH: "name";
-  NEON_AUTH_BASE_URL: "baseUrl";
-  NEON_AUTH_JWKS_URL: "jwksUrl";
-  NEON_DATA_API_URL: "url";
-  AWS_ACCESS_KEY_ID: "accessKeyId";
-  AWS_SECRET_ACCESS_KEY: "secretAccessKey";
-  AWS_ENDPOINT_URL_S3: "endpoint";
-  AWS_REGION: "region";
-  NEON_AI_GATEWAY_TOKEN: "apiKey";
-  NEON_AI_GATEWAY_BASE_URL: "baseUrl";
-}
-/**
- * The OS-level env-var keys selectable for a given policy: the union of input vars across
- * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the
- * `keys` filter — selecting a var from a namespace the policy does not enable is a type error
- * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).
- */
-type SelectableEnvKey<C extends Config> = EnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];
-/**
- * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced
- * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no
- * selected key are dropped, and within a kept namespace only the selected properties survive
- * — selecting just `["DATABASE_URL"]` yields `{ postgres: { databaseUrl: string } }`, with no
- * `databaseUrlUnpooled`.
- *
- * The policy gating lives on the `parseEnv` overload (which binds `K` to
- * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare
- * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops
- * any namespace whose intersection with the selection is empty (`[…] extends [never]`,
- * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its
- * camelCase property and looks the value type up on the canonical namespace interface, so it
- * stays correct if a field ever stops being a plain `string`.
- */
-type FilteredNeonEnv<K extends string> = { [N in keyof EnvKeysByNamespace as [Extract<K, EnvKeysByNamespace[N]>] extends [never] ? never : N]: { [P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P & keyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P & keyof EnvKeyToProp] & keyof NamespaceEnv[N]] } };
-interface FetchEnvOptions {
-  /**
-   * Neon project id. **Required** — the management API addresses branches through their
-   * project. Resolve it in your CLI (e.g. neonctl) and pass it in.
-   */
-  projectId: string;
-  /**
-   * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the
-   * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by
-   * id first, then by name, so either form works.
-   */
-  branch?: string;
-  /**
-   * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts
-   * a branch name or id. Still honored for backward compatibility; ignored when `branch`
-   * is set.
-   */
-  branchId?: string;
-  /**
-   * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →
-   * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`
-   * is supplied.
-   */
-  apiKey?: string;
-  /**
-   * Neon **management** API base URL (not the Auth base URL). Falls back to
-   * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.
-   */
-  apiHost?: string;
-  /**
-   * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely
-   * on the default real adapter built from `apiKey`.
-   */
-  api?: NeonApi;
-  /**
-   * Role name to fetch credentials for. When omitted, the connection role is auto-picked:
-   * the only role on the branch, else Neon's default owner (`neondb_owner`), else the
-   * single role left after dropping the managed Auth/Data API roles
-   * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with
-   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.
-   */
-  roleName?: string;
-  /**
-   * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,
-   * else the only database on the branch. Throws {@link PlatformError} with
-   * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is
-   * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when
-   * the branch has no databases or the requested `databaseName` does not exist.
-   */
-  databaseName?: string;
-}
-/**
- * Resolve the project + branch this process should target, then fetch live Neon
- * connection strings for that branch over the network. Async — calls the Neon API.
- *
- * Use this from build scripts and the `neon-env run` command, where top-level await is
- * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle
- * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use
- * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against
- * `process.env`.
- *
- * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)
- * explicitly (resolve them in your CLI, e.g. neonctl).
- *
- * ```ts
- * import config from "../neon";
- * import { fetchEnv } from "@neon/env";
- *
- * const env = await fetchEnv(config, { projectId: "patient-art-12345", branch: "main" });
- * const db = drizzle(neon(env.postgres.databaseUrl), { schema });
- * ```
- *
- * Pass `keys` to fetch only some of them — see the overload below.
- *
- * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything
- * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret
- * issued to a previous call) is minted afresh rather than recovered. Callers that hold
- * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides
- * what is still valid and narrows this call's `keys` accordingly.
- */
-declare function fetchEnv<const C extends Config, const K extends SelectableEnvKey<C>>(config: C, options: FetchEnvOptions & {
-  /**
-   * Fetch only these OS-level env vars, instead of everything the policy enables. The
-   * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is
-   * narrowed to match ({@link FilteredNeonEnv}).
-   *
-   * The point is not just a smaller result: **work is skipped too.** Leave out
-   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch
-   * credential is minted at all, so a caller that already holds valid secrets can refresh
-   * everything else without issuing a new one. The non-secret vars of the same features
-   * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not
-   * credential-backed and stay available on their own.
-   *
-   * The selection **intersects** with the policy rather than overriding it: naming a var
-   * the branch policy does not enable is not an error, it simply yields nothing.
-   */
-  keys: readonly K[];
-}): Promise<FilteredNeonEnv<K>>;
-declare function fetchEnv<const C extends Config>(config: C, options: FetchEnvOptions): Promise<NeonEnv<C>>;
-/**
- * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
- * narrowing. Exists for callers that compute the selection at runtime — notably
- * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the
- * branch — since the public overload's `keys` is bound to a literal union those callers cannot
- * produce without asserting.
- *
- * `keys === null` selects everything the policy enables.
- */
-declare function fetchEnvKeys(config: Config, options: FetchEnvOptions, keys: readonly string[] | null): Promise<ResolvedNeonEnv>;
-/**
- * Resolve the target branch and evaluate the policy against it — the first thing any
- * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}
- * so the two agree on which branch they're talking about and what it has enabled.
- */
-declare function resolveBranchPolicy(config: Config, options: Pick<FetchEnvOptions, "projectId" | "branch" | "branchId">, api: NeonApi): Promise<{
-  branch: NeonBranchSnapshot;
-  desired: ReturnType<typeof resolveConfig>;
-}>;
-/**
- * Scopes the branch credential should carry for a resolved branch policy. Only object storage
- * and the AI Gateway *require* a credential; functions never force one (they have no credential
- * of their own), but `functions:invoke` is added to the scope set when a credential is already
- * being minted for storage / the AI Gateway, so the one credential can invoke the branch's
- * functions too. Returns `[]` only when nothing credential-bearing is enabled.
- */
-declare function previewCredentialScopes(preview: ResolvedPreviewConfig | undefined): CredentialScope[];
-/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */
-declare function credentialName(branchName: string): string;
-/** The env-var keys a branch credential's secrets surface under, in emit order. */
-declare function credentialEnvKeys(flags: {
-  storage: boolean;
-  aiGateway: boolean;
-}): string[];
-/**
- * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller
- * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without
- * re-deriving which vars a policy implies.
- */
-declare function policyEnvKeys(desired: ReturnType<typeof resolveConfig>): string[];
-declare function createApiFromOptions(options: FetchEnvOptions): NeonApi;
-/**
- * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used
- * for cross-process transport. Named after the web-platform `.entries()` convention
- * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an
- * iterator of tuples since that's the shape env injection needs (wrap with
- * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`
- * to inject the vars into a subprocess's `process.env`.
- *
- * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which
- * conditional namespaces are present.
- */
-declare function toEntries(env: ResolvedNeonEnv): Record<string, string>;
-/**
- * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed
- * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and
- * property is optional so a filtered result — which legitimately carries only what was asked
- * for — projects to exactly the vars it holds instead of failing to type-check.
- */
-type ResolvedNeonEnv = { [N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]> };
-//#endregion
-export { FetchEnvOptions, FilteredNeonEnv, NEON_ENV_VAR_KEYS, NeonAiGatewayEnv, NeonAuthEnv, NeonBranchEnv, NeonDataApiEnv, NeonEnv, NeonPostgresEnv, NeonStorageEnv, ResolvedNeonEnv, SelectableEnvKey, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };
-//# sourceMappingURL=env.d.ts.map

package/dist/_shared/env-core/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","names":[],"sources":["../../../src/_shared/env-core/env.ts"],"mappings":";;;;;;;AAgMK,cA/HQ,iBA+HY,EAAA;EAapB;AAAS;AAAO;AAEjB;AAEC;EAEC,SAAA,MAAA,EAAA;IAEC,SAAA,IAAA,EAAA,aAAA;EAEC,CAAA;EAAC,SAAA,QAAA,EAAA;IAKJ,SAAO,WAAc,EAAA,cAAA;IAWrB,SAAU,mBAAA,EAAA,uBAAA;EAAA,CAAA;EAAW,SAAA,IAAA,EAAA;IAAuB,SAAA,OAAA,EAAA,oBAAA;IAAZ,SAAA,OAAA,EAAA,oBAAA;EAEtB,CAAA;EAAZ,SAAA,OAAA,EAAA;IACqB,SAAA,GAAA,EAAA,mBAAA;EAAZ,CAAA;EAAR;AAAO;AAAA;AAYK;AAAW;EAAuB,SAAA,OAAA,EAAA;IAAZ,SAAA,WAAA,EAAA,mBAAA;IAEvB,SAAA,eAAA,EAAA,uBAAA;IAAZ,SAAA,QAAA,EAAA,qBAAA;IACuB,SAAA,MAAA,EAAA,YAAA;EAAZ,CAAA;EAAV;AAAS;AAiBb;AAAmB;AAAW;AAAS;AAC5B;EAKD,SAAA,SAAA,EAAA;IACiB,SAAA,MAAA,EAAA,uBAAA;IAAZ,SAAA,OAAA,EAAA,0BAAA;EAAV,CAAA;AACM,CAAA;AACR;AACqB;AAAZ;AAAV;AACa;AACX;AACS,UApKI,aAAA,CAoKJ;EAAX,IAAA,EAAA,MAAA;AAAwC;AAAmB;AAC/C,UAhKG,eAAA,CAgKH;EAAZ;AACe;AACb;AAAW;EAWL,WAAA,EAAA,MAAA;EAcA;AAAY;AACX;AACF;AACF;EACG,mBAAA,EAAA,MAAA;AACA;AACE;AAAgB;AAAA;AAyB5B;AAA4B;AAAW;AACtC;AAAiC;AAAR;AAAmB,UApM5B,WAAA,CAoM4B;EAAkB,OAAA,EAAA,MAAA;EAiBnD;EAAe,OAAA,EAAA,MAAA;AACd;AACH;AAAG,UAhNI,cAAA,CAgNJ;EAAmB,GAAA,EAAA,MAAA;AAA9B;AAGE;AACY;AAAG;AAAmB;AAA9B;AAAqC;AAAa;AACjD;AAAgB;AAAa;AAAG;AAAa,UAtMrC,cAAA,CAsMqC;EAC7C,WAAA,EAAA,MAAA;EACA,eAAA,EAAA,MAAA;EAAa;EAAC,QAAA,EAAA,MAAA;EAIN;EAiFK,MAAA,EAAA,MAAQ;AAAA;AACb;AACiB;AAAjB;AAER;AACC;AAgBO;AAEU;AAAhB;AAAR,UAnSc,gBAAA,CAmSd;EAAO,MAAA,EAAA,MAAA;EACY,OAAA,EAAA,MAAQ;AAAA;AAAiB;AACtC;AACC;AACS;AAAR;AAAR,KA7RE,WAAA,GAAc,MA6RhB,CAAA,KAAA,EAAA,KAAA,CAAA;AAAO;AAiBV;AAAkC;AACzB;AACC;AAEC;AAAR;AAAO;AAuMV;AAAyC;AAChC;AACM,KA9eV,SA8eU,CAAA,CAAA,CAAA,GAAA,CA9eM,CA8eN,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,CA5eX,CA4eW,CAAA,SAAA,CAAA;EAAL,OAAA,EAAA,KAAA;AACJ,CAAA,CAAA,GAAA,KAAA,GAAA,CA3eD,CA2eC,CAAA,SAAA,CAAA,SAAA,CAAA,GAAA,KAAA,GAAA,CAzeA,CAyeA,CAAA,SAAA,CAAA,IAAA,CAAA,GAAA,IAAA,GAAA,CAveC,CAueD,CAAA,SAAA,CAAA;EAEG,OAAA,EAAA,IAAA;AACmB,CAAA,CAAA,GAAA,IAAA,GAAA,CAxepB,CAweoB,CAAA,SAAA,CAAA,MAAA,CAAA,GAAA,IAAA,GAAA,KAAA;AAAlB;AAFP,KAjeE,OAieF,CAAA,CAAA,CAAA,GAAA,CAAA,MAjesB,CAietB,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAAA,IAAA;AAAO;AAgDV;AAAuC;AAC7B;AACP;AAAe;AAalB;AAKA;AAoBA;AAA6B,KA9iBxB,UA8iBwB,CAAA,UA9iBH,MA8iBG,CAAA,GAAA,CA9iBQ,WA8iBR,CA9iBoB,CA8iBpB,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GA5iB1B,WA4iB0B,CA5iBd,CA4iBc,CAAA,SAAA,CAAA,CAAA,SAAA;EACD,OAAA,EAAA,KAAA,EAAA;AAAlB,CAAA,GA5iBN,OA4iBM,CA5iBE,WA4iBF,CA5iBc,CA4iBd,CAAA,CAAA,GAAA,KAAA;AAAU;AA0FpB;AAAoC;AAAU;AAAkB;AAAO;AA2KvE;AAAyB;AAAM;AAAkB,KAryB5C,WAqyB4C,CAAA,UAryBtB,MAqyBsB,CAAA,GAAA,CAryBX,WAqyBW,CAryBC,CAqyBD,CAAA,SAAA,CAAA,CAAA,CAAA,SAAA,CAAA,KAAA,CAAA,GAAA,KAAA,GAnyB9C,WAmyB8C,CAnyBlC,CAmyBkC,CAAA,SAAA,CAAA,CAAA,SAAA;EAAM,SAAA,EAAA,KAAA,EAAA;AA8BvD,CAAA,GAh0BI,SAg0BQ,CAh0BE,WAg0Ba,CAh0BD,CAg0BC,CAAA,CAAA,GAAA,KAAA;AAAA;AACd;AAAwB;AAAa;AAArB;AAAO;;;;;;;;;KAhzBxB,kBAAkB,SAAS;YAC5B;;;;;WAKD;KACL,UAAU,YAAY;QAChB;IACR,gBACD,UAAU,YAAY;WACT;IACX,gBACF,WAAW;WAA6B;IAAmB,gBAC3D,YAAY;aACG;IACb;;;;;;;;UAWM,kBAAA;;;;;;;;;UAcA,YAAA;YACC;UACF;QACF;WACG;WACA;aACE;;;UAIF,YAAA;;;;;;;;;;;;;;;;;;;;KAqBE,2BAA2B,UACtC,yBAAyB,QAAQ,WAAW;;;;;;;;;;;;;;;;KAiBjC,kDACC,uBACX,QAAQ,GAAG,mBAAmB,+BAG5B,YACI,QAAQ,GAAG,mBAAmB,OAAO,aAAa,UACjD,gBAAgB,aAAa,GAAG,aAAa,UAC7C,sBACA,aAAa;UAIL,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiCV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDe,yBACL,wBACA,iBAAiB,YAEzB,YACC;;;;;;;;;;;;;;;;iBAgBO;IAEd,QAAQ,gBAAgB;iBACL,yBAAyB,gBACtC,YACC,kBACP,QAAQ,QAAQ;;;;;;;;;;iBAiBG,YAAA,SACb,iBACC,kDAEP,QAAQ;;;;;;iBAuMW,mBAAA,SACb,iBACC,KAAK,4DACT,UACH;UACM;WACC,kBAAkB;;;;;;;;;iBA8CZ,uBAAA,UACN,oCACP;;iBAaa,cAAA;;iBAKA,iBAAA;;;;;;;;;iBAoBA,aAAA,UACN,kBAAkB;iBA0FZ,oBAAA,UAA8B,kBAAkB;;;;;;;;;;;;iBA2KhD,SAAA,MAAe,kBAAkB;;;;;;;KA8BrC,eAAA,iBACC,gBAAgB,QAAQ,aAAa"}

package/dist/_shared/env-core/env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.js","names":[],"sources":["../../../src/_shared/env-core/env.ts"],"sourcesContent":["/**\n * The Neon env core — resolving a branch's env from the Neon API, and projecting it into\n * OS-level `{ KEY: value }` pairs.\n *\n * Shared source, not a package: `scripts/sync-shared.mjs` copies it into `@neon/env` (which\n * publishes it as `fetchEnv` / `toEntries`) and into the `neon` CLI (which needs the\n * credential-reuse half in `reuse-secrets.ts`). See `shared/env-core/README.md` for why it is\n * a copy rather than an import.\n *\n * The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It\n * has no consumer outside `@neon/env`, so it stays in that package and imports this.\n */\n\nimport {\n\ttype Config,\n\ttype CredentialScope,\n\tcreateNeonApiFromOptions,\n\tderiveCredentialScopes,\n\tErrorCode,\n\ttype NeonApi,\n\ttype NeonBranchSnapshot,\n\ttype NeonBranchStorageSnapshot,\n\ttype NeonDatabaseSnapshot,\n\ttype NeonRoleSnapshot,\n\tPlatformError,\n\ttype ResolvedPreviewConfig,\n\tresolveConfig,\n} from \"@neon/config/v1\";\n\n/**\n * Mapping between the {@link NeonEnv} property paths and the OS-level env-var keys used\n * for cross-process transport (via `.env` files, `env run -- <cmd>`, or anything else\n * that talks to `process.env`).\n *\n * Each top-level key here is a {@link NeonEnv} namespace; the inner record maps the\n * camelCase property names exposed to TypeScript to the UPPER_SNAKE env-var names used\n * by the OS. Keep this in sync with {@link postgresEnvSchema} / {@link authEnvSchema} /\n * {@link dataApiEnvSchema}.\n */\n/**\n * Neon's default branch owner role, created with every project. This is the role a\n * `DATABASE_URL` should connect as.\n */\nconst NEON_DEFAULT_OWNER_ROLE = \"neondb_owner\";\n\n/**\n * Neon's default database, created with every project. When a branch has several databases\n * and none was requested, this is preferred for the `DATABASE_URL` so the common case (a\n * user added a second database next to `neondb`) auto-picks without asking.\n */\nconst NEON_DEFAULT_DATABASE = \"neondb\";\n\n/**\n * Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back\n * RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —\n * so they're skipped when auto-picking the connection role. Enabling Neon Auth or the\n * Data API (`neon config apply`) adds these next to the owner role, which is why a plain\n * branch routinely reports more than one role.\n */\nconst NEON_MANAGED_AUTH_ROLES: ReadonlySet<string> = new Set([\n\t\"authenticator\",\n\t\"anonymous\",\n\t\"authenticated\",\n]);\n\nexport const NEON_ENV_VAR_KEYS = {\n\t/**\n\t * Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the\n\t * Neon Functions runtime on every branch (including the default) by default. `env pull` /\n\t * `neon dev` / `neon-env run` emit it too so local dev mirrors the deployed runtime.\n\t */\n\tbranch: {\n\t\tname: \"NEON_BRANCH\",\n\t},\n\tpostgres: {\n\t\tdatabaseUrl: \"DATABASE_URL\",\n\t\tdatabaseUrlUnpooled: \"DATABASE_URL_UNPOOLED\",\n\t},\n\tauth: {\n\t\tbaseUrl: \"NEON_AUTH_BASE_URL\",\n\t\tjwksUrl: \"NEON_AUTH_JWKS_URL\",\n\t},\n\tdataApi: {\n\t\turl: \"NEON_DATA_API_URL\",\n\t},\n\t/**\n\t * Object storage (Preview). The S3 SDKs read `AWS_*` from their standard config chain, so\n\t * a branch credential + `neon dev` / `env pull` makes object storage work from env alone.\n\t * `region` is injected under the SDK-standard `AWS_REGION`.\n\t */\n\tstorage: {\n\t\taccessKeyId: \"AWS_ACCESS_KEY_ID\",\n\t\tsecretAccessKey: \"AWS_SECRET_ACCESS_KEY\",\n\t\tendpoint: \"AWS_ENDPOINT_URL_S3\",\n\t\tregion: \"AWS_REGION\",\n\t},\n\t/**\n\t * AI Gateway (Preview). Exposed under the Neon-branded env vars the deployed Functions\n\t * runtime injects: `apiKey` is the minted credential's bearer (`NEON_AI_GATEWAY_TOKEN`)\n\t * and `baseUrl` is the bare branch gateway host (`NEON_AI_GATEWAY_BASE_URL`,\n\t * `scheme://host`, no path). Clients like `@neon/ai-sdk-provider` read these and append the\n\t * dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves (https://github.com/vercel/ai/pull/15997).\n\t */\n\taiGateway: {\n\t\tapiKey: \"NEON_AI_GATEWAY_TOKEN\",\n\t\tbaseUrl: \"NEON_AI_GATEWAY_BASE_URL\",\n\t},\n} as const;\n\n/**\n * Branch identity for the resolved branch. Always present on a `fetchEnv` result (the branch\n * name is always known); on a `parseEnv` result it's present only when `NEON_BRANCH` was\n * injected into `process.env` (the Functions runtime injects it by default, as do `neon dev` /\n * `neon-env run` / `env pull`). `name` is the branch **name** (e.g. `main`, `preview/foo`).\n */\nexport interface NeonBranchEnv {\n\tname: string;\n}\n\n/** Per-namespace inner shapes. Exposed so consumers can name the parts independently. */\nexport interface NeonPostgresEnv {\n\t/**\n\t * Pooled connection string (via Neon's PgBouncer pooler). The right default for\n\t * serverless drivers (`@neondatabase/serverless`, edge runtimes, Postgres.js, …).\n\t */\n\tdatabaseUrl: string;\n\t/**\n\t * Direct (unpooled) connection string. Use this when you need session-level\n\t * features (`LISTEN`/`NOTIFY`, prepared statements across calls, transactions\n\t * spanning round-trips) that PgBouncer's transaction-mode pooling drops.\n\t */\n\tdatabaseUrlUnpooled: string;\n}\n\n/**\n * Bits of a Neon Auth integration for the resolved branch. Only present on `NeonEnv`\n * when the branch policy enables `auth`.\n *\n * Neon Auth exposes the `baseUrl` (which doubles as the publishable client identifier) and\n * the `jwksUrl` used to verify tokens it issues. `fetchEnv` reads both from the live\n * integration; `parseEnv` reads them from `process.env` (`NEON_AUTH_BASE_URL` /\n * `NEON_AUTH_JWKS_URL`).\n */\nexport interface NeonAuthEnv {\n\tbaseUrl: string;\n\t/** JWKS URL for verifying tokens issued by Neon Auth (`NEON_AUTH_JWKS_URL`). */\n\tjwksUrl: string;\n}\n\n/** Bits of a Neon Data API integration. Only present when the branch policy enables it. */\nexport interface NeonDataApiEnv {\n\turl: string;\n}\n\n/**\n * S3-compatible object-storage access for the branch (Preview). Present on `NeonEnv` only\n * when the policy declares `preview.buckets`. Combines a minted branch credential's access\n * keys (`accessKeyId` = the credential's full token id, e.g. `nak_live_…`, which is what the\n * storage gateway authenticates against; `secretAccessKey` = its\n * `s3_secret_access_key`) with the branch's non-secret connection details\n * (`endpoint`/`region`, from `GET .../storage`). Projects to the AWS SDK's\n * standard config env (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_ENDPOINT_URL_S3`,\n * `AWS_REGION`) so the S3 client works from env alone. Neon's storage gateway always\n * requires path-style addressing, so set `forcePathStyle: true` on your S3 client.\n */\nexport interface NeonStorageEnv {\n\taccessKeyId: string;\n\tsecretAccessKey: string;\n\t/** S3-compatible endpoint URL for the branch. */\n\tendpoint: string;\n\t/** AWS region string (e.g. `us-east-2`). Injected as `AWS_REGION`. */\n\tregion: string;\n}\n\n/**\n * AI Gateway access for the branch (Preview). Present on `NeonEnv` only when the policy\n * enables `preview.aiGateway`. `apiKey` is the minted credential's bearer (`api_token`);\n * `baseUrl` is the bare branch-scoped gateway host\n * (`https://<branchId>-api.ai.<region>.…`, no path). Projects to the Neon-branded env\n * (`NEON_AI_GATEWAY_TOKEN`, `NEON_AI_GATEWAY_BASE_URL`); clients like `@neon/ai-sdk-provider`\n * append the dialect route (`/v1`, `/openai/v1`, `/anthropic/v1`) themselves.\n */\nexport interface NeonAiGatewayEnv {\n\tapiKey: string;\n\tbaseUrl: string;\n}\n\n/**\n * Empty record alias used as the \"false\" branch of the conditional namespace adds below.\n * `Record<never, never>` is the no-op for intersection — the cleaner alternative to `{}`,\n * which biome rejects (it means \"any non-null\", not \"empty object\").\n */\ntype NoNamespace = Record<never, never>;\n\n/**\n * Resolve a **static** service toggle (the value of `config.auth` / `config.dataApi`) to a\n * type-level boolean. The whole-thing wrapping (`[T] extends […]`) turns off distribution\n * so a union/`undefined` is checked as one unit:\n *\n * - `false` / `{ enabled: false }` / `undefined` → `false`\n * - `true` / `{ enabled: true }` / any other object (`{}`, `{ enabled?: boolean }`) → `true`\n *   (a present toggle defaults to enabled)\n * - the bare `boolean | ServiceToggle | undefined` (the default `Config` param, no literal\n *   info) → `false`, so an untyped policy yields just `{ postgres }`.\n */\ntype ServiceOn<T> = [T] extends [false]\n\t? false\n\t: [T] extends [{ enabled: false }]\n\t\t? false\n\t\t: [T] extends [undefined]\n\t\t\t? false\n\t\t\t: [T] extends [true]\n\t\t\t\t? true\n\t\t\t\t: [T] extends [{ enabled: true }]\n\t\t\t\t\t? true\n\t\t\t\t\t: [T] extends [object]\n\t\t\t\t\t\t? true\n\t\t\t\t\t\t: false;\n\n/** True when `T` has at least one known key; `false` for `{}` / `never`. */\ntype HasKeys<T> = [keyof T] extends [never] ? false : true;\n\n/**\n * Whether the policy's **static** `preview` block declares at least one object-storage bucket\n * (`preview.buckets`). Drives whether {@link NeonEnv} carries the `storage` namespace.\n *\n * The leading `[never]` guard is load-bearing: when a policy has no `preview` at all,\n * `NonNullable<C[\"preview\"]>` is `never`, and without the guard the `extends { … }` probe\n * below would vacuously match (everything extends `never`-derived shapes) and `HasKeys<never>`\n * would resolve `true`, wrongly adding the namespace. The guard short-circuits to `false`.\n */\ntype HasBuckets<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never]\n\t? false\n\t: NonNullable<C[\"preview\"]> extends { buckets: infer B }\n\t\t? HasKeys<NonNullable<B>>\n\t\t: false;\n\n/**\n * Whether the policy's **static** `preview` block enables the AI Gateway\n * (`preview.aiGateway`). Drives whether {@link NeonEnv} carries the `aiGateway` namespace.\n *\n * The leading `[never]` guard is load-bearing for the same reason as {@link HasBuckets}: when\n * a policy has no `preview`, `NonNullable<C[\"preview\"]>` is `never`, and a naked `never` in the\n * `extends` below would *distribute* (collapsing the result — and the whole `NeonEnv`\n * intersection — to `never`). The tuple-wrapped guard short-circuits that to `false`.\n */\ntype AiGatewayOn<C extends Config> = [NonNullable<C[\"preview\"]>] extends [never]\n\t? false\n\t: NonNullable<C[\"preview\"]> extends { aiGateway: infer A }\n\t\t? ServiceOn<NonNullable<A>>\n\t\t: false;\n\n/**\n * Static, namespaced shape of `fetchEnv` / `parseEnv`'s return value. Generic over the\n * {@link Config} so the type system knows which optional namespaces are present.\n *\n * Because the secret-bearing toggles now live in the **static** top-level `config.auth` /\n * `config.dataApi` (not inside a per-branch closure), the namespace presence is a direct\n * read of those fields — no union-across-branches, no default-config escape hatch:\n *\n * - `postgres` is always present.\n * - `auth` is added iff `config.auth` is statically enabled.\n * - `dataApi` is added iff `config.dataApi` is statically enabled.\n * - `storage` is added iff `config.preview.buckets` declares at least one bucket.\n * - `aiGateway` is added iff `config.preview.aiGateway` is statically enabled.\n */\nexport type NeonEnv<C extends Config = Config> = {\n\tpostgres: NeonPostgresEnv;\n\t/**\n\t * Branch identity (`NEON_BRANCH`). Optional because `parseEnv` only surfaces it when the\n\t * var was injected; `fetchEnv` always populates it.\n\t */\n\tbranch?: NeonBranchEnv;\n} & (ServiceOn<NonNullable<C[\"auth\"]>> extends true\n\t? { auth: NeonAuthEnv }\n\t: NoNamespace) &\n\t(ServiceOn<NonNullable<C[\"dataApi\"]>> extends true\n\t\t? { dataApi: NeonDataApiEnv }\n\t\t: NoNamespace) &\n\t(HasBuckets<C> extends true ? { storage: NeonStorageEnv } : NoNamespace) &\n\t(AiGatewayOn<C> extends true\n\t\t? { aiGateway: NeonAiGatewayEnv }\n\t\t: NoNamespace);\n\n// ───────────────────────── env-var key filtering ─────────────────────────\n\n/**\n * OS-level env-var keys grouped by the {@link NeonEnv} namespace they populate. Only the\n * **input** vars `parseEnv` validates are listed — the output-only aliases in\n * {@link NEON_ENV_VAR_KEYS} (`NEON_AI_GATEWAY_TOKEN`, …) are intentionally absent, so they\n * are not selectable in a `parseEnv(config, keys)` filter. Keep in sync with\n * {@link EnvKeyToProp}.\n */\ninterface EnvKeysByNamespace {\n\tpostgres: \"DATABASE_URL\" | \"DATABASE_URL_UNPOOLED\";\n\tbranch: \"NEON_BRANCH\";\n\tauth: \"NEON_AUTH_BASE_URL\" | \"NEON_AUTH_JWKS_URL\";\n\tdataApi: \"NEON_DATA_API_URL\";\n\tstorage:\n\t\t| \"AWS_ACCESS_KEY_ID\"\n\t\t| \"AWS_SECRET_ACCESS_KEY\"\n\t\t| \"AWS_ENDPOINT_URL_S3\"\n\t\t| \"AWS_REGION\";\n\taiGateway: \"NEON_AI_GATEWAY_TOKEN\" | \"NEON_AI_GATEWAY_BASE_URL\";\n}\n\n/** The {@link NeonEnv} namespace interface backing each namespace key. */\ninterface NamespaceEnv {\n\tpostgres: NeonPostgresEnv;\n\tbranch: NeonBranchEnv;\n\tauth: NeonAuthEnv;\n\tdataApi: NeonDataApiEnv;\n\tstorage: NeonStorageEnv;\n\taiGateway: NeonAiGatewayEnv;\n}\n\n/** OS-level env-var key → the camelCase property it sets on its namespace object. */\ninterface EnvKeyToProp {\n\tDATABASE_URL: \"databaseUrl\";\n\tDATABASE_URL_UNPOOLED: \"databaseUrlUnpooled\";\n\tNEON_BRANCH: \"name\";\n\tNEON_AUTH_BASE_URL: \"baseUrl\";\n\tNEON_AUTH_JWKS_URL: \"jwksUrl\";\n\tNEON_DATA_API_URL: \"url\";\n\tAWS_ACCESS_KEY_ID: \"accessKeyId\";\n\tAWS_SECRET_ACCESS_KEY: \"secretAccessKey\";\n\tAWS_ENDPOINT_URL_S3: \"endpoint\";\n\tAWS_REGION: \"region\";\n\tNEON_AI_GATEWAY_TOKEN: \"apiKey\";\n\tNEON_AI_GATEWAY_BASE_URL: \"baseUrl\";\n}\n\n/**\n * The OS-level env-var keys selectable for a given policy: the union of input vars across\n * exactly the namespaces {@link NeonEnv}<C> carries. Drives the typesafe autocomplete of the\n * `keys` filter — selecting a var from a namespace the policy does not enable is a type error\n * (e.g. `NEON_AUTH_BASE_URL` is only offered once the policy turns on `auth`).\n */\nexport type SelectableEnvKey<C extends Config> =\n\tEnvKeysByNamespace[keyof NeonEnv<C> & keyof EnvKeysByNamespace];\n\n/**\n * The result shape of a **filtered** `parseEnv(config, keys)` call: the namespaced\n * {@link NeonEnv} restricted to exactly the selected OS-level keys `K`. Namespaces with no\n * selected key are dropped, and within a kept namespace only the selected properties survive\n * — selecting just `[\"DATABASE_URL\"]` yields `{ postgres: { databaseUrl: string } }`, with no\n * `databaseUrlUnpooled`.\n *\n * The policy gating lives on the `parseEnv` overload (which binds `K` to\n * {@link SelectableEnvKey}); this type only needs the selection, so it takes a bare\n * `K extends string` and filters with `Extract`. The outer mapped type's `as` clause drops\n * any namespace whose intersection with the selection is empty (`[…] extends [never]`,\n * tuple-wrapped to switch off distribution); the inner one re-keys each selected OS var to its\n * camelCase property and looks the value type up on the canonical namespace interface, so it\n * stays correct if a field ever stops being a plain `string`.\n */\nexport type FilteredNeonEnv<K extends string> = {\n\t[N in keyof EnvKeysByNamespace as [\n\t\tExtract<K, EnvKeysByNamespace[N]>,\n\t] extends [never]\n\t\t? never\n\t\t: N]: {\n\t\t[P in Extract<K, EnvKeysByNamespace[N]> as EnvKeyToProp[P &\n\t\t\tkeyof EnvKeyToProp]]: NamespaceEnv[N][EnvKeyToProp[P &\n\t\t\tkeyof EnvKeyToProp] &\n\t\t\tkeyof NamespaceEnv[N]];\n\t};\n};\n\nexport interface FetchEnvOptions {\n\t/**\n\t * Neon project id. **Required** — the management API addresses branches through their\n\t * project. Resolve it in your CLI (e.g. neonctl) and pass it in.\n\t */\n\tprojectId: string;\n\t/**\n\t * Neon branch — its **name** (e.g. `main`) or its id (`br-…`). **Required** (or pass the\n\t * legacy {@link FetchEnvOptions.branchId}). Resolved against the project's branches by\n\t * id first, then by name, so either form works.\n\t */\n\tbranch?: string;\n\t/**\n\t * @deprecated Legacy id-only field. Prefer {@link FetchEnvOptions.branch}, which accepts\n\t * a branch name or id. Still honored for backward compatibility; ignored when `branch`\n\t * is set.\n\t */\n\tbranchId?: string;\n\t/**\n\t * Neon API key. Resolved via the standard chain (option → `NEON_API_KEY` →\n\t * `~/.config/neonctl/credentials.json`) when omitted. Ignored when a custom `api`\n\t * is supplied.\n\t */\n\tapiKey?: string;\n\t/**\n\t * Neon **management** API base URL (not the Auth base URL). Falls back to\n\t * `NEON_API_HOST`, then production. Ignored when a custom `api` is supplied.\n\t */\n\tapiHost?: string;\n\t/**\n\t * Inject a custom NeonApi adapter. Primarily used by tests; production callers can rely\n\t * on the default real adapter built from `apiKey`.\n\t */\n\tapi?: NeonApi;\n\t/**\n\t * Role name to fetch credentials for. When omitted, the connection role is auto-picked:\n\t * the only role on the branch, else Neon's default owner (`neondb_owner`), else the\n\t * single role left after dropping the managed Auth/Data API roles\n\t * (`authenticator`/`anonymous`/`authenticated`). Throws {@link PlatformError} with\n\t * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` only when more than one app role remains.\n\t */\n\troleName?: string;\n\t/**\n\t * Database name. When omitted, it is auto-picked: Neon's default `neondb` if present,\n\t * else the only database on the branch. Throws {@link PlatformError} with\n\t * `PLATFORM_AMBIGUOUS_BRANCH_AUTH` when the branch has several databases and none is\n\t * `neondb` (pass `databaseName` to disambiguate), and `PLATFORM_BRANCH_NOT_FOUND` when\n\t * the branch has no databases or the requested `databaseName` does not exist.\n\t */\n\tdatabaseName?: string;\n}\n\n/**\n * Resolve the project + branch this process should target, then fetch live Neon\n * connection strings for that branch over the network. Async — calls the Neon API.\n *\n * Use this from build scripts and the `neon-env run` command, where top-level await is\n * fine. For application code that needs a synchronous bootstrap (most frameworks: Drizzle\n * config, Next.js, Vite, etc.), inject env vars via `neon-env run -- <cmd>` and use\n * {@link parseEnv} instead — same {@link NeonEnv} shape, but a sync call against\n * `process.env`.\n *\n * Filesystem- and env-agnostic: pass `projectId` and the target `branch` (name or id)\n * explicitly (resolve them in your CLI, e.g. neonctl).\n *\n * ```ts\n * import config from \"../neon\";\n * import { fetchEnv } from \"@neon/env\";\n *\n * const env = await fetchEnv(config, { projectId: \"patient-art-12345\", branch: \"main\" });\n * const db = drizzle(neon(env.postgres.databaseUrl), { schema });\n * ```\n *\n * Pass `keys` to fetch only some of them — see the overload below.\n *\n * The package does **not** read `process.env`, mutate it, or touch the filesystem. Everything\n * it returns comes from the Neon API, so a value the API cannot produce (a one-time secret\n * issued to a previous call) is minted afresh rather than recovered. Callers that hold\n * persisted secrets and want to keep them use {@link fetchEnvReusingSecrets}, which decides\n * what is still valid and narrows this call's `keys` accordingly.\n */\nexport async function fetchEnv<\n\tconst C extends Config,\n\tconst K extends SelectableEnvKey<C>,\n>(\n\tconfig: C,\n\toptions: FetchEnvOptions & {\n\t\t/**\n\t\t * Fetch only these OS-level env vars, instead of everything the policy enables. The\n\t\t * keys autocomplete from the policy ({@link SelectableEnvKey}), and the result is\n\t\t * narrowed to match ({@link FilteredNeonEnv}).\n\t\t *\n\t\t * The point is not just a smaller result: **work is skipped too.** Leave out\n\t\t * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `NEON_AI_GATEWAY_TOKEN` and no branch\n\t\t * credential is minted at all, so a caller that already holds valid secrets can refresh\n\t\t * everything else without issuing a new one. The non-secret vars of the same features\n\t\t * (`AWS_ENDPOINT_URL_S3`, `AWS_REGION`, `NEON_AI_GATEWAY_BASE_URL`) are not\n\t\t * credential-backed and stay available on their own.\n\t\t *\n\t\t * The selection **intersects** with the policy rather than overriding it: naming a var\n\t\t * the branch policy does not enable is not an error, it simply yields nothing.\n\t\t */\n\t\tkeys: readonly K[];\n\t},\n): Promise<FilteredNeonEnv<K>>;\nexport async function fetchEnv<const C extends Config>(\n\tconfig: C,\n\toptions: FetchEnvOptions,\n): Promise<NeonEnv<C>>;\nexport async function fetchEnv(\n\tconfig: Config,\n\toptions: FetchEnvOptions & { keys?: readonly string[] },\n): Promise<unknown> {\n\treturn fetchEnvKeys(config, options, options.keys ?? null);\n}\n\n/**\n * The {@link fetchEnv} body, with the key selection as a plain argument and no generic\n * narrowing. Exists for callers that compute the selection at runtime — notably\n * {@link fetchEnvReusingSecrets}, which decides which keys it still needs by checking the\n * branch — since the public overload's `keys` is bound to a literal union those callers cannot\n * produce without asserting.\n *\n * `keys === null` selects everything the policy enables.\n */\nexport async function fetchEnvKeys(\n\tconfig: Config,\n\toptions: FetchEnvOptions,\n\tkeys: readonly string[] | null,\n): Promise<ResolvedNeonEnv> {\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst projectId = options.projectId;\n\tconst { branch, desired } = await resolveBranchPolicy(config, options, api);\n\n\tconst selection = keys ? new Set<string>(keys) : null;\n\tconst wants = (key: string): boolean =>\n\t\tselection === null || selection.has(key);\n\n\tconst result: ResolvedNeonEnv = {};\n\tconst [roles, databases] = await Promise.all([\n\t\tapi.listBranchRoles(projectId, branch.id),\n\t\tapi.listBranchDatabases(projectId, branch.id),\n\t]);\n\n\tconst roleName = pickRoleName(roles, branch, options.roleName);\n\tconst databaseName = pickDatabaseName(\n\t\tdatabases,\n\t\tbranch,\n\t\toptions.databaseName,\n\t);\n\n\t// Fan out: always fetch both Postgres URIs — the direct one also derives the AI Gateway\n\t// host, so a selection that drops `DATABASE_URL_UNPOOLED` still needs it. Conditionally\n\t// fetch auth + dataApi based on the branch policy and the selection. Auth key fields are\n\t// only returned at integration creation time; for Better Auth they may legitimately be\n\t// empty, so they can come back as empty strings.\n\tconst K = NEON_ENV_VAR_KEYS;\n\tconst wantsAuth =\n\t\tdesired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));\n\tconst wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);\n\n\tconst [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all(\n\t\t[\n\t\t\tapi.getConnectionUri(projectId, {\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName,\n\t\t\t\troleName,\n\t\t\t\tpooled: true,\n\t\t\t}),\n\t\t\tapi.getConnectionUri(projectId, {\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tdatabaseName,\n\t\t\t\troleName,\n\t\t\t\tpooled: false,\n\t\t\t}),\n\t\t\twantsAuth\n\t\t\t\t? api.getNeonAuth(projectId, branch.id)\n\t\t\t\t: Promise.resolve(null),\n\t\t\twantsDataApi\n\t\t\t\t? api.getNeonDataApi(projectId, branch.id, databaseName)\n\t\t\t\t: Promise.resolve(null),\n\t\t],\n\t);\n\n\tconst postgres: Partial<NeonPostgresEnv> = {};\n\tif (wants(K.postgres.databaseUrl)) postgres.databaseUrl = pooled.uri;\n\tif (wants(K.postgres.databaseUrlUnpooled)) {\n\t\tpostgres.databaseUrlUnpooled = unpooled.uri;\n\t}\n\tif (Object.keys(postgres).length > 0) result.postgres = postgres;\n\n\t// Branch identity, mirroring what the Functions runtime injects on every branch. Surfaced\n\t// as `NEON_BRANCH` so local dev (`neon dev` / `neon-env run` / `env pull`) matches the\n\t// deployed runtime. Uses the branch name.\n\tif (wants(K.branch.name)) {\n\t\tresult.branch = { name: branch.name } satisfies NeonBranchEnv;\n\t}\n\n\tif (wantsAuth) {\n\t\tif (!authSnapshot) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.NotFound,\n\t\t\t\t[\n\t\t\t\t\t`fetchEnv: branch policy enables auth but no Neon Auth integration is enabled on branch ${branch.name} (${branch.id}).`,\n\t\t\t\t\t\"Enable it via `apply(config, { projectId, branchId })` (or `npx neon …`), in the Neon Console — then re-run fetchEnv. Or return auth.enabled=false.\",\n\t\t\t\t].join(\" \"),\n\t\t\t\t{\n\t\t\t\t\tdetails: { projectId, branchId: branch.id },\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\tconst auth: Partial<NeonAuthEnv> = {};\n\t\tif (wants(K.auth.baseUrl)) auth.baseUrl = authSnapshot.baseUrl ?? \"\";\n\t\tif (wants(K.auth.jwksUrl)) auth.jwksUrl = authSnapshot.jwksUrl ?? \"\";\n\t\tresult.auth = auth;\n\t}\n\n\tif (wantsDataApi) {\n\t\tif (!dataApiSnapshot) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.NotFound,\n\t\t\t\t[\n\t\t\t\t\t`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${databaseName}.`,\n\t\t\t\t\t\"Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false.\",\n\t\t\t\t].join(\" \"),\n\t\t\t\t{\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tprojectId,\n\t\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\t\tdatabaseName,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\tresult.dataApi = { url: dataApiSnapshot.url } satisfies NeonDataApiEnv;\n\t}\n\n\t// Object storage + AI Gateway (Preview). A single branch credential backs whichever of\n\t// these the policy enables; functions never force one but ride along on its scopes. None\n\t// of this runs when the policy enables neither, so the Postgres / Auth / Data API path\n\t// never touches the credentials/storage endpoints (and keeps working on production, where\n\t// they may not exist yet).\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst wantsStorage =\n\t\tstorageEnabled &&\n\t\t(wants(K.storage.accessKeyId) ||\n\t\t\twants(K.storage.secretAccessKey) ||\n\t\t\twants(K.storage.endpoint) ||\n\t\t\twants(K.storage.region));\n\tconst wantsGateway =\n\t\tgatewayEnabled &&\n\t\t(wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));\n\t// A credential is minted only for its *secrets*. The endpoint, region and gateway host\n\t// are plain branch metadata, so selecting only those touches no credential at all — which\n\t// is how a caller holding valid secrets refreshes the rest without issuing a new one.\n\tconst wantsCredential =\n\t\t(storageEnabled &&\n\t\t\t(wants(K.storage.accessKeyId) ||\n\t\t\t\twants(K.storage.secretAccessKey))) ||\n\t\t(gatewayEnabled && wants(K.aiGateway.apiKey));\n\n\tif (wantsStorage || wantsGateway) {\n\t\t// Read the branch's storage settings *before* minting: a policy that declares buckets\n\t\t// on a branch without storage has to fail without having spent a credential on a\n\t\t// resolve that cannot succeed.\n\t\tlet storage: NeonBranchStorageSnapshot | null = null;\n\t\tif (wantsStorage) {\n\t\t\tstorage = await api.getProjectBranchStorage(projectId, branch.id);\n\t\t\tif (!storage) {\n\t\t\t\tthrow new PlatformError(\n\t\t\t\t\tErrorCode.NotFound,\n\t\t\t\t\t[\n\t\t\t\t\t\t`fetchEnv: branch policy declares object storage (preview.buckets) but storage is not enabled on branch ${branch.name} (${branch.id}).`,\n\t\t\t\t\t\t\"Enable it via `apply(config, { projectId, branchId })` (or in the Neon Console) — then re-run fetchEnv. Or remove preview.buckets.\",\n\t\t\t\t\t].join(\" \"),\n\t\t\t\t\t{ details: { projectId, branchId: branch.id } },\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst secrets = wantsCredential\n\t\t\t? await mintBranchCredential({\n\t\t\t\t\tapi,\n\t\t\t\t\tprojectId,\n\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\tbranchName: branch.name,\n\t\t\t\t\tscopes: previewCredentialScopes(desired.preview),\n\t\t\t\t})\n\t\t\t: null;\n\n\t\tif (storage) {\n\t\t\tconst storageEnv: Partial<NeonStorageEnv> = {};\n\t\t\tif (secrets && wants(K.storage.accessKeyId)) {\n\t\t\t\tstorageEnv.accessKeyId = secrets.accessKeyId;\n\t\t\t}\n\t\t\tif (secrets && wants(K.storage.secretAccessKey)) {\n\t\t\t\tstorageEnv.secretAccessKey = secrets.secretAccessKey;\n\t\t\t}\n\t\t\tif (wants(K.storage.endpoint)) {\n\t\t\t\tstorageEnv.endpoint = storage.s3Endpoint;\n\t\t\t}\n\t\t\tif (wants(K.storage.region)) storageEnv.region = storage.region;\n\t\t\tresult.storage = storageEnv;\n\t\t}\n\t\tif (wantsGateway) {\n\t\t\tconst gateway: Partial<NeonAiGatewayEnv> = {};\n\t\t\tif (secrets && wants(K.aiGateway.apiKey)) {\n\t\t\t\tgateway.apiKey = secrets.apiToken;\n\t\t\t}\n\t\t\tif (wants(K.aiGateway.baseUrl)) {\n\t\t\t\t// Bare branch-scoped gateway host derived from the branch's connection URI —\n\t\t\t\t// not the control-plane API origin (which doesn't serve the gateway). Clients\n\t\t\t\t// append the dialect route (/v1, /openai/v1, /anthropic/v1) themselves.\n\t\t\t\tgateway.baseUrl = aiGatewayBaseUrl(branch.id, unpooled.uri);\n\t\t\t}\n\t\t\tresult.aiGateway = gateway;\n\t\t}\n\t}\n\n\treturn result;\n}\n\n/**\n * Resolve the target branch and evaluate the policy against it — the first thing any\n * branch-scoped operation needs. Shared by {@link fetchEnv} and {@link fetchEnvReusingSecrets}\n * so the two agree on which branch they're talking about and what it has enabled.\n */\nexport async function resolveBranchPolicy(\n\tconfig: Config,\n\toptions: Pick<FetchEnvOptions, \"projectId\" | \"branch\" | \"branchId\">,\n\tapi: NeonApi,\n): Promise<{\n\tbranch: NeonBranchSnapshot;\n\tdesired: ReturnType<typeof resolveConfig>;\n}> {\n\tconst projectId = options.projectId;\n\tconst branches = await api.listBranches(projectId);\n\tif (branches.length === 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.BranchNotFound,\n\t\t\t[\n\t\t\t\t`fetchEnv: project ${projectId} has no branches.`,\n\t\t\t\t\"Deploy your neon.ts policy (or create a branch) first, or pick a different project id.\",\n\t\t\t].join(\" \"),\n\t\t\t{ details: { projectId } },\n\t\t);\n\t}\n\n\tconst branchRef = options.branch ?? options.branchId;\n\tif (!branchRef) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.BranchNotFound,\n\t\t\t[\n\t\t\t\t\"fetchEnv: no branch provided.\",\n\t\t\t\t\"Pass `branch` with a branch name (e.g. `main`) or id (`br-…`).\",\n\t\t\t].join(\" \"),\n\t\t\t{ details: { projectId } },\n\t\t);\n\t}\n\tconst branch = resolveBranch(branchRef, branches);\n\tconst desired = resolveConfig(config, {\n\t\tname: branch.name,\n\t\tid: branch.id,\n\t\texists: true,\n\t\t...(branch.parentId ? { parentId: branch.parentId } : {}),\n\t\tisDefault: branch.isDefault,\n\t\tisProtected: branch.protected,\n\t\t...(branch.expiresAt ? { expiresAt: branch.expiresAt } : {}),\n\t});\n\treturn { branch, desired };\n}\n\n/**\n * Scopes the branch credential should carry for a resolved branch policy. Only object storage\n * and the AI Gateway *require* a credential; functions never force one (they have no credential\n * of their own), but `functions:invoke` is added to the scope set when a credential is already\n * being minted for storage / the AI Gateway, so the one credential can invoke the branch's\n * functions too. Returns `[]` only when nothing credential-bearing is enabled.\n */\nexport function previewCredentialScopes(\n\tpreview: ResolvedPreviewConfig | undefined,\n): CredentialScope[] {\n\tif (!preview) return [];\n\tconst storage = preview.buckets.length > 0;\n\tconst aiGateway = preview.aiGatewayEnabled;\n\tif (!storage && !aiGateway) return [];\n\treturn deriveCredentialScopes({\n\t\tstorage,\n\t\taiGateway,\n\t\tfunctions: preview.functions.length > 0,\n\t});\n}\n\n/** The `name` this tool stamps on every credential it mints, so it can recognize its own. */\nexport function credentialName(branchName: string): string {\n\treturn `neon-env ${branchName}`;\n}\n\n/** The env-var keys a branch credential's secrets surface under, in emit order. */\nexport function credentialEnvKeys(flags: {\n\tstorage: boolean;\n\taiGateway: boolean;\n}): string[] {\n\treturn [\n\t\t...(flags.storage\n\t\t\t? [\n\t\t\t\t\tNEON_ENV_VAR_KEYS.storage.accessKeyId,\n\t\t\t\t\tNEON_ENV_VAR_KEYS.storage.secretAccessKey,\n\t\t\t\t]\n\t\t\t: []),\n\t\t...(flags.aiGateway ? [NEON_ENV_VAR_KEYS.aiGateway.apiKey] : []),\n\t];\n}\n\n/**\n * Every OS-level env var a resolved branch policy produces, in emit order. Lets a caller\n * subtract the ones it already holds and pass the rest as {@link fetchEnv}'s `keys`, without\n * re-deriving which vars a policy implies.\n */\nexport function policyEnvKeys(\n\tdesired: ReturnType<typeof resolveConfig>,\n): string[] {\n\tconst K = NEON_ENV_VAR_KEYS;\n\treturn [\n\t\tK.postgres.databaseUrl,\n\t\tK.postgres.databaseUrlUnpooled,\n\t\tK.branch.name,\n\t\t...(desired.authEnabled ? [K.auth.baseUrl, K.auth.jwksUrl] : []),\n\t\t...(desired.dataApiEnabled ? [K.dataApi.url] : []),\n\t\t...((desired.preview?.buckets.length ?? 0) > 0\n\t\t\t? [\n\t\t\t\t\tK.storage.accessKeyId,\n\t\t\t\t\tK.storage.secretAccessKey,\n\t\t\t\t\tK.storage.endpoint,\n\t\t\t\t\tK.storage.region,\n\t\t\t\t]\n\t\t\t: []),\n\t\t...(desired.preview?.aiGatewayEnabled\n\t\t\t? [K.aiGateway.apiKey, K.aiGateway.baseUrl]\n\t\t\t: []),\n\t];\n}\n\n/**\n * Mint the branch credential backing object storage / the AI Gateway.\n *\n * `api_token` and `s3_secret_access_key` come back **exactly once** — they are not stored\n * server-side and the list endpoint returns metadata only — so the caller's copy is the only\n * copy. That is why {@link fetchEnv} mints rather than fetches: there is nothing to fetch. A\n * caller that already holds a valid copy should leave the secret keys out of `keys` (see\n * {@link fetchEnvReusingSecrets}) instead of minting one it will discard.\n */\nasync function mintBranchCredential(args: {\n\tapi: NeonApi;\n\tprojectId: string;\n\tbranchId: string;\n\tbranchName: string;\n\tscopes: CredentialScope[];\n}): Promise<{\n\taccessKeyId: string;\n\tsecretAccessKey: string;\n\tapiToken: string;\n}> {\n\tconst minted = await args.api.createCredential(\n\t\targs.projectId,\n\t\targs.branchId,\n\t\t{\n\t\t\tscopes: args.scopes,\n\t\t\tprincipalType: \"user\",\n\t\t\tname: credentialName(args.branchName),\n\t\t},\n\t);\n\treturn {\n\t\t// The storage gateway authenticates against the full token id (e.g.\n\t\t// `nak_live_…`), not the short token id — using the short id yields\n\t\t// `InvalidAccessKeyId` on every S3 request.\n\t\taccessKeyId: minted.tokenId,\n\t\tsecretAccessKey: minted.s3SecretAccessKey,\n\t\tapiToken: minted.apiToken,\n\t};\n}\n\n/**\n * The AI Gateway is a **branch-scoped host** — `<branchId>-api.ai.<host-suffix>` — NOT the\n * control-plane API origin. Derive the suffix from the branch's own Postgres connection host\n * by dropping only the endpoint label (the first segment) and keeping everything after it,\n * including any infra cell prefix (`c-N.`): a connection host of\n * `ep-x.c-3.us-east-2.aws.neon.tech` yields the gateway host\n * `<branchId>-api.ai.c-3.us-east-2.aws.neon.tech`. The cell prefix is **load-bearing** —\n * the gateway is cell-routed, so dropping `c-N.` resolves to the wrong (or no) host.\n */\nfunction aiGatewayHost(branchId: string, connectionUri: string): string {\n\tlet connectionHost = \"\";\n\ttry {\n\t\tconnectionHost = new URL(connectionUri).hostname;\n\t} catch {\n\t\tconnectionHost = \"\";\n\t}\n\t// Drop the endpoint label (first segment, e.g. `ep-x` / `ep-x-pooler`), keeping the rest\n\t// of the host verbatim — including any infra cell prefix (`c-N.`) the gateway routes on:\n\t// `[c-N.]<region>.<cloud>.neon.<tld>`.\n\tconst suffix = connectionHost.split(\".\").slice(1).join(\".\");\n\treturn `${branchId}-api.ai.${suffix}`;\n}\n\n/** The AI Gateway's bare base URL (`NEON_AI_GATEWAY_BASE_URL`) on the branch gateway host. */\nfunction aiGatewayBaseUrl(branchId: string, connectionUri: string): string {\n\treturn `https://${aiGatewayHost(branchId, connectionUri)}`;\n}\n\nexport function createApiFromOptions(options: FetchEnvOptions): NeonApi {\n\treturn createNeonApiFromOptions(\"fetchEnv\", {\n\t\t...(options.apiKey ? { apiKey: options.apiKey } : {}),\n\t\t...(options.apiHost ? { apiHost: options.apiHost } : {}),\n\t});\n}\n\n/**\n * Resolve a branch ref — a name or an id — to a concrete branch. Matches by id first\n * (exact `br-…`), then by name; both are unique within a project, so the lookup is\n * unambiguous. This lets `.neon` files written by `neonctl` (which pin the branch *name*)\n * and explicit `br-…` ids both work.\n */\nfunction resolveBranch(\n\tbranch: string,\n\tbranches: NeonBranchSnapshot[],\n): NeonBranchSnapshot {\n\tconst match =\n\t\tbranches.find((b) => b.id === branch) ??\n\t\tbranches.find((b) => b.name === branch);\n\tif (match) return match;\n\tthrow new PlatformError(\n\t\tErrorCode.BranchNotFound,\n\t\t[\n\t\t\t`fetchEnv: branch ${JSON.stringify(branch)} not found on project (matched by id or name).`,\n\t\t\t`Existing branches: ${branches.map((b) => `${b.name} (${b.id})`).join(\", \")}.`,\n\t\t].join(\" \"),\n\t\t{\n\t\t\tdetails: {\n\t\t\t\tbranch,\n\t\t\t\tavailable: branches.map((b) => `${b.name} (${b.id})`),\n\t\t\t},\n\t\t},\n\t);\n}\n\nfunction pickRoleName(\n\troles: NeonRoleSnapshot[],\n\tbranch: NeonBranchSnapshot,\n\trequested: string | undefined,\n): string {\n\tif (requested) {\n\t\tif (!roles.some((r) => r.name === requested)) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.BranchNotFound,\n\t\t\t\t[\n\t\t\t\t\t`fetchEnv: role \"${requested}\" not found on branch ${branch.name} (${branch.id}).`,\n\t\t\t\t\t`Existing roles: ${roles.map((r) => r.name).join(\", \") || \"(none)\"}.`,\n\t\t\t\t].join(\" \"),\n\t\t\t\t{\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\t\troleName: requested,\n\t\t\t\t\t\tavailableRoles: roles.map((r) => r.name),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn requested;\n\t}\n\tif (roles.length === 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.BranchNotFound,\n\t\t\t[\n\t\t\t\t`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`,\n\t\t\t\t\"Create one via the Neon console or pass `roleName` explicitly.\",\n\t\t\t].join(\" \"),\n\t\t\t{ details: { branchId: branch.id } },\n\t\t);\n\t}\n\tif (roles.length === 1) return roles[0].name;\n\n\t// Multiple roles. Enabling Neon Auth / the Data API provisions the PostgREST roles\n\t// (authenticator/anonymous/authenticated) alongside the project owner, so a normal\n\t// branch ends up with >1 role even though only the owner backs a `DATABASE_URL`.\n\t// Default to Neon's owner role; if the project was created with a custom owner name,\n\t// fall back to the single role left after dropping the managed auth roles. Only a\n\t// genuinely ambiguous set (more than one app role) still asks the caller to choose.\n\tconst owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);\n\tif (owner) return owner.name;\n\n\tconst appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));\n\tif (appRoles.length === 1) return appRoles[0].name;\n\n\tthrow new PlatformError(\n\t\tErrorCode.AmbiguousBranchAuth,\n\t\t[\n\t\t\t`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is \"${NEON_DEFAULT_OWNER_ROLE}\"; cannot auto-pick.`,\n\t\t\t`Pass \\`roleName\\` explicitly. Available: ${roles.map((r) => r.name).join(\", \")}.`,\n\t\t].join(\" \"),\n\t\t{\n\t\t\tdetails: {\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tavailableRoles: roles.map((r) => r.name),\n\t\t\t},\n\t\t},\n\t);\n}\n\nfunction pickDatabaseName(\n\tdatabases: NeonDatabaseSnapshot[],\n\tbranch: NeonBranchSnapshot,\n\trequested: string | undefined,\n): string {\n\tif (requested) {\n\t\tif (!databases.some((d) => d.name === requested)) {\n\t\t\tthrow new PlatformError(\n\t\t\t\tErrorCode.BranchNotFound,\n\t\t\t\t[\n\t\t\t\t\t`fetchEnv: database \"${requested}\" not found on branch ${branch.name} (${branch.id}).`,\n\t\t\t\t\t`Existing databases: ${databases.map((d) => d.name).join(\", \") || \"(none)\"}.`,\n\t\t\t\t].join(\" \"),\n\t\t\t\t{\n\t\t\t\t\tdetails: {\n\t\t\t\t\t\tbranchId: branch.id,\n\t\t\t\t\t\tdatabaseName: requested,\n\t\t\t\t\t\tavailableDatabases: databases.map((d) => d.name),\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn requested;\n\t}\n\tif (databases.length === 0) {\n\t\tthrow new PlatformError(\n\t\t\tErrorCode.BranchNotFound,\n\t\t\t[\n\t\t\t\t`fetchEnv: branch ${branch.name} (${branch.id}) has no databases.`,\n\t\t\t\t\"Create one via the Neon console or pass `databaseName` explicitly.\",\n\t\t\t].join(\" \"),\n\t\t\t{ details: { branchId: branch.id } },\n\t\t);\n\t}\n\n\t// Prefer Neon's default `neondb`. On the common \"added a second database\" branch this\n\t// auto-picks it, so a lone or `neondb`-including branch resolves without asking.\n\tconst neondb = databases.find((d) => d.name === NEON_DEFAULT_DATABASE);\n\tif (neondb) return neondb.name;\n\n\tif (databases.length === 1) return databases[0].name;\n\n\t// Several databases and no `neondb` to fall back on. Auto-picking any of them would be\n\t// perceived as random and is bad DX, so fail loudly and let the caller disambiguate.\n\tthrow new PlatformError(\n\t\tErrorCode.AmbiguousBranchAuth,\n\t\t[\n\t\t\t`fetchEnv: branch ${branch.name} (${branch.id}) has ${databases.length} databases and none is named \"${NEON_DEFAULT_DATABASE}\"; cannot auto-pick.`,\n\t\t\t`Rename one to \"${NEON_DEFAULT_DATABASE}\" or keep a single database on the branch (or, when calling fetchEnv directly, pass \\`databaseName\\`). Available: ${databases.map((d) => d.name).join(\", \")}.`,\n\t\t].join(\" \"),\n\t\t{\n\t\t\tdetails: {\n\t\t\t\tbranchId: branch.id,\n\t\t\t\tavailableDatabases: databases.map((d) => d.name),\n\t\t\t},\n\t\t},\n\t);\n}\n\n// ───────────────────────── env-var mapping helpers ─────────────────────────\n\n/**\n * Project a fully-resolved {@link NeonEnv} into the OS-level `{ KEY: value }` pairs used\n * for cross-process transport. Named after the web-platform `.entries()` convention\n * (`URLSearchParams` / `Headers` / `FormData`); returns a `Record` rather than an\n * iterator of tuples since that's the shape env injection needs (wrap with\n * `Object.entries(...)` if you want literal `[key, value]` pairs). Used by `neon-env run`\n * to inject the vars into a subprocess's `process.env`.\n *\n * Walks the value at runtime so it works for any `NeonEnv<C>` regardless of which\n * conditional namespaces are present.\n */\nexport function toEntries(env: ResolvedNeonEnv): Record<string, string> {\n\tconst out: Record<string, string> = {};\n\tconst put = (key: string, value: string | undefined): void => {\n\t\tif (value !== undefined) out[key] = value;\n\t};\n\tconst K = NEON_ENV_VAR_KEYS;\n\tput(K.postgres.databaseUrl, env.postgres?.databaseUrl);\n\tput(K.postgres.databaseUrlUnpooled, env.postgres?.databaseUrlUnpooled);\n\tput(K.branch.name, env.branch?.name);\n\tput(K.auth.baseUrl, env.auth?.baseUrl);\n\tput(K.auth.jwksUrl, env.auth?.jwksUrl);\n\tput(K.dataApi.url, env.dataApi?.url);\n\tput(K.storage.accessKeyId, env.storage?.accessKeyId);\n\tput(K.storage.secretAccessKey, env.storage?.secretAccessKey);\n\tput(K.storage.endpoint, env.storage?.endpoint);\n\tput(K.storage.region, env.storage?.region);\n\t// Neon-branded gateway vars only: the bearer and the bare branch gateway host\n\t// (scheme://host, no path) — the @neon/ai-sdk-provider appends the dialect route\n\t// (/v1, /openai/v1, /anthropic/v1) itself (https://github.com/vercel/ai/pull/15997).\n\tput(K.aiGateway.apiKey, env.aiGateway?.apiKey);\n\tput(K.aiGateway.baseUrl, env.aiGateway?.baseUrl);\n\treturn out;\n}\n\n/**\n * Any resolved env {@link toEntries} can project: a full {@link NeonEnv}, or the narrowed\n * result of a `keys`-filtered {@link fetchEnv} / {@link parseEnv} call. Every namespace and\n * property is optional so a filtered result — which legitimately carries only what was asked\n * for — projects to exactly the vars it holds instead of failing to type-check.\n */\nexport type ResolvedNeonEnv = {\n\t[N in keyof NamespaceEnv]?: Partial<NamespaceEnv[N]>;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,0BAA0B;;;;;;AAOhC,MAAM,wBAAwB;;;;;;;;AAS9B,MAAM,0CAA+C,IAAI,IAAI;CAC5D;CACA;CACA;AACD,CAAC;AAED,MAAa,oBAAoB;;;;;;CAMhC,QAAQ,EACP,MAAM,cACP;CACA,UAAU;EACT,aAAa;EACb,qBAAqB;CACtB;CACA,MAAM;EACL,SAAS;EACT,SAAS;CACV;CACA,SAAS,EACR,KAAK,oBACN;;;;;;CAMA,SAAS;EACR,aAAa;EACb,iBAAiB;EACjB,UAAU;EACV,QAAQ;CACT;;;;;;;;CAQA,WAAW;EACV,QAAQ;EACR,SAAS;CACV;AACD;AAmXA,eAAsB,SACrB,QACA,SACmB;CACnB,OAAO,aAAa,QAAQ,SAAS,QAAQ,QAAQ,IAAI;AAC1D;;;;;;;;;;AAWA,eAAsB,aACrB,QACA,SACA,MAC2B;CAC3B,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,EAAE,QAAQ,YAAY,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CAE1E,MAAM,YAAY,OAAO,IAAI,IAAY,IAAI,IAAI;CACjD,MAAM,SAAS,QACd,cAAc,QAAQ,UAAU,IAAI,GAAG;CAExC,MAAM,SAA0B,CAAC;CACjC,MAAM,CAAC,OAAO,aAAa,MAAM,QAAQ,IAAI,CAC5C,IAAI,gBAAgB,WAAW,OAAO,EAAE,GACxC,IAAI,oBAAoB,WAAW,OAAO,EAAE,CAC7C,CAAC;CAED,MAAM,WAAW,aAAa,OAAO,QAAQ,QAAQ,QAAQ;CAC7D,MAAM,eAAe,iBACpB,WACA,QACA,QAAQ,YACT;CAOA,MAAM,IAAI;CACV,MAAM,YACL,QAAQ,gBAAgB,MAAM,EAAE,KAAK,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO;CACtE,MAAM,eAAe,QAAQ,kBAAkB,MAAM,EAAE,QAAQ,GAAG;CAElE,MAAM,CAAC,QAAQ,UAAU,cAAc,mBAAmB,MAAM,QAAQ,IACvE;EACC,IAAI,iBAAiB,WAAW;GAC/B,UAAU,OAAO;GACjB;GACA;GACA,QAAQ;EACT,CAAC;EACD,IAAI,iBAAiB,WAAW;GAC/B,UAAU,OAAO;GACjB;GACA;GACA,QAAQ;EACT,CAAC;EACD,YACG,IAAI,YAAY,WAAW,OAAO,EAAE,IACpC,QAAQ,QAAQ,IAAI;EACvB,eACG,IAAI,eAAe,WAAW,OAAO,IAAI,YAAY,IACrD,QAAQ,QAAQ,IAAI;CACxB,CACD;CAEA,MAAM,WAAqC,CAAC;CAC5C,IAAI,MAAM,EAAE,SAAS,WAAW,GAAG,SAAS,cAAc,OAAO;CACjE,IAAI,MAAM,EAAE,SAAS,mBAAmB,GACvC,SAAS,sBAAsB,SAAS;CAEzC,IAAI,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,GAAG,OAAO,WAAW;CAKxD,IAAI,MAAM,EAAE,OAAO,IAAI,GACtB,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK;CAGrC,IAAI,WAAW;EACd,IAAI,CAAC,cACJ,MAAM,IAAI,cACT,UAAU,UACV,CACC,0FAA0F,OAAO,KAAK,IAAI,OAAO,GAAG,KACpH,qJACD,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;GAAE;GAAW,UAAU,OAAO;EAAG,EAC3C,CACD;EAED,MAAM,OAA6B,CAAC;EACpC,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,IAAI,MAAM,EAAE,KAAK,OAAO,GAAG,KAAK,UAAU,aAAa,WAAW;EAClE,OAAO,OAAO;CACf;CAEA,IAAI,cAAc;EACjB,IAAI,CAAC,iBACJ,MAAM,IAAI,cACT,UAAU,UACV,CACC,4FAA4F,OAAO,KAAK,IAAI,OAAO,GAAG,aAAa,aAAa,IAChJ,wIACD,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;GACR;GACA,UAAU,OAAO;GACjB;EACD,EACD,CACD;EAED,OAAO,UAAU,EAAE,KAAK,gBAAgB,IAAI;CAC7C;CAOA,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,eACL,mBACC,MAAM,EAAE,QAAQ,WAAW,KAC3B,MAAM,EAAE,QAAQ,eAAe,KAC/B,MAAM,EAAE,QAAQ,QAAQ,KACxB,MAAM,EAAE,QAAQ,MAAM;CACxB,MAAM,eACL,mBACC,MAAM,EAAE,UAAU,MAAM,KAAK,MAAM,EAAE,UAAU,OAAO;CAIxD,MAAM,kBACJ,mBACC,MAAM,EAAE,QAAQ,WAAW,KAC3B,MAAM,EAAE,QAAQ,eAAe,MAChC,kBAAkB,MAAM,EAAE,UAAU,MAAM;CAE5C,IAAI,gBAAgB,cAAc;EAIjC,IAAI,UAA4C;EAChD,IAAI,cAAc;GACjB,UAAU,MAAM,IAAI,wBAAwB,WAAW,OAAO,EAAE;GAChE,IAAI,CAAC,SACJ,MAAM,IAAI,cACT,UAAU,UACV,CACC,0GAA0G,OAAO,KAAK,IAAI,OAAO,GAAG,KACpI,oIACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS;IAAE;IAAW,UAAU,OAAO;GAAG,EAAE,CAC/C;EAEF;EAEA,MAAM,UAAU,kBACb,MAAM,qBAAqB;GAC3B;GACA;GACA,UAAU,OAAO;GACjB,YAAY,OAAO;GACnB,QAAQ,wBAAwB,QAAQ,OAAO;EAChD,CAAC,IACA;EAEH,IAAI,SAAS;GACZ,MAAM,aAAsC,CAAC;GAC7C,IAAI,WAAW,MAAM,EAAE,QAAQ,WAAW,GACzC,WAAW,cAAc,QAAQ;GAElC,IAAI,WAAW,MAAM,EAAE,QAAQ,eAAe,GAC7C,WAAW,kBAAkB,QAAQ;GAEtC,IAAI,MAAM,EAAE,QAAQ,QAAQ,GAC3B,WAAW,WAAW,QAAQ;GAE/B,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,WAAW,SAAS,QAAQ;GACzD,OAAO,UAAU;EAClB;EACA,IAAI,cAAc;GACjB,MAAM,UAAqC,CAAC;GAC5C,IAAI,WAAW,MAAM,EAAE,UAAU,MAAM,GACtC,QAAQ,SAAS,QAAQ;GAE1B,IAAI,MAAM,EAAE,UAAU,OAAO,GAI5B,QAAQ,UAAU,iBAAiB,OAAO,IAAI,SAAS,GAAG;GAE3D,OAAO,YAAY;EACpB;CACD;CAEA,OAAO;AACR;;;;;;AAOA,eAAsB,oBACrB,QACA,SACA,KAIE;CACF,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,MAAM,IAAI,aAAa,SAAS;CACjD,IAAI,SAAS,WAAW,GACvB,MAAM,IAAI,cACT,UAAU,gBACV,CACC,qBAAqB,UAAU,oBAC/B,wFACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B;CAGD,MAAM,YAAY,QAAQ,UAAU,QAAQ;CAC5C,IAAI,CAAC,WACJ,MAAM,IAAI,cACT,UAAU,gBACV,CACC,iCACA,gEACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B;CAED,MAAM,SAAS,cAAc,WAAW,QAAQ;CAUhD,OAAO;EAAE;EAAQ,SATD,cAAc,QAAQ;GACrC,MAAM,OAAO;GACb,IAAI,OAAO;GACX,QAAQ;GACR,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;GACvD,WAAW,OAAO;GAClB,aAAa,OAAO;GACpB,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;EAC3D,CACuB;CAAE;AAC1B;;;;;;;;AASA,SAAgB,wBACf,SACoB;CACpB,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,UAAU,QAAQ,QAAQ,SAAS;CACzC,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WAAW,CAAC,WAAW,OAAO,CAAC;CACpC,OAAO,uBAAuB;EAC7B;EACA;EACA,WAAW,QAAQ,UAAU,SAAS;CACvC,CAAC;AACF;;AAGA,SAAgB,eAAe,YAA4B;CAC1D,OAAO,YAAY;AACpB;;AAGA,SAAgB,kBAAkB,OAGrB;CACZ,OAAO,CACN,GAAI,MAAM,UACP,CACA,kBAAkB,QAAQ,aAC1B,kBAAkB,QAAQ,eAC3B,IACC,CAAC,GACJ,GAAI,MAAM,YAAY,CAAC,kBAAkB,UAAU,MAAM,IAAI,CAAC,CAC/D;AACD;;;;;;AAOA,SAAgB,cACf,SACW;CACX,MAAM,IAAI;CACV,OAAO;EACN,EAAE,SAAS;EACX,EAAE,SAAS;EACX,EAAE,OAAO;EACT,GAAI,QAAQ,cAAc,CAAC,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,IAAI,CAAC;EAC9D,GAAI,QAAQ,iBAAiB,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;EAChD,IAAK,QAAQ,SAAS,QAAQ,UAAU,KAAK,IAC1C;GACA,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;GACV,EAAE,QAAQ;EACX,IACC,CAAC;EACJ,GAAI,QAAQ,SAAS,mBAClB,CAAC,EAAE,UAAU,QAAQ,EAAE,UAAU,OAAO,IACxC,CAAC;CACL;AACD;;;;;;;;;;AAWA,eAAe,qBAAqB,MAUjC;CACF,MAAM,SAAS,MAAM,KAAK,IAAI,iBAC7B,KAAK,WACL,KAAK,UACL;EACC,QAAQ,KAAK;EACb,eAAe;EACf,MAAM,eAAe,KAAK,UAAU;CACrC,CACD;CACA,OAAO;EAIN,aAAa,OAAO;EACpB,iBAAiB,OAAO;EACxB,UAAU,OAAO;CAClB;AACD;;;;;;;;;;AAWA,SAAS,cAAc,UAAkB,eAA+B;CACvE,IAAI,iBAAiB;CACrB,IAAI;EACH,iBAAiB,IAAI,IAAI,aAAa,CAAC,CAAC;CACzC,QAAQ;EACP,iBAAiB;CAClB;CAKA,OAAO,GAAG,SAAS,UADJ,eAAe,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GACrB;AACnC;;AAGA,SAAS,iBAAiB,UAAkB,eAA+B;CAC1E,OAAO,WAAW,cAAc,UAAU,aAAa;AACxD;AAEA,SAAgB,qBAAqB,SAAmC;CACvE,OAAO,yBAAyB,YAAY;EAC3C,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;;;;;;AAQA,SAAS,cACR,QACA,UACqB;CACrB,MAAM,QACL,SAAS,MAAM,MAAM,EAAE,OAAO,MAAM,KACpC,SAAS,MAAM,MAAM,EAAE,SAAS,MAAM;CACvC,IAAI,OAAO,OAAO;CAClB,MAAM,IAAI,cACT,UAAU,gBACV,CACC,oBAAoB,KAAK,UAAU,MAAM,EAAE,iDAC3C,sBAAsB,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAC7E,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;EACR;EACA,WAAW,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,EAAE;CACrD,EACD,CACD;AACD;AAEA,SAAS,aACR,OACA,QACA,WACS;CACT,IAAI,WAAW;EACd,IAAI,CAAC,MAAM,MAAM,MAAM,EAAE,SAAS,SAAS,GAC1C,MAAM,IAAI,cACT,UAAU,gBACV,CACC,mBAAmB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KAC/E,mBAAmB,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EACpE,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;GACR,UAAU,OAAO;GACjB,UAAU;GACV,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;EACxC,EACD,CACD;EAED,OAAO;CACR;CACA,IAAI,MAAM,WAAW,GACpB,MAAM,IAAI,cACT,UAAU,gBACV,CACC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,kBAC9C,gEACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CACpC;CAED,IAAI,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC;CAQxC,MAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,SAAS,uBAAuB;CAClE,IAAI,OAAO,OAAO,MAAM;CAExB,MAAM,WAAW,MAAM,QAAQ,MAAM,CAAC,wBAAwB,IAAI,EAAE,IAAI,CAAC;CACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS,EAAE,CAAC;CAE9C,MAAM,IAAI,cACT,UAAU,qBACV,CACC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,MAAM,OAAO,sBAAsB,wBAAwB,uBACjH,4CAA4C,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EACjF,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;EACR,UAAU,OAAO;EACjB,gBAAgB,MAAM,KAAK,MAAM,EAAE,IAAI;CACxC,EACD,CACD;AACD;AAEA,SAAS,iBACR,WACA,QACA,WACS;CACT,IAAI,WAAW;EACd,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,GAC9C,MAAM,IAAI,cACT,UAAU,gBACV,CACC,uBAAuB,UAAU,wBAAwB,OAAO,KAAK,IAAI,OAAO,GAAG,KACnF,uBAAuB,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,SAAS,EAC5E,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;GACR,UAAU,OAAO;GACjB,cAAc;GACd,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;EAChD,EACD,CACD;EAED,OAAO;CACR;CACA,IAAI,UAAU,WAAW,GACxB,MAAM,IAAI,cACT,UAAU,gBACV,CACC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,sBAC9C,oEACD,CAAC,CAAC,KAAK,GAAG,GACV,EAAE,SAAS,EAAE,UAAU,OAAO,GAAG,EAAE,CACpC;CAKD,MAAM,SAAS,UAAU,MAAM,MAAM,EAAE,SAAS,qBAAqB;CACrE,IAAI,QAAQ,OAAO,OAAO;CAE1B,IAAI,UAAU,WAAW,GAAG,OAAO,UAAU,EAAE,CAAC;CAIhD,MAAM,IAAI,cACT,UAAU,qBACV,CACC,oBAAoB,OAAO,KAAK,IAAI,OAAO,GAAG,QAAQ,UAAU,OAAO,gCAAgC,sBAAsB,uBAC7H,kBAAkB,sBAAsB,oHAAoH,UAAU,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EACrM,CAAC,CAAC,KAAK,GAAG,GACV,EACC,SAAS;EACR,UAAU,OAAO;EACjB,oBAAoB,UAAU,KAAK,MAAM,EAAE,IAAI;CAChD,EACD,CACD;AACD;;;;;;;;;;;;AAeA,SAAgB,UAAU,KAA8C;CACvE,MAAM,MAA8B,CAAC;CACrC,MAAM,OAAO,KAAa,UAAoC;EAC7D,IAAI,UAAU,KAAA,GAAW,IAAI,OAAO;CACrC;CACA,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,aAAa,IAAI,UAAU,WAAW;CACrD,IAAI,EAAE,SAAS,qBAAqB,IAAI,UAAU,mBAAmB;CACrE,IAAI,EAAE,OAAO,MAAM,IAAI,QAAQ,IAAI;CACnC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,OAAO;CACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,SAAS,GAAG;CACnC,IAAI,EAAE,QAAQ,aAAa,IAAI,SAAS,WAAW;CACnD,IAAI,EAAE,QAAQ,iBAAiB,IAAI,SAAS,eAAe;CAC3D,IAAI,EAAE,QAAQ,UAAU,IAAI,SAAS,QAAQ;CAC7C,IAAI,EAAE,QAAQ,QAAQ,IAAI,SAAS,MAAM;CAIzC,IAAI,EAAE,UAAU,QAAQ,IAAI,WAAW,MAAM;CAC7C,IAAI,EAAE,UAAU,SAAS,IAAI,WAAW,OAAO;CAC/C,OAAO;AACR"}