@alchemy.run/planetscale 0.0.0 → 2.0.0-beta.84

package/lib/MySQL/MySQLPassword.js

@@ -0,0 +1,212 @@
+import * as planetscale from "@distilled.cloud/planetscale";
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+/** @resource */
+export const MySQLPassword = Resource("Planetscale.MySQLPassword");
+export const MySQLPasswordProvider = () => Provider.succeed(MySQLPassword, {
+    stables: ["id"],
+    diff: Effect.fn(function* ({ olds = {}, news }) {
+        if (!isResolved(news))
+            return undefined;
+        // Replace on any immutable-in-place change; engine falls through
+        // to reconcile for everything else (which authoritatively diffs
+        // against observed cloud state).
+        if (news.role !== olds.role)
+            return { action: "replace" };
+        if (news.replica !== olds.replica) {
+            return { action: "replace" };
+        }
+        if (news.ttl !== olds.ttl)
+            return { action: "replace" };
+        const newDb = resolveDatabaseName(news.database);
+        const oldDb = olds.database ? resolveDatabaseName(olds.database) : undefined;
+        if (oldDb && newDb !== oldDb) {
+            return { action: "replace" };
+        }
+        const newBranch = resolveBranchName(news.branch);
+        const oldBranch = resolveBranchName(olds.branch);
+        if (newBranch !== oldBranch) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ output }) {
+        // Adoption (no cached output) is impossible: the PlanetScale API
+        // never re-issues plaintext, so even if we found a matching live
+        // password by listing+name we couldn't deliver the `password`
+        // attribute. Fall through to greenfield create in `reconcile`.
+        if (!output)
+            return undefined;
+        // Refresh — verify the cached password still exists and
+        // re-emit the persisted output (with plaintext intact).
+        // If it's gone, return undefined so the engine routes to
+        // reconcile, which will surface the unrecoverable-rotation
+        // condition explicitly.
+        return yield* planetscale
+            .getPassword({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+            id: output.id,
+        })
+            .pipe(Effect.map((password) => buildAttributes(password, output.password, {
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+        })), Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+    }),
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+        const newName = yield* createPasswordName(id, news.name);
+        // Identifiers — stable across update (diff replaces on
+        // database/branch changes), so we can pull from `output` first
+        // and fall back to `news` for greenfield.
+        const { organization: envOrg } = yield* yield* Credentials;
+        const organization = output?.organization ?? resolveDatabaseOrg(news.database) ?? envOrg;
+        const databaseName = output?.database ?? resolveDatabaseName(news.database);
+        const branchName = output?.branch ?? resolveBranchName(news.branch);
+        // 1. Observe — read live state. The PlanetScale API has no
+        //    "lookup by name" path (names aren't unique within a branch)
+        //    so the only way to find the live password is by id. Without
+        //    a cached output we cannot observe and fall straight through
+        //    to ensure (greenfield create).
+        const observed = output
+            ? yield* planetscale
+                .getPassword({
+                organization,
+                database: databaseName,
+                branch: branchName,
+                id: output.id,
+            })
+                .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)))
+            : undefined;
+        // 2. Ensure — create the password if it doesn't exist live.
+        //    This single branch covers greenfield (no output) AND the
+        //    out-of-band-deletion case (output cached but cloud lost it).
+        //    The latter is structurally a rotation: the new password
+        //    has a fresh id/host/username/plaintext that propagate
+        //    downstream through the dependency graph. There is no path
+        //    to recover the original plaintext, so recreating is the
+        //    only way to converge.
+        let live;
+        let plaintext;
+        if (observed) {
+            live = observed;
+            // We re-use the cached plaintext: the API never re-issues it.
+            plaintext = output.password;
+        }
+        else {
+            const created = yield* planetscale.createPassword({
+                organization,
+                database: databaseName,
+                branch: branchName,
+                name: newName,
+                role: news.role,
+                replica: news.replica,
+                ttl: news.ttl,
+                cidrs: news.cidrs,
+            });
+            plaintext = created.plain_text;
+            live = created;
+        }
+        // 3. Sync — diff observed cloud state against desired and patch
+        //    only what changed. Only `name` and `cidrs` are mutable in
+        //    place; everything else triggers a replace via diff().
+        //    Skip the API entirely when there's no delta.
+        const wantsRename = newName !== live.name;
+        const observedCidrs = normalizeCidrs(live.cidrs);
+        const desiredCidrs = normalizeCidrs(news.cidrs);
+        const wantsCidrs = !deepEqual(desiredCidrs, observedCidrs);
+        if (wantsRename || wantsCidrs) {
+            live = yield* planetscale.updatePassword({
+                organization,
+                database: databaseName,
+                branch: branchName,
+                id: live.id,
+                name: wantsRename ? newName : undefined,
+                cidrs: wantsCidrs ? news.cidrs : undefined,
+            });
+        }
+        // 4. Return — fresh attrs sourced from observed cloud state,
+        //    re-using cached plaintext when we didn't just create.
+        return buildAttributes(live, plaintext, {
+            organization,
+            database: databaseName,
+            branch: branchName,
+        });
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        yield* planetscale
+            .deletePassword({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+            id: output.id,
+        })
+            .pipe(Effect.catchTag("NotFound", () => Effect.void));
+    }),
+    list: Effect.fn(function* () {
+        const { organization } = yield* yield* Credentials;
+        const databases = yield* planetscale.listDatabases.pages({ organization }).pipe(Stream.runCollect, Effect.map((chunk) => Array.from(chunk).flatMap((page) => page.data.filter((db) => db.kind === "mysql"))));
+        const rows = yield* Effect.forEach(databases, (db) => planetscale.listBranches.pages({ organization, database: db.name }).pipe(Stream.runCollect, Effect.map((branchPages) => Array.from(branchPages).flatMap((page) => page.data.filter((branch) => branch.kind === "mysql"))), Effect.catchTag("NotFound", () => Effect.succeed([{ name: db.default_branch ?? "main" }])), Effect.flatMap((branches) => Effect.forEach(branches, (branch) => planetscale.listPasswords
+            .pages({
+            organization,
+            database: db.name,
+            branch: branch.name,
+        })
+            .pipe(Stream.runCollect, Effect.map((passwordPages) => Array.from(passwordPages).flatMap((page) => page.data.map((password) => buildAttributes(password, Redacted.make(""), {
+            organization,
+            database: db.name,
+            branch: branch.name,
+        })))), Effect.catchTag("NotFound", () => Effect.succeed([]))), { concurrency: 10 }).pipe(Effect.map((perBranch) => perBranch.flat())))), { concurrency: 10 });
+        return rows.flat();
+    }),
+});
+const resolveDatabaseName = (database) => {
+    const ref = database;
+    return typeof ref === "string" ? ref : ref.name;
+};
+const resolveDatabaseOrg = (database) => {
+    const ref = database;
+    return typeof ref === "string" ? undefined : ref.organization;
+};
+const resolveBranchName = (branch) => {
+    const ref = branch;
+    return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+const createPasswordName = (id, name) => Effect.gen(function* () {
+    return name ?? (yield* createPhysicalName({ id, lowercase: true, maxLength: 63 }));
+});
+// Normalize the API's nullable `cidrs` field into the `string[] | undefined`
+// shape we persist so downstream comparisons line up regardless of the
+// API returning `null` vs `[]` vs an actual list.
+const normalizeCidrs = (cidrs) => (cidrs == null || cidrs.length === 0 ? undefined : cidrs);
+const buildAttributes = (password, plaintext, context) => ({
+    id: password.id,
+    name: password.name,
+    expiresAt: password.expires_at,
+    host: password.access_host_url,
+    username: password.username,
+    password: plaintext,
+    origin: {
+        scheme: "mysql",
+        host: password.access_host_url,
+        port: 3306,
+        database: context.database,
+        user: password.username,
+        password: plaintext,
+    },
+    organization: context.organization,
+    database: context.database,
+    branch: context.branch,
+    role: password.role,
+    replica: password.replica,
+    ttl: password.ttl_seconds ?? undefined,
+    cidrs: normalizeCidrs(password.cidrs),
+});
+//# sourceMappingURL=MySQLPassword.js.map

package/lib/MySQL/MySQLPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MySQLPassword.js","sourceRoot":"","sources":["../../src/MySQL/MySQLPassword.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA6HxC,gBAAgB;AAChB,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAgB,2BAA2B,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CACxC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE;IAC9B,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAExC,iEAAiE;QACjE,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACnE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QAEjE,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,wDAAwD;QACxD,wDAAwD;QACxD,yDAAyD;QACzD,2DAA2D;QAC3D,wBAAwB;QACxB,OAAO,KAAK,CAAC,CAAC,WAAW;aACtB,WAAW,CAAC;YACX,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;SACd,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YACzC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;IACN,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzD,uDAAuD;QACvD,+DAA+D;QAC/D,0CAA0C;QAC1C,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;QACzF,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEpE,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW;iBACf,WAAW,CAAC;gBACX,YAAY;gBACZ,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;gBAClB,EAAE,EAAE,MAAM,CAAC,EAAE;aACd,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,SAAS,CAAC;QAEd,4DAA4D;QAC5D,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,2DAA2D;QAC3D,+DAA+D;QAC/D,6DAA6D;QAC7D,2BAA2B;QAC3B,IAAI,IAAmC,CAAC;QACxC,IAAI,SAAoC,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,QAAQ,CAAC;YAChB,8DAA8D;YAC9D,SAAS,GAAG,MAAO,CAAC,QAAQ,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;gBAChD,YAAY;gBACZ,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YAC/B,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,2DAA2D;QAC3D,kDAAkD;QAClD,MAAM,WAAW,GAAG,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC;QAC1C,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAE3D,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;gBACvC,YAAY;gBACZ,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,UAAU;gBAClB,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,2DAA2D;QAC3D,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE;YACtC,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,KAAK,CAAC,CAAC,WAAW;aACf,cAAc,CAAC;YACd,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;SACd,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QAEnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CACnF,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAChC,SAAS,EACT,CAAC,EAAE,EAAE,EAAE,CACL,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACzB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CACtD,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC,CAAC,CACxD,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CACZ,QAAQ,EACR,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,aAAa;aACtB,KAAK,CAAC;YACL,YAAY;YACZ,QAAQ,EAAE,EAAE,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAAG,CAAC,CAAC,aAAa,EAA6B,EAAE,CACtD,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACzB,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAC3C,YAAY;YACZ,QAAQ,EAAE,EAAE,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC,CACH,CACF,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAA+B,CAAC,CAChD,CACF,EACL,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CACpD,CACF,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC;CACH,CAAC,CAAC;AAUL,MAAM,mBAAmB,GAAG,CAAC,QAAgC,EAAU,EAAE;IACvE,MAAM,GAAG,GAAG,QAAkC,CAAC;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,QAAgC,EAAsB,EAAE;IAClF,MAAM,GAAG,GAAG,QAAkC,CAAC;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAAwC,EAAU,EAAE;IAC7E,MAAM,GAAG,GAAG,MAA0C,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAC7E,uEAAuE;AACvE,kDAAkD;AAClD,MAAM,cAAc,GAAG,CACrB,KAA2C,EACZ,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAE9F,MAAM,eAAe,GAAG,CACtB,QAUC,EACD,SAAoC,EACpC,OAIC,EACwB,EAAE,CAAC,CAAC;IAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,SAAS,EAAE,QAAQ,CAAC,UAAU;IAC9B,IAAI,EAAE,QAAQ,CAAC,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;IAC3B,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,QAAQ,CAAC,eAAe;QAC9B,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,QAAQ,EAAE,SAAS;KACpB;IACD,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;IACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,GAAG,EAAE,QAAQ,CAAC,WAAW,IAAI,SAAS;IACtC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC"}

package/lib/MySQL/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./MySQLClusterSize.ts";
+export * from "./MySQLBranch.ts";
+export * from "./MySQLDatabase.ts";
+export * from "./MySQLOrigin.ts";
+export * from "./MySQLPassword.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/MySQL/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/MySQL/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/lib/MySQL/index.js

@@ -0,0 +1,6 @@
+export * from "./MySQLClusterSize.js";
+export * from "./MySQLBranch.js";
+export * from "./MySQLDatabase.js";
+export * from "./MySQLOrigin.js";
+export * from "./MySQLPassword.js";
+//# sourceMappingURL=index.js.map

package/lib/MySQL/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/MySQL/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/lib/OAuthClient.d.ts

@@ -0,0 +1,32 @@
+import * as Redacted from "effect/Redacted";
+export { OAuthCredentials, OAuthError, type Authorization } from "alchemy/Auth/OAuthFlow";
+/**
+ * Registered PlanetScale OAuth application credentials.
+ *
+ * Unlike Cloudflare, PlanetScale OAuth has **no public-client flow** — the
+ * token endpoint requires client authentication for every grant (PKCE is
+ * advertised in their discovery doc but does not lift that requirement), so
+ * exchanging the authorization code (and refreshing the token) requires the
+ * application's `client_secret`. There is no way to keep that secret out of
+ * a distributed CLI, so it ships here: the exposure is the same posture as a
+ * public `client_id` (a stolen refresh token is usable, exactly like
+ * Cloudflare's secret-less refresh), and it can be rotated by cutting a new
+ * release. PlanetScale's own CLI ships its OAuth `client_secret` in source
+ * the same way:
+ * https://github.com/planetscale/cli/blob/main/internal/auth/authenticator.go
+ *
+ * Registered at https://app.planetscale.com with redirect URI
+ * {@link OAUTH_REDIRECT_URI}. Scopes are configured on the application
+ * itself, not requested per-authorization (so `authorize()` is called with
+ * no scopes). Rotate by registering a new secret and cutting a release.
+ */
+export declare const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
+export declare const OAUTH_CLIENT_SECRET: Redacted.Redacted<string>;
+export declare const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
+export declare const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
+export declare const OAUTH_ENDPOINTS: {
+    authorize: string;
+    token: string;
+};
+export declare const { authorize, callback, exchange, exchangeCallbackInput, refresh, usesCurrentClient }: import("alchemy/Auth/OAuthFlow").OAuthClient;
+//# sourceMappingURL=OAuthClient.d.ts.map

package/lib/OAuthClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthClient.d.ts","sourceRoot":"","sources":["../src/OAuthClient.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,gDAAgD,CAAC;AAC7E,eAAO,MAAM,mBAAmB,2BAE/B,CAAC;AAEF,eAAO,MAAM,kBAAkB,sCAAsC,CAAC;AACtE,eAAO,MAAM,wBAAwB,wCAAwC,CAAC;AAC9E,eAAO,MAAM,eAAe;IAO1B,SAAS;IACT,KAAK;CACN,CAAC;AAgBF,eAAO,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,8CACzF,CAAC"}

package/lib/OAuthClient.js

@@ -0,0 +1,52 @@
+import { makeOAuthClient } from "alchemy/Auth/OAuthFlow";
+import * as Redacted from "effect/Redacted";
+export { OAuthCredentials, OAuthError } from "alchemy/Auth/OAuthFlow";
+/**
+ * Registered PlanetScale OAuth application credentials.
+ *
+ * Unlike Cloudflare, PlanetScale OAuth has **no public-client flow** — the
+ * token endpoint requires client authentication for every grant (PKCE is
+ * advertised in their discovery doc but does not lift that requirement), so
+ * exchanging the authorization code (and refreshing the token) requires the
+ * application's `client_secret`. There is no way to keep that secret out of
+ * a distributed CLI, so it ships here: the exposure is the same posture as a
+ * public `client_id` (a stolen refresh token is usable, exactly like
+ * Cloudflare's secret-less refresh), and it can be rotated by cutting a new
+ * release. PlanetScale's own CLI ships its OAuth `client_secret` in source
+ * the same way:
+ * https://github.com/planetscale/cli/blob/main/internal/auth/authenticator.go
+ *
+ * Registered at https://app.planetscale.com with redirect URI
+ * {@link OAUTH_REDIRECT_URI}. Scopes are configured on the application
+ * itself, not requested per-authorization (so `authorize()` is called with
+ * no scopes). Rotate by registering a new secret and cutting a release.
+ */
+export const OAUTH_CLIENT_ID = "pscale_app_aa12e3938baebb788aac443f66e422da";
+export const OAUTH_CLIENT_SECRET = Redacted.make("pscale_app_secret_yyZ3Q8oe99GP9_yA5wrA5er6RuN6Lz9dC66Bj1OJzpg");
+export const OAUTH_REDIRECT_URI = "https://alchemy.run/auth/callback";
+export const OAUTH_LOCAL_CALLBACK_URI = "http://localhost:9976/auth/callback";
+export const OAUTH_ENDPOINTS = {
+    // PlanetScale's own .well-known OAuth discovery doc declares this as
+    // the authorization_endpoint — NOT auth.planetscale.com/oauth/authorize
+    // (which their public docs cite). The auth.planetscale.com alias does
+    // render a consent screen but emits codes whose resulting tokens lack
+    // a `sub` claim, so the resource API at api.planetscale.com rejects
+    // them as invalid. Use the canonical endpoint.
+    authorize: "https://app.planetscale.com/oauth/authorize",
+    token: "https://auth.planetscale.com/oauth/token",
+};
+const client = makeOAuthClient({
+    clientId: OAUTH_CLIENT_ID,
+    endpoints: OAUTH_ENDPOINTS,
+    redirectUri: OAUTH_REDIRECT_URI,
+    localCallbackUri: OAUTH_LOCAL_CALLBACK_URI,
+    auth: { kind: "clientSecret", clientSecret: OAUTH_CLIENT_SECRET },
+    // PlanetScale's docs show the token endpoint with all parameters in the
+    // query string (https://planetscale.com/docs/api/reference/oauth). Their
+    // .well-known discovery doc advertises client_secret_basic /
+    // client_secret_post instead, but both behave identically to the
+    // query-string form in practice, so we follow the public docs literally.
+    tokenTransport: "query",
+});
+export const { authorize, callback, exchange, exchangeCallbackInput, refresh, usesCurrentClient } = client;
+//# sourceMappingURL=OAuthClient.js.map

package/lib/OAuthClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthClient.js","sourceRoot":"","sources":["../src/OAuthClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAsB,MAAM,wBAAwB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,6CAA6C,CAAC;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAC9C,+DAA+D,CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,+CAA+C;IAC/C,SAAS,EAAE,6CAA6C;IACxD,KAAK,EAAE,0CAA0C;CAClD,CAAC;AAEF,MAAM,MAAM,GAAG,eAAe,CAAC;IAC7B,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,WAAW,EAAE,kBAAkB;IAC/B,gBAAgB,EAAE,wBAAwB;IAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE;IACjE,wEAAwE;IACxE,yEAAyE;IACzE,6DAA6D;IAC7D,iEAAiE;IACjE,yEAAyE;IACzE,cAAc,EAAE,OAAO;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAC/F,MAAM,CAAC"}

package/lib/Postgres/PostgresBranch.d.ts

@@ -0,0 +1,75 @@
+import { Resource } from "alchemy/Resource";
+import { type BaseBranchAttributes, type BaseBranchProps } from "../Branch.ts";
+import type { Providers } from "../Providers.ts";
+import type { PostgresClusterSize } from "./PostgresClusterSize.ts";
+import type { PostgresDatabase } from "./PostgresDatabase.ts";
+/**
+ * Properties for creating or updating a {@link PostgresBranch}.
+ */
+export interface PostgresBranchProps extends BaseBranchProps {
+    /**
+     * The Postgres database. Either a string database name or a
+     * {@link PostgresDatabase} resource.
+     */
+    database: string | PostgresDatabase;
+    /**
+     * PostgreSQL cluster size for the branch. Required if `backupId` is provided.
+     * Short NAS sizes are expanded using the parent branch's region and CPU
+     * architecture (e.g. `"PS_DEV"` off an ARM parent becomes `"PS_DEV_AWS_ARM"`). Metal
+     * requires the full SKU (e.g. `"M1_10_AWS_ARM_D_METAL_10"`).
+     */
+    clusterSize?: PostgresClusterSize;
+    /**
+     * Total number of replicas for the branch. `0` creates or converges the
+     * branch to non-HA/single-node; `2+` enables HA.
+     */
+    replicas?: number;
+    /**
+     * Parent branch — either a string name or another {@link PostgresBranch}.
+     * @default "main"
+     */
+    parentBranch?: string | PostgresBranch;
+}
+/**
+ * Output attributes of a deployed {@link PostgresBranch}.
+ */
+export interface PostgresBranchAttributes extends BaseBranchAttributes {
+}
+/**
+ * A PlanetScale branch of a {@link PostgresDatabase}. For MySQL branches
+ * use {@link MySQLBranch} instead.
+ *
+ * ### Creating a Branch
+ * **Example:** Branch from main
+ * ```typescript
+ * const branch = yield* Planetscale.PostgresBranch("Feature123", {
+ *   database: "my-db",
+ *   parentBranch: "main",
+ * });
+ * ```
+ *
+ * **Example:** Branch from a PostgresDatabase resource
+ * ```typescript
+ * const db = yield* Planetscale.PostgresDatabase("MyDb", { clusterSize: "PS_10" });
+ * const branch = yield* Planetscale.PostgresBranch("Feature456", {
+ *   database: db,
+ *   parentBranch: "main",
+ * });
+ * ```
+ *
+ * ### Migrations and seed data
+ * **Example:** Apply migrations on a branch
+ * ```typescript
+ * const branch = yield* Planetscale.PostgresBranch("Feature123", {
+ *   database: db,
+ *   parentBranch: "main",
+ *   migrationsDir: "./migrations",
+ *   importFiles: ["./seed.sql"],
+ * });
+ * ```
+ */
+export type PostgresBranch = Resource<"Planetscale.PostgresBranch", PostgresBranchProps, PostgresBranchAttributes, never, Providers>;
+/** @resource */
+export declare const PostgresBranch: import("alchemy/Resource").ResourceClass<PostgresBranch>;
+export declare const PostgresBranchProvider: () => import("effect/Layer").Layer<import("alchemy/Provider").Provider<PostgresBranch>, never, never>;
+//# sourceMappingURL=PostgresBranch.d.ts.map

package/lib/Postgres/PostgresBranch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresBranch.d.ts","sourceRoot":"","sources":["../../src/Postgres/PostgresBranch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,eAAe,EAAsB,MAAM,cAAc,CAAC;AACnG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D;;;OAGG;IACH,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAEpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;CAAG;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CACnC,4BAA4B,EAC5B,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,SAAS,CACV,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,cAAc,0DAAyD,CAAC;AAErF,eAAO,MAAM,sBAAsB,uGAS/B,CAAC"}

package/lib/Postgres/PostgresBranch.js

@@ -0,0 +1,15 @@
+import { Resource } from "alchemy/Resource";
+import { makeBranchProvider } from "../Branch.js";
+import { runPostgresImports, runPostgresMigrations } from "./PostgresMigrations.js";
+/** @resource */
+export const PostgresBranch = Resource("Planetscale.PostgresBranch");
+export const PostgresBranchProvider = () => makeBranchProvider({
+    resource: PostgresBranch,
+    expectedKind: "postgresql",
+    engineLabel: "PostgresBranch",
+    runners: {
+        runMigrations: runPostgresMigrations,
+        runImports: runPostgresImports,
+    },
+});
+//# sourceMappingURL=PostgresBranch.js.map

package/lib/Postgres/PostgresBranch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresBranch.js","sourceRoot":"","sources":["../../src/Postgres/PostgresBranch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAmD,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA+EpF,gBAAgB;AAChB,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAiB,4BAA4B,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CACzC,kBAAkB,CAAC;IACjB,QAAQ,EAAE,cAAc;IACxB,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,gBAAgB;IAC7B,OAAO,EAAE;QACP,aAAa,EAAE,qBAAqB;QACpC,UAAU,EAAE,kBAAkB;KAC/B;CACF,CAAC,CAAC"}

package/lib/Postgres/PostgresClusterSize.d.ts

@@ -0,0 +1,77 @@
+import * as planetscale from "@distilled.cloud/planetscale";
+import * as Effect from "effect/Effect";
+/**
+ * Published PlanetScale Metal SKUs for Postgres (AWS).
+ *
+ * Short display names (`"M-10"`, `"M_10"`) are **not** valid SKUs. Each
+ * Metal SKU encodes CPU series, compute size, provider, architecture, and
+ * NVMe storage size.
+ *
+ * Hyphenated SKUs copied from PlanetScale's pricing docs
+ * (`"M1-10-AWS-ARM-D-METAL-10"`) are accepted and normalized to
+ * underscores by {@link toPostgresClusterSku}. GCP and custom SKUs are
+ * still valid via {@link PostgresClusterSize}'s open-string fallback.
+ *
+ * @see https://planetscale.com/docs/postgres/pricing
+ * @see https://planetscale.com/docs/metal
+ */
+export type PostgresMetalClusterSize = "M1_10_AWS_ARM_D_METAL_10" | "M1_10_AWS_AMD_D_METAL_10" | "M1_10_AWS_ARM_D_METAL_25" | "M1_10_AWS_AMD_D_METAL_25" | "M1_10_AWS_ARM_D_METAL_50" | "M1_10_AWS_AMD_D_METAL_50" | "M1_10_AWS_ARM_D_METAL_100" | "M1_10_AWS_AMD_D_METAL_100" | "M1_10_AWS_ARM_D_METAL_200" | "M1_10_AWS_AMD_D_METAL_200" | "M1_20_AWS_ARM_D_METAL_10" | "M1_20_AWS_AMD_D_METAL_10" | "M1_20_AWS_ARM_D_METAL_25" | "M1_20_AWS_AMD_D_METAL_25" | "M1_20_AWS_ARM_D_METAL_50" | "M1_20_AWS_AMD_D_METAL_50" | "M1_20_AWS_ARM_D_METAL_100" | "M1_20_AWS_AMD_D_METAL_100" | "M1_20_AWS_ARM_D_METAL_200" | "M1_20_AWS_AMD_D_METAL_200" | "M1_40_AWS_ARM_D_METAL_10" | "M1_40_AWS_AMD_D_METAL_10" | "M1_40_AWS_ARM_D_METAL_25" | "M1_40_AWS_AMD_D_METAL_25" | "M1_40_AWS_ARM_D_METAL_50" | "M1_40_AWS_AMD_D_METAL_50" | "M1_40_AWS_ARM_D_METAL_100" | "M1_40_AWS_AMD_D_METAL_100" | "M1_40_AWS_ARM_D_METAL_200" | "M1_40_AWS_AMD_D_METAL_200" | "M1_40_AWS_ARM_D_METAL_400" | "M1_40_AWS_AMD_D_METAL_400" | "M1_40_AWS_ARM_D_METAL_800" | "M1_40_AWS_AMD_D_METAL_800" | "M1_40_AWS_ARM_D_METAL_1200" | "M1_40_AWS_AMD_D_METAL_1200" | "M1_80_AWS_ARM_D_METAL_100" | "M1_80_AWS_AMD_D_METAL_100" | "M1_80_AWS_ARM_D_METAL_200" | "M1_80_AWS_AMD_D_METAL_200" | "M1_80_AWS_ARM_D_METAL_400" | "M1_80_AWS_AMD_D_METAL_400" | "M1_80_AWS_ARM_D_METAL_800" | "M1_80_AWS_AMD_D_METAL_800" | "M1_80_AWS_ARM_D_METAL_1200" | "M1_80_AWS_AMD_D_METAL_1200" | "M1_160_AWS_ARM_D_METAL_100" | "M1_160_AWS_AMD_D_METAL_100" | "M1_160_AWS_ARM_D_METAL_200" | "M1_160_AWS_AMD_D_METAL_200" | "M1_160_AWS_ARM_D_METAL_400" | "M1_160_AWS_AMD_D_METAL_400" | "M1_160_AWS_ARM_D_METAL_800" | "M1_160_AWS_AMD_D_METAL_800" | "M1_160_AWS_ARM_D_METAL_1200" | "M1_160_AWS_AMD_D_METAL_1200" | "M8_160_AWS_ARM_D_METAL_118" | "M6_160_AWS_INTEL_D_METAL_118" | "M7_160_AWS_INTEL_D_METAL_468" | "M7_160_AWS_INTEL_D_METAL_1250" | "M8_320_AWS_ARM_D_METAL_237" | "M6_320_AWS_INTEL_D_METAL_237" | "M7_320_AWS_INTEL_D_METAL_937" | "M7_320_AWS_INTEL_D_METAL_2500" | "M8_640_AWS_ARM_D_METAL_474" | "M6_640_AWS_INTEL_D_METAL_474" | "M7_640_AWS_INTEL_D_METAL_1875" | "M7_640_AWS_INTEL_D_METAL_5000" | "M7_960_AWS_INTEL_D_METAL_7500" | "M8_1280_AWS_ARM_D_METAL_950" | "M6_1280_AWS_INTEL_D_METAL_950" | "M7_1280_AWS_INTEL_D_METAL_3750" | "M7_1920_AWS_INTEL_D_METAL_15000" | "M8_2560_AWS_ARM_D_METAL_1900" | "M6_2560_AWS_INTEL_D_METAL_1900" | "M7_2560_AWS_INTEL_D_METAL_7500" | "M8_3840_AWS_ARM_D_METAL_2850" | "M6_3840_AWS_INTEL_D_METAL_2850" | "M7_3840_AWS_INTEL_D_METAL_11250" | "M7_3840_AWS_INTEL_D_METAL_30000" | "M8_5120_AWS_ARM_D_METAL_3800" | "M6_5120_AWS_INTEL_D_METAL_3800" | "M7_5120_AWS_INTEL_D_METAL_15000" | "M7_5760_AWS_INTEL_D_METAL_45000" | "M8_7680_AWS_ARM_D_METAL_5700" | "M6_7680_AWS_INTEL_D_METAL_5700" | "M7_7680_AWS_INTEL_D_METAL_22500" | "M7_7680_AWS_INTEL_D_METAL_60000" | "M6_10240_AWS_INTEL_D_METAL_7600" | "M8_15360_AWS_ARM_D_METAL_11400" | "M7_15360_AWS_INTEL_D_METAL_45000" | "M7_15360_AWS_INTEL_D_METAL_120000";
+/**
+ * Available PlanetScale PostgreSQL cluster sizes.
+ *
+ * ## Network-attached storage (NAS)
+ *
+ * `PS_*` sizes are backed by network-attached storage and can be specified
+ * either as the short size (`"PS_10"`) or the API SKU (`"PS_10_AWS_X86"`).
+ * Short NAS sizes are expanded to a SKU by {@link toPostgresClusterSku}
+ * using the target region and arch.
+ *
+ * ## Metal
+ *
+ * [PlanetScale Metal](https://planetscale.com/docs/metal) sizes are backed
+ * by locally-attached NVMe. Pass a **full Metal SKU** from
+ * {@link PostgresMetalClusterSize} — short `M-*` names are not valid on
+ * their own because Metal SKUs also encode CPU series, architecture, and
+ * drive size. See [Postgres pricing](https://planetscale.com/docs/postgres/pricing).
+ *
+ * @see https://planetscale.com/docs/postgres/pricing
+ * @see https://planetscale.com/docs/metal
+ */
+export type PostgresClusterSize = "PS_DEV" | "PS_5" | "PS_10" | "PS_20" | "PS_40" | "PS_80" | "PS_160" | "PS_320" | "PS_640" | "PS_1280" | "PS_2560" | PostgresMetalClusterSize | (string & {});
+/**
+ * Converts a {@link PostgresClusterSize} into the SKU string expected by
+ * the PlanetScale API.
+ *
+ * Hyphens are normalized to underscores so SKUs copied from PlanetScale
+ * docs (`"PS-10"`, `"M1-10-AWS-ARM-D-METAL-10"`) match the API form.
+ *
+ * For NAS-backed clusters, the API expects a suffixed name like
+ * `PS_<size>_<provider>_<arch>`. Short `PS_*` sizes are expanded using the
+ * supplied region and arch.
+ *
+ * Metal-backed sizes (anything starting with `M`) are passed through after
+ * hyphen normalization. The short `M_*` / `M-*` form is not a valid SKU on
+ * its own — the API requires the full Metal SKU (e.g.
+ * `M1_10_AWS_ARM_D_METAL_10`), which encodes the CPU series, provider,
+ * arch, and storage size.
+ *
+ * Already-suffixed NAS sizes are also passed through unchanged.
+ */
+export declare function toPostgresClusterSku(input: {
+    size: PostgresClusterSize;
+    arch?: "x86" | "arm";
+    region?: string;
+}): string;
+export declare function toPostgresClusterArch(architecture: planetscale.DatabaseBranch["cluster_architecture"]): "arm" | "x86";
+/**
+ * Polls branch change requests until all visible changes are in a terminal
+ * state (`completed` or `canceled`), or — if `changeId` is provided — until
+ * that specific change reaches a terminal state.
+ */
+export declare const waitForPendingPostgresChanges: (organization: string, database: string, branch: string, changeId?: string | undefined) => Effect.Effect<void, planetscale.ListBranchChangeRequestsError, planetscale.PlanetScaleOpContext>;
+/**
+ * Ensures a PostgreSQL production branch has the expected cluster size,
+ * queuing the change via the change-request API if it doesn't.
+ */
+export declare const ensurePostgresProductionBranchClusterSize: (organization: string, database: string, branch: string, expectedClusterSize: PostgresClusterSize) => Effect.Effect<void, import("../Util.ts").NotReady | planetscale.ListBranchChangeRequestsError, planetscale.PlanetScaleOpContext>;
+//# sourceMappingURL=PostgresClusterSize.d.ts.map

package/lib/Postgres/PostgresClusterSize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresClusterSize.d.ts","sourceRoot":"","sources":["../../src/Postgres/PostgresClusterSize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,wBAAwB,GAChC,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,4BAA4B,GAC5B,4BAA4B,GAC5B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,4BAA4B,GAC5B,6BAA6B,GAC7B,6BAA6B,GAC7B,4BAA4B,GAC5B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,4BAA4B,GAC5B,8BAA8B,GAC9B,8BAA8B,GAC9B,+BAA+B,GAC/B,4BAA4B,GAC5B,8BAA8B,GAC9B,+BAA+B,GAC/B,+BAA+B,GAC/B,+BAA+B,GAC/B,6BAA6B,GAC7B,+BAA+B,GAC/B,gCAAgC,GAChC,iCAAiC,GACjC,8BAA8B,GAC9B,gCAAgC,GAChC,gCAAgC,GAChC,8BAA8B,GAC9B,gCAAgC,GAChC,iCAAiC,GACjC,iCAAiC,GACjC,8BAA8B,GAC9B,gCAAgC,GAChC,iCAAiC,GACjC,iCAAiC,GACjC,8BAA8B,GAC9B,gCAAgC,GAChC,iCAAiC,GACjC,iCAAiC,GACjC,iCAAiC,GACjC,gCAAgC,GAChC,kCAAkC,GAClC,mCAAmC,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,SAAS,GACT,wBAAwB,GACxB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAOT;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,sBAAsB,CAAC,GAC/D,KAAK,GAAG,KAAK,CAEf;AASD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,6LA2BxC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,yCAAyC,wOA4BpD,CAAC"}

package/lib/Postgres/PostgresClusterSize.js

@@ -0,0 +1,89 @@
+import * as planetscale from "@distilled.cloud/planetscale";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { pollUntil, waitForBranchReady } from "../Util.js";
+/**
+ * Converts a {@link PostgresClusterSize} into the SKU string expected by
+ * the PlanetScale API.
+ *
+ * Hyphens are normalized to underscores so SKUs copied from PlanetScale
+ * docs (`"PS-10"`, `"M1-10-AWS-ARM-D-METAL-10"`) match the API form.
+ *
+ * For NAS-backed clusters, the API expects a suffixed name like
+ * `PS_<size>_<provider>_<arch>`. Short `PS_*` sizes are expanded using the
+ * supplied region and arch.
+ *
+ * Metal-backed sizes (anything starting with `M`) are passed through after
+ * hyphen normalization. The short `M_*` / `M-*` form is not a valid SKU on
+ * its own — the API requires the full Metal SKU (e.g.
+ * `M1_10_AWS_ARM_D_METAL_10`), which encodes the CPU series, provider,
+ * arch, and storage size.
+ *
+ * Already-suffixed NAS sizes are also passed through unchanged.
+ */
+export function toPostgresClusterSku(input) {
+    const size = input.size.replaceAll("-", "_");
+    if (!size.startsWith("PS_") || size.match(/(AWS|GCP)/))
+        return size;
+    // Not all AWS regions start with "aws-", but all GCP regions start with "gcp-".
+    const provider = input.region?.startsWith("gcp") ? "GCP" : "AWS";
+    const arch = (input.arch ?? "x86").toUpperCase();
+    return `${size}_${provider}_${arch}`;
+}
+export function toPostgresClusterArch(architecture) {
+    return architecture === "aarch64" ? "arm" : "x86";
+}
+/**
+ * Schedule for polling branch change requests. Postgres cluster resizes
+ * routinely take longer than the default 10-minute polling budget, so
+ * give change requests a 60-minute budget (720 × 5s).
+ */
+const changeRequestSchedule = Schedule.max([Schedule.spaced("5 seconds"), Schedule.recurs(720)]);
+/**
+ * Polls branch change requests until all visible changes are in a terminal
+ * state (`completed` or `canceled`), or — if `changeId` is provided — until
+ * that specific change reaches a terminal state.
+ */
+export const waitForPendingPostgresChanges = Effect.fn(function* (organization, database, branch, changeId) {
+    yield* pollUntil(`changes for branch "${branch}"`, planetscale.listBranchChangeRequests({
+        organization,
+        database,
+        branch,
+        page: 1,
+        per_page: 25,
+    }), (page) => {
+        const isTerminal = (state) => state === "completed" || state === "canceled";
+        if (changeId) {
+            const change = page.data.find((change) => change.id === changeId);
+            return change ? isTerminal(change.state) : false;
+        }
+        return page.data.every((change) => isTerminal(change.state));
+    }, changeRequestSchedule);
+});
+/**
+ * Ensures a PostgreSQL production branch has the expected cluster size,
+ * queuing the change via the change-request API if it doesn't.
+ */
+export const ensurePostgresProductionBranchClusterSize = Effect.fn(function* (organization, database, branch, expectedClusterSize) {
+    // A freshly-forked branch can't accept (or complete) change requests
+    // until it has finished provisioning — queueing a resize against it
+    // just leaves the change pending until the poll budget runs out.
+    const data = yield* waitForBranchReady(organization, database, branch);
+    const sku = toPostgresClusterSku({
+        size: expectedClusterSize,
+        arch: toPostgresClusterArch(data.cluster_architecture),
+        region: data.region.slug,
+    });
+    if (data.cluster_name === sku) {
+        return;
+    }
+    yield* waitForPendingPostgresChanges(organization, database, branch);
+    const change = yield* planetscale.updateBranchChangeRequest({
+        organization,
+        database,
+        branch,
+        cluster_size: sku,
+    });
+    yield* waitForPendingPostgresChanges(organization, database, branch, change.id);
+});
+//# sourceMappingURL=PostgresClusterSize.js.map

package/lib/Postgres/PostgresClusterSize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresClusterSize.js","sourceRoot":"","sources":["../../src/Postgres/PostgresClusterSize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,8BAA8B,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAmJ3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,YAAgE;IAEhE,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEjG;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC9D,YAAoB,EACpB,QAAgB,EAChB,MAAc,EACd,QAAiB;IAEjB,KAAK,CAAC,CAAC,SAAS,CACd,uBAAuB,MAAM,GAAG,EAChC,WAAW,CAAC,wBAAwB,CAAC;QACnC,YAAY;QACZ,QAAQ;QACR,MAAM;QACN,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,EAAE;KACb,CAAC,EACF,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,UAAU,CAAC;QAEpF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnD,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC,EACD,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC1E,YAAoB,EACpB,QAAgB,EAChB,MAAc,EACd,mBAAwC;IAExC,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEvE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,oBAAoB,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;KACzB,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,YAAY,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,KAAK,CAAC,CAAC,6BAA6B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC;QAC1D,YAAY;QACZ,QAAQ;QACR,MAAM;QACN,YAAY,EAAE,GAAG;KAClB,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,6BAA6B,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC"}