@alchemy.run/planetscale 0.0.0 → 2.0.0-beta.84

package/lib/Postgres/PostgresDefaultRole.js

@@ -0,0 +1,187 @@
+import * as planetscale from "@distilled.cloud/planetscale";
+import { Credentials } from "@distilled.cloud/planetscale/Credentials";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import { PlanetscaleConflict, waitForBranchReady } from "../Util.js";
+/** @resource */
+export const PostgresDefaultRole = Resource("Planetscale.PostgresDefaultRole");
+export const PostgresDefaultRoleProvider = () => Provider.succeed(PostgresDefaultRole, {
+    stables: ["id"],
+    diff: Effect.fn(function* ({ news, olds = {} }) {
+        if (!isResolved(news))
+            return undefined;
+        const newDb = resolveDatabaseName(news.database);
+        const oldDb = olds.database ? resolveDatabaseName(olds.database) : undefined;
+        if (oldDb && newDb !== oldDb) {
+            return { action: "replace" };
+        }
+        const newBranch = resolveBranchName(news.branch);
+        const oldBranch = resolveBranchName(olds.branch);
+        if (newBranch !== oldBranch) {
+            return { action: "replace" };
+        }
+        return undefined;
+    }),
+    read: Effect.fn(function* ({ output }) {
+        // Adoption (no cached output) is impossible without destroying
+        // existing credentials. The engine routes adoption through
+        // `read`, but here we always defer to reconcile so the
+        // `forceReset` props flag remains the user-facing switch for
+        // takeover. Returning undefined makes the engine treat the
+        // resource as greenfield; reconcile then observes live state
+        // and either fails (no forceReset) or resets (forceReset).
+        if (!output)
+            return undefined;
+        // Refresh — verify the default role still exists and re-emit
+        // the persisted output (with plaintext intact). If gone,
+        // return undefined so the engine routes through reconcile,
+        // which will recreate via reset.
+        return yield* planetscale
+            .getDefaultRole({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+        })
+            .pipe(Effect.map((role) => ({
+            ...output,
+            privateHost: role.private_access_host_url,
+            privateConnectionServiceName: role.private_connection_service_name,
+        })), Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+    }),
+    reconcile: Effect.fn(function* ({ news, output }) {
+        const { organization: envOrg } = yield* yield* Credentials;
+        const organization = resolveDatabaseOrg(news.database) ?? envOrg;
+        const databaseName = resolveDatabaseName(news.database);
+        const branchName = resolveBranchName(news.branch);
+        // 1. Observe — the default role is the singleton for this
+        //    (database, branch); we key on those rather than an id.
+        //    Observation runs unconditionally so the adoption guard
+        //    below fires on greenfield deploys against branches that
+        //    already have a default role (otherwise we would silently
+        //    `resetDefault` and destroy their credentials).
+        const observed = yield* planetscale
+            .getDefaultRole({
+            organization,
+            database: databaseName,
+            branch: branchName,
+        })
+            .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)));
+        // 2. Sync (no-op) — we own the role and it still exists in the
+        //    cloud. Default roles have nothing mutable in place: their
+        //    plaintext password isn't retrievable, so we retain the cached
+        //    credentials while refreshing the private connection details.
+        //    diff() forces a replace when database/branch change.
+        if (output && observed) {
+            return {
+                ...output,
+                privateHost: observed.private_access_host_url,
+                privateConnectionServiceName: observed.private_connection_service_name,
+            };
+        }
+        // 3. Adoption guard — observed exists but we have no prior
+        //    output (greenfield against a pre-existing default role).
+        //    Taking over requires a reset (which destroys the existing
+        //    password), so gate on an explicit forceReset opt-in.
+        if (observed && !news.forceReset) {
+            return yield* new PlanetscaleConflict({
+                message: `Default role already exists for database "${databaseName}" branch "${branchName}". Use forceReset: true to reset.`,
+            });
+        }
+        // 4. Ensure — (re)create the default role. This branch runs
+        //    for greenfield (no output, no observed), drift recovery
+        //    (output cached but cloud state gone), and authorised
+        //    adoption (observed present + forceReset).
+        yield* waitForBranchReady(organization, databaseName, branchName);
+        const data = yield* planetscale.resetDefaultRole({
+            organization,
+            database: databaseName,
+            branch: branchName,
+        });
+        if (!data.password) {
+            return yield* Effect.die(`Planetscale did not return a password for Default Role.`);
+        }
+        const password = Redacted.isRedacted(data.password)
+            ? Redacted.value(data.password)
+            : data.password;
+        const connectionUrl = `postgresql://${data.username}:${password}@${data.access_host_url}:5432/${data.database_name}?sslmode=verify-full`;
+        const connectionUrlPooled = `postgresql://${data.username}:${password}@${data.access_host_url}:6432/${data.database_name}?sslmode=verify-full`;
+        return {
+            id: data.id,
+            name: data.name,
+            expiresAt: data.expires_at,
+            host: data.access_host_url,
+            username: data.username,
+            password: Redacted.make(password),
+            ttl: data.ttl,
+            databaseName: data.database_name,
+            connectionUrl: Redacted.make(connectionUrl),
+            connectionUrlPooled: Redacted.make(connectionUrlPooled),
+            privateHost: data.private_access_host_url,
+            privateConnectionServiceName: data.private_connection_service_name,
+            inheritedRoles: data.inherited_roles,
+            organization,
+            database: databaseName,
+            branch: branchName,
+        };
+    }),
+    delete: Effect.fn(function* ({ output }) {
+        // No delete endpoint — reset to invalidate existing credentials.
+        yield* planetscale
+            .resetDefaultRole({
+            organization: output.organization,
+            database: output.database,
+            branch: output.branch,
+        })
+            .pipe(Effect.catchTag("NotFound", () => Effect.void));
+    }),
+    list: Effect.fn(function* () {
+        const { organization } = yield* yield* Credentials;
+        const roles = yield* planetscale.listDatabases.pages({ organization }).pipe(Stream.map((page) => page.data.filter((db) => db.kind === "postgresql")), Stream.flattenIterable, Stream.flatMap((db) => planetscale.listBranches.pages({ organization, database: db.name }).pipe(Stream.map((page) => page.data.filter((branch) => branch.kind === "postgresql")), Stream.flattenIterable, Stream.catchTag("NotFound", () => Stream.succeed({ name: db.default_branch ?? "main" })), Stream.flatMap((branch) => planetscale.listRoles
+            .pages({
+            organization,
+            database: db.name,
+            branch: branch.name,
+        })
+            .pipe(Stream.map((page) => page.data
+            .filter((role) => role.default)
+            .map((role) => ({
+            id: role.id,
+            name: role.name,
+            expiresAt: role.expires_at,
+            host: role.access_host_url,
+            username: role.username,
+            password: Redacted.make(""),
+            ttl: role.ttl,
+            databaseName: role.database_name,
+            connectionUrl: Redacted.make(""),
+            connectionUrlPooled: Redacted.make(""),
+            privateHost: role.private_access_host_url,
+            privateConnectionServiceName: role.private_connection_service_name,
+            inheritedRoles: role.inherited_roles,
+            organization,
+            database: db.name,
+            branch: branch.name,
+        }))), Stream.flattenIterable, Stream.catchTags({
+            NotFound: () => Stream.empty,
+            Forbidden: () => Stream.empty,
+        })), { concurrency: 10 })), { concurrency: 10 }), Stream.runCollect);
+        return Array.from(roles);
+    }),
+});
+const resolveDatabaseName = (database) => {
+    const ref = database;
+    return typeof ref === "string" ? ref : ref.name;
+};
+const resolveDatabaseOrg = (database) => {
+    const ref = database;
+    return typeof ref === "string" ? undefined : ref.organization;
+};
+const resolveBranchName = (branch) => {
+    const ref = branch;
+    return !ref ? "main" : typeof ref === "string" ? ref : ref.name;
+};
+//# sourceMappingURL=PostgresDefaultRole.js.map

package/lib/Postgres/PostgresDefaultRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresDefaultRole.js","sourceRoot":"","sources":["../../src/Postgres/PostgresDefaultRole.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAkGrE,gBAAgB;AAChB,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAsB,iCAAiC,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,EAAE,CAC9C,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE;IACpC,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAExC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,+DAA+D;QAC/D,2DAA2D;QAC3D,uDAAuD;QACvD,6DAA6D;QAC7D,2DAA2D;QAC3D,6DAA6D;QAC7D,2DAA2D;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,6DAA6D;QAC7D,yDAAyD;QACzD,2DAA2D;QAC3D,iCAAiC;QACjC,OAAO,KAAK,CAAC,CAAC,WAAW;aACtB,cAAc,CAAC;YACd,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpB,GAAG,MAAM;YACT,WAAW,EAAE,IAAI,CAAC,uBAAuB;YACzC,4BAA4B,EAAE,IAAI,CAAC,+BAA+B;SACnE,CAAC,CAAC,EACH,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC7D,CAAC;IACN,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9C,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QAC3D,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;QACjE,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,0DAA0D;QAC1D,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,8DAA8D;QAC9D,oDAAoD;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW;aAChC,cAAc,CAAC;YACd,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,UAAU;SACnB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtE,+DAA+D;QAC/D,+DAA+D;QAC/D,mEAAmE;QACnE,kEAAkE;QAClE,0DAA0D;QAC1D,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,OAAO;gBACL,GAAG,MAAM;gBACT,WAAW,EAAE,QAAQ,CAAC,uBAAuB;gBAC7C,4BAA4B,EAAE,QAAQ,CAAC,+BAA+B;aACvE,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,8DAA8D;QAC9D,+DAA+D;QAC/D,0DAA0D;QAC1D,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC;gBACpC,OAAO,EAAE,6CAA6C,YAAY,aAAa,UAAU,mCAAmC;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,6DAA6D;QAC7D,0DAA0D;QAC1D,+CAA+C;QAC/C,KAAK,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;YAC/C,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAElB,MAAM,aAAa,GAAG,gBAAgB,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC,eAAe,SAAS,IAAI,CAAC,aAAa,sBAAsB,CAAC;QACzI,MAAM,mBAAmB,GAAG,gBAAgB,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAAI,IAAI,CAAC,eAAe,SAAS,IAAI,CAAC,aAAa,sBAAsB,CAAC;QAE/I,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,IAAI,EAAE,IAAI,CAAC,eAAe;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAC3C,mBAAmB,EAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACvD,WAAW,EAAE,IAAI,CAAC,uBAAuB;YACzC,4BAA4B,EAAE,IAAI,CAAC,+BAA+B;YAClE,cAAc,EAAE,IAAI,CAAC,eAAkC;YACvD,YAAY;YACZ,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,UAAU;SACqB,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACrC,iEAAiE;QACjE,KAAK,CAAC,CAAC,WAAW;aACf,gBAAgB,CAAC;YAChB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;QAEnD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,CACzE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,EACxE,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,OAAO,CACZ,CAAC,EAAE,EAAE,EAAE,CACL,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,EAChF,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC,CACtD,EACD,MAAM,CAAC,OAAO,CACZ,CAAC,MAAM,EAAE,EAAE,CACT,WAAW,CAAC,SAAS;aAClB,KAAK,CAAC;YACL,YAAY;YACZ,QAAQ,EAAE,EAAE,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClB,IAAI,CAAC,IAAI;aACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;aAC9B,GAAG,CACF,CAAC,IAAI,EAAE,EAAE,CACP,CAAC;YACC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,IAAI,EAAE,IAAI,CAAC,eAAe;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,mBAAmB,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,IAAI,CAAC,uBAAuB;YACzC,4BAA4B,EAAE,IAAI,CAAC,+BAA+B;YAClE,cAAc,EAAE,IAAI,CAAC,eAAkC;YACvD,YAAY;YACZ,QAAQ,EAAE,EAAE,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAA0E,CAC9E,CACJ,EACD,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,SAAS,CAAC;YACf,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK;YAC5B,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK;SAC9B,CAAC,CACH,EACL,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,CACF,EACH,EAAE,WAAW,EAAE,EAAE,EAAE,CACpB,EACD,MAAM,CAAC,UAAU,CAClB,CAAC;QAEF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;CACH,CAAC,CAAC;AAOL,MAAM,mBAAmB,GAAG,CAAC,QAAmC,EAAU,EAAE;IAC1E,MAAM,GAAG,GAAG,QAAkC,CAAC;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,QAAmC,EAAsB,EAAE;IACrF,MAAM,GAAG,GAAG,QAAkC,CAAC;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAA2C,EAAU,EAAE;IAChF,MAAM,GAAG,GAAG,MAA0C,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;AAClE,CAAC,CAAC"}

package/lib/Postgres/PostgresMigrations.d.ts

@@ -0,0 +1,24 @@
+import { type NormalizedMigrationsInput, type StampedMigrationsState } from "@alchemy.run/sql/Migrations";
+import * as ps from "@distilled.cloud/planetscale";
+import * as Effect from "effect/Effect";
+declare const PostgresMigrationError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "Planetscale::PostgresMigrationError";
+} & Readonly<A>;
+export declare class PostgresMigrationError extends PostgresMigrationError_base<{
+    message: string;
+    cause?: unknown;
+}> {
+}
+export interface PostgresMigrationTarget {
+    organization: string;
+    database: string;
+    branch: string;
+}
+/**
+ * PlanetScale Postgres's migration adaptation is exactly this: the shared
+ * pipeline with a temp-role-scoped pg client as its executor.
+ */
+export declare const runPostgresMigrations: (target: PostgresMigrationTarget, input: NormalizedMigrationsInput, stamped: StampedMigrationsState) => Effect.Effect<import("@alchemy.run/sql/Migrations").MigrationRun, import("@alchemy.run/sql/Migrations").DrizzleV0LayoutError | PostgresMigrationError | ps.CreateRoleError | import("@alchemy.run/sql/Migrations").MigrationApplyError, import("effect/FileSystem").FileSystem | import("effect/Path").Path | ps.PlanetScaleOpContext>;
+export declare const runPostgresImports: (target: PostgresMigrationTarget, importFiles: ReadonlyArray<string>, rootDir: string, previous: Record<string, string>) => Effect.Effect<Record<string, string>, import("effect/PlatformError").PlatformError | PostgresMigrationError | ps.CreateRoleError, import("effect/FileSystem").FileSystem | import("effect/Path").Path | ps.PlanetScaleOpContext>;
+export {};
+//# sourceMappingURL=PostgresMigrations.d.ts.map

package/lib/Postgres/PostgresMigrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresMigrations.d.ts","sourceRoot":"","sources":["../../src/Postgres/PostgresMigrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC5B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAEnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;;;;AAiBxC,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;CAAG;AAEL,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,WACxB,uBAAuB,SACxB,yBAAyB,WACvB,sBAAsB,2UAO7B,CAAC;AAEL,eAAO,MAAM,kBAAkB,WACrB,uBAAuB,eAClB,aAAa,CAAC,MAAM,CAAC,WACzB,MAAM,YACL,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,qOAkB9B,CAAC"}

package/lib/Postgres/PostgresMigrations.js

@@ -0,0 +1,116 @@
+import { makePgMigrationExecutor, runMigrations, } from "@alchemy.run/sql/Migrations";
+import { readSqlFile } from "@alchemy.run/sql/SqlFile";
+import * as ps from "@distilled.cloud/planetscale";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Schedule from "effect/Schedule";
+// `pg` is an optional peer dependency — loaded lazily so importing the
+// Planetscale provider never requires the driver unless migrations run.
+const importPg = () => import("pg").catch((cause) => {
+    throw new Error("Failed to load the 'pg' driver. Install the optional peer dependency 'pg' to run Planetscale Postgres migrations.", { cause });
+});
+const MIGRATION_ROLE_TTL_SECONDS = 600;
+export class PostgresMigrationError extends Data.TaggedError("Planetscale::PostgresMigrationError") {
+}
+/**
+ * PlanetScale Postgres's migration adaptation is exactly this: the shared
+ * pipeline with a temp-role-scoped pg client as its executor.
+ */
+export const runPostgresMigrations = (target, input, stamped) => runMigrations({
+    input,
+    stamped,
+    withExecutor: (apply) => withPostgresClient(target, (client) => apply(makePgMigrationExecutor(client))),
+});
+export const runPostgresImports = (target, importFiles, rootDir, previous) => Effect.gen(function* () {
+    const hashes = { ...previous };
+    for (const filePath of importFiles) {
+        const file = yield* readSqlFile(rootDir, filePath);
+        if (previous[filePath] === file.hash) {
+            hashes[filePath] = file.hash;
+            continue;
+        }
+        yield* runPostgresSql(target, file.sql);
+        hashes[filePath] = file.hash;
+    }
+    const tracked = new Set(importFiles);
+    for (const key of Object.keys(hashes)) {
+        if (!tracked.has(key))
+            delete hashes[key];
+    }
+    return hashes;
+});
+const runPostgresSql = (target, sql) => withPostgresClient(target, (client) => pgExec(client, sql));
+const withPostgresClient = (target, use) => withTemporaryPostgresRole(target, (role) => Effect.acquireUseRelease(Effect.gen(function* () {
+    const { Client } = yield* Effect.tryPromise({
+        try: importPg,
+        catch: toMigrationError,
+    });
+    const client = yield* Effect.sync(() => new Client({
+        connectionString: role.connectionUrl.pipe(Redacted.value, stripPgSslQueryParams),
+        ssl: { rejectUnauthorized: true },
+    }));
+    yield* Effect.tryPromise({
+        try: () => client.connect(),
+        catch: toMigrationError,
+    });
+    return client;
+}), use, (client) => Effect.tryPromise({
+    try: () => client.end(),
+    catch: toMigrationError,
+}).pipe(Effect.ignore)));
+const withTemporaryPostgresRole = (target, use) => Effect.acquireUseRelease(Effect.gen(function* () {
+    const created = yield* ps.createRole({
+        organization: target.organization,
+        database: target.database,
+        branch: target.branch,
+        ttl: MIGRATION_ROLE_TTL_SECONDS,
+        inherited_roles: ["postgres"],
+    });
+    const password = created.password;
+    const value = Redacted.value(password);
+    const connectionUrl = yield* Effect.sync(() => `postgresql://${encodeURIComponent(created.username)}:${encodeURIComponent(value)}@${created.access_host_url}:5432/${created.database_name}?sslmode=verify-full`);
+    return {
+        id: created.id,
+        connectionUrl: Redacted.make(connectionUrl),
+    };
+}), use, (role) => ps
+    .deleteRole({
+    organization: target.organization,
+    database: target.database,
+    branch: target.branch,
+    id: role.id,
+    successor: "postgres",
+})
+    .pipe(
+// Already-deleted roles are a success: nothing to clean up.
+Effect.catchTag("NotFound", () => Effect.void), Effect.retry({
+    schedule: Schedule.max([Schedule.exponential("500 millis"), Schedule.recurs(5)]),
+}), 
+// Migrations succeeded; don't fail the parent over a release-step
+// hiccup. The role's TTL bounds the orphan window; log loudly so
+// an operator can clean it up manually if needed.
+Effect.catch((cause) => Effect.logWarning(`Failed to delete temporary Planetscale migration role after retries. ` +
+    `It will expire via TTL (~${MIGRATION_ROLE_TTL_SECONDS}s). ` +
+    `organization=${target.organization} database=${target.database} ` +
+    `branch=${target.branch} id=${role.id}`, cause))));
+const pgExec = (client, sql, values) => Effect.tryPromise({
+    try: () => client.query(sql, values).then(() => undefined),
+    catch: toMigrationError,
+});
+const toMigrationError = (cause) => new PostgresMigrationError({
+    message: cause instanceof Error ? cause.message : String(cause),
+    cause,
+});
+const stripPgSslQueryParams = (uri) => {
+    try {
+        const url = new URL(uri);
+        url.searchParams.delete("sslmode");
+        url.searchParams.delete("channel_binding");
+        return url.toString();
+    }
+    catch {
+        return uri;
+    }
+};
+//# sourceMappingURL=PostgresMigrations.js.map

package/lib/Postgres/PostgresMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresMigrations.js","sourceRoot":"","sources":["../../src/Postgres/PostgresMigrations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,aAAa,GAGd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,8BAA8B,CAAC;AACnD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IAC3B,MAAM,IAAI,KAAK,CACb,mHAAmH,EACnH,EAAE,KAAK,EAAE,CACV,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,OAAO,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAC1D,qCAAqC,CAIrC;CAAG;AAQL;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAA+B,EAC/B,KAAgC,EAChC,OAA+B,EAC/B,EAAE,CACF,aAAa,CAAC;IACZ,KAAK;IACL,OAAO;IACP,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CACtB,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;CACjF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,MAA+B,EAC/B,WAAkC,EAClC,OAAe,EACf,QAAgC,EAChC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAA2B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACvD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,CAAC,MAA+B,EAAE,GAAW,EAAE,EAAE,CACtE,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9D,MAAM,kBAAkB,GAAG,CACzB,MAA+B,EAC/B,GAA+C,EAC/C,EAAE,CACF,yBAAyB,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACzC,MAAM,CAAC,iBAAiB,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1C,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAC/B,GAAG,EAAE,CACH,IAAI,MAAM,CAAC;QACT,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;QAChF,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;KAClC,CAAC,CACL,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;QAC3B,KAAK,EAAE,gBAAgB;KACxB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,EACF,GAAG,EACH,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE;IACvB,KAAK,EAAE,gBAAgB;CACxB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACzB,CACF,CAAC;AAEJ,MAAM,yBAAyB,GAAG,CAChC,MAA+B,EAC/B,GAA+F,EAC/F,EAAE,CACF,MAAM,CAAC,iBAAiB,CACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,0BAA0B;QAC/B,eAAe,EAAE,CAAC,UAAU,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAS,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACtC,GAAG,EAAE,CACH,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,eAAe,SAAS,OAAO,CAAC,aAAa,sBAAsB,CACnK,CAAC;IACF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;KAC5C,CAAC;AACJ,CAAC,CAAC,EACF,GAAG,EACH,CAAC,IAAI,EAAE,EAAE,CACP,EAAE;KACC,UAAU,CAAC;IACV,YAAY,EAAE,MAAM,CAAC,YAAY;IACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,SAAS,EAAE,UAAU;CACtB,CAAC;KACD,IAAI;AACH,4DAA4D;AAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9C,MAAM,CAAC,KAAK,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CACjF,CAAC;AACF,kEAAkE;AAClE,iEAAiE;AACjE,kDAAkD;AAClD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAC9B,MAAM,CAAC,UAAU,CACf,uEAAuE;IACrE,4BAA4B,0BAA0B,MAAM;IAC5D,gBAAgB,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,QAAQ,GAAG;IAClE,UAAU,MAAM,CAAC,MAAM,OAAO,IAAI,CAAC,EAAE,EAAE,EACzC,KAAK,CACN,CACF,CACF,CACN,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,MAA+B,EAAE,EAAE,CAC9E,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAwB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;IAC5E,KAAK,EAAE,gBAAgB;CACxB,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC1C,IAAI,sBAAsB,CAAC;IACzB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC/D,KAAK;CACN,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAU,EAAE;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC,CAAC"}

package/lib/Postgres/PostgresOrigin.d.ts

@@ -0,0 +1,15 @@
+import * as Redacted from "effect/Redacted";
+/**
+ * The shape `Cloudflare.Hyperdrive` and other Postgres consumers accept as an
+ * origin. Materialized on `Planetscale.PostgresRole` so callers can wire role
+ * credentials into Hyperdrive directly.
+ */
+export type PostgresOrigin = {
+    scheme: "postgres" | "postgresql";
+    host: string;
+    port: number;
+    database: string;
+    user: string;
+    password: Redacted.Redacted<string>;
+};
+//# sourceMappingURL=PostgresOrigin.d.ts.map

package/lib/Postgres/PostgresOrigin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresOrigin.d.ts","sourceRoot":"","sources":["../../src/Postgres/PostgresOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC,CAAC"}

package/lib/Postgres/PostgresOrigin.js

@@ -0,0 +1,2 @@
+import * as Redacted from "effect/Redacted";
+//# sourceMappingURL=PostgresOrigin.js.map

package/lib/Postgres/PostgresOrigin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresOrigin.js","sourceRoot":"","sources":["../../src/Postgres/PostgresOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC"}

package/lib/Postgres/PostgresRole.d.ts

@@ -0,0 +1,142 @@
+import * as planetscale from "@distilled.cloud/planetscale";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Redacted from "effect/Redacted";
+import type { Providers } from "../Providers.ts";
+import type { PostgresBranch } from "./PostgresBranch.ts";
+import type { PostgresDatabase } from "./PostgresDatabase.ts";
+import type { PostgresOrigin } from "./PostgresOrigin.ts";
+/**
+ * Built-in PostgreSQL roles that can be inherited from. Custom role names
+ * (referencing other Role resources) are also accepted.
+ */
+export type InheritedRole = "pscale_managed" | "pg_checkpoint" | "pg_create_subscription" | "pg_maintain" | "pg_monitor" | "pg_read_all_data" | "pg_read_all_settings" | "pg_read_all_stats" | "pg_signal_backend" | "pg_stat_scan_tables" | "pg_use_reserved_connections" | "pg_write_all_data" | "postgres" | (string & {});
+/**
+ * Properties for creating or updating a PlanetScale PostgreSQL role.
+ *
+ * Roles are only meant for PostgreSQL databases. For MySQL,
+ * use {@link MySQLPassword} instead.
+ */
+export interface PostgresRoleProps {
+    /**
+     * Role name. If not provided, a physical name will be generated.
+     */
+    name?: string;
+    /**
+     * PostgreSQL database — string name or {@link PostgresDatabase} resource.
+     */
+    database: string | PostgresDatabase;
+    /**
+     * Branch — string name or {@link PostgresBranch} resource.
+     * @default "main"
+     */
+    branch?: string | PostgresBranch;
+    /**
+     * Time to live in seconds.
+     */
+    ttl?: number;
+    /**
+     * Roles to inherit from. Either a list of built-in role names, or
+     * another {@link PostgresRole} resource (whose `inheritedRoles` are reused).
+     */
+    inheritedRoles: InheritedRole[] | PostgresRole;
+    /**
+     * Give the role the REPLICATION attribute, for a logical-replication
+     * consumer (Electric, Debezium, a CDC pipeline). PlanetScale only grants
+     * it alongside `inheritedRoles: ["postgres"]`. Create-only: changing it
+     * replaces the role.
+     * @default false
+     */
+    withReplication?: boolean;
+    /**
+     * Successor role to reassign ownership to before dropping. Used during
+     * delete.
+     * @default "postgres"
+     */
+    successor?: string | PostgresRole;
+}
+/**
+ * Output attributes of a deployed PlanetScale role.
+ */
+export interface PostgresRoleAttributes {
+    /** Unique identifier for the role (stable). */
+    id: string;
+    /** The Postgres role name (assigned by PlanetScale). */
+    name: string;
+    /** ISO 8601 timestamp at which the role expires. */
+    expiresAt: string | null;
+    /** Hostname for the database connection. */
+    host: string;
+    /** Username for database authentication. */
+    username: string;
+    /** Password for database authentication (Redacted). */
+    password: Redacted.Redacted<string>;
+    /** The database name. */
+    database: string;
+    /** The Postgres database name inside the branch. */
+    databaseName: string;
+    /** Parsed direct (port 5432) connection components ready to feed into Cloudflare Hyperdrive. */
+    origin: PostgresOrigin;
+    /** Parsed pooled (PSBouncer, port 6432) connection components, e.g. for a Hyperdrive `dev` origin. */
+    pooledOrigin: PostgresOrigin;
+    /**
+     * Private connection host or DNS zone for this branch, supplied by
+     * PlanetScale. GCP Private Service Connect requires an endpoint name before
+     * this DNS zone.
+     */
+    privateHost: string;
+    /** Service name for this branch supplied by PlanetScale to establish a private connection. */
+    privateConnectionServiceName: string;
+    /** Direct connection URL for the database (Redacted). */
+    connectionUrl: Redacted.Redacted<string>;
+    /** Pooled connection URL via PSBouncer (port 6432, Redacted). */
+    connectionUrlPooled: Redacted.Redacted<string>;
+    /** Inherited roles. */
+    inheritedRoles: InheritedRole[];
+    /** Whether the role carries the REPLICATION attribute. */
+    withReplication: boolean;
+    /** The successor role used during delete. */
+    successor: string;
+    /** Resolved organization slug. */
+    organization: string;
+    /** Resolved branch name. */
+    branch: string;
+    /** Time-to-live for the role in seconds. */
+    ttl: number | null;
+}
+/**
+ * A PlanetScale role for accessing a PostgreSQL database branch.
+ *
+ * For MySQL databases, use {@link MySQLPassword} instead.
+ *
+ * ### Creating a Role
+ * **Example:** Postgres admin role
+ * ```typescript
+ * const admin = yield* Planetscale.PostgresRole("Admin", {
+ *   database: "my-db",
+ *   inheritedRoles: ["postgres"],
+ * });
+ * ```
+ *
+ * **Example:** Read-only role
+ * ```typescript
+ * const reader = yield* Planetscale.PostgresRole("Reader", {
+ *   database: "my-db",
+ *   inheritedRoles: ["pg_read_all_data", "pg_read_all_settings"],
+ * });
+ * ```
+ *
+ * **Example:** Role with TTL
+ * ```typescript
+ * const tempReader = yield* Planetscale.PostgresRole("TempReader", {
+ *   database: "my-db",
+ *   inheritedRoles: ["pg_read_all_data"],
+ *   ttl: 3600,
+ * });
+ * ```
+ */
+export type PostgresRole = Resource<"Planetscale.PostgresRole", PostgresRoleProps, PostgresRoleAttributes, never, Providers>;
+/** @resource */
+export declare const PostgresRole: import("alchemy/Resource").ResourceClass<PostgresRole>;
+export declare const PostgresRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<PostgresRole>, never, import("alchemy/Stack").Stack | import("alchemy/Stage").Stage | planetscale.PlanetScaleOpContext>;
+//# sourceMappingURL=PostgresRole.d.ts.map

package/lib/Postgres/PostgresRole.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresRole.d.ts","sourceRoot":"","sources":["../../src/Postgres/PostgresRole.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,WAAW,MAAM,8BAA8B,CAAC;AAI5D,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,eAAe,GACf,wBAAwB,GACxB,aAAa,GACb,YAAY,GACZ,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,6BAA6B,GAC7B,mBAAmB,GACnB,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAiBlB;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAEpC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAEjC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,cAAc,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC;IAE/C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,MAAM,EAAE,cAAc,CAAC;IACvB,sGAAsG;IACtG,YAAY,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8FAA8F;IAC9F,4BAA4B,EAAE,MAAM,CAAC;IACrC,yDAAyD;IACzD,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,iEAAiE;IACjE,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,uBAAuB;IACvB,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,0DAA0D;IAC1D,eAAe,EAAE,OAAO,CAAC;IACzB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CACjC,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,SAAS,CACV,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,YAAY,wDAAqD,CAAC;AAE/E,eAAO,MAAM,oBAAoB,8KAwP7B,CAAC"}