@heroku/sdk 0.12.0 → 0.12.1

package/dist/resources/data/database-credential/create.d.ts

@@ -0,0 +1,17 @@
+import type { PostgresCredentialCreateOpts, PostgresCredentialCreateResult, PostgresDatabaseCreateCredentialsResult } from '@heroku/types/data';
+import type { ResourceCtx } from '../../../core/extend-resource.js';
+import type { ResolvedAddOn } from '../../platform/add-on/types.js';
+import type { DatabaseCredentialOptions } from './index.js';
+export type CreateDatabaseCredentialResult = {
+    addon: ResolvedAddOn;
+    credential: PostgresCredentialCreateResult | PostgresDatabaseCreateCredentialsResult;
+};
+/**
+ * Creates a credential on a Postgres database, dispatching to the
+ * Advanced-tier or classic-tier endpoint based on the resolved add-on's plan.
+ *
+ * Essential and legacy Essential-tier databases don't support custom credentials.
+ *
+ * Returns the resolved addon alongside the created credential
+ */
+export declare function create(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, body: PostgresCredentialCreateOpts, options?: DatabaseCredentialOptions): Promise<CreateDatabaseCredentialResult>;

package/dist/resources/data/database-credential/create.js

@@ -0,0 +1,28 @@
+import { withSignal } from '../../../core/with-signal.js';
+import { resolveAddonInternal } from '../../platform/add-on/resolve.js';
+import { getPostgresServiceName, isAdvancedDatabase, isEssentialTier } from '../internal/postgres-utils.js';
+/**
+ * Creates a credential on a Postgres database, dispatching to the
+ * Advanced-tier or classic-tier endpoint based on the resolved add-on's plan.
+ *
+ * Essential and legacy Essential-tier databases don't support custom credentials.
+ *
+ * Returns the resolved addon alongside the created credential
+ */
+export async function create(ctx, addonIdentity, body, options = {}) {
+    const { appIdentity, signal } = options;
+    signal?.throwIfAborted();
+    // Bind the signal so the resolve and create requests abort in flight.
+    const platform = withSignal(ctx.platform, signal);
+    const addon = await resolveAddonInternal(platform, addonIdentity, {
+        addonService: getPostgresServiceName(), appIdentity,
+    });
+    if (isEssentialTier(addon)) {
+        throw new Error('You can\'t create custom credentials on Essential-tier databases.');
+    }
+    const data = withSignal(ctx.data, signal);
+    const credential = await (isAdvancedDatabase(addon)
+        ? data.postgresCredential.create(addon.id, body)
+        : data.postgresDatabase.createCredentials(addon.id, body));
+    return { addon, credential };
+}

package/dist/resources/data/database-credential/destroy.d.ts

@@ -0,0 +1,17 @@
+import type { PostgresDatabaseDeleteCredentialResult } from '@heroku/types/data';
+import type { ResourceCtx } from '../../../core/extend-resource.js';
+import type { ResolvedAddOn } from '../../platform/add-on/types.js';
+import type { DatabaseCredentialOptions } from './index.js';
+export type DestroyDatabaseCredentialResult = {
+    addon: ResolvedAddOn;
+    result: PostgresDatabaseDeleteCredentialResult | void;
+};
+/**
+ * Destroys a credential on a Postgres database, dispatching to the
+ * Advanced-tier or classic-tier endpoint based on the resolved add-on's plan.
+ *
+ * The owner credential (Advanced tier) and the default credential (classic/Essential
+ * tier) can't be destroyed, custom credentials can't be destroyed on Essential-tier
+ * databases, and a credential still attached to any app must be detached first.
+ */
+export declare function destroy(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, credName: string, options?: DatabaseCredentialOptions): Promise<DestroyDatabaseCredentialResult>;

package/dist/resources/data/database-credential/destroy.js

@@ -0,0 +1,55 @@
+import { withSignal } from '../../../core/with-signal.js';
+import { resolveAddonInternal } from '../../platform/add-on/resolve.js';
+import { parseAttachmentFactors } from '../internal/parse-attachment-factors.js';
+import { getPostgresServiceName, isAdvancedDatabase, isEssentialDatabase, isLegacyEssentialDatabase, } from '../internal/postgres-utils.js';
+/**
+ * Destroys a credential on a Postgres database, dispatching to the
+ * Advanced-tier or classic-tier endpoint based on the resolved add-on's plan.
+ *
+ * The owner credential (Advanced tier) and the default credential (classic/Essential
+ * tier) can't be destroyed, custom credentials can't be destroyed on Essential-tier
+ * databases, and a credential still attached to any app must be detached first.
+ */
+export async function destroy(ctx, addonIdentity, credName, options = {}) {
+    const { appIdentity, signal } = options;
+    signal?.throwIfAborted();
+    // Bind the signal so the resolve and destroy requests abort in flight.
+    const platform = withSignal(ctx.platform, signal);
+    const addon = await resolveAddonInternal(platform, addonIdentity, {
+        addonService: getPostgresServiceName(), appIdentity,
+    });
+    const data = withSignal(ctx.data, signal);
+    const isEssentialTier = isEssentialDatabase(addon);
+    const isLegacyEssentialTier = isLegacyEssentialDatabase(addon);
+    const isAdvancedTier = isAdvancedDatabase(addon);
+    let credAttachments = [];
+    if (isAdvancedTier) {
+        const [{ items: availableCreds }, attachments] = await Promise.all([
+            data.postgresCredential.list(addon.id),
+            platform.addOnAttachment.listByAddOn(addon.id),
+        ]);
+        const ownerCred = availableCreds.find(cred => cred.type === 'owner');
+        if (ownerCred?.name === credName) {
+            throw new Error('You can\'t destroy the owner credential.');
+        }
+        credAttachments = attachments.filter(a => parseAttachmentFactors(a.namespace).role === credName);
+    }
+    else if (isEssentialTier) {
+        throw new Error('You can\'t destroy custom credentials on Essential-tier databases.');
+    }
+    else if (isLegacyEssentialTier || credName === 'default') {
+        throw new Error('You can\'t destroy the default credential.');
+    }
+    else {
+        const attachments = await platform.addOnAttachment.listByAddOn(addon.id);
+        credAttachments = attachments.filter(a => a.namespace === `credential:${credName}`);
+    }
+    const credAttachmentApps = [...new Set(credAttachments.map(a => a.app.name))];
+    if (credAttachmentApps.length > 0) {
+        throw new Error(`You must detach the credential ${credName} from the app${credAttachmentApps.length > 1 ? 's' : ''} ${credAttachmentApps.join(', ')} before destroying it.`);
+    }
+    const result = await (isAdvancedTier
+        ? data.postgresCredential.delete(addon.id, credName)
+        : data.postgresDatabase.deleteCredential(addon.id, credName));
+    return { addon, result };
+}

package/dist/resources/data/database-credential/get-url.d.ts

@@ -0,0 +1,25 @@
+import type { ResourceCtx } from '../../../core/extend-resource.js';
+import type { ResolvedAddOn } from '../../platform/add-on/types.js';
+import type { DatabaseCredentialOptions } from './index.js';
+export type CredentialConnectionInfo = {
+    credName: string;
+    database: string;
+    host: string;
+    password: string;
+    port: number;
+    url: string;
+    user: string;
+};
+export type GetDatabaseCredentialUrlResult = {
+    addon: ResolvedAddOn;
+    credentialConnectionInfo: CredentialConnectionInfo;
+};
+/**
+ * Looks up the active connection info for a Postgres database credential,
+ * dispatching to the Advanced-tier or classic-tier endpoint based on the
+ * resolved add-on's plan, and returns a ready-to-use connection URL.
+ *
+ * `credName` defaults to the owner credential on the Advanced tier, or the
+ * `default` credential on the classic tier.
+ */
+export declare function getUrl(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, credName?: string, options?: DatabaseCredentialOptions): Promise<GetDatabaseCredentialUrlResult>;

package/dist/resources/data/database-credential/get-url.js

@@ -0,0 +1,68 @@
+import { withSignal } from '../../../core/with-signal.js';
+import { resolveAddonInternal } from '../../platform/add-on/resolve.js';
+import { getPostgresServiceName, isAdvancedCredential, isAdvancedDatabase, isEssentialTier, } from '../internal/postgres-utils.js';
+/**
+ * Looks up the active connection info for a Postgres database credential,
+ * dispatching to the Advanced-tier or classic-tier endpoint based on the
+ * resolved add-on's plan, and returns a ready-to-use connection URL.
+ *
+ * `credName` defaults to the owner credential on the Advanced tier, or the
+ * `default` credential on the classic tier.
+ */
+export async function getUrl(ctx, addonIdentity, credName, options = {}) {
+    options.signal?.throwIfAborted();
+    // Bind the signal so the resolve and lookup requests abort in flight.
+    const platform = withSignal(ctx.platform, options.signal);
+    const addon = await resolveAddonInternal(platform, addonIdentity, {
+        addonService: getPostgresServiceName(), appIdentity: options.appIdentity,
+    });
+    const data = withSignal(ctx.data, options.signal);
+    if (isEssentialTier(addon) && credName && credName !== 'default') {
+        throw new Error('Essential-tier databases don\'t support named credentials.');
+    }
+    let name;
+    let info;
+    if (isAdvancedDatabase(addon)) {
+        name = credName;
+        if (!name) {
+            const { items } = await data.postgresCredential.list(addon.id);
+            name = items.find(item => item.type === 'owner')?.name;
+            if (!name) {
+                throw new Error(`There are no active credentials on the database ${addon.name}.`);
+            }
+        }
+        info = await data.postgresCredential.info(addon.id, name);
+    }
+    else {
+        name = credName || 'default';
+        info = await data.postgresDatabase.infoCredential(addon.id, name);
+    }
+    const activeCred = isAdvancedCredential(info)
+        ? info.roles.find(r => r.state === 'active')
+        : info.credentials.find(c => c.state === 'active');
+    if (!activeCred) {
+        throw new Error(`The credential ${name} isn't active on the database ${addon.name}.`);
+    }
+    const credInfo = {
+        credName: name,
+        database: info.database,
+        host: info.host,
+        password: activeCred.password,
+        port: info.port,
+        user: activeCred.user,
+    };
+    const url = new URL(`postgres://${credInfo.host}/${credInfo.database}`);
+    url.port = credInfo.port.toString();
+    if (credInfo.user && credInfo.password) {
+        url.username = credInfo.user;
+        url.password = credInfo.password;
+    }
+    const credentialConnectionInfo = {
+        ...credInfo,
+        url: url.toString(),
+    };
+    return {
+        addon,
+        credentialConnectionInfo,
+    };
+}

package/dist/resources/data/database-credential/index.d.ts

@@ -0,0 +1,24 @@
+import type { PostgresCredentialCreateOpts } from '@heroku/types/data';
+import type { RotateAllDatabaseCredentialsResult, RotateDatabaseCredentialOptions, RotateDatabaseCredentialOpts, RotateDatabaseCredentialResult } from './rotate.js';
+export type DatabaseCredentialOptions = {
+    appIdentity?: string;
+    signal?: AbortSignal;
+};
+export { create, type CreateDatabaseCredentialResult } from './create.js';
+export { destroy, type DestroyDatabaseCredentialResult } from './destroy.js';
+export { type GetDatabaseCredentialUrlResult, getUrl, } from './get-url.js';
+export { NotAdvancedDatabaseError } from './list.js';
+export { list, type ListDatabaseCredentialsResult } from './list.js';
+export { rotate, type RotateAllDatabaseCredentialsResult, type RotateDatabaseCredentialOptions, type RotateDatabaseCredentialOpts, type RotateDatabaseCredentialPreview, type RotateDatabaseCredentialResult, } from './rotate.js';
+export declare const databaseCredentialExtensions: import("../../../core/extend-resource.js").ResourceExtension<"data", "databaseCredential", {
+    create: (addonIdentity: string, body: PostgresCredentialCreateOpts, options?: DatabaseCredentialOptions) => Promise<import("./create.js").CreateDatabaseCredentialResult>;
+    destroy: (addonIdentity: string, credName: string, options?: DatabaseCredentialOptions) => Promise<import("./destroy.js").DestroyDatabaseCredentialResult>;
+    getUrl: (addonIdentity: string, credName?: string, options?: DatabaseCredentialOptions) => Promise<import("./get-url.js").GetDatabaseCredentialUrlResult>;
+    list: (addonIdentity: string, options?: DatabaseCredentialOptions) => Promise<import("./list.js").ListDatabaseCredentialsResult>;
+    rotate: {
+        (addonIdentity: string, body: RotateDatabaseCredentialOpts & {
+            all: true;
+        }, options?: RotateDatabaseCredentialOptions): Promise<RotateAllDatabaseCredentialsResult>;
+        (addonIdentity: string, body?: RotateDatabaseCredentialOpts, options?: RotateDatabaseCredentialOptions): Promise<RotateDatabaseCredentialResult>;
+    };
+}>;

package/dist/resources/data/database-credential/index.js

@@ -0,0 +1,24 @@
+import { extendResource } from '../../../core/extend-resource.js';
+import { create } from './create.js';
+import { destroy } from './destroy.js';
+import { getUrl } from './get-url.js';
+import { list } from './list.js';
+import { rotate } from './rotate.js';
+export { create } from './create.js';
+export { destroy } from './destroy.js';
+export { getUrl, } from './get-url.js';
+export { NotAdvancedDatabaseError } from './list.js';
+export { list } from './list.js';
+export { rotate, } from './rotate.js';
+export const databaseCredentialExtensions = extendResource('data', 'databaseCredential', ctx => {
+    function rotateCredential(addonIdentity, body, options) {
+        return rotate(ctx, addonIdentity, body, options);
+    }
+    return {
+        create: (addonIdentity, body, options) => create(ctx, addonIdentity, body, options),
+        destroy: (addonIdentity, credName, options) => destroy(ctx, addonIdentity, credName, options),
+        getUrl: (addonIdentity, credName, options) => getUrl(ctx, addonIdentity, credName, options),
+        list: (addonIdentity, options) => list(ctx, addonIdentity, options),
+        rotate: rotateCredential,
+    };
+});

package/dist/resources/data/database-credential/list.d.ts

@@ -0,0 +1,32 @@
+import type { PostgresCredentialListResult } from '@heroku/types/data';
+import type { ResourceCtx } from '../../../core/extend-resource.js';
+import type { ResolvedAddOn } from '../../platform/add-on/types.js';
+import { DatabaseCredentialOptions } from './index.js';
+/**
+ * Thrown by `list` when the resolved add-on is not an Advanced-tier
+ * database. Carries the resolved addon so callers that need its identity
+ * (e.g. to point the user at the classic-tier equivalent) don't need a
+ * second resolve call.
+ */
+export declare class NotAdvancedDatabaseError extends Error {
+    readonly addon: ResolvedAddOn;
+    readonly id = "not_advanced_database";
+    constructor(addon: ResolvedAddOn);
+    get body(): {
+        id: string;
+        message: string;
+    };
+}
+export type ListDatabaseCredentialsResult = {
+    addon: ResolvedAddOn;
+    credentials: PostgresCredentialListResult;
+};
+/**
+ * Lists credentials on an Advanced-tier Postgres database. Classic-tier
+ * databases don't support this endpoint; use `postgresDatabase.listCredentials`
+ * for those instead.
+ *
+ * Throws `NotAdvancedDatabaseError` (carrying the resolved addon) if
+ * `addonIdentity` doesn't resolve to an Advanced-tier database.
+ */
+export declare function list(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, options?: DatabaseCredentialOptions): Promise<ListDatabaseCredentialsResult>;

package/dist/resources/data/database-credential/list.js

@@ -0,0 +1,44 @@
+import { withSignal } from '../../../core/with-signal.js';
+import { resolveAddonInternal } from '../../platform/add-on/resolve.js';
+import { getPostgresServiceName, isAdvancedDatabase } from '../internal/postgres-utils.js';
+/**
+ * Thrown by `list` when the resolved add-on is not an Advanced-tier
+ * database. Carries the resolved addon so callers that need its identity
+ * (e.g. to point the user at the classic-tier equivalent) don't need a
+ * second resolve call.
+ */
+export class NotAdvancedDatabaseError extends Error {
+    addon;
+    id = 'not_advanced_database';
+    constructor(addon) {
+        super(`You can only list credentials on Advanced-tier databases. ${addon.name} isn't an Advanced-tier database.`);
+        this.addon = addon;
+        this.name = 'NotAdvancedDatabaseError';
+    }
+    get body() {
+        return { id: this.id, message: this.message };
+    }
+}
+/**
+ * Lists credentials on an Advanced-tier Postgres database. Classic-tier
+ * databases don't support this endpoint; use `postgresDatabase.listCredentials`
+ * for those instead.
+ *
+ * Throws `NotAdvancedDatabaseError` (carrying the resolved addon) if
+ * `addonIdentity` doesn't resolve to an Advanced-tier database.
+ */
+export async function list(ctx, addonIdentity, options = {}) {
+    const { appIdentity, signal } = options;
+    signal?.throwIfAborted();
+    // Bind the signal so the resolve and list requests abort in flight.
+    const platform = withSignal(ctx.platform, signal);
+    const addon = await resolveAddonInternal(platform, addonIdentity, {
+        addonService: getPostgresServiceName(), appIdentity,
+    });
+    if (!isAdvancedDatabase(addon)) {
+        throw new NotAdvancedDatabaseError(addon);
+    }
+    const data = withSignal(ctx.data, signal);
+    const credentials = await data.postgresCredential.list(addon.id);
+    return { addon, credentials };
+}

package/dist/resources/data/database-credential/rotate.d.ts

@@ -0,0 +1,56 @@
+import type { PostgresDatabaseInfoCredentialResult as NonAdvancedCredentialInfo, PostgresCredentialListResult, PostgresDatabaseRotateCredentialResult, PostgresDatabaseRotateCredentialsResult, PostgresRotateCredentialsResult } from '@heroku/types/data';
+import { AddOnAttachment } from '@heroku/types/3.sdk';
+import type { ResourceCtx } from '../../../core/extend-resource.js';
+import type { ResolvedAddOn } from '../../platform/add-on/types.js';
+import type { DatabaseCredentialOptions } from './index.js';
+type AdvancedCredentialInfo = PostgresCredentialListResult['items'][number];
+export type RotateDatabaseCredentialOptions = DatabaseCredentialOptions & {
+    /**
+     * Fires before the rotate request, allowing the caller to perform any
+     * necessary pre-rotation checks or UI rendering.
+     */
+    beforeRotate?: (preview: RotateDatabaseCredentialPreview) => Promise<void> | void;
+};
+export type RotateDatabaseCredentialOpts = {
+    /** Rotate every credential on the database instead of a single one. */
+    all?: boolean;
+    /** Name of the credential to rotate. Defaults to owner or default credential. */
+    credName?: string;
+    /** Immediately kill connections using the credential(s) being rotated. */
+    forced?: boolean;
+};
+/**
+ * Resolved state of a rotation, passed to `beforeRotate` before the request
+ * is sent: the add-on, the credential that will rotate, the owner and default
+ * credentials, whether the database is Advanced or Essential tier, and the
+ * add-on's attachments.
+ */
+export type RotateDatabaseCredentialPreview = {
+    addon: ResolvedAddOn;
+    attachments: AddOnAttachment[];
+    credToRotate?: AdvancedCredentialInfo | NonAdvancedCredentialInfo;
+    defaultCred?: NonAdvancedCredentialInfo;
+    isAdvancedTier: boolean;
+    isEssentialTier: boolean;
+    ownerCred?: AdvancedCredentialInfo;
+};
+export type RotateAllDatabaseCredentialsResult = {
+    addon: ResolvedAddOn;
+    credentials: PostgresDatabaseRotateCredentialsResult | PostgresRotateCredentialsResult;
+};
+export type RotateDatabaseCredentialResult = {
+    addon: ResolvedAddOn;
+    credential: PostgresDatabaseRotateCredentialResult | void;
+};
+/**
+ * Rotates one or all credentials on a Postgres database, dispatching to the
+ * Advanced-tier or classic-tier endpoint based on the resolved add-on's plan.
+ *
+ * Essential and legacy Essential-tier databases don't support named-credential
+ * rotation.
+ */
+export declare function rotate(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, body: RotateDatabaseCredentialOpts & {
+    all: true;
+}, options?: RotateDatabaseCredentialOptions): Promise<RotateAllDatabaseCredentialsResult>;
+export declare function rotate(ctx: Pick<ResourceCtx, 'data' | 'platform'>, addonIdentity: string, body?: RotateDatabaseCredentialOpts, options?: RotateDatabaseCredentialOptions): Promise<RotateDatabaseCredentialResult>;
+export {};

package/dist/resources/data/database-credential/rotate.js

@@ -0,0 +1,71 @@
+import { withSignal } from '../../../core/with-signal.js';
+import { resolveAddonInternal } from '../../platform/add-on/resolve.js';
+import { getPostgresServiceName, isAdvancedDatabase, isEssentialDatabase, isLegacyEssentialDatabase, } from '../internal/postgres-utils.js';
+export async function rotate(ctx, addonIdentity, body = {}, options = {}) {
+    const { appIdentity, beforeRotate, signal } = options;
+    signal?.throwIfAborted();
+    // Bind the signal so the resolve and rotate requests abort in flight.
+    const platform = withSignal(ctx.platform, signal);
+    const addon = await resolveAddonInternal(platform, addonIdentity, {
+        addonService: getPostgresServiceName(), appIdentity,
+    });
+    const { all, credName, forced } = body;
+    const isAdvancedTier = isAdvancedDatabase(addon);
+    // Check for essential tier only; legacy Essential-tier databases
+    // get their own message below and are otherwise treated like
+    // any other classic-tier database for credential selection.
+    const isEssentialTier = isEssentialDatabase(addon);
+    if (!isAdvancedTier && credName && credName !== 'default') {
+        if (isLegacyEssentialDatabase(addon)) {
+            throw new Error('Legacy Essential-tier databases do not support named credentials.');
+        }
+        if (isEssentialTier) {
+            throw new Error('Essential-tier databases do not support named credentials.');
+        }
+    }
+    const data = withSignal(ctx.data, signal);
+    const attachments = await platform.addOnAttachment.listByAddOn(addon.id);
+    let ownerCred;
+    let defaultCred;
+    let credToRotate;
+    if (isAdvancedTier) {
+        const { items: availableCreds } = await data.postgresCredential.list(addon.id);
+        ownerCred = availableCreds.find(cred => cred.type === 'owner');
+        credToRotate = credName
+            ? availableCreds.find(cred => cred.name === credName)
+            : ownerCred;
+    }
+    else {
+        const availableCreds = await data.postgresDatabase.listCredentials(addon.id);
+        defaultCred = isEssentialTier
+            ? availableCreds[0]
+            : availableCreds.find(cred => cred.name === 'default');
+        credToRotate = credName && !isEssentialTier
+            ? availableCreds.find(cred => cred.name === credName)
+            : defaultCred;
+    }
+    await beforeRotate?.({
+        addon,
+        attachments,
+        credToRotate,
+        defaultCred,
+        isAdvancedTier,
+        isEssentialTier,
+        ownerCred,
+    });
+    signal?.throwIfAborted();
+    if (all) {
+        const credentials = await (isAdvancedTier
+            ? data.postgres.rotateCredentials(addon.id, { forced })
+            : data.postgresDatabase.rotateCredentials(addon.id, { forced }));
+        return { addon, credentials };
+    }
+    const finalCredName = isEssentialTier ? 'default' : credToRotate?.name;
+    if (!finalCredName) {
+        throw new Error(`There are no credentials on the database ${addon.name}.`);
+    }
+    const credential = await (isAdvancedTier
+        ? data.postgresCredential.rotate(addon.id, finalCredName, { forced })
+        : data.postgresDatabase.rotateCredential(addon.id, finalCredName, { forced }));
+    return { addon, credential };
+}

package/dist/resources/data/internal/parse-attachment-factors.d.ts

@@ -0,0 +1,25 @@
+declare enum AttachmentFactorKeys {
+    POOL = "pool",
+    PROXY = "proxy",
+    ROLE = "role"
+}
+export type AttachmentFactors = {
+    [AttachmentFactorKeys.POOL]?: string;
+    [AttachmentFactorKeys.PROXY]?: boolean;
+    [AttachmentFactorKeys.ROLE]?: string;
+};
+/**
+ * Parses a Heroku add-on attachment `namespace` string into structured factors.
+ *
+ * The namespace is a list of segments separated by `|`. Each segment must look
+ * like `key:value`, using only the **first** `:` as the separator so values may
+ * contain additional colons. Whitespace around keys and values is trimmed.
+ *
+ * Only keys listed in {@link AttachmentFactorKeys} are applied; unknown keys are
+ * ignored. For `proxy`, the value is interpreted as a boolean (`true` only when
+ * the trimmed string is exactly `"true"`). For `pool` and `role`, the value is
+ * kept as a string. If the same key appears more than once, the last occurrence
+ * wins.
+ */
+export declare function parseAttachmentFactors(namespace?: null | string): AttachmentFactors;
+export {};

package/dist/resources/data/internal/parse-attachment-factors.js

@@ -0,0 +1,37 @@
+var AttachmentFactorKeys;
+(function (AttachmentFactorKeys) {
+    AttachmentFactorKeys["POOL"] = "pool";
+    AttachmentFactorKeys["PROXY"] = "proxy";
+    AttachmentFactorKeys["ROLE"] = "role";
+})(AttachmentFactorKeys || (AttachmentFactorKeys = {}));
+/**
+ * Parses a Heroku add-on attachment `namespace` string into structured factors.
+ *
+ * The namespace is a list of segments separated by `|`. Each segment must look
+ * like `key:value`, using only the **first** `:` as the separator so values may
+ * contain additional colons. Whitespace around keys and values is trimmed.
+ *
+ * Only keys listed in {@link AttachmentFactorKeys} are applied; unknown keys are
+ * ignored. For `proxy`, the value is interpreted as a boolean (`true` only when
+ * the trimmed string is exactly `"true"`). For `pool` and `role`, the value is
+ * kept as a string. If the same key appears more than once, the last occurrence
+ * wins.
+ */
+export function parseAttachmentFactors(namespace) {
+    const result = {};
+    if (!namespace?.trim()) {
+        return result;
+    }
+    for (const factor of namespace.split('|')) {
+        const parts = factor.match(/^([^:]+):(.*)$/) ?? [];
+        if (parts.length !== 3) {
+            continue;
+        }
+        const key = parts[1].trim();
+        const value = (key === AttachmentFactorKeys.PROXY ? parts[2].trim() === 'true' : parts[2].trim());
+        if (Object.values(AttachmentFactorKeys).includes(key)) {
+            Object.assign(result, { [key]: value });
+        }
+    }
+    return result;
+}

package/dist/resources/data/internal/postgres-utils.d.ts

@@ -1,10 +1,13 @@
 import type { AddOn } from '@heroku/types/3.sdk';
+import { PostgresCredentialInfoResult as AdvancedCredentialInfo } from '@heroku/types/data';
 import type { ResourceCtx } from '../../../core/extend-resource.js';
 import type { AddOnAttachmentWithInclusions } from '../../platform/add-on-attachment/resolve.js';
+import { CredentialInfo as NonAdvancedCredentialInfo } from '../postgres-database.js';
 /**
  * Returns the first legacy database add-on on the app.
  */
 export declare function findLegacyDatabase(ctx: Pick<ResourceCtx, 'platform'>, appIdentity: string): Promise<AddOn>;
+export declare function isAdvancedCredential(credential: AdvancedCredentialInfo | NonAdvancedCredentialInfo): credential is AdvancedCredentialInfo;
 export declare const getPostgresServiceName: () => string;
 /**
  * `AddOnAttachmentWithInclusions` is an internal type. The public `isPostgresAddon` takes `AddOn` only.
@@ -13,3 +16,6 @@ export declare const isPostgresAddonInternal: (addon: AddOn | AddOnAttachmentWit
 export declare const isPostgresAddon: (addon: AddOn) => boolean;
 export declare const isAdvancedDatabase: (addon: AddOn) => boolean;
 export declare const isLegacyDatabase: (addon: AddOn) => boolean;
+export declare const isLegacyEssentialDatabase: (addon: AddOn) => boolean;
+export declare const isEssentialDatabase: (addon: AddOn) => boolean;
+export declare const isEssentialTier: (addon: AddOn) => boolean;

package/dist/resources/data/internal/postgres-utils.js

@@ -11,6 +11,9 @@ export async function findLegacyDatabase(ctx, appIdentity) {
         throw new Error(`No Heroku Postgres legacy database on ${appIdentity}`);
     return addon;
 }
+export function isAdvancedCredential(credential) {
+    return 'roles' in credential;
+}
 export const getPostgresServiceName = () => process.env.HEROKU_POSTGRESQL_ADDON_NAME || process.env.HEROKU_DATA_SERVICE || 'heroku-postgresql';
 /**
  * `AddOnAttachmentWithInclusions` is an internal type. The public `isPostgresAddon` takes `AddOn` only.
@@ -19,3 +22,6 @@ export const isPostgresAddonInternal = (addon) => addon.plan?.name?.split(':', 2
 export const isPostgresAddon = (addon) => isPostgresAddonInternal(addon);
 export const isAdvancedDatabase = (addon) => isPostgresAddonInternal(addon) && /^(advanced|performance)/.test(addon.plan?.name?.split(':', 2)[1] ?? '');
 export const isLegacyDatabase = (addon) => isPostgresAddonInternal(addon) && !isAdvancedDatabase(addon);
+export const isLegacyEssentialDatabase = (addon) => isLegacyDatabase(addon) && /^(dev|basic|mini)/.test(addon.plan?.name?.split(':', 2)[1] ?? '');
+export const isEssentialDatabase = (addon) => isLegacyDatabase(addon) && (addon.plan?.name?.split(':', 2)[1] ?? '').startsWith('essential');
+export const isEssentialTier = (addon) => isEssentialDatabase(addon) || isLegacyEssentialDatabase(addon);

package/dist/resources/data/postgres-database.d.ts

@@ -12,7 +12,7 @@ export type CredentialInfo = {
     database: string;
     host: string;
     name: string;
-    port: string;
+    port: number;
     state: string;
     uuid: string;
 };
@@ -20,4 +20,5 @@ export declare function listCredentials(ctx: Pick<ResourceCtx, 'data' | 'platfor
 export declare const postgresDatabaseExtensions: import("../../core/extend-resource.js").ResourceExtension<"data", "postgresDatabase", {
     listCredentials: (appIdentity: string, addonIdentity?: string, options?: ListCredentialsOptions) => Promise<CredentialInfo[]>;
 }>;
-export { findLegacyDatabase, getPostgresServiceName, isAdvancedDatabase, isLegacyDatabase, isPostgresAddon, } from './internal/postgres-utils.js';
+export { type AttachmentFactors, parseAttachmentFactors, } from './internal/parse-attachment-factors.js';
+export { findLegacyDatabase, getPostgresServiceName, isAdvancedCredential, isAdvancedDatabase, isEssentialDatabase, isEssentialTier, isLegacyDatabase, isLegacyEssentialDatabase, isPostgresAddon, } from './internal/postgres-utils.js';

package/dist/resources/data/postgres-database.js

@@ -11,4 +11,5 @@ export async function listCredentials(ctx, appIdentity, addonIdentity, options =
 export const postgresDatabaseExtensions = extendResource('data', 'postgresDatabase', ctx => ({
     listCredentials: (appIdentity, addonIdentity, options) => listCredentials(ctx, appIdentity, addonIdentity, options),
 }));
-export { findLegacyDatabase, getPostgresServiceName, isAdvancedDatabase, isLegacyDatabase, isPostgresAddon, } from './internal/postgres-utils.js';
+export { parseAttachmentFactors, } from './internal/parse-attachment-factors.js';
+export { findLegacyDatabase, getPostgresServiceName, isAdvancedCredential, isAdvancedDatabase, isEssentialDatabase, isEssentialTier, isLegacyDatabase, isLegacyEssentialDatabase, isPostgresAddon, } from './internal/postgres-utils.js';

package/dist/resources/extensions/data.d.ts

@@ -1,3 +1,4 @@
+export { databaseCredentialExtensions } from '../data/database-credential/index.js';
 export { databaseExtensions } from '../data/database.js';
 export { maintenanceExtensions } from '../data/maintenance.js';
 export { postgresDatabaseExtensions } from '../data/postgres-database.js';

package/dist/resources/extensions/data.js

@@ -1,3 +1,4 @@
+export { databaseCredentialExtensions } from '../data/database-credential/index.js';
 export { databaseExtensions } from '../data/database.js';
 export { maintenanceExtensions } from '../data/maintenance.js';
 export { postgresDatabaseExtensions } from '../data/postgres-database.js';

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "0.12.0";
+export declare const SDK_VERSION = "0.12.1";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated from package.json by scripts/write-version.mjs (build prebuild). Do not edit.
-export const SDK_VERSION = '0.12.0';
+export const SDK_VERSION = '0.12.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heroku/sdk",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Heroku SDK",
   "author": "Heroku",
   "type": "module",
@@ -102,6 +102,10 @@
       "types": "./dist/resources/platform/vpn-connection/index.d.ts",
       "default": "./dist/resources/platform/vpn-connection/index.js"
     },
+    "./resources/data/database-credential": {
+      "types": "./dist/resources/data/database-credential/index.d.ts",
+      "default": "./dist/resources/data/database-credential/index.js"
+    },
     "./resources/data/redis": {
       "types": "./dist/resources/data/redis/index.d.ts",
       "default": "./dist/resources/data/redis/index.js"
@@ -149,14 +153,14 @@
     "@heroku-cli/test-utils": "^1.0.3",
     "@types/debug": "^4.1.12",
     "@types/node": "^26.5.1",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^5.0.5",
     "@vitest/eslint-plugin": "^1.6.0",
     "eslint": "^9.39.4",
     "eslint-config-oclif": "^6.0.167",
     "rimraf": "^6.1.3",
     "tsx": "^4.22.4",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.4"
+    "vitest": "^5.0.5"
   },
   "dependencies": {
     "@heroku/heroku-fetch": "^0.2.3",