@superblocksteam/shared 0.9618.2 → 0.9619.1

package/dist-esm/database-lifecycle/index.test.js

@@ -1,314 +0,0 @@
-import { describe, expect, test } from 'vitest';
-import { ApiTriggerType } from '../types/api/index.js';
-import { DATABASE_LIFECYCLE_MANAGED_BY, DATABASE_LIFECYCLE_OPERATIONS, LIFECYCLE_OPERATIONS, computeBindingKey, computeDesiredSpecHash, computeNativeDbApplicationToken, computeNativeDbProfileToken, computeRequirementKey, containsCredentialMaterial, isLifecycleManagedIntegrationAllowedForApiTrigger, isPoolScopedLifecycleOperation, isSecretKey, isTerminalLifecycleState, nativeDbIamSessionPolicy, parseNativeDbIamDescriptor, redactLifecycleSecrets } from './index.js';
-describe('database lifecycle contracts', () => {
-    test('lists persisted operations first and appends import operations', () => {
-        expect(LIFECYCLE_OPERATIONS).toEqual([
-            'ensure_database',
-            'migrate_schema',
-            'retire_database',
-            'ensure_physical_database_instance',
-            'retire_physical_database_instance',
-            'verify_database_infra_absence',
-            'prepare_import_upload',
-            'complete_import_upload',
-            'prepare_import_prefix_upload',
-            'inspect_import_prefix',
-            'capture_integration_pg_dump',
-            'restore_integration_pg_dump',
-            'restore_import_data',
-            'describe_schema',
-            'import_table_data'
-        ]);
-    });
-    test('keeps import operations out of the default agent operation set', () => {
-        expect(DATABASE_LIFECYCLE_OPERATIONS).toEqual([
-            'ensure_database',
-            'migrate_schema',
-            'retire_database',
-            'ensure_physical_database_instance',
-            'retire_physical_database_instance',
-            'verify_database_infra_absence'
-        ]);
-    });
-    // The pool-scoped split is what `CK_lifecycle_request_shape` enforces: these
-    // operations carry an organization and no binding, every other operation is
-    // the reverse. Getting this wrong wedges inserts at the database level.
-    test('treats only physical instance operations as pool scoped', () => {
-        expect(LIFECYCLE_OPERATIONS.filter(isPoolScopedLifecycleOperation)).toEqual([
-            'ensure_physical_database_instance',
-            'retire_physical_database_instance'
-        ]);
-    });
-    test('allows lifecycle-managed integrations only in application APIs', () => {
-        expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.UI, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(true);
-        expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
-        expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.SCHEDULE, DATABASE_LIFECYCLE_MANAGED_BY)).toBe(false);
-        expect(isLifecycleManagedIntegrationAllowedForApiTrigger(ApiTriggerType.WORKFLOW, null)).toBe(true);
-    });
-    test('computes stable requirement, binding, and desired spec identifiers', async () => {
-        const requirement = {
-            logicalName: 'Orders DB',
-            engine: 'postgres',
-            version: '16',
-            sizing: {
-                storageGb: 20,
-                tier: 'shared'
-            },
-            extensions: ['pgcrypto', 'uuid-ossp']
-        };
-        expect(computeRequirementKey(requirement)).toBe('orders-db~Orders%20DB:postgres');
-        expect(computeRequirementKey({ logicalName: 'orders/db', engine: 'postgres' })).toBe('orders-db~orders%2Fdb:postgres');
-        expect(computeRequirementKey({ logicalName: 'orders-db', engine: 'postgres' })).toBe('orders-db~orders-db:postgres');
-        // binding_key excludes the logical name on purpose: one database per
-        // (organization, application, profile). Two different logical names under
-        // the same profile resolve to the same binding_key.
-        expect(computeBindingKey({
-            organizationId: 'org-1',
-            applicationId: 'app-1',
-            profile: 'Staging EU'
-        })).toBe('org-1:app-1:staging-eu~Staging%20EU');
-        expect(computeBindingKey({
-            organizationId: 'org-1',
-            applicationId: 'app-1',
-            profile: 'staging'
-        })).toBe('org-1:app-1:staging~staging');
-        await expect(computeDesiredSpecHash(requirement)).resolves.toBe(await computeDesiredSpecHash({
-            ...requirement,
-            extensions: ['uuid-ossp', 'pgcrypto']
-        }));
-        await expect(computeDesiredSpecHash(requirement)).resolves.toBe('QsCl6RVzJVEwf4Nuk0D27rRtycYe2vQZMxcXLt9WUkQ=');
-    });
-    test('ignores migrationDirectory when hashing the desired spec', async () => {
-        const infrastructureSpec = {
-            logicalName: 'Orders DB',
-            engine: 'postgres',
-            version: '16',
-            sizing: { storageGb: 20, tier: 'shared' },
-            extensions: ['pgcrypto', 'uuid-ossp']
-        };
-        const withoutDirectory = await computeDesiredSpecHash(infrastructureSpec);
-        const withDirectory = await computeDesiredSpecHash({
-            ...infrastructureSpec,
-            migrationDirectory: 'db/migrations'
-        });
-        const withOtherDirectory = await computeDesiredSpecHash({
-            ...infrastructureSpec,
-            migrationDirectory: 'db/other-migrations'
-        });
-        // migrationDirectory only says where the SQL files live, not what
-        // infrastructure to provision, so changing it must not look like drift.
-        expect(withDirectory).toBe(withoutDirectory);
-        expect(withOtherDirectory).toBe(withoutDirectory);
-    });
-    test('hashes desired specs with locale-invariant ordering', async () => {
-        const first = await computeDesiredSpecHash({
-            logicalName: 'Éclair DB',
-            engine: 'postgres',
-            extensions: ['ä', 'z', 'a']
-        });
-        const second = await computeDesiredSpecHash({
-            logicalName: 'Éclair DB',
-            engine: 'postgres',
-            extensions: ['z', 'a', 'ä']
-        });
-        expect(first).toBe(second);
-    });
-    test('redacts raw credential material and generic credential refs while preserving physical masterCredentialRef', () => {
-        const redacted = redactLifecycleSecrets({
-            host: 'db.internal',
-            password: 'raw-password',
-            nested: {
-                token: 'raw-token',
-                credentialRef: {
-                    resolver: 'aws_secrets_manager',
-                    ref: 'arn:aws:secretsmanager:us-east-1:123:secret:orders'
-                }
-            },
-            credential_refs: {
-                password: {
-                    resolver: 'vault',
-                    ref: 'database/orders',
-                    field: 'password'
-                }
-            },
-            masterCredentialRef: {
-                resolver: 'aws_secrets_manager',
-                ref: 'physical-instance/master',
-                field: 'password'
-            }
-        });
-        expect(redacted).toEqual({
-            host: 'db.internal',
-            password: '[REDACTED]',
-            nested: {
-                token: '[REDACTED]',
-                credentialRef: {
-                    resolver: 'aws_secrets_manager',
-                    ref: 'arn:aws:secretsmanager:us-east-1:123:secret:orders'
-                }
-            },
-            credential_refs: {
-                password: '[REDACTED]'
-            },
-            masterCredentialRef: {
-                resolver: 'aws_secrets_manager',
-                ref: 'physical-instance/master',
-                field: 'password'
-            }
-        });
-    });
-    test('recognizes terminal lifecycle states', () => {
-        expect(isTerminalLifecycleState('ready')).toBe(true);
-        expect(isTerminalLifecycleState('failed')).toBe(true);
-        expect(isTerminalLifecycleState('provisioning')).toBe(false);
-    });
-    test('flags secret-shaped keys', () => {
-        for (const key of ['password', 'PASSWORD', 'api_token', 'private_key', 'private-key', 'dsn']) {
-            expect(isSecretKey(key)).toBe(true);
-        }
-        for (const key of ['host', 'port', 'database', 'username']) {
-            expect(isSecretKey(key)).toBe(false);
-        }
-    });
-    test('flags secret-shaped value content', () => {
-        expect(containsCredentialMaterial('postgres://user:pass@db.internal:5432/orders')).toBe(true);
-        expect(containsCredentialMaterial('mongodb+srv://app:secret@cluster0.example.net/db')).toBe(true);
-        expect(containsCredentialMaterial('password=hunter2;host=db.internal')).toBe(true);
-        expect(containsCredentialMaterial('{"password":"hunter2"}')).toBe(true);
-        expect(containsCredentialMaterial('host=db.internal port=5432')).toBe(false);
-        expect(containsCredentialMaterial('arn:aws:secretsmanager:us-east-1:123:secret:orders')).toBe(false);
-    });
-    test('builds a canonical session policy from a valid managed Postgres IAM descriptor', () => {
-        const descriptor = parseNativeDbIamDescriptor({
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
-        });
-        expect(descriptor).toBeDefined();
-        if (!descriptor) {
-            throw new Error('Expected a valid IAM descriptor');
-        }
-        expect(nativeDbIamSessionPolicy(descriptor)).toBe('{"Version":"2012-10-17","Statement":[{"Sid":"ConnectToThisNativeDatabaseUser","Effect":"Allow","Action":"rds-db:connect","Resource":"arn:aws:rds-db:us-west-2:123456789012:dbuser:cluster-ABC123DEF456EXAMPLE/sbndb_abcdef1234567890_0123456789abcdef01234567_runtime"}]}');
-    });
-    test('reads managed Postgres IAM descriptors with auth_descriptor_version 3', () => {
-        expect(parseNativeDbIamDescriptor({
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
-        })).toEqual({
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
-        });
-    });
-    test('rejects descriptors when database and runtime username do not match', () => {
-        expect(parseNativeDbIamDescriptor({
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_fedcba9876543210fedcba98_runtime'
-        })).toBeUndefined();
-    });
-    test('rejects malformed or non-commercial managed Postgres IAM descriptors', () => {
-        const descriptor = {
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'cluster-ABC123DEF456EXAMPLE',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.cluster-example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
-        };
-        expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 1 })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({ ...descriptor, auth_descriptor_version: 2 })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({
-            ...descriptor,
-            cluster_resource_id: 'not-an-rds-resource'
-        })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({
-            ...descriptor,
-            connector_role_arn: 'arn:aws:iam::210987654321:role/other'
-        })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({ ...descriptor, database: 'orders' })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({
-            ...descriptor,
-            host: descriptor.host.toUpperCase()
-        })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({
-            ...descriptor,
-            host: 'native-db.cluster-example.us-east-1.rds.amazonaws.com'
-        })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({ ...descriptor, port: 0 })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'cn-north-1' })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({ ...descriptor, region: 'us-gov-west-1' })).toBeUndefined();
-        expect(parseNativeDbIamDescriptor({
-            ...descriptor,
-            username: 'sbndb_0000000000000000_7bfeae1170db923274f1943f_runtime'
-        })).toBeUndefined();
-    });
-    test('accepts standalone RDS IAM resource IDs', () => {
-        expect(parseNativeDbIamDescriptor({
-            application_id: 'application-id',
-            auth_descriptor_version: 3,
-            auth_mode: 'aws_iam_role',
-            aws_account_id: '123456789012',
-            binding_id: 'binding-id',
-            cluster_resource_id: 'db-ABCDEF0123456789-1',
-            connector_role_arn: 'arn:aws:iam::123456789012:role/superblocks-native-db-connector-prod',
-            database: 'sbndb_abcdef1234567890_0123456789abcdef01234567',
-            host: 'native-db.example.us-west-2.rds.amazonaws.com',
-            port: 5432,
-            region: 'us-west-2',
-            username: 'sbndb_abcdef1234567890_0123456789abcdef01234567_runtime'
-        })).toBeDefined();
-    });
-    test('derives canonical IAM application token', async () => {
-        await expect(computeNativeDbApplicationToken('application-id')).resolves.toBe('7bfeae1170db923274f1943f');
-    });
-    test('derives canonical IAM profile token', async () => {
-        await expect(computeNativeDbProfileToken('production')).resolves.toHaveLength(16);
-        await expect(computeNativeDbProfileToken('Production')).resolves.toBe(await computeNativeDbProfileToken('production'));
-    });
-});
-//# sourceMappingURL=index.test.js.map

package/dist-esm/database-lifecycle/index.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../../src/database-lifecycle/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,+BAA+B,EAC/B,2BAA2B,EAC3B,qBAAqB,EACrB,0BAA0B,EAC1B,iDAAiD,EACjD,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;YACnC,iBAAiB;YACjB,gBAAgB;YAChB,iBAAiB;YACjB,mCAAmC;YACnC,mCAAmC;YACnC,+BAA+B;YAC/B,uBAAuB;YACvB,wBAAwB;YACxB,8BAA8B;YAC9B,uBAAuB;YACvB,6BAA6B;YAC7B,6BAA6B;YAC7B,qBAAqB;YACrB,iBAAiB;YACjB,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC;YAC5C,iBAAiB;YACjB,gBAAgB;YAChB,iBAAiB;YACjB,mCAAmC;YACnC,mCAAmC;YACnC,+BAA+B;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,mCAAmC;YACnC,mCAAmC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvH,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9H,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9H,MAAM,CAAC,iDAAiD,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,WAAW,GAAG;YAClB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,QAAQ;aACf;YACD,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAClF,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACvH,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACrH,qEAAqE;QACrE,0EAA0E;QAC1E,oDAAoD;QACpD,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,YAAY;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC9C,MAAM,CACJ,iBAAiB,CAAC;YAChB,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,OAAO;YACtB,OAAO,EAAE,SAAS;SACnB,CAAC,CACH,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAC7D,MAAM,sBAAsB,CAAC;YAC3B,GAAG,WAAW;YACd,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;SACtC,CAAC,CACH,CAAC;QACF,MAAM,MAAM,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,kBAAkB,GAAG;YACzB,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;SAC7B,CAAC;QAEX,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;QAC1E,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;YACjD,GAAG,kBAAkB;YACrB,kBAAkB,EAAE,eAAe;SACpC,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,MAAM,sBAAsB,CAAC;YACtD,GAAG,kBAAkB;YACrB,kBAAkB,EAAE,qBAAqB;SAC1C,CAAC,CAAC;QAEH,kEAAkE;QAClE,wEAAwE;QACxE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC;YACzC,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACrH,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE;oBACR,QAAQ,EAAE,OAAO;oBACjB,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,UAAU;iBAClB;aACF;YACD,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,qBAAqB;gBAC/B,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,UAAU;aAClB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE;gBACN,KAAK,EAAE,YAAY;gBACnB,aAAa,EAAE;oBACb,QAAQ,EAAE,qBAAqB;oBAC/B,GAAG,EAAE,oDAAoD;iBAC1D;aACF;YACD,eAAe,EAAE;gBACf,QAAQ,EAAE,YAAY;aACvB;YACD,mBAAmB,EAAE;gBACnB,QAAQ,EAAE,qBAAqB;gBAC/B,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,UAAU;aAClB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,0BAA0B,CAAC,8CAA8C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,CAAC,0BAA0B,CAAC,kDAAkD,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,CAAC,0BAA0B,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,0BAA0B,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,GAAG,EAAE;QAC1F,MAAM,UAAU,GAAG,0BAA0B,CAAC;YAC5C,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC/C,2QAA2Q,CAC5Q,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;QACjF,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,OAAO,CAAC;YACR,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,UAAU,GAAG;YACjB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,6BAA6B;YAClD,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,uDAAuD;YAC7D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC;QAEF,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClG,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,mBAAmB,EAAE,qBAAqB;SAC3C,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,kBAAkB,EAAE,sCAAsC;SAC3D,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1F,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;SACpC,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,IAAI,EAAE,uDAAuD;SAC9D,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/E,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5F,MAAM,CAAC,0BAA0B,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC/F,MAAM,CACJ,0BAA0B,CAAC;YACzB,GAAG,UAAU;YACb,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,CACJ,0BAA0B,CAAC;YACzB,cAAc,EAAE,gBAAgB;YAChC,uBAAuB,EAAE,CAAC;YAC1B,SAAS,EAAE,cAAc;YACzB,cAAc,EAAE,cAAc;YAC9B,UAAU,EAAE,YAAY;YACxB,mBAAmB,EAAE,uBAAuB;YAC5C,kBAAkB,EAAE,qEAAqE;YACzF,QAAQ,EAAE,iDAAiD;YAC3D,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,yDAAyD;SACpE,CAAC,CACH,CAAC,WAAW,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.d.ts

@@ -1,23 +0,0 @@
-import { type DatabaseEngine } from './capacityPolicy.js';
-export type PhysicalDatabaseInstanceResourceKey = {
-    engine: DatabaseEngine;
-    profile: string;
-    provisionId: string;
-    region: string;
-};
-/**
- * Reads the fields the worker needs to reach an existing instance's Terraform
- * state back out of the resource key recorded when it was provisioned.
- *
- * The key is the only place this survives: the instance row keeps a region and
- * an engine, but not the profile, and the profile is what the Terraform backend
- * key template expands. Reconstructing it from anything else would point a
- * destroy at a state file that describes different hardware, or at no state at
- * all -- which reports success having destroyed nothing.
- *
- * Returns undefined for a key this cannot be read out of, including the
- * `legacy:<id>` value backfilled onto instances that predate provision keys.
- * Callers must treat that as "not retirable" rather than guessing.
- */
-export declare function parsePhysicalDatabaseInstanceResourceKey(resourceKey: string): PhysicalDatabaseInstanceResourceKey | undefined;
-//# sourceMappingURL=physicalInstanceResourceKey.d.ts.map

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalInstanceResourceKey.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalInstanceResourceKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,MAAM,MAAM,mCAAmC,GAAG;IAChD,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CAAC,WAAW,EAAE,MAAM,GAAG,mCAAmC,GAAG,SAAS,CAqB7H"}

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.js

@@ -1,42 +0,0 @@
-import { DATABASE_ENGINES } from './capacityPolicy.js';
-const PHYSICAL_DATABASE_INSTANCE_RESOURCE_KEY_PREFIX = 'physical-database-instance';
-// Present only in keys minted before the lifecycle environment shims were
-// deleted (orchestrator 65c545698). It is what tells a six-segment key apart
-// from a malformed one.
-const LEGACY_RESOURCE_KEY_ENVIRONMENTS = ['edit', 'preview', 'deployed'];
-/**
- * Reads the fields the worker needs to reach an existing instance's Terraform
- * state back out of the resource key recorded when it was provisioned.
- *
- * The key is the only place this survives: the instance row keeps a region and
- * an engine, but not the profile, and the profile is what the Terraform backend
- * key template expands. Reconstructing it from anything else would point a
- * destroy at a state file that describes different hardware, or at no state at
- * all -- which reports success having destroyed nothing.
- *
- * Returns undefined for a key this cannot be read out of, including the
- * `legacy:<id>` value backfilled onto instances that predate provision keys.
- * Callers must treat that as "not retirable" rather than guessing.
- */
-export function parsePhysicalDatabaseInstanceResourceKey(resourceKey) {
-    const segments = resourceKey.split(':');
-    if (segments[0] !== PHYSICAL_DATABASE_INSTANCE_RESOURCE_KEY_PREFIX) {
-        return undefined;
-    }
-    // Six segments is the pre-refactor form, which carried an environment ahead
-    // of the profile. Dropping that segment is what makes the two forms line up.
-    const fields = segments.length === 6 && LEGACY_RESOURCE_KEY_ENVIRONMENTS.includes(segments[1])
-        ? segments.slice(2)
-        : segments.length === 5
-            ? segments.slice(1)
-            : undefined;
-    if (!fields) {
-        return undefined;
-    }
-    const [profile, region, engine, provisionId] = fields;
-    if (!profile || !region || !provisionId || !DATABASE_ENGINES.includes(engine)) {
-        return undefined;
-    }
-    return { engine: engine, profile, provisionId, region };
-}
-//# sourceMappingURL=physicalInstanceResourceKey.js.map

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalInstanceResourceKey.js","sourceRoot":"","sources":["../../src/database-lifecycle/physicalInstanceResourceKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,qBAAqB,CAAC;AAE5E,MAAM,8CAA8C,GAAG,4BAA4B,CAAC;AACpF,0EAA0E;AAC1E,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,gCAAgC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AASlF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wCAAwC,CAAC,WAAmB;IAC1E,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,8CAA8C,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAK,gCAAsD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACnB,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAwB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC"}

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=physicalInstanceResourceKey.test.d.ts.map

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalInstanceResourceKey.test.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalInstanceResourceKey.test.ts"],"names":[],"mappings":""}

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.test.js

@@ -1,56 +0,0 @@
-import { describe, expect, test } from 'vitest';
-import { parsePhysicalDatabaseInstanceResourceKey } from './physicalInstanceResourceKey.js';
-describe('parsePhysicalDatabaseInstanceResourceKey', () => {
-    test('reads the routing fields a decommission needs off a provisioned key', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:production:us-east-1:postgres:abc123')).toEqual({
-            engine: 'postgres',
-            profile: 'production',
-            provisionId: 'abc123',
-            region: 'us-east-1'
-        });
-    });
-    // Keys minted before the lifecycle environment shims were deleted carry an
-    // extra environment segment ahead of the profile. Those are the oldest
-    // instances in the fleet, so they are the ones most likely to be retired --
-    // refusing to parse them would put decommissioning out of reach for exactly
-    // the instances that need it.
-    test('reads a key minted before the environment segment was dropped', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:deployed:production:us-east-1:postgres:abc123')).toEqual({
-            engine: 'postgres',
-            profile: 'production',
-            provisionId: 'abc123',
-            region: 'us-east-1'
-        });
-    });
-    // Instances registered before provision keys existed were backfilled with
-    // `legacy:<id>`, which names no Terraform state. A destroy against one would
-    // init an empty state and report success having destroyed nothing.
-    test('rejects the backfilled key legacy instances carry', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('legacy:0ac37a52-6a24-4bf2-9d10-4b1e2d0f5f6c')).toBeUndefined();
-    });
-    test('rejects keys that are not physical instance keys at all', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-pool-provisioning:abc123')).toBeUndefined();
-        expect(parsePhysicalDatabaseInstanceResourceKey('')).toBeUndefined();
-    });
-    // Every segment feeds either worker routing or the Terraform backend key, so
-    // a key with a blank one cannot locate state.
-    test('rejects keys with a missing or blank segment', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:production:us-east-1:postgres')).toBeUndefined();
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance::us-east-1:postgres:abc123')).toBeUndefined();
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:production:us-east-1:postgres:')).toBeUndefined();
-    });
-    // Six segments is only meaningful as the pre-refactor form, whose second
-    // segment is an environment. Anything else with that length is a key this
-    // parser does not understand, and guessing at it would point a destroy at
-    // the wrong Terraform state.
-    test('rejects a six segment key whose second segment is not an environment', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:prod:us-east-1:postgres:abc123:extra')).toBeUndefined();
-    });
-    test('rejects keys longer than any format ever minted', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:deployed:prod:us-east-1:postgres:abc123:extra')).toBeUndefined();
-    });
-    test('rejects an engine outside the supported set', () => {
-        expect(parsePhysicalDatabaseInstanceResourceKey('physical-database-instance:prod:us-east-1:mysql:abc123')).toBeUndefined();
-    });
-});
-//# sourceMappingURL=physicalInstanceResourceKey.test.js.map

package/dist-esm/database-lifecycle/physicalInstanceResourceKey.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalInstanceResourceKey.test.js","sourceRoot":"","sources":["../../src/database-lifecycle/physicalInstanceResourceKey.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,wCAAwC,EAAE,MAAM,kCAAkC,CAAC;AAE5F,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,wCAAwC,CAAC,iEAAiE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1H,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,wCAAwC,CAAC,0EAA0E,CAAC,CAAC,CAAC,OAAO,CAAC;YACnI,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,wCAAwC,CAAC,6CAA6C,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,wCAAwC,CAAC,mCAAmC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtG,MAAM,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8CAA8C;IAC9C,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,wCAAwC,CAAC,0DAA0D,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7H,MAAM,CAAC,wCAAwC,CAAC,uDAAuD,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1H,MAAM,CAAC,wCAAwC,CAAC,2DAA2D,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAChI,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,wCAAwC,CAAC,iEAAiE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtI,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,MAAM,CACJ,wCAAwC,CAAC,0EAA0E,CAAC,CACrH,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,wCAAwC,CAAC,wDAAwD,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist-esm/database-lifecycle/physicalPoolIdentity.d.ts

@@ -1,29 +0,0 @@
-import type { PhysicalDatabaseCapacityPolicy } from './capacityPolicy.js';
-/**
- * Agent tag key for the customer-managed deployment name that identifies a
- * worker's physical database pool, `(organizationId, agentName, engine)`.
- *
- * Published on its own rather than read out of
- * `databaseLifecycle:capacityPolicies`, so a customer who wants no proactive
- * scaling still gets a resolvable pool. One value, e.g. `customer-opa`.
- */
-export declare const DATABASE_LIFECYCLE_TAG_AGENT_NAME = "databaseLifecycle:agentName";
-export declare class PhysicalPoolIdentityError extends Error {
-    readonly code = "physical_pool_identity_invalid";
-    constructor(message: string);
-}
-/**
- * The single physical pool a worker's registration names, or undefined when it
- * published none.
- *
- * Throws {@link PhysicalPoolIdentityError} when the registration names more
- * than one pool. Guessing between them would provision infrastructure under
- * one deployment's Terraform state and hand it to another, so callers must
- * either refuse the registration or withhold the identity.
- *
- * Falls back to the capacity policy's name when the tag is absent, for a
- * worker predating {@link DATABASE_LIFECYCLE_TAG_AGENT_NAME} that is still
- * rolling: the policy names the same pool, so identity stays unambiguous.
- */
-export declare function parsePhysicalPoolAgentNameTag(published: string[] | undefined, capacityPolicies?: readonly PhysicalDatabaseCapacityPolicy[]): string | undefined;
-//# sourceMappingURL=physicalPoolIdentity.d.ts.map

package/dist-esm/database-lifecycle/physicalPoolIdentity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalPoolIdentity.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,oCAAoC;gBAErC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,gBAAgB,GAAE,SAAS,8BAA8B,EAAO,GAC/D,MAAM,GAAG,SAAS,CAqCpB"}

package/dist-esm/database-lifecycle/physicalPoolIdentity.js

@@ -1,59 +0,0 @@
-/**
- * Agent tag key for the customer-managed deployment name that identifies a
- * worker's physical database pool, `(organizationId, agentName, engine)`.
- *
- * Published on its own rather than read out of
- * `databaseLifecycle:capacityPolicies`, so a customer who wants no proactive
- * scaling still gets a resolvable pool. One value, e.g. `customer-opa`.
- */
-export const DATABASE_LIFECYCLE_TAG_AGENT_NAME = 'databaseLifecycle:agentName';
-export class PhysicalPoolIdentityError extends Error {
-    code = 'physical_pool_identity_invalid';
-    constructor(message) {
-        super(message);
-        this.name = 'PhysicalPoolIdentityError';
-    }
-}
-/**
- * The single physical pool a worker's registration names, or undefined when it
- * published none.
- *
- * Throws {@link PhysicalPoolIdentityError} when the registration names more
- * than one pool. Guessing between them would provision infrastructure under
- * one deployment's Terraform state and hand it to another, so callers must
- * either refuse the registration or withhold the identity.
- *
- * Falls back to the capacity policy's name when the tag is absent, for a
- * worker predating {@link DATABASE_LIFECYCLE_TAG_AGENT_NAME} that is still
- * rolling: the policy names the same pool, so identity stays unambiguous.
- */
-export function parsePhysicalPoolAgentNameTag(published, capacityPolicies = []) {
-    if (published !== undefined && !Array.isArray(published)) {
-        throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} must be an array holding one deployment name.`);
-    }
-    const values = published ?? [];
-    if (values.some((value) => typeof value !== 'string' || value.trim() === '')) {
-        throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} must be a non-empty string when provided.`);
-    }
-    const declared = new Set(values.map((value) => value.trim()));
-    if (declared.size > 1) {
-        throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} names ${declared.size} pools (${[...declared].sort().join(', ')}); it must name exactly one.`);
-    }
-    const policyNames = new Set(capacityPolicies.map((policy) => policy.agentName));
-    const [declaredName] = declared;
-    if (declaredName !== undefined) {
-        // Every policy has to be for the pool this deployment owns. A policy for
-        // another pool would have proactive evaluation scaling something the
-        // deployment cannot provision into.
-        if ([...policyNames].some((policyName) => policyName !== declaredName)) {
-            throw new PhysicalPoolIdentityError(`${DATABASE_LIFECYCLE_TAG_AGENT_NAME} is ${declaredName} but databaseLifecycle:capacityPolicies names ${[...policyNames].sort().join(', ')}; they must name the same pool.`);
-        }
-        return declaredName;
-    }
-    if (policyNames.size > 1) {
-        throw new PhysicalPoolIdentityError(`databaseLifecycle:capacityPolicies names ${policyNames.size} pools; publish ${DATABASE_LIFECYCLE_TAG_AGENT_NAME} to say which one this deployment owns.`);
-    }
-    const [policyName] = policyNames;
-    return policyName;
-}
-//# sourceMappingURL=physicalPoolIdentity.js.map

package/dist-esm/database-lifecycle/physicalPoolIdentity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalPoolIdentity.js","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAE/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,gCAAgC,CAAC;IAEjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAA+B,EAC/B,mBAA8D,EAAE;IAEhE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,GAAG,iCAAiC,gDAAgD,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,IAAI,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,yBAAyB,CAAC,GAAG,iCAAiC,4CAA4C,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,yBAAyB,CACjC,GAAG,iCAAiC,UAAU,QAAQ,CAAC,IAAI,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACpI,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC;IAChC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,yEAAyE;QACzE,qEAAqE;QACrE,oCAAoC;QACpC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,yBAAyB,CACjC,GAAG,iCAAiC,OAAO,YAAY,iDAAiD,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAC5K,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,WAAW,CAAC,IAAI,mBAAmB,iCAAiC,yCAAyC,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;IACjC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist-esm/database-lifecycle/physicalPoolIdentity.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=physicalPoolIdentity.test.d.ts.map

package/dist-esm/database-lifecycle/physicalPoolIdentity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"physicalPoolIdentity.test.d.ts","sourceRoot":"","sources":["../../src/database-lifecycle/physicalPoolIdentity.test.ts"],"names":[],"mappings":""}