alchemy 2.0.0-beta.52 → 2.0.0-beta.53

package/src/Planetscale/MySQL/MySQLPassword.ts

@@ -1,5 +1,5 @@
 import { Credentials } from "@distilled.cloud/planetscale/Credentials";
-import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as planetscale from "@distilled.cloud/planetscale/Operations";
 import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import { deepEqual, isResolved } from "../../Diff.ts";
@@ -134,6 +134,166 @@ export const MySQLPassword = Resource<MySQLPassword>(
   "Planetscale.MySQLPassword",
 );
 
+export const MySQLPasswordProvider = () =>
+  Provider.succeed(MySQLPassword, {
+    stables: ["id"],
+    diff: Effect.fn(function* ({ olds = {}, news }) {
+      if (!isResolved(news)) return undefined;
+
+      // Replace on any immutable-in-place change; engine falls through
+      // to reconcile for everything else (which authoritatively diffs
+      // against observed cloud state).
+      if (news.role !== olds.role) return { action: "replace" } as const;
+      if (news.replica !== olds.replica) {
+        return { action: "replace" } as const;
+      }
+      if (news.ttl !== olds.ttl) return { action: "replace" } as const;
+
+      const newDb = resolveDatabaseName(news.database);
+      const oldDb = olds.database
+        ? resolveDatabaseName(olds.database)
+        : undefined;
+      if (oldDb && newDb !== oldDb) {
+        return { action: "replace" } as const;
+      }
+      const newBranch = resolveBranchName(news.branch);
+      const oldBranch = resolveBranchName(olds.branch);
+      if (newBranch !== oldBranch) {
+        return { action: "replace" } as const;
+      }
+      return undefined;
+    }),
+
+    read: Effect.fn(function* ({ output }) {
+      // Adoption (no cached output) is impossible: the PlanetScale API
+      // never re-issues plaintext, so even if we found a matching live
+      // password by listing+name we couldn't deliver the `password`
+      // attribute. Fall through to greenfield create in `reconcile`.
+      if (!output) return undefined;
+
+      // Refresh — verify the cached password still exists and
+      // re-emit the persisted output (with plaintext intact).
+      // If it's gone, return undefined so the engine routes to
+      // reconcile, which will surface the unrecoverable-rotation
+      // condition explicitly.
+      return yield* planetscale
+        .getPassword({
+          organization: output.organization,
+          database: output.database,
+          branch: output.branch,
+          id: output.id,
+        })
+        .pipe(
+          Effect.map((password) =>
+            buildAttributes(password, output.password, {
+              organization: output.organization,
+              database: output.database,
+              branch: output.branch,
+            }),
+          ),
+          Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
+        );
+    }),
+
+    reconcile: Effect.fn(function* ({ id, news, output }) {
+      const newName = yield* createPasswordName(id, news.name);
+
+      // Identifiers — stable across update (diff replaces on
+      // database/branch changes), so we can pull from `output` first
+      // and fall back to `news` for greenfield.
+      const { organization: envOrg } = yield* yield* Credentials;
+      const organization =
+        output?.organization ?? resolveDatabaseOrg(news.database) ?? envOrg;
+      const databaseName =
+        output?.database ?? resolveDatabaseName(news.database);
+      const branchName = output?.branch ?? resolveBranchName(news.branch);
+
+      // 1. Observe — read live state. The PlanetScale API has no
+      //    "lookup by name" path (names aren't unique within a branch)
+      //    so the only way to find the live password is by id. Without
+      //    a cached output we cannot observe and fall straight through
+      //    to ensure (greenfield create).
+      const observed = output
+        ? yield* planetscale
+            .getPassword({
+              organization,
+              database: databaseName,
+              branch: branchName,
+              id: output.id,
+            })
+            .pipe(Effect.catchTag("NotFound", () => Effect.succeed(undefined)))
+        : undefined;
+
+      // 2. Ensure — create the password if it doesn't exist live.
+      //    This single branch covers greenfield (no output) AND the
+      //    out-of-band-deletion case (output cached but cloud lost it).
+      //    The latter is structurally a rotation: the new password
+      //    has a fresh id/host/username/plaintext that propagate
+      //    downstream through the dependency graph. There is no path
+      //    to recover the original plaintext, so recreating is the
+      //    only way to converge.
+      let live: planetscale.GetPasswordOutput;
+      let plaintext: Redacted.Redacted<string>;
+      if (observed) {
+        live = observed;
+        // We re-use the cached plaintext: the API never re-issues it.
+        plaintext = output!.password;
+      } else {
+        const created = yield* planetscale.createPassword({
+          organization,
+          database: databaseName,
+          branch: branchName,
+          name: newName,
+          role: news.role,
+          replica: news.replica,
+          ttl: news.ttl,
+          cidrs: news.cidrs,
+        });
+        plaintext = created.plain_text;
+        live = created;
+      }
+
+      // 3. Sync — diff observed cloud state against desired and patch
+      //    only what changed. Only `name` and `cidrs` are mutable in
+      //    place; everything else triggers a replace via diff().
+      //    Skip the API entirely when there's no delta.
+      const wantsRename = newName !== live.name;
+      const observedCidrs = normalizeCidrs(live.cidrs);
+      const desiredCidrs = normalizeCidrs(news.cidrs);
+      const wantsCidrs = !deepEqual(desiredCidrs, observedCidrs);
+
+      if (wantsRename || wantsCidrs) {
+        live = yield* planetscale.updatePassword({
+          organization,
+          database: databaseName,
+          branch: branchName,
+          id: live.id,
+          name: wantsRename ? newName : undefined,
+          cidrs: wantsCidrs ? news.cidrs : undefined,
+        });
+      }
+
+      // 4. Return — fresh attrs sourced from observed cloud state,
+      //    re-using cached plaintext when we didn't just create.
+      return buildAttributes(live, plaintext, {
+        organization,
+        database: databaseName,
+        branch: branchName,
+      });
+    }),
+
+    delete: Effect.fn(function* ({ output }) {
+      yield* planetscale
+        .deletePassword({
+          organization: output.organization,
+          database: output.database,
+          branch: output.branch,
+          id: output.id,
+        })
+        .pipe(Effect.catchTag("NotFound", () => Effect.void));
+    }),
+  });
+
 // At runtime, Resource references in props are resolved to their full
 // attributes — so `news.database` (when a Database resource was passed)
 // is `{ name: string; organization: string; ... }` rather than the
@@ -218,170 +378,3 @@ const buildAttributes = (
   ttl: password.ttl_seconds ?? undefined,
   cidrs: normalizeCidrs(password.cidrs),
 });
-
-export const MySQLPasswordProvider = () =>
-  Provider.effect(
-    MySQLPassword,
-    Effect.gen(function* () {
-      const createPwd = yield* ops.createPassword;
-      const getPwd = yield* ops.getPassword;
-      const updatePwd = yield* ops.updatePassword;
-      const deletePwd = yield* ops.deletePassword;
-
-      return {
-        stables: ["id"],
-
-        diff: Effect.fn(function* ({ olds = {}, news }) {
-          if (!isResolved(news)) return undefined;
-
-          // Replace on any immutable-in-place change; engine falls through
-          // to reconcile for everything else (which authoritatively diffs
-          // against observed cloud state).
-          if (news.role !== olds.role) return { action: "replace" } as const;
-          if (news.replica !== olds.replica) {
-            return { action: "replace" } as const;
-          }
-          if (news.ttl !== olds.ttl) return { action: "replace" } as const;
-
-          const newDb = resolveDatabaseName(news.database);
-          const oldDb = olds.database
-            ? resolveDatabaseName(olds.database)
-            : undefined;
-          if (oldDb && newDb !== oldDb) {
-            return { action: "replace" } as const;
-          }
-          const newBranch = resolveBranchName(news.branch);
-          const oldBranch = resolveBranchName(olds.branch);
-          if (newBranch !== oldBranch) {
-            return { action: "replace" } as const;
-          }
-          return undefined;
-        }),
-
-        read: Effect.fn(function* ({ output }) {
-          // Adoption (no cached output) is impossible: the PlanetScale API
-          // never re-issues plaintext, so even if we found a matching live
-          // password by listing+name we couldn't deliver the `password`
-          // attribute. Fall through to greenfield create in `reconcile`.
-          if (!output) return undefined;
-
-          // Refresh — verify the cached password still exists and
-          // re-emit the persisted output (with plaintext intact).
-          // If it's gone, return undefined so the engine routes to
-          // reconcile, which will surface the unrecoverable-rotation
-          // condition explicitly.
-          return yield* getPwd({
-            organization: output.organization,
-            database: output.database,
-            branch: output.branch,
-            id: output.id,
-          }).pipe(
-            Effect.map((password) =>
-              buildAttributes(password, output.password, {
-                organization: output.organization,
-                database: output.database,
-                branch: output.branch,
-              }),
-            ),
-            Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
-          );
-        }),
-
-        reconcile: Effect.fn(function* ({ id, news, output }) {
-          const newName = yield* createPasswordName(id, news.name);
-
-          // Identifiers — stable across update (diff replaces on
-          // database/branch changes), so we can pull from `output` first
-          // and fall back to `news` for greenfield.
-          const { organization: envOrg } = yield* Credentials;
-          const organization =
-            output?.organization ?? resolveDatabaseOrg(news.database) ?? envOrg;
-          const databaseName =
-            output?.database ?? resolveDatabaseName(news.database);
-          const branchName = output?.branch ?? resolveBranchName(news.branch);
-
-          // 1. Observe — read live state. The PlanetScale API has no
-          //    "lookup by name" path (names aren't unique within a branch)
-          //    so the only way to find the live password is by id. Without
-          //    a cached output we cannot observe and fall straight through
-          //    to ensure (greenfield create).
-          const observed = output
-            ? yield* getPwd({
-                organization,
-                database: databaseName,
-                branch: branchName,
-                id: output.id,
-              }).pipe(
-                Effect.catchTag("NotFound", () => Effect.succeed(undefined)),
-              )
-            : undefined;
-
-          // 2. Ensure — create the password if it doesn't exist live.
-          //    This single branch covers greenfield (no output) AND the
-          //    out-of-band-deletion case (output cached but cloud lost it).
-          //    The latter is structurally a rotation: the new password
-          //    has a fresh id/host/username/plaintext that propagate
-          //    downstream through the dependency graph. There is no path
-          //    to recover the original plaintext, so recreating is the
-          //    only way to converge.
-          let live: ops.GetPasswordOutput;
-          let plaintext: Redacted.Redacted<string>;
-          if (observed) {
-            live = observed;
-            // We re-use the cached plaintext: the API never re-issues it.
-            plaintext = output!.password;
-          } else {
-            const created = yield* createPwd({
-              organization,
-              database: databaseName,
-              branch: branchName,
-              name: newName,
-              role: news.role,
-              replica: news.replica,
-              ttl: news.ttl,
-              cidrs: news.cidrs,
-            });
-            plaintext = created.plain_text;
-            live = created;
-          }
-
-          // 3. Sync — diff observed cloud state against desired and patch
-          //    only what changed. Only `name` and `cidrs` are mutable in
-          //    place; everything else triggers a replace via diff().
-          //    Skip the API entirely when there's no delta.
-          const wantsRename = newName !== live.name;
-          const observedCidrs = normalizeCidrs(live.cidrs);
-          const desiredCidrs = normalizeCidrs(news.cidrs);
-          const wantsCidrs = !deepEqual(desiredCidrs, observedCidrs);
-
-          if (wantsRename || wantsCidrs) {
-            live = yield* updatePwd({
-              organization,
-              database: databaseName,
-              branch: branchName,
-              id: live.id,
-              name: wantsRename ? newName : undefined,
-              cidrs: wantsCidrs ? news.cidrs : undefined,
-            });
-          }
-
-          // 4. Return — fresh attrs sourced from observed cloud state,
-          //    re-using cached plaintext when we didn't just create.
-          return buildAttributes(live, plaintext, {
-            organization,
-            database: databaseName,
-            branch: branchName,
-          });
-        }),
-
-        delete: Effect.fn(function* ({ output }) {
-          yield* deletePwd({
-            organization: output.organization,
-            database: output.database,
-            branch: output.branch,
-            id: output.id,
-          }).pipe(Effect.catchTag("NotFound", () => Effect.void));
-        }),
-      };
-    }),
-  );

package/src/Planetscale/Postgres/PostgresClusterSize.ts

@@ -1,4 +1,4 @@
-import * as ops from "@distilled.cloud/planetscale/Operations";
+import * as planetscale from "@distilled.cloud/planetscale";
 import * as Effect from "effect/Effect";
 import { pollUntil } from "../Util.ts";
 
@@ -67,7 +67,7 @@ export const waitForPendingPostgresChanges = Effect.fn(function* (
 ) {
   yield* pollUntil(
     `changes for branch "${branch}"`,
-    ops.listBranchChangeRequests({
+    planetscale.listBranchChangeRequests({
       organization,
       database,
       branch,
@@ -98,7 +98,7 @@ export const ensurePostgresProductionBranchClusterSize = Effect.fn(function* (
   branch: string,
   expectedClusterSize: PostgresClusterSize,
 ) {
-  const data = yield* ops.getBranch({ organization, database, branch });
+  const data = yield* planetscale.getBranch({ organization, database, branch });
 
   const sku = toPostgresClusterSku({
     size: expectedClusterSize,
@@ -110,7 +110,7 @@ export const ensurePostgresProductionBranchClusterSize = Effect.fn(function* (
     return;
   }
   yield* waitForPendingPostgresChanges(organization, database, branch);
-  const change = yield* ops.updateBranchChangeRequest({
+  const change = yield* planetscale.updateBranchChangeRequest({
     organization,
     database,
     branch,