@ontemper/sdk 0.0.0 → 0.2.0

package/dist/Resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Resource.js","sourceRoot":"","sources":["../src/Resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAiB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAmC,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAkB,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAmD9F,wGAAwG;AACxG,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA8B,CAAC;AAE3D,oEAAoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAwC,EAAkC,EAAE,CACxG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;AAE9E,qFAAqF;AACrF,MAAM,YAAY,GAAG,CAAC,MAAkB,EAA+B,EAAE;IACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAC5C,CAAC,CAAC,QAAQ,CAAC,MAAM;QACjB,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,QAAQ,GACZ,CAAwB,GAAW,EAAE,MAAS,EAAE,EAAE,CAClD,CAAC,KAAkB,EAAE,EAAE,CACrB,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,oBAAoB,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,EAAE;IACpB,OAAO,EAAE,YAAY,GAAG,wCAAwC,KAAK,CAAC,OAAO,EAAE;CAChF,CAAC,CACL,CACF,CAAC;AAEN,MAAM,OAAO,GAAG,CACd,IAAO,EACP,IAAU,EACV,QAA0B,EAC1B,IAAqD,EACtB,EAAE;IACjC,MAAM,EAAE,GAA2B,gCAAgC,IAAI,IAAI,IAAI,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAA4B,CAAC,EAAE,CAAC,CAAC;IAC7E,wGAAwG;IACxG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAA0B,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,CACX,UAAU,EACV,UAAU,CAAC,SAAS,CAAmB,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CACxG,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAW,UAAU,CAAC;IACpC,oGAAoG;IACpG,OAAO,QAAyC,CAAC;AACnD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GACnB,GAAS,EAAE,CACX,CACE,GAAS,EACT,OAAuD,EACP,EAAE,CAClD,OAAO,CACL,UAAU,EACV,GAAG,EACH,OAAO,CAAC,IAAI,KAAK,SAAS;IACxB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;IACjE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EACvF,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CACxG,CAAC;AAEN,iGAAiG;AACjG,MAAM,CAAC,MAAM,QAAQ,GACnB,GAAS,EAAE,CACX,CAA4B,GAAS,EAAkE,EAAE,CACvG,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9G;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,GAAS,EAAE,CACX,CACE,IAAU,EACV,OAA+B,EACwC,EAAE,CACzE,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAChH,MAAM,CAAC,OAAO,CAAC;IACb,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC,CAAC;CACL,CAAC,CACH,CAAC;AAEN,kHAAkH;AAClH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,UAAwC,EAAE,OAA2B,EAAE,EAAE,CACxG,KAAK,CAAC,MAAM;AACV,sGAAsG;AACtG,UAAU,EACV,MAAM,CAAC,GAAG,CACR,gBAAgB,EAChB,CAAC,SAAS,EAA4D,EAAE,CACtE,CAAC,UAAU,EAAE,EAAE,CACb,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAC9D,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CACvD,CACN,CACF,CAAC"}

package/dist/ResourcesErrors.d.ts

@@ -0,0 +1,36 @@
+import { Schema } from 'effect';
+declare const ResourceNotFoundError_base: Schema.Class<ResourceNotFoundError, Schema.TaggedStruct<"ResourceNotFoundError", {
+    readonly target: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Nothing answers to the key or selector. For a selector this is the caller's answer (an unknown tenant), not a fault. */
+export declare class ResourceNotFoundError extends ResourceNotFoundError_base {
+}
+declare const ResourceNotSelectableError_base: Schema.Class<ResourceNotSelectableError, Schema.TaggedStruct<"ResourceNotSelectableError", {
+    readonly target: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The selector was refused: its field is not the type's `x-selectable` one, or the match is empty or names several fields. */
+export declare class ResourceNotSelectableError extends ResourceNotSelectableError_base {
+}
+declare const InvalidResourceError_base: Schema.Class<InvalidResourceError, Schema.TaggedStruct<"InvalidResourceError", {
+    readonly target: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The record exists but cannot serve this read: a reference cycle, several records matching one selector, or a value the caller's schema rejects. */
+export declare class InvalidResourceError extends InvalidResourceError_base {
+}
+declare const ResourcesUnauthorizedError_base: Schema.Class<ResourcesUnauthorizedError, Schema.TaggedStruct<"ResourcesUnauthorizedError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The runtime identity is missing or refused: no API URL or runtime token, a provider that never published a fresh token, or a 401/403. */
+export declare class ResourcesUnauthorizedError extends ResourcesUnauthorizedError_base {
+}
+declare const ResourcesUnavailableError_base: Schema.Class<ResourcesUnavailableError, Schema.TaggedStruct<"ResourcesUnavailableError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, or a body the SDK cannot read. */
+export declare class ResourcesUnavailableError extends ResourcesUnavailableError_base {
+}
+export {};
+//# sourceMappingURL=ResourcesErrors.d.ts.map

package/dist/ResourcesErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesErrors.d.ts","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;AAIhC,2HAA2H;AAC3H,qBAAa,qBAAsB,SAAQ,0BAGzC;CAAG;;;;;AAEL,+HAA+H;AAC/H,qBAAa,0BAA2B,SAAQ,+BAM/C;CAAG;;;;;AAEJ,sJAAsJ;AACtJ,qBAAa,oBAAqB,SAAQ,yBAGxC;CAAG;;;;AAEL,4IAA4I;AAC5I,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;;;;AAEJ,mHAAmH;AACnH,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG"}

package/dist/ResourcesErrors.js

@@ -0,0 +1,27 @@
+import { Schema } from 'effect';
+// `target` names what was asked for — `key <key>` or `<type> matching <field>` — never a presented match value.
+/** Nothing answers to the key or selector. For a selector this is the caller's answer (an unknown tenant), not a fault. */
+export class ResourceNotFoundError extends Schema.TaggedError()('ResourceNotFoundError', {
+    target: Schema.String,
+    message: Schema.String,
+}) {
+}
+/** The selector was refused: its field is not the type's `x-selectable` one, or the match is empty or names several fields. */
+export class ResourceNotSelectableError extends Schema.TaggedError()('ResourceNotSelectableError', {
+    target: Schema.String,
+    message: Schema.String,
+}) {
+}
+/** The record exists but cannot serve this read: a reference cycle, several records matching one selector, or a value the caller's schema rejects. */
+export class InvalidResourceError extends Schema.TaggedError()('InvalidResourceError', {
+    target: Schema.String,
+    message: Schema.String,
+}) {
+}
+/** The runtime identity is missing or refused: no API URL or runtime token, a provider that never published a fresh token, or a 401/403. */
+export class ResourcesUnauthorizedError extends Schema.TaggedError()('ResourcesUnauthorizedError', { message: Schema.String }) {
+}
+/** The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, or a body the SDK cannot read. */
+export class ResourcesUnavailableError extends Schema.TaggedError()('ResourcesUnavailableError', { message: Schema.String }) {
+}
+//# sourceMappingURL=ResourcesErrors.js.map

package/dist/ResourcesErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesErrors.js","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,gHAAgH;AAEhH,2HAA2H;AAC3H,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CAAC,uBAAuB,EAAE;IAC9G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,+HAA+H;AAC/H,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B;IACE,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ,sJAAsJ;AACtJ,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAAC,sBAAsB,EAAE;IAC3G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,4IAA4I;AAC5I,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG"}

package/dist/ResourcesToken.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from 'effect';
+import { ResourcesUnauthorizedError } from './ResourcesErrors.js';
+export interface RuntimeTokens {
+    /** The provider's token when it outlives the refresh window, otherwise the next one it publishes. */
+    readonly current: Effect.Effect<string, ResourcesUnauthorizedError>;
+    /** The first usable token other than the one the runtime API just refused. */
+    readonly replacing: (refused: string) => Effect.Effect<string, ResourcesUnauthorizedError>;
+}
+export declare const makeRuntimeTokens: Effect.Effect<RuntimeTokens>;
+//# sourceMappingURL=ResourcesToken.d.ts.map

package/dist/ResourcesToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesToken.d.ts","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,MAAM,EAAsC,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAuElE,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACpE,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CAC5F;AAED,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAWzD,CAAC"}

package/dist/ResourcesToken.js

@@ -0,0 +1,63 @@
+import { readFile } from 'node:fs/promises';
+import { Cache, Clock, Config, Duration, Effect, Option, Redacted, Schedule, Schema } from 'effect';
+import { ResourcesUnauthorizedError } from './ResourcesErrors.js';
+/** A token this close to `exp` could lapse mid-request, so it counts as spent. */
+const REFRESH_WINDOW_MS = 30_000;
+/** Providers republish well inside this: the k8s refresher every 30 s, the Firecracker host on every renewal. */
+const PUBLISH_TIMEOUT = Duration.seconds(35);
+const POLL_INTERVAL = Duration.millis(100);
+const TokenExpiry = Schema.StringFromBase64Url.pipe(Schema.decodeTo(Schema.fromJsonString(Schema.Struct({ exp: Schema.Number }))));
+const decodeTokenExpiry = Schema.decodeUnknownOption(TokenExpiry);
+/** Only a JWT that outlives the refresh window is sent; one without `exp` never is, as in `@ontemper/resources`. */
+const outlivesRefreshWindow = (token, now) => Option.match(decodeTokenExpiry(token.split('.')[1]), {
+    onNone: () => false,
+    onSome: ({ exp }) => exp * 1000 - now > REFRESH_WINDOW_MS,
+});
+const TokenSources = Config.all({
+    file: Config.option(Config.String('UNNBOUND_RUNTIME_TOKEN_FILE')),
+    token: Config.option(Config.Redacted('UNNBOUND_RUNTIME_TOKEN')),
+}).pipe(Effect.mapError((error) => new ResourcesUnauthorizedError({ message: `Runtime token settings are unreadable: ${error.message}` })));
+/**
+ * The provider's file wins over the env token and both are re-read on every call, so a rotation is seen at once.
+ * An unreadable or empty file falls back to the env token; with neither configured nothing can ever authenticate.
+ */
+const readToken = Effect.gen(function* () {
+    const sources = yield* TokenSources;
+    const file = Option.filter(sources.file, (path) => path.length > 0);
+    const token = Option.filter(Option.map(sources.token, Redacted.value), (value) => value.length > 0);
+    if (Option.isNone(file) && Option.isNone(token)) {
+        return yield* new ResourcesUnauthorizedError({
+            message: 'No runtime token is configured: set UNNBOUND_RUNTIME_TOKEN_FILE or UNNBOUND_RUNTIME_TOKEN.',
+        });
+    }
+    if (Option.isSome(file)) {
+        const contents = yield* Effect.option(Effect.tryPromise(() => readFile(file.value, 'utf8')));
+        const published = Option.filter(Option.map(contents, (text) => text.trim()), (text) => text.length > 0);
+        if (Option.isSome(published))
+            return published;
+    }
+    return token;
+});
+/** Polls the provider until it publishes a usable token other than `refused`. */
+const awaitPublished = (refused) => Effect.gen(function* () {
+    const token = yield* readToken;
+    const now = yield* Clock.currentTimeMillis;
+    return Option.filter(token, (candidate) => candidate !== refused && outlivesRefreshWindow(candidate, now));
+}).pipe(Effect.repeat({ schedule: Schedule.spaced(POLL_INTERVAL), until: Option.isSome }), Effect.map((published) => published.value), Effect.timeoutOrElse({
+    duration: PUBLISH_TIMEOUT,
+    orElse: () => Effect.fail(new ResourcesUnauthorizedError({ message: 'Runtime resolver token provider did not publish a fresh token.' })),
+}));
+export const makeRuntimeTokens = Effect.gen(function* () {
+    // Waiters on one refused token share a single poll; a refusal of a newer token starts its own.
+    const published = yield* Cache.makeWith(awaitPublished, { capacity: 8, timeToLive: () => Duration.zero });
+    const replacing = (refused) => Cache.get(published, refused);
+    const current = Effect.gen(function* () {
+        const token = yield* readToken;
+        const now = yield* Clock.currentTimeMillis;
+        if (Option.isSome(token) && outlivesRefreshWindow(token.value, now))
+            return token.value;
+        return yield* replacing(Option.getOrElse(token, () => ''));
+    });
+    return { current, replacing };
+});
+//# sourceMappingURL=ResourcesToken.js.map

package/dist/ResourcesToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesToken.js","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,iHAAiH;AACjH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAC9E,CAAC;AACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;AAElE,oHAAoH;AACpH,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAE,GAAW,EAAW,EAAE,CACpE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;IACnD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB;CAC1D,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;CAChE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,0CAA0C,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAClH,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,4FAA4F;SACtG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,IAAI,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7G,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAc,EAAE,CAAC,EACzF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1C,MAAM,CAAC,aAAa,CAAC;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAC9G;CACJ,CAAC,CACH,CAAC;AASJ,MAAM,CAAC,MAAM,iBAAiB,GAAiC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjF,+FAA+F;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACxF,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/dist/RuntimeResources.d.ts

@@ -0,0 +1,26 @@
+import { Context, Effect, Layer, Redacted, Schema } from 'effect';
+import { HttpClient } from 'effect/unstable/http';
+import { type SelectResourceRuntimeInputSchema } from './Contract/RuntimeApi.js';
+import { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError } from './ResourcesErrors.js';
+/** Finds the one record of a type whose `x-selectable` field equals the value a tenant presented. */
+export type ResourceSelector = typeof SelectResourceRuntimeInputSchema.Type;
+export type ReadError = ResourceNotFoundError | ResourcesUnauthorizedError | ResourcesUnavailableError;
+/** What declared resources read through: the Temper runtime API in production, fixed values in tests. */
+export interface ResourceReader {
+    /** A Variable's live value; `Redacted` because the platform, not the caller, decides what is secret. */
+    readonly variable: (key: string) => Effect.Effect<Redacted.Redacted<string>, ReadError>;
+    /** The record's value with every secret filled in, still undecoded. */
+    readonly resolve: (key: string) => Effect.Effect<Schema.Json, ReadError | InvalidResourceError>;
+    /** The key of the one record whose `x-selectable` field matches. */
+    readonly select: (selector: ResourceSelector) => Effect.Effect<string, ReadError | ResourceNotSelectableError | InvalidResourceError>;
+}
+declare const RuntimeResources_base: Context.ServiceClass<RuntimeResources, "@temper/workflow/RuntimeResources", ResourceReader>;
+/**
+ * Variables and resources read live from the Temper runtime API with the workflow's runtime identity
+ * (`UNNBOUND_API_URL` plus `UNNBOUND_RUNTIME_TOKEN_FILE` or `UNNBOUND_RUNTIME_TOKEN`), cached for 30 s.
+ */
+export declare class RuntimeResources extends RuntimeResources_base {
+    static readonly layer: Layer.Layer<RuntimeResources, never, HttpClient.HttpClient>;
+}
+export {};
+//# sourceMappingURL=RuntimeResources.d.ts.map

package/dist/RuntimeResources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimeResources.d.ts","sourceRoot":"","sources":["../src/RuntimeResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,OAAO,EAAY,MAAM,EAAQ,KAAK,EAAU,QAAQ,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAErH,OAAO,EAAE,UAAU,EAA2C,MAAM,sBAAsB,CAAC;AAE3F,OAAO,EAQL,KAAK,gCAAgC,EACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAY9B,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAC;AAE5E,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,0BAA0B,GAAG,yBAAyB,CAAC;AA2KvG,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAAC,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,CACf,QAAQ,EAAE,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,0BAA0B,GAAG,oBAAoB,CAAC,CAAC;CAC3F;;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;IAEC,MAAM,CAAC,QAAQ,CAAC,KAAK,8DAAiD;CACvE"}

package/dist/RuntimeResources.js

@@ -0,0 +1,115 @@
+import { Cache, Config, Context, Duration, Effect, Exit, Layer, Option, Redacted, Schema } from 'effect';
+import { constTrue } from 'effect/Function';
+import { HttpClient, HttpClientRequest } from 'effect/unstable/http';
+import { HttpApiClient } from 'effect/unstable/httpapi';
+import { ResourcesRuntimeApi, } from './Contract/RuntimeApi.js';
+import { registerSecrets } from './Redaction.js';
+import { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError, } from './ResourcesErrors.js';
+import { makeRuntimeTokens } from './ResourcesToken.js';
+// Resolved values are live configuration: an edit, or a revoked secret, reaches a warm process within this window.
+const CACHE_TTL = Duration.seconds(30);
+// Bounds memory for a workflow that selects across many tenants; the least recently read entry goes first.
+const CACHE_CAPACITY = 1_024;
+const REQUEST_TIMEOUT = Duration.seconds(5);
+const Endpoints = ResourcesRuntimeApi.groups.resourcesRuntime.endpoints;
+// A 401 on the first attempt ends it before its body is read, so the retry never waits on a refused answer.
+class TokenRefused extends Schema.TaggedError()('TokenRefused', {}) {
+}
+class ApiUrlMissing extends Schema.TaggedError()('ApiUrlMissing', {}) {
+}
+// The status each declared runtime error answers with (see `Contract/RuntimeApi.ts`).
+const statusOfRuntimeError = {
+    RuntimeResourcesBadRequestError: 400,
+    RuntimeResourcesUnauthorizedError: 401,
+    RuntimeResourcesForbiddenError: 403,
+    RuntimeResourcesNotFoundError: 404,
+    RuntimeResourcesConflictError: 409,
+    RuntimeResourcesUnavailableError: 503,
+};
+const ResourcesMake = Effect.gen(function* () {
+    const tokens = yield* makeRuntimeTokens;
+    // Each attempt's scope owns its request: leaving the scope aborts it, so no response outlives its attempt.
+    const platform = HttpClient.withScope(yield* HttpClient.HttpClient).pipe(HttpClient.mapRequestEffect((request) => Config.NonEmptyString('UNNBOUND_API_URL').pipe(Effect.map((apiUrl) => HttpClientRequest.prependUrl(request, apiUrl)), Effect.mapError(() => new ApiUrlMissing()))));
+    // A 401's body is the fixed `Unauthorized`; failing before it is read lets a refused attempt end at once.
+    const client = yield* HttpApiClient.makeWith(ResourcesRuntimeApi, {
+        httpClient: platform.pipe(HttpClient.filterOrFail((response) => response.status !== 401, () => new TokenRefused())),
+    });
+    // One call to the runtime API; a 401 swaps in the provider's next token and tries once more.
+    const call = (operation, target, send, refuse = () => undefined) => {
+        const failed = (detail) => `Runtime resolver ${Endpoints[operation].path} failed for ${target}: ${detail}`;
+        // A status the contract does not declare, or a body the SDK cannot read, leaves the resolver unavailable.
+        const toReadError = (error) => {
+            switch (error._tag) {
+                case 'ApiUrlMissing':
+                    return new ResourcesUnauthorizedError({ message: failed('UNNBOUND_API_URL is not set') });
+                case 'TokenRefused':
+                    return new ResourcesUnauthorizedError({ message: failed('401 Unauthorized') });
+                case 'HttpClientError':
+                    return new ResourcesUnavailableError({
+                        message: failed(error.response === undefined ? error.message : `${error.response.status}`),
+                    });
+                case 'SchemaError':
+                    return new ResourcesUnavailableError({ message: failed('unreadable answer') });
+                default: {
+                    const status = statusOfRuntimeError[error._tag];
+                    const message = failed(`${status} ${error.error}`);
+                    if (status === 401 || status === 403)
+                        return new ResourcesUnauthorizedError({ message });
+                    if (status === 404)
+                        return new ResourceNotFoundError({ target, message });
+                    return refuse(status, message) ?? new ResourcesUnavailableError({ message });
+                }
+            }
+        };
+        // One request under one deadline that also covers reading its body; the attempt aborts the request as it ends.
+        const attempt = (attemptClient, token) => send(attemptClient, `Bearer ${token}`).pipe(Effect.scoped, Effect.timeoutOrElse({
+            duration: REQUEST_TIMEOUT,
+            orElse: () => Effect.fail(new ResourcesUnavailableError({
+                message: failed(`no answer within ${Duration.toMillis(REQUEST_TIMEOUT)} ms`),
+            })),
+        }), 
+        // Resolver traffic is Temper's own transport, not the customer's work: no protocol lines, no span (T-3831).
+        Effect.provideService(HttpClient.TracerDisabledWhen, constTrue));
+        return Effect.gen(function* () {
+            const token = yield* tokens.current;
+            const first = yield* attempt(client.resourcesRuntime, token).pipe(Effect.map(Option.some), Effect.catchTag('TokenRefused', () => Effect.succeedNone));
+            if (Option.isSome(first))
+                return first.value;
+            return yield* attempt(client.resourcesRuntime, yield* tokens.replacing(token));
+        }).pipe(Effect.catchIf((error) => error._tag !== 'ResourcesUnauthorizedError' && error._tag !== 'ResourcesUnavailableError', (error) => Effect.fail(toReadError(error))));
+    };
+    const cache = (lookup) => Cache.makeWith(lookup, {
+        capacity: CACHE_CAPACITY,
+        // A failure is not kept: the next read asks the resolver again.
+        timeToLive: (exit) => (Exit.isSuccess(exit) ? CACHE_TTL : Duration.zero),
+    });
+    const variables = yield* cache((key) => call('resolveVariable', `key ${key}`, (api, authorization) => api.resolveVariable({ headers: { authorization }, payload: { key } })));
+    const values = yield* cache((key) => call('resolveResource', `key ${key}`, (api, authorization) => api.resolveResource({ headers: { authorization }, payload: { key } }), (status, message) => (status === 409 ? new InvalidResourceError({ target: `key ${key}`, message }) : undefined)));
+    // Keyed by value: `{a,b}` and `{b,a}` share one entry, and each tenant's presented value gets its own.
+    const selections = yield* cache((selector) => {
+        const target = `${selector.resourceTypeKey} matching ${Object.keys(selector.match).join(', ')}`;
+        return call('selectResource', target, (api, authorization) => api.selectResource({ headers: { authorization }, payload: selector }), (status, message) => status === 400
+            ? new ResourceNotSelectableError({ target, message })
+            : status === 409
+                ? new InvalidResourceError({ target, message })
+                : undefined);
+    });
+    // Registers the answer's secrets in the caller's context, so a cached read masks them like a fresh one.
+    const unwrap = (read) => read.pipe(Effect.tap(({ redactionMasks }) => registerSecrets(redactionMasks ?? [])), Effect.map(({ value }) => value));
+    return RuntimeResources.of({
+        variable: (key) => Effect.map(unwrap(Cache.get(variables, key)), Redacted.make),
+        // Each caller gets its own copy: the cached value is shared across requests for 30 s.
+        resolve: (key) => Effect.map(unwrap(Cache.get(values, key)), (value) => structuredClone(value)),
+        // A fresh key: Effect caches an object's hash by reference, so a reused, mutated selector could hit another tenant's entry.
+        select: (selector) => Effect.map(unwrap(Cache.get(selections, { resourceTypeKey: selector.resourceTypeKey, match: { ...selector.match } })), (selected) => selected.key),
+    });
+});
+/**
+ * Variables and resources read live from the Temper runtime API with the workflow's runtime identity
+ * (`UNNBOUND_API_URL` plus `UNNBOUND_RUNTIME_TOKEN_FILE` or `UNNBOUND_RUNTIME_TOKEN`), cached for 30 s.
+ */
+export class RuntimeResources extends Context.Service()('@temper/workflow/RuntimeResources') {
+    // Needs `HttpClient`, which `workflow()` provides.
+    static layer = Layer.effect(RuntimeResources, ResourcesMake);
+}
+//# sourceMappingURL=RuntimeResources.js.map

package/dist/RuntimeResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimeResources.js","sourceRoot":"","sources":["../src/RuntimeResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AACrH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAwB,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EACL,mBAAmB,GAQpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,mHAAmH;AACnH,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACvC,2GAA2G;AAC3G,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;AAQxE,4GAA4G;AAC5G,MAAM,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;CAAG;AACpF,MAAM,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;CAAG;AAYvF,sFAAsF;AACtF,MAAM,oBAAoB,GAAG;IAC3B,+BAA+B,EAAE,GAAG;IACpC,iCAAiC,EAAE,GAAG;IACtC,8BAA8B,EAAE,GAAG;IACnC,6BAA6B,EAAE,GAAG;IAClC,6BAA6B,EAAE,GAAG;IAClC,gCAAgC,EAAE,GAAG;CACkB,CAAC;AAE1D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACxC,2GAA2G;IAC3G,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CACtE,UAAU,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAE,CACtC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EACrE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC,CAC3C,CACF,CACF,CAAC;IACF,0GAA0G;IAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QAChE,UAAU,EAAE,QAAQ,CAAC,IAAI,CACvB,UAAU,CAAC,YAAY,CACrB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,EACrC,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE,CACzB,CACF;KACF,CAAC,CAAC;IAGH,6FAA6F;IAC7F,MAAM,IAAI,GAAG,CACX,SAAoB,EACpB,MAAc,EACd,IAAyF,EACzF,MAAM,GAAuD,GAAG,EAAE,CAAC,SAAS,EAC3C,EAAE;QACnC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,oBAAoB,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,eAAe,MAAM,KAAK,MAAM,EAAE,CAAC;QAEnH,0GAA0G;QAC1G,MAAM,WAAW,GAAG,CAAC,KAAgB,EAAiB,EAAE;YACtD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,eAAe;oBAClB,OAAO,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;gBAC5F,KAAK,cAAc;oBACjB,OAAO,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBACjF,KAAK,iBAAiB;oBACpB,OAAO,IAAI,yBAAyB,CAAC;wBACnC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBAC3F,CAAC,CAAC;gBACL,KAAK,aAAa;oBAChB,OAAO,IAAI,yBAAyB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBACjF,SAAS,CAAC;oBACR,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;oBACnD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;wBAAE,OAAO,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;oBACzF,IAAI,MAAM,KAAK,GAAG;wBAAE,OAAO,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC1E,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,yBAAyB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,+GAA+G;QAC/G,MAAM,OAAO,GAAG,CAAC,aAAqB,EAAE,KAAa,EAAE,EAAE,CACvD,IAAI,CAAC,aAAa,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC,IAAI,CACzC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,aAAa,CAAC;YACnB,QAAQ,EAAE,eAAe;YACzB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,IAAI,yBAAyB,CAAC;gBAC5B,OAAO,EAAE,MAAM,CAAC,oBAAoB,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC;aAC7E,CAAC,CACH;SACJ,CAAC;QACF,4GAA4G;QAC5G,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAChE,CAAC;QAEJ,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAC1D,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;YAC7C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,4BAA4B,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,EACpG,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAC3C,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAU,MAAuC,EAAE,EAAE,CACjE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;QACrB,QAAQ,EAAE,cAAc;QACxB,gEAAgE;QAChE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;KACzE,CAAC,CAAC;IAEL,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAC7C,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAC3D,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CACtE,CACF,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAW,EAAE,EAAE,CAC1C,IAAI,CACF,iBAAiB,EACjB,OAAO,GAAG,EAAE,EACZ,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,EAC7F,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAChH,CACF,CAAC;IACF,uGAAuG;IACvG,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,QAA0B,EAAE,EAAE;QAC7D,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,aAAa,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CACT,gBAAgB,EAChB,MAAM,EACN,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAC7F,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAClB,MAAM,KAAK,GAAG;YACZ,CAAC,CAAC,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACrD,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC/C,CAAC,CAAC,SAAS,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wGAAwG;IACxG,MAAM,MAAM,GAAG,CACb,IAA8F,EAC9F,EAAE,CACF,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,EACzE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CACjC,CAAC;IAEJ,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;QAC/E,sFAAsF;QACtF,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/F,4HAA4H;QAC5H,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CACnB,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC1G,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAC3B;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAcH;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,OAAO,CAAC,OAAO,EAAoC,CACvF,mCAAmC,CACpC;IACC,mDAAmD;IACnD,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;CACvE"}

package/dist/Trigger.d.ts

@@ -0,0 +1,17 @@
+import { Context } from 'effect';
+declare const Trigger_base: Context.ServiceClass<Trigger, "@temper/workflow/Trigger", {
+    readonly kind: "http";
+    readonly response?: "ack" | "wait" | undefined;
+} | {
+    readonly kind: "schedule";
+    readonly cron?: string | undefined;
+    readonly timezone?: string | undefined;
+} | {
+    readonly kind: "manual";
+} | {
+    readonly kind: "internal";
+}>;
+export declare class Trigger extends Trigger_base {
+}
+export {};
+//# sourceMappingURL=Trigger.d.ts.map

package/dist/Trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Trigger.d.ts","sourceRoot":"","sources":["../src/Trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;;;;;;;;;;;;;AAGjC,qBAAa,OAAQ,SAAQ,YAAuE;CAAG"}

package/dist/Trigger.js

@@ -0,0 +1,4 @@
+import { Context } from 'effect';
+export class Trigger extends Context.Service()('@temper/workflow/Trigger') {
+}
+//# sourceMappingURL=Trigger.js.map

package/dist/Trigger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Trigger.js","sourceRoot":"","sources":["../src/Trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAGjC,MAAM,OAAO,OAAQ,SAAQ,OAAO,CAAC,OAAO,EAA4B,CAAC,0BAA0B,CAAC;CAAG"}

package/dist/Workflow.d.ts

@@ -0,0 +1,36 @@
+import { Clock, ConfigProvider, Layer } from 'effect';
+import { type HttpClient, HttpRouter } from 'effect/unstable/http';
+import { HttpApi, type HttpApiGroup } from 'effect/unstable/httpapi';
+import type { InvocationContext } from './Contract/Invocation.js';
+import type { WorkflowManifest } from './Contract/Manifest.js';
+import { type OutboundFetch } from './HttpClient.js';
+import { Invocation } from './Invocation.js';
+import { type AnyDeclaration } from './Resource.js';
+import { type ResourceReader } from './RuntimeResources.js';
+/** Platform services a test or local tool may replace; production uses every default. */
+export interface WorkflowPlatform {
+    /** Receives one JSON line per log. Defaults to stdout, which the platform reads. */
+    readonly writeLog?: ((line: string) => void) | undefined;
+    /** Answers `Config` reads. Defaults to the live process environment. */
+    readonly configProvider?: ConfigProvider.ConfigProvider | undefined;
+    /** Sends the requests of the workflow's `HttpClient`. Defaults to the global `fetch`. */
+    readonly outboundFetch?: OutboundFetch | undefined;
+    /** Times the invocation deadline and log spans. Defaults to the system clock. */
+    readonly clock?: Clock.Clock | undefined;
+    /** Answers declared resources and variables. Defaults to the Temper runtime API. */
+    readonly resources?: ResourceReader | undefined;
+}
+export interface WorkflowModule<Api extends HttpApi.Constraint = HttpApi.Constraint> {
+    readonly api: Api;
+    readonly manifest: WorkflowManifest;
+    readonly fetch: (request: Request, context: InvocationContext) => Promise<Response>;
+    readonly dispose: () => Promise<void>;
+    /** The same workflow over replaced platform services; the caller disposes it. */
+    readonly withPlatform: (platform: WorkflowPlatform) => WorkflowModule<Api>;
+}
+export interface WorkflowOptions<Id extends string, Groups extends HttpApiGroup.Constraint> extends WorkflowPlatform {
+    readonly api: HttpApi.HttpApi<Id, Groups>;
+    readonly handlers: Layer.Layer<HttpApiGroup.ToService<Id, Groups>, never, HttpRouter.Request.From<'Requires', Invocation> | HttpClient.HttpClient | AnyDeclaration>;
+}
+export declare const workflow: <Id extends string, Groups extends HttpApiGroup.Constraint>(options: WorkflowOptions<Id, Groups>) => WorkflowModule<HttpApi.HttpApi<Id, Groups>>;
+//# sourceMappingURL=Workflow.d.ts.map

package/dist/Workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Workflow.d.ts","sourceRoot":"","sources":["../src/Workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,cAAc,EAAuB,KAAK,EAAQ,MAAM,QAAQ,CAAC;AACjF,OAAO,EAAQ,KAAK,UAAU,EAAgB,UAAU,EAAkC,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,OAAO,EAAE,KAAK,cAAc,EAAmC,MAAM,eAAe,CAAC;AACrF,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkB9E,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACzD,wEAAwE;IACxE,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,cAAc,GAAG,SAAS,CAAC;IACpE,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnD,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACjD;AAED,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;IACjF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,cAAc,CAAC,GAAG,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,MAAM,SAAS,YAAY,CAAC,UAAU,CAAE,SAAQ,gBAAgB;IAClH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAC5B,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAClC,KAAK,EACL,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,UAAU,GAAG,cAAc,CACzF,CAAC;CACH;AAsDD,eAAO,MAAM,QAAQ,GAAI,EAAE,SAAS,MAAM,EAAE,MAAM,SAAS,YAAY,CAAC,UAAU,WACvE,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,KACnC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAmC5C,CAAC"}

package/dist/Workflow.js

@@ -0,0 +1,80 @@
+import { Clock, ConfigProvider, Context, FileSystem, Layer, Path } from 'effect';
+import { Etag, HttpPlatform, HttpRouter, HttpServer, HttpServerResponse } from 'effect/unstable/http';
+import { HttpApi, HttpApiBuilder } from 'effect/unstable/httpapi';
+import { httpClientLayer } from './HttpClient.js';
+import { Invocation } from './Invocation.js';
+import { loggerLayer, writeStdoutLine } from './Logger.js';
+import { HEALTHCHECK_PATH, makeManifest } from './Manifest.js';
+import { EventRequestMiddleware, UnmatchedRequestMiddleware } from './Middleware.js';
+import { makeSecretMasks, SecretMasks } from './Redaction.js';
+import { declarationLayer, declarationOf } from './Resource.js';
+import { RuntimeResources } from './RuntimeResources.js';
+/**
+ * Kubernetes probes every workflow pod on `GET /healthcheck` (startup, liveness, readiness). The
+ * runtime owns that route so a migrated workflow cannot crash-loop by omitting it. It is composed
+ * onto the router ahead of the user API, so it is served regardless of the user's `Api` and never
+ * appears in the manifest, which rejects an API declaring it. Like legacy, it runs outside any
+ * request trace and logs nothing.
+ */
+const PlatformRoutes = HttpRouter.add('GET', HEALTHCHECK_PATH, HttpServerResponse.jsonUnsafe({ status: 'ok' }));
+const InMemoryHttpPlatform = Layer.mergeAll(HttpPlatform.layer.pipe(Layer.provide(FileSystem.layerNoop({}))), FileSystem.layerNoop({}), Path.layer, Etag.layerWeak);
+/**
+ * Standard Effect services the workflow depends on: `Effect.log*` as legacy JSON lines, `Config`
+ * over the environment, and the platform `HttpClient`. One secret registry lives per module.
+ */
+const platformLayer = (platform) => Layer.mergeAll(loggerLayer(platform.writeLog ?? writeStdoutLine), httpClientLayer(platform.outboundFetch ?? ((url, init) => globalThis.fetch(url, init)))).pipe(Layer.provideMerge(Layer.mergeAll(
+// Legacy `process.env.X ?? fallback` treated an empty variable as set.
+ConfigProvider.layer(platform.configProvider ?? ConfigProvider.fromEnvRecord(process.env, { preserveEmptyStrings: true })), Layer.succeed(SecretMasks, makeSecretMasks()), platform.clock === undefined ? Layer.empty : Layer.succeed(Clock.Clock, platform.clock))));
+/** Platform run metadata travels in `context`; the header copies are removed so handlers cannot drift onto them. */
+const stripPlatformHeaders = (request) => {
+    const names = [];
+    request.headers.forEach((_value, name) => {
+        if (name.startsWith('x-temper-'))
+            names.push(name);
+    });
+    for (const name of names)
+        request.headers.delete(name);
+};
+/** One middleware layer per resource, variable, and resource type the API's endpoints declare. */
+const declarationsOf = (api, platform) => {
+    const layers = new Map();
+    HttpApi.reflect(api, {
+        onGroup() { },
+        onEndpoint({ middleware }) {
+            for (const key of middleware) {
+                const runtime = declarationOf(key);
+                if (runtime !== undefined && !layers.has(key.key))
+                    layers.set(key.key, declarationLayer(key, runtime));
+            }
+        },
+    });
+    return Layer.mergeAll(Layer.empty, ...layers.values()).pipe(Layer.provide(platform.resources === undefined ? RuntimeResources.layer : Layer.succeed(RuntimeResources, platform.resources)));
+};
+export const workflow = (options) => {
+    const manifest = makeManifest(options.api);
+    const handlers = options.handlers.pipe(Layer.provide(declarationsOf(options.api, options)));
+    const appLayer = Layer.mergeAll(PlatformRoutes, HttpApiBuilder.layer(options.api).pipe(Layer.provide(handlers), Layer.provide(EventRequestMiddleware)), UnmatchedRequestMiddleware).pipe(Layer.provide(HttpServer.layerServices), Layer.provide(InMemoryHttpPlatform), Layer.provideMerge(platformLayer(options)));
+    // Legacy Hono routing: exact case, no trailing- or duplicate-slash folding, unbounded parameters.
+    const web = HttpRouter.toWebHandler(appLayer, {
+        disableLogger: true,
+        routerConfig: {
+            caseSensitive: true,
+            ignoreTrailingSlash: false,
+            ignoreDuplicateSlashes: false,
+            maxParamLength: Number.POSITIVE_INFINITY,
+        },
+    });
+    // SAFETY: WorkflowOptions accepts a complete handler layer whose only request service is Invocation.
+    const handler = web.handler;
+    return Object.freeze({
+        api: options.api,
+        manifest,
+        fetch: (request, invocation) => {
+            stripPlatformHeaders(request);
+            return handler(request, Context.make(Invocation, invocation));
+        },
+        dispose: web.dispose,
+        withPlatform: (platform) => workflow({ ...options, ...platform }),
+    });
+};
+//# sourceMappingURL=Workflow.js.map

package/dist/Workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Workflow.js","sourceRoot":"","sources":["../src/Workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACjF,OAAO,EAAE,IAAI,EAAmB,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACvH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAC;AAGrF,OAAO,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAuB,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEhH,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CACzC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAChE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EACxB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,SAAS,CACf,CAAC;AAkCF;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,QAA0B,EAAE,EAAE,CACnD,KAAK,CAAC,QAAQ,CACZ,WAAW,CAAC,QAAQ,CAAC,QAAQ,IAAI,eAAe,CAAC,EACjD,eAAe,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CACxF,CAAC,IAAI,CACJ,KAAK,CAAC,YAAY,CAChB,KAAK,CAAC,QAAQ;AACZ,uEAAuE;AACvE,cAAc,CAAC,KAAK,CAClB,QAAQ,CAAC,cAAc,IAAI,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CACrG,EACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,EAC7C,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CACxF,CACF,CACF,CAAC;AAEJ,oHAAoH;AACpH,MAAM,oBAAoB,GAAG,CAAC,OAAgB,EAAQ,EAAE;IACtD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,cAAc,GAAG,CACrB,GAAgC,EAChC,QAA0B,EAC1B,EAAE;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgE,CAAC;IACvF,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QACnB,OAAO,KAAI,CAAC;QACZ,UAAU,CAAC,EAAE,UAAU,EAAE;YACvB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACzD,KAAK,CAAC,OAAO,CACX,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAChH,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,OAAoC,EACS,EAAE;IAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,cAAc,EACd,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,EACtG,0BAA0B,CAC3B,CAAC,IAAI,CACJ,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EACvC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,EACnC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAC3C,CAAC;IACF,kGAAkG;IAClG,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC5C,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE;YACZ,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;YAC7B,cAAc,EAAE,MAAM,CAAC,iBAAiB;SACzC;KACF,CAAC,CAAC;IACH,qGAAqG;IACrG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAwF,CAAC;IAE7G,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ;QACR,KAAK,EAAE,CAAC,OAAgB,EAAE,UAA6B,EAAE,EAAE;YACzD,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,CAAC,QAA0B,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;KACpF,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export declare const runCli: (arguments_: ReadonlyArray<string>) => Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAgeA,eAAO,MAAM,MAAM,eAAsB,aAAa,CAAC,MAAM,CAAC,KAAG,OAAO,CAAC,IAAI,CAK5E,CAAC"}