@ontemper/sdk 0.7.1-postgresql.1 → 0.7.1-postgresql.3

package/dist/Kafka.js

@@ -0,0 +1,297 @@
+import { constants, createPrivateKey, createSign, randomUUID } from 'node:crypto';
+import { Option, Redacted, Schema } from 'effect';
+export class OptionalKafkaDependencyError extends Error {
+    constructor(packageName) {
+        super(`Kafka authentication requires the optional package ${packageName}.`);
+        this.name = 'OptionalKafkaDependencyError';
+    }
+}
+export class UnsupportedKafkaAuthError extends Error {
+    constructor(field) {
+        super(`Kafka record uses an unsupported ${field}. Upgrade @ontemper/sdk to support it.`);
+        this.name = 'UnsupportedKafkaAuthError';
+    }
+}
+// STS credentials are reused until this long before they expire.
+const ASSUMED_ROLE_REFRESH_MARGIN_MS = 60_000;
+const OAUTH_TOKEN_REQUEST_TIMEOUT_MS = 15_000;
+const base64Url = (value) => Buffer.from(value).toString('base64url');
+const formEncode = (value) => encodeURIComponent(value).replace(/%20/g, '+');
+function privateKeyAssertion(tokenRequest, now) {
+    const clientAuthentication = tokenRequest.clientAuthentication;
+    if (clientAuthentication.type !== 'private_key_jwt') {
+        throw new UnsupportedKafkaAuthError('auth.tokenRequest.clientAuthentication');
+    }
+    const header = {
+        alg: clientAuthentication.algorithm,
+        typ: 'JWT',
+    };
+    if (clientAuthentication.keyId !== undefined) {
+        header.kid = clientAuthentication.keyId;
+    }
+    const issuedAt = Math.floor(now / 1000);
+    const claims = {
+        iss: tokenRequest.clientId,
+        sub: tokenRequest.clientId,
+        aud: tokenRequest.tokenUrl,
+        exp: issuedAt + 60,
+        iat: issuedAt,
+        jti: randomUUID(),
+    };
+    const signed = `${base64Url(JSON.stringify(header))}.${base64Url(JSON.stringify(claims))}`;
+    const signature = createSign('SHA256');
+    signature.update(signed);
+    signature.end();
+    const value = clientAuthentication.algorithm === 'ES256'
+        ? signature.sign({ key: Redacted.value(clientAuthentication.privateKey), dsaEncoding: 'ieee-p1363' })
+        : clientAuthentication.algorithm === 'PS256'
+            ? signature.sign({
+                key: Redacted.value(clientAuthentication.privateKey),
+                padding: constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+            })
+            : signature.sign(Redacted.value(clientAuthentication.privateKey));
+    return `${signed}.${base64Url(value)}`;
+}
+function oauthBearerProvider(tokenRequest, options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    let cached;
+    // Concurrent broker authentications share one in-flight token request.
+    let pendingFetch = null;
+    const fetchToken = async () => {
+        const clientAuthentication = tokenRequest.clientAuthentication;
+        if (!['none', 'basic', 'body', 'query', 'private_key_jwt'].includes(clientAuthentication.type)) {
+            throw new UnsupportedKafkaAuthError('auth.tokenRequest.clientAuthentication');
+        }
+        const parameters = new URLSearchParams({ ...tokenRequest.extraParams, grant_type: 'client_credentials' });
+        if (tokenRequest.scope !== undefined)
+            parameters.set('scope', tokenRequest.scope);
+        if (tokenRequest.audience !== undefined)
+            parameters.set('audience', tokenRequest.audience);
+        const headers = {};
+        const tokenUrl = new URL(tokenRequest.tokenUrl);
+        switch (clientAuthentication.type) {
+            case 'none':
+                parameters.set('client_id', tokenRequest.clientId);
+                break;
+            case 'basic':
+                headers.Authorization = `Basic ${Buffer.from(`${formEncode(tokenRequest.clientId)}:${formEncode(Redacted.value(clientAuthentication.clientSecret))}`).toString('base64')}`;
+                break;
+            case 'body':
+                parameters.set('client_id', tokenRequest.clientId);
+                parameters.set('client_secret', Redacted.value(clientAuthentication.clientSecret));
+                break;
+            case 'query':
+                tokenUrl.searchParams.set('client_id', tokenRequest.clientId);
+                tokenUrl.searchParams.set('client_secret', Redacted.value(clientAuthentication.clientSecret));
+                break;
+            case 'private_key_jwt':
+                parameters.set('client_id', tokenRequest.clientId);
+                parameters.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+                parameters.set('client_assertion', privateKeyAssertion(tokenRequest, now()));
+                break;
+        }
+        const isJson = tokenRequest.tokenRequestFormat === 'json';
+        headers['Content-Type'] = isJson ? 'application/json' : 'application/x-www-form-urlencoded';
+        const response = await fetchImpl(tokenUrl, {
+            method: 'POST',
+            headers,
+            body: isJson ? JSON.stringify(Object.fromEntries(parameters)) : parameters,
+            redirect: 'error',
+            signal: AbortSignal.timeout(OAUTH_TOKEN_REQUEST_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new Error(`OAuth token request failed with status ${response.status}.`);
+        const body = await response.json();
+        const parsed = decodeTokenResponse(body);
+        if (Option.isNone(parsed))
+            throw new Error('OAuth token response did not include an access token.');
+        const accessToken = parsed.value.access_token;
+        const expiresIn = Option.getOrUndefined(decodeExpiresIn(parsed.value.expires_in));
+        // Without a stated lifetime the token's expiry is unknown, so each authentication requests a fresh one.
+        cached =
+            expiresIn === undefined
+                ? undefined
+                : { value: accessToken, expiresAt: now() + Math.max(0, expiresIn - 30) * 1000 };
+        return { value: accessToken };
+    };
+    return () => {
+        if (cached !== undefined && cached.expiresAt > now())
+            return Promise.resolve({ value: cached.value });
+        if (pendingFetch !== null)
+            return pendingFetch;
+        const request = (async () => {
+            try {
+                return await fetchToken();
+            }
+            finally {
+                pendingFetch = null;
+            }
+        })();
+        pendingFetch = request;
+        return request;
+    };
+}
+const decodeTokenResponse = Schema.decodeUnknownOption(Schema.Struct({
+    access_token: Schema.String.check(Schema.isMinLength(1)),
+    expires_in: Schema.optionalKey(Schema.Unknown),
+}));
+// A missing, non-numeric, or non-positive expires_in reads as absent, so the token is not cached.
+const decodeExpiresIn = Schema.decodeUnknownOption(Schema.Finite.check(Schema.isGreaterThan(0)));
+function mskOAuthBearerProvider(resource, options) {
+    const auth = resource.auth;
+    if (auth.type !== 'aws_msk_iam')
+        throw new UnsupportedKafkaAuthError('auth.type');
+    const loadMskSigner = options.loadMskSigner ??
+        (async () => {
+            // The optional peer is absent in workflows that do not use MSK IAM, so loading it must remain lazy.
+            try {
+                return await import('aws-msk-iam-sasl-signer-js');
+            }
+            catch (error) {
+                if (error instanceof Error && 'code' in error && error.code === 'ERR_MODULE_NOT_FOUND') {
+                    throw new OptionalKafkaDependencyError('aws-msk-iam-sasl-signer-js');
+                }
+                throw error;
+            }
+        });
+    const loadCredentialProviders = options.loadCredentialProviders ??
+        (async () => {
+            // The optional peer is loaded only when a record asks the client to assume an AWS role.
+            try {
+                return await import('@aws-sdk/credential-providers');
+            }
+            catch (error) {
+                if (error instanceof Error && 'code' in error && error.code === 'ERR_MODULE_NOT_FOUND') {
+                    throw new OptionalKafkaDependencyError('@aws-sdk/credential-providers');
+                }
+                throw error;
+            }
+        });
+    const now = options.now ?? Date.now;
+    // One STS provider per config, and its credentials reused until shortly before expiry, so each broker
+    // authentication does not send its own AssumeRole call.
+    let assumeRoleProvider;
+    let assumedCredentials;
+    const loadAssumeRoleProvider = async (params) => {
+        try {
+            return (await loadCredentialProviders()).fromTemporaryCredentials({
+                params,
+                clientConfig: { region: auth.region },
+            });
+        }
+        catch (error) {
+            // A failed load is retried on the next authentication instead of caching the rejection.
+            assumeRoleProvider = undefined;
+            throw error;
+        }
+    };
+    const assumedRoleCredentials = async (params) => {
+        if (assumedCredentials !== undefined && assumedCredentials.refreshAt > now())
+            return assumedCredentials.credentials;
+        assumeRoleProvider ??= loadAssumeRoleProvider(params);
+        const { expiration, ...credentials } = await (await assumeRoleProvider)();
+        assumedCredentials =
+            expiration === undefined
+                ? undefined
+                : { credentials, refreshAt: expiration.getTime() - ASSUMED_ROLE_REFRESH_MARGIN_MS };
+        return credentials;
+    };
+    return async () => {
+        const signer = await loadMskSigner();
+        const awsAuth = auth.awsAuth;
+        if (!['access_key', 'assume_role', 'ambient'].includes(awsAuth.type)) {
+            throw new UnsupportedKafkaAuthError('auth.awsAuth');
+        }
+        const token = awsAuth.type === 'access_key'
+            ? await signer.generateAuthTokenFromCredentialsProvider({
+                region: auth.region,
+                awsCredentialsProvider: async () => {
+                    const creds = {
+                        accessKeyId: awsAuth.accessKeyId,
+                        secretAccessKey: Redacted.value(awsAuth.secretAccessKey),
+                    };
+                    if (awsAuth.sessionToken !== undefined)
+                        creds.sessionToken = Redacted.value(awsAuth.sessionToken);
+                    return creds;
+                },
+            })
+            : awsAuth.type === 'assume_role'
+                ? await signer.generateAuthTokenFromCredentialsProvider({
+                    region: auth.region,
+                    awsCredentialsProvider: () => {
+                        const params = { RoleArn: awsAuth.roleArn, RoleSessionName: 'temper-kafka' };
+                        if (awsAuth.externalId !== undefined)
+                            params.ExternalId = awsAuth.externalId;
+                        return assumedRoleCredentials(params);
+                    },
+                })
+                : await signer.generateAuthToken({ region: auth.region });
+        return { value: token.token };
+    };
+}
+// A bad endpoint or key would otherwise surface only at the first broker authentication, deep inside KafkaJS.
+function assertTokenRequestUsable(tokenRequest) {
+    const tokenUrl = URL.canParse(tokenRequest.tokenUrl) ? new URL(tokenRequest.tokenUrl) : undefined;
+    if (tokenUrl?.protocol !== 'https:') {
+        throw new Error('Kafka OAuth auth.tokenRequest.tokenUrl must be an https URL.');
+    }
+    const clientAuthentication = tokenRequest.clientAuthentication;
+    if (clientAuthentication.type !== 'private_key_jwt')
+        return;
+    try {
+        createPrivateKey(Redacted.value(clientAuthentication.privateKey));
+    }
+    catch {
+        throw new Error('Kafka OAuth auth.tokenRequest.clientAuthentication.privateKey is not a valid PEM private key.');
+    }
+}
+/** Maps a resolved Kafka record to the options accepted by `new Kafka(...)`. */
+export function kafkaConfig(resource, options = {}) {
+    if (resource.brokers.some((broker) => broker.startsWith('['))) {
+        throw new Error('KafkaJS does not support bracketed IPv6 bootstrap broker addresses; configure a hostname or IPv4 address.');
+    }
+    let ssl;
+    if (resource.tls !== undefined) {
+        const tlsOptions = {};
+        if (resource.tls.caCertificate !== undefined)
+            tlsOptions.ca = resource.tls.caCertificate;
+        if (resource.tls.clientCertificate !== undefined)
+            tlsOptions.cert = resource.tls.clientCertificate;
+        if (resource.tls.clientKey !== undefined)
+            tlsOptions.key = Redacted.value(resource.tls.clientKey);
+        if (resource.tls.clientKeyPassphrase !== undefined) {
+            tlsOptions.passphrase = Redacted.value(resource.tls.clientKeyPassphrase);
+        }
+        if (resource.tls.serverName !== undefined)
+            tlsOptions.servername = resource.tls.serverName;
+        ssl = Object.keys(tlsOptions).length === 0 ? true : tlsOptions;
+    }
+    const auth = resource.auth;
+    if (!['none', 'sasl_plain', 'sasl_scram', 'oauthbearer', 'aws_msk_iam'].includes(auth.type)) {
+        throw new UnsupportedKafkaAuthError('auth.type');
+    }
+    if (auth.type === 'oauthbearer')
+        assertTokenRequestUsable(auth.tokenRequest);
+    const sasl = auth.type === 'none'
+        ? undefined
+        : auth.type === 'sasl_plain'
+            ? { mechanism: 'plain', username: auth.username, password: Redacted.value(auth.password) }
+            : auth.type === 'sasl_scram'
+                ? auth.mechanism === 'SCRAM-SHA-256'
+                    ? { mechanism: 'scram-sha-256', username: auth.username, password: Redacted.value(auth.password) }
+                    : { mechanism: 'scram-sha-512', username: auth.username, password: Redacted.value(auth.password) }
+                : auth.type === 'oauthbearer'
+                    ? { mechanism: 'oauthbearer', oauthBearerProvider: oauthBearerProvider(auth.tokenRequest, options) }
+                    : { mechanism: 'oauthbearer', oauthBearerProvider: mskOAuthBearerProvider(resource, options) };
+    const config = { brokers: [...resource.brokers] };
+    if (resource.clientId !== undefined)
+        config.clientId = resource.clientId;
+    if (ssl !== undefined)
+        config.ssl = ssl;
+    if (sasl !== undefined)
+        config.sasl = sasl;
+    return config;
+}
+//# sourceMappingURL=Kafka.js.map

package/dist/Kafka.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Kafka.js","sourceRoot":"","sources":["../src/Kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGlD,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,WAAmB;QAC7B,KAAK,CAAC,sDAAsD,WAAW,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,KAAa;QACvB,KAAK,CAAC,oCAAoC,KAAK,wCAAwC,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AA2DD,iEAAiE;AACjE,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAiB9C,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAErF,SAAS,mBAAmB,CAAC,YAA0B,EAAE,GAAW;IAClE,MAAM,oBAAoB,GAAG,YAAY,CAAC,oBAAoB,CAAC;IAC/D,IAAI,oBAAoB,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAc;QACxB,GAAG,EAAE,oBAAoB,CAAC,SAAS;QACnC,GAAG,EAAE,KAAK;KACX,CAAC;IACF,IAAI,oBAAoB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,YAAY,CAAC,QAAQ;QAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ;QAC1B,GAAG,EAAE,YAAY,CAAC,QAAQ;QAC1B,GAAG,EAAE,QAAQ,GAAG,EAAE;QAClB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,UAAU,EAAE;KAClB,CAAC;IACF,MAAM,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,SAAS,CAAC,GAAG,EAAE,CAAC;IAChB,MAAM,KAAK,GACT,oBAAoB,CAAC,SAAS,KAAK,OAAO;QACxC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACrG,CAAC,CAAC,oBAAoB,CAAC,SAAS,KAAK,OAAO;YAC1C,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC;gBACb,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC;gBACpD,OAAO,EAAE,SAAS,CAAC,qBAAqB;gBACxC,UAAU,EAAE,SAAS,CAAC,sBAAsB;aAC7C,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA0B,EAAE,OAA2B;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,MAAwD,CAAC;IAC7D,uEAAuE;IACvE,IAAI,YAAY,GAAsC,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,IAAgC,EAAE;QACxD,MAAM,oBAAoB,GAAG,YAAY,CAAC,oBAAoB,CAAC;QAC/D,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC1G,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3F,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,QAAQ,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAClC,KAAK,MAAM;gBACT,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAC1C,GAAG,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,EAAE,CACxG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM;YACR,KAAK,MAAM;gBACT,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnF,MAAM;YACR,KAAK,OAAO;gBACV,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC9D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC9F,MAAM;YACR,KAAK,iBAAiB;gBACpB,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnD,UAAU,CAAC,GAAG,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;gBAClG,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7E,MAAM;QACV,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,KAAK,MAAM,CAAC;QAC1D,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YAC1E,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8BAA8B,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,wGAAwG;QACxG,MAAM;YACJ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC;IACF,OAAO,GAAG,EAAE;QACV,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACtG,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,OAAO,MAAM,UAAU,EAAE,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,YAAY,GAAG,OAAO,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CACpD,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxD,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;CAC/C,CAAC,CACH,CAAC;AACF,kGAAkG;AAClG,MAAM,eAAe,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjG,SAAS,sBAAsB,CAAC,QAAuB,EAAE,OAA2B;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,MAAM,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,KAAK,IAAI,EAAE;YACV,oGAAoG;YACpG,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACvF,MAAM,IAAI,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,MAAM,uBAAuB,GAC3B,OAAO,CAAC,uBAAuB;QAC/B,CAAC,KAAK,IAAI,EAAE;YACV,wFAAwF;YACxF,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACvF,MAAM,IAAI,4BAA4B,CAAC,+BAA+B,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,sGAAsG;IACtG,wDAAwD;IACxD,IAAI,kBAA+D,CAAC;IACpE,IAAI,kBAAkF,CAAC;IACvF,MAAM,sBAAsB,GAAG,KAAK,EAAE,MAAqB,EAAmC,EAAE;QAC9F,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAAC,wBAAwB,CAAC;gBAChE,MAAM;gBACN,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,kBAAkB,GAAG,SAAS,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,sBAAsB,GAAG,KAAK,EAAE,MAAqB,EAA2B,EAAE;QACtF,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,CAAC,SAAS,GAAG,GAAG,EAAE;YAAE,OAAO,kBAAkB,CAAC,WAAW,CAAC;QACpH,kBAAkB,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC;QAC1E,kBAAkB;YAChB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,8BAA8B,EAAE,CAAC;QACxF,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,KAAK,GACT,OAAO,CAAC,IAAI,KAAK,YAAY;YAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,wCAAwC,CAAC;gBACpD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,sBAAsB,EAAE,KAAK,IAAI,EAAE;oBACjC,MAAM,KAAK,GAAmB;wBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;qBACzD,CAAC;oBACF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;wBAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBAClG,OAAO,KAAK,CAAC;gBACf,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;gBAC9B,CAAC,CAAC,MAAM,MAAM,CAAC,wCAAwC,CAAC;oBACpD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,sBAAsB,EAAE,GAAG,EAAE;wBAC3B,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;wBAC5F,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;4BAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;wBAC7E,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBACxC,CAAC;iBACF,CAAC;gBACJ,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,wBAAwB,CAAC,YAA0B;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,QAAQ,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,oBAAoB,GAAG,YAAY,CAAC,oBAAoB,CAAC;IAC/D,IAAI,oBAAoB,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO;IAC5D,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,QAAuB,EAAE,OAAO,GAAuB,EAAE;IACnF,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAA6B,CAAC;IAClC,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;YAAE,UAAU,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;QACzF,IAAI,QAAQ,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACnG,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClG,IAAI,QAAQ,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACnD,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS;YAAE,UAAU,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3F,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,IAAI,GACR,IAAI,CAAC,IAAI,KAAK,MAAM;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC1F,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY;gBAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,eAAe;oBAClC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAClG,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACpG,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa;oBAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE;oBACpG,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;IACzG,MAAM,MAAM,GAAsB,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACzE,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/Manifest.d.ts

@@ -1,6 +1,6 @@
 import { HttpApi, type HttpApiGroup } from 'effect/http-api';
 import { type WorkflowManifest } from './Contract/Manifest.js';
-export declare const SDK_VERSION = "0.7.1-postgresql.1";
+export declare const SDK_VERSION = "0.7.1-postgresql.3";
 export declare const RUNTIME_API_VERSION = 1;
 /** The route the SDK serves for platform probes; an API declaring `GET` on it collides with it on every request. */
 export declare const HEALTHCHECK_PATH = "/healthcheck";

package/dist/Manifest.js

@@ -5,7 +5,7 @@ import { declarationOf } from './Resource.js';
 import { Trigger } from './Trigger.js';
 const decodeTrigger = Schema.decodeUnknownSync(TriggerMetadata, { onExcessProperty: 'error' });
 const identityOf = (resource) => `${resource.kind}:${resource.kind === 'resourceType' ? resource.type : resource.key}`;
-export const SDK_VERSION = '0.7.1-postgresql.1';
+export const SDK_VERSION = '0.7.1-postgresql.3';
 export const RUNTIME_API_VERSION = 1;
 /** The route the SDK serves for platform probes; an API declaring `GET` on it collides with it on every request. */
 export const HEALTHCHECK_PATH = '/healthcheck';

package/dist/PostgreSql.d.ts

@@ -1,6 +1,6 @@
 /**
- * PostgreSQL Resource pools: `import { createPostgresqlPool } from '@temper/workflow/postgresql'`. Needs the `pg`
- * and `ws` packages, which only this subpath loads.
+ * PostgreSQL Resource pools, exported from `@temper/workflow/resources`. A pool needs the `pg` package, and a
+ * builder's tunnel to a Temper-managed database needs `ws`; both load only when a pool is built.
  */
 import { Effect, type Scope } from 'effect';
 import type pg from 'pg';

package/dist/PostgreSql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSql.d.ts","sourceRoot":"","sources":["../src/PostgreSql.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA2C,MAAM,EAAuB,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE1G,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAGzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAiDnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAC7C,CAAC;AAS5D;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAIxE"}
+{"version":3,"file":"PostgreSql.d.ts","sourceRoot":"","sources":["../src/PostgreSql.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA2C,MAAM,EAAuB,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE1G,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAIzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,0GAA0G;AAC1G,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAqCnE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAC7C,CAAC;AAS5D;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAIxE"}

package/dist/PostgreSql.js

@@ -1,9 +1,10 @@
 /**
- * PostgreSQL Resource pools: `import { createPostgresqlPool } from '@temper/workflow/postgresql'`. Needs the `pg`
- * and `ws` packages, which only this subpath loads.
+ * PostgreSQL Resource pools, exported from `@temper/workflow/resources`. A pool needs the `pg` package, and a
+ * builder's tunnel to a Temper-managed database needs `ws`; both load only when a pool is built.
  */
 import { Cause, Config, ConfigProvider, Duration, Effect, Exit, Layer, Option } from 'effect';
 import { FetchHttpClient, HttpClient } from 'effect/http';
+import { databaseTunnelUrl } from './DatabaseTunnelAuthorization.js';
 import { loggerLayer, writeStdoutLine } from './Logger.js';
 import { endPool, makeResourcePool, tunnelEnabled } from './PostgreSqlPool.js';
 import { makeRuntimeResourceClient } from './RuntimeResources.js';
@@ -11,16 +12,6 @@ export { PostgresqlResource } from './PostgreSqlPool.js';
 // A token in its refresh window waits for the provider's next publish. pg's connect timeout is 10 s, so the wait
 // ends with the connection attempt instead of holding the process open.
 const TUNNEL_AUTHORIZATION_TIMEOUT = Duration.seconds(10);
-// The tunnel path keeps literal dots out of the router's file-extension handling, as @ontemper/resources did.
-const tunnelAuthorization = (key) => Effect.gen(function* () {
-    const apiUrl = yield* Config.NonEmptyString('UNNBOUND_API_URL');
-    const endpoint = new URL(`/api/runtime/databases/${encodeURIComponent(key.replaceAll('.', '%2E'))}/tunnel`, apiUrl);
-    if (endpoint.protocol !== 'https:' && endpoint.protocol !== 'http:') {
-        return yield* Effect.fail(new Error('Temper API URL must use HTTP or HTTPS.'));
-    }
-    endpoint.protocol = endpoint.protocol === 'https:' ? 'wss:' : 'ws:';
-    return endpoint.href;
-});
 const open = (rawKey) => Effect.gen(function* () {
     const key = rawKey.trim();
     // A workflow's own HttpClient when there is one; resolver calls disable its tracing either way.
@@ -34,7 +25,7 @@ const open = (rawKey) => Effect.gen(function* () {
         resolve: client.resolve,
         inspect: client.inspect,
         authorizeTunnel: tunnel
-            ? (tunnelKey) => Effect.runPromiseWith(context)(Effect.all({ url: tunnelAuthorization(tunnelKey), token: client.tunnelToken }).pipe(Effect.timeoutOrElse({
+            ? (tunnelKey) => Effect.runPromiseWith(context)(Effect.all({ url: databaseTunnelUrl(tunnelKey), token: client.tunnelToken }).pipe(Effect.timeoutOrElse({
                 duration: TUNNEL_AUTHORIZATION_TIMEOUT,
                 orElse: () => Effect.fail(new Error('No runtime token for the database tunnel within 10 s.')),
             })))

package/dist/PostgreSql.js.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSql.js","sourceRoot":"","sources":["../src/PostgreSql.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,yBAAyB,EAAkB,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAKzD,iHAAiH;AACjH,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE1D,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,EAAE,CAC1C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACpH,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,MAAM,IAAI,GAAG,CAAC,MAAc,EAA+C,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,gGAAgG;IAChG,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAClD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAC1C,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM;YACrB,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CACZ,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAC5B,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,aAAa,CAAC;gBACnB,QAAQ,EAAE,4BAA4B;gBACtC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;aAC9F,CAAC,CACH,CACF;YACL,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAA4D,EAAE,CAC1G,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE5D,4GAA4G;AAC5G,gFAAgF;AAChF,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAClD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACpH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC5C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"PostgreSql.js","sourceRoot":"","sources":["../src/PostgreSql.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,yBAAyB,EAAkB,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAKzD,iHAAiH;AACjH,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAE1D,MAAM,IAAI,GAAG,CAAC,MAAc,EAA+C,EAAE,CAC3E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,gGAAgG;IAChG,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAClD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAC1C,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAC1B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM;YACrB,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CACZ,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAC5B,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,aAAa,CAAC;gBACnB,QAAQ,EAAE,4BAA4B;gBACtC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;aAC9F,CAAC,CACH,CACF;YACL,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAA4D,EAAE,CAC1G,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE5D,4GAA4G;AAC5G,gFAAgF;AAChF,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAClD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACpH,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC5C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/PostgreSqlPool.d.ts

@@ -1,46 +1,8 @@
 import { type Duration, Effect, Option, Schema } from 'effect';
-import pg from 'pg';
+import type pg from 'pg';
 import { InvalidResourceError } from './ResourcesErrors.js';
 import type { InspectedResource, ReadError } from './RuntimeResources.js';
-/** A `postgresql` record as `@ontemper/resources` reads it; `sslmode` carries libpq semantics, and `tls` the CA and client certificate. */
-export declare const PostgresqlResource: Schema.Struct<{
-    readonly host: Schema.String;
-    readonly port: Schema.withDecodingDefaultKey<Schema.Int, never>;
-    readonly dbname: Schema.String;
-    readonly user: Schema.String;
-    readonly auth: Schema.Union<readonly [Schema.Struct<{
-        readonly type: Schema.Literal<"password">;
-        readonly password: Schema.RedactedFromValue<Schema.String>;
-    }>, Schema.Struct<{
-        readonly type: Schema.Literal<"rds_iam">;
-        readonly region: Schema.String;
-        readonly awsAuth: Schema.Union<readonly [Schema.Struct<{
-            readonly type: Schema.Literal<"access_key">;
-            readonly accessKeyId: Schema.String;
-            readonly secretAccessKey: Schema.RedactedFromValue<Schema.String>;
-            readonly sessionToken: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
-        }>, Schema.Struct<{
-            readonly type: Schema.Literal<"assume_role">;
-            readonly roleArn: Schema.String;
-            readonly externalId: Schema.optionalKey<Schema.String>;
-        }>, Schema.Struct<{
-            readonly type: Schema.Literal<"ambient">;
-        }>]>;
-    }>, Schema.Struct<{
-        readonly type: Schema.Literal<"none">;
-    }>]>;
-    readonly sslmode: Schema.withDecodingDefaultKey<Schema.Literals<readonly ["disable", "require", "verify-ca", "verify-full"]>, never>;
-    readonly tls: Schema.optionalKey<Schema.Struct<{
-        readonly caCertificate: Schema.optionalKey<Schema.String>;
-        readonly clientCertificate: Schema.optionalKey<Schema.String>;
-        readonly clientKey: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
-        readonly clientKeyPassphrase: Schema.optionalKey<Schema.RedactedFromValue<Schema.String>>;
-        readonly serverName: Schema.optionalKey<Schema.String>;
-    }>>;
-    readonly sshTunnel: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly options: Schema.optionalKey<Schema.String>;
-}>;
-export type PostgresqlResource = typeof PostgresqlResource.Type;
+export { PostgresqlResource } from './ResourceRecords.js';
 /** Where a pool reads its Resource: the runtime API in a workflow, fixed answers in tests. */
 export interface ResourceSource {
     readonly resolve: (key: string) => Effect.Effect<Schema.Json, ReadError | InvalidResourceError>;

package/dist/PostgreSqlPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSqlPool.d.ts","sourceRoot":"","sources":["../src/PostgreSqlPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAuB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpF,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAK1E,2IAA2I;AAC3I,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqB7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAAC,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACrH;AAsED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QACtB,MAAM,UACH,cAAc,KACrB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAqCtD,CAAC;AAEL,eAAO,MAAM,aAAa,UAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAwC,CAAC;AAEnG,+GAA+G;AAC/G,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,KAAoB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,YAClC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAUlB,CAAC"}
+{"version":3,"file":"PostgreSqlPool.d.ts","sourceRoot":"","sources":["../src/PostgreSqlPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAuB,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAIzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAAC,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAC;CACrH;AAgFD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QACtB,MAAM,UACH,cAAc,KACrB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAwCtD,CAAC;AAEL,eAAO,MAAM,aAAa,UAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAwC,CAAC;AAEnG,+GAA+G;AAC/G,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,KAAoB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,OAAO,SACZ;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,YAClC,QAAQ,CAAC,KAAK,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAUlB,CAAC"}

package/dist/PostgreSqlPool.js

@@ -1,31 +1,9 @@
 import { Effect, Option, Predicate, Redacted, Schema } from 'effect';
-import pg from 'pg';
-import { AwsAuth, TlsSettings } from './HttpApiResource.js';
 import { observePostgreSqlTimeouts } from './PostgreSqlTimeouts.js';
-import { PostgreSqlTunnelStream } from './PostgreSqlTunnel.js';
 import { registerSecrets } from './Redaction.js';
+import { PostgresqlResource } from './ResourceRecords.js';
 import { InvalidResourceError } from './ResourcesErrors.js';
-const NonEmptyString = Schema.String.check(Schema.isMinLength(1));
-const Secret = Schema.RedactedFromValue(Schema.String);
-/** A `postgresql` record as `@ontemper/resources` reads it; `sslmode` carries libpq semantics, and `tls` the CA and client certificate. */
-export const PostgresqlResource = Schema.Struct({
-    host: NonEmptyString,
-    port: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 })).pipe(Schema.withDecodingDefaultKey(Effect.succeed(5432))),
-    dbname: NonEmptyString,
-    user: NonEmptyString,
-    // Closed: the type decides how the client signs in.
-    auth: Schema.Union([
-        Schema.Struct({ type: Schema.Literal('password'), password: Secret }),
-        Schema.Struct({ type: Schema.Literal('rds_iam'), region: NonEmptyString, awsAuth: AwsAuth }),
-        Schema.Struct({ type: Schema.Literal('none') }),
-    ]),
-    // Closed: libpq's weaker `allow` and `prefer` would map to no TLS at all.
-    sslmode: Schema.Literals(['disable', 'require', 'verify-ca', 'verify-full']).pipe(Schema.withDecodingDefaultKey(Effect.succeed('verify-full'))),
-    tls: Schema.optionalKey(TlsSettings),
-    // Only its presence matters: this pool refuses a bastion tunnel.
-    sshTunnel: Schema.optionalKey(Schema.Record(Schema.String, Schema.Json)),
-    options: Schema.optionalKey(Schema.String),
-});
+export { PostgresqlResource } from './ResourceRecords.js';
 const validate = Schema.toStandardSchemaV1(PostgresqlResource)['~standard'].validate;
 // Names only the failing paths: a schema message can quote the value, which may be a secret.
 const decode = (key, value) => Effect.suspend(() => {
@@ -75,6 +53,13 @@ const resourcePassword = (key, resource) => {
     }
     return Effect.succeed(resource.auth.type === 'password' ? Redacted.value(resource.auth.password) : '');
 };
+// `pg` and `ws` are optional peers, so they load when a pool is built: importing `./resources` needs neither.
+const loadOptional = (name, load) => Effect.tryPromise({
+    try: load,
+    catch: () => new Error(`PostgreSQL Resource pools need the ${name} package: add ${name} to the workflow dependencies.`),
+}).pipe(Effect.orDie);
+const loadPg = loadOptional('pg', () => import('pg').then((module) => module.default));
+const loadTunnel = loadOptional('ws', () => import('./PostgreSqlTunnel.js'));
 const ManagedPlacement = Schema.Struct({ managedDatabasePlacementId: Schema.String });
 const isManaged = Schema.is(ManagedPlacement);
 // The runtime API answers a missing Variable reference with the same 404 as a missing record, so after a found
@@ -94,14 +79,16 @@ export const makeResourcePool = (key, source) => Effect.gen(function* () {
     yield* registerSecrets([password]);
     const authorize = source.authorizeTunnel;
     const managed = isManaged(record.metadata);
+    const driver = yield* loadPg;
+    const TunnelStream = managed && authorize ? (yield* loadTunnel).PostgreSqlTunnelStream : undefined;
     const context = yield* Effect.context();
     const warn = (event, message, fields = {}) => {
         Effect.runForkWith(context)(Effect.logWarning(message).pipe(Effect.annotateLogs({ event, ...fields })));
     };
     // Each physical connection reads current runtime authorization, including connections opened after token renewal.
-    const stream = managed && authorize ? () => new PostgreSqlTunnelStream(() => authorize(key)) : undefined;
+    const stream = TunnelStream && authorize ? () => new TunnelStream(() => authorize(key)) : undefined;
     // A callback prevents pg from substituting ambient PGPASSWORD/pgpass for an empty Resource password.
-    const pool = observePostgreSqlTimeouts(new pg.Pool({
+    const pool = observePostgreSqlTimeouts(driver, new driver.Pool({
         stream,
         host: resource.host,
         port: resource.port,

package/dist/PostgreSqlPool.js.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSqlPool.js","sourceRoot":"","sources":["../src/PostgreSqlPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpF,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAEvD,2IAA2I;AAC3I,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACpD;IACD,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,cAAc;IACpB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAsB,CAAC,CAAC,CACtE;IACD,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;IACpC,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CAC3C,CAAC,CAAC;AAYH,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;AAErF,6FAA6F;AAC7F,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,YAAY,OAAO;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAC7G,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC;QACvB,MAAM,EAAE,OAAO,GAAG,EAAE;QACpB,OAAO,EAAE,YAAY,GAAG,gDAAgD,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACzG,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,QAA4B;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC;IACzB,MAAM,iBAAiB,GAAG,GAAG,EAAE,iBAAiB;QAC9C,CAAC,CAAC;YACE,IAAI,EAAE,GAAG,CAAC,iBAAiB;YAC3B,GAAG,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC5E,UAAU,EAAE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;SACxG;QACH,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC7D,KAAK,WAAW;YACd,OAAO;gBACL,kBAAkB,EAAE,IAAI;gBACxB,EAAE,EAAE,GAAG,EAAE,aAAa;gBACtB,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,GAAG,EAAE,CAAC,SAAS;aACrC,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnH,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,QAA4B,EAAE,EAAE;IACrE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,CAAC,SAAS;QACpB,OAAO,MAAM,CAAC,uBAAuB,GAAG,qDAAqD,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,uBAAuB,GAAG,gEAAgE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+GAA+G;AAC/G,sEAAsE;AACtE,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE,CACtC,IAAI,oBAAoB,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,EAAE;IACpB,OAAO,EAAE,YAAY,GAAG,0GAA0G;CACnI,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAAW,EACX,MAAsB,EACoC,EAAE,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EACjF,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAA2B,EAAE,EAAE,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC,CAAC;IACF,kHAAkH;IAClH,MAAM,MAAM,GAAG,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,sBAAsB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,qGAAqG;IACrG,MAAM,IAAI,GAAG,yBAAyB,CACpC,IAAI,EAAE,CAAC,IAAI,CAAC;QACV,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC;QACxB,GAAG,EAAE,CAAC;QACN,uBAAuB,EAAE,MAAM;QAC/B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,MAAM;KAC1B,CAAC,EACF,GAAG,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAClG,CAAC;IACF,wGAAwG;IACxG,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAEnG,+GAA+G;AAC/G,MAAM,CAAC,MAAM,gBAAgB,GAAmB,YAAY,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,IAA2C,EAC3C,OAAO,GAAmB,gBAAgB,EACrB,EAAE,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mEAAmE,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CACnE,CACN,CACF,CAAC"}
+{"version":3,"file":"PostgreSqlPool.js","sourceRoot":"","sources":["../src/PostgreSqlPool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAW1D,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;AAErF,6FAA6F;AAC7F,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAkB,EAAE,EAAE,CACjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,YAAY,OAAO;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAC7G,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,oBAAoB,CAAC;QACvB,MAAM,EAAE,OAAO,GAAG,EAAE;QACpB,OAAO,EAAE,YAAY,GAAG,gDAAgD,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACzG,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,QAA4B;IAC7C,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC;IACzB,MAAM,iBAAiB,GAAG,GAAG,EAAE,iBAAiB;QAC9C,CAAC,CAAC;YACE,IAAI,EAAE,GAAG,CAAC,iBAAiB;YAC3B,GAAG,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC5E,UAAU,EAAE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;SACxG;QACH,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC7D,KAAK,WAAW;YACd,OAAO;gBACL,kBAAkB,EAAE,IAAI;gBACxB,EAAE,EAAE,GAAG,EAAE,aAAa;gBACtB,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,GAAG,EAAE,CAAC,SAAS;aACrC,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IACnH,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,QAA4B,EAAE,EAAE;IACrE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7G,IAAI,QAAQ,CAAC,SAAS;QACpB,OAAO,MAAM,CAAC,uBAAuB,GAAG,qDAAqD,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,uBAAuB,GAAG,gEAAgE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC,CAAC;AAEF,8GAA8G;AAC9G,MAAM,YAAY,GAAG,CAAI,IAAY,EAAE,IAAsB,EAAE,EAAE,CAC/D,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,KAAK,CAAC,sCAAsC,IAAI,iBAAiB,IAAI,gCAAgC,CAAC;CAC7G,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACvF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;AAE7E,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+GAA+G;AAC/G,sEAAsE;AACtE,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE,CACtC,IAAI,oBAAoB,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,EAAE;IACpB,OAAO,EAAE,YAAY,GAAG,0GAA0G;CACnI,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAAW,EACX,MAAsB,EACoC,EAAE,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EACjF,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,YAAY,GAAG,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAA2B,EAAE,EAAE,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC,CAAC;IACF,kHAAkH;IAClH,MAAM,MAAM,GAAG,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,qGAAqG;IACrG,MAAM,IAAI,GAAG,yBAAyB,CACpC,MAAM,EACN,IAAI,MAAM,CAAC,IAAI,CAAC;QACd,MAAM;QACN,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC;QACxB,GAAG,EAAE,CAAC;QACN,uBAAuB,EAAE,MAAM;QAC/B,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,MAAM;KAC1B,CAAC,EACF,GAAG,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAClG,CAAC;IACF,wGAAwG;IACxG,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAEnG,+GAA+G;AAC/G,MAAM,CAAC,MAAM,gBAAgB,GAAmB,YAAY,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,IAA2C,EAC3C,OAAO,GAAmB,gBAAgB,EACrB,EAAE,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,mEAAmE,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CACnE,CACN,CACF,CAAC"}

package/dist/PostgreSqlTimeouts.d.ts

@@ -1,4 +1,6 @@
-import pg from 'pg';
+import type pg from 'pg';
+/** The `pg` classes the observer checks against; the caller passes the module it loaded. */
+export type PgClasses = Pick<typeof pg, 'Client' | 'DatabaseError'>;
 /** Calls `report` once per statement timeout on any connection of the pool, without changing query results. */
-export declare const observePostgreSqlTimeouts: (pool: pg.Pool, report: () => void) => pg.Pool;
+export declare const observePostgreSqlTimeouts: (driver: PgClasses, pool: pg.Pool, report: () => void) => pg.Pool;
 //# sourceMappingURL=PostgreSqlTimeouts.d.ts.map

package/dist/PostgreSqlTimeouts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSqlTimeouts.d.ts","sourceRoot":"","sources":["../src/PostgreSqlTimeouts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,+GAA+G;AAC/G,eAAO,MAAM,yBAAyB,SAAU,EAAE,CAAC,IAAI,UAAU,MAAM,IAAI,KAAG,EAAE,CAAC,IAWhF,CAAC"}
+{"version":3,"file":"PostgreSqlTimeouts.d.ts","sourceRoot":"","sources":["../src/PostgreSqlTimeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,4FAA4F;AAC5F,MAAM,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,GAAG,eAAe,CAAC,CAAC;AAEpE,+GAA+G;AAC/G,eAAO,MAAM,yBAAyB,WAAY,SAAS,QAAQ,EAAE,CAAC,IAAI,UAAU,MAAM,IAAI,KAAG,EAAE,CAAC,IAenG,CAAC"}

package/dist/PostgreSqlTimeouts.js

@@ -1,12 +1,13 @@
-import pg from 'pg';
 /** Calls `report` once per statement timeout on any connection of the pool, without changing query results. */
-export const observePostgreSqlTimeouts = (pool, report) => {
+export const observePostgreSqlTimeouts = (driver, pool, report) => {
     pool.on('connect', (client) => {
-        if (!(client instanceof pg.Client) || !client.connection)
+        if (!(client instanceof driver.Client) || !client.connection)
             return;
         // Wire errors cover pool, checked-out client, and callback queries without changing their return values.
         client.connection.on('errorMessage', (error) => {
-            if (error instanceof pg.DatabaseError && error.code === '57014' && error.message.includes('statement timeout')) {
+            if (error instanceof driver.DatabaseError &&
+                error.code === '57014' &&
+                error.message.includes('statement timeout')) {
                 report();
             }
         });

package/dist/PostgreSqlTimeouts.js.map

@@ -1 +1 @@
-{"version":3,"file":"PostgreSqlTimeouts.js","sourceRoot":"","sources":["../src/PostgreSqlTimeouts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,+GAA+G;AAC/G,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAa,EAAE,MAAkB,EAAW,EAAE;IACtF,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;QAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO;QACjE,yGAAyG;QACzG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,KAAY,EAAE,EAAE;YACpD,IAAI,KAAK,YAAY,EAAE,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC/G,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"PostgreSqlTimeouts.js","sourceRoot":"","sources":["../src/PostgreSqlTimeouts.ts"],"names":[],"mappings":"AAKA,+GAA+G;AAC/G,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAiB,EAAE,IAAa,EAAE,MAAkB,EAAW,EAAE;IACzG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;QAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO;QACrE,yGAAyG;QACzG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,KAAY,EAAE,EAAE;YACpD,IACE,KAAK,YAAY,MAAM,CAAC,aAAa;gBACrC,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAC3C,CAAC;gBACD,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/Redaction.d.ts

@@ -17,6 +17,8 @@ export interface SecretMasks {
     readonly mask: (text: string) => string;
 }
 export declare const makeSecretMasks: () => SecretMasks;
+/** A module's own registry that also masks every secret registered process-wide, in one longest-first pass. */
+export declare const makeWorkflowSecretMasks: () => SecretMasks;
 /** `workflow()` installs one registry per module, so a secret seen by one request stays masked in every later one. */
 export declare const SecretMasks: Context.Reference<SecretMasks>;
 /**