@ontemper/sdk 0.7.1-postgresql.2 → 0.7.1-postgresql.3

package/dist/ResourceRecords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceRecords.d.ts","sourceRoot":"","sources":["../src/ResourceRecords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAuB,MAAM,EAAqD,MAAM,QAAQ,CAAC;AAYhH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAK5D,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;AAC3C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;AAkBlD,yGAAyG;AACzG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAkC7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AA4BhE,uGAAuG;AACvG,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAazB,CAAC;AACF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,sHAAsH;AACtH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAUrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;AAqBhD,oGAAoG;AACpG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAU5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAwC9D;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CAiBxB,CAAC;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;;;;;;;AAIpD;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,4BAK3C;IACA,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAU7E;CACF;AA2GD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,GAAG;IAAE,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAA;CAAE,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,YAAY,UACzC,CAAC,OACJ,MAAM,SACJ,MAAM,CAAC,IAAI,KACjB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,uBAAuB,CAwBvE,CAAC"}

package/dist/ResourceRecords.js

@@ -0,0 +1,303 @@
+import { Effect, Predicate, Redacted, Schema, SchemaAST, SchemaTransformation } from 'effect';
+import { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+import { AbsoluteHttpUrl, AwsAuth, HttpApiResource, HttpProxy, OAuthTokenRequest, recordStruct, TlsSettings, } from './HttpApiResource.js';
+import { SDK_VERSION } from './Manifest.js';
+import { InvalidResourceError } from './ResourcesErrors.js';
+const Secret = Schema.RedactedFromValue(Schema.String);
+const NonEmptySecret = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(1)));
+const NonEmptyString = Schema.String.check(Schema.isMinLength(1));
+const Port = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 }));
+// Legacy SSH ports accept every integer, including those outside the safe-integer range and TCP port range.
+const SshPort = Schema.Number.check(Schema.makeFilter(Number.isInteger, { expected: 'an integer', toJsonSchema: () => ({ type: 'integer' }) }));
+const SshAlgorithms = recordStruct({
+    kex: Schema.optional(Schema.Array(Schema.String)),
+    serverHostKey: Schema.optional(Schema.Array(Schema.String)),
+    cipher: Schema.optional(Schema.Array(Schema.String)),
+    hmac: Schema.optional(Schema.Array(Schema.String)),
+});
+/** A `postgresql` record; `sslmode` carries libpq semantics, and `tls` the CA and client certificate. */
+export const PostgresqlResource = recordStruct({
+    host: NonEmptyString,
+    port: Port.pipe(Schema.withDecodingDefault(Effect.succeed(5432))),
+    dbname: NonEmptyString,
+    user: NonEmptyString,
+    // Closed: the type decides how the client signs in.
+    auth: Schema.Union([
+        recordStruct({ type: Schema.Literal('password'), password: Secret }),
+        recordStruct({ type: Schema.Literal('rds_iam'), region: NonEmptyString, awsAuth: AwsAuth }),
+        recordStruct({ type: Schema.Literal('none') }),
+    ]),
+    // Closed: libpq's weaker `allow` and `prefer` would map to no TLS at all.
+    sslmode: Schema.Literals(['disable', 'require', 'verify-ca', 'verify-full']).pipe(Schema.withDecodingDefault(Effect.succeed('verify-full'))),
+    tls: Schema.optional(TlsSettings),
+    sshTunnel: Schema.optional(recordStruct({
+        host: NonEmptyString,
+        port: SshPort.pipe(Schema.withDecodingDefault(Effect.succeed(22))),
+        username: Schema.String,
+        auth: Schema.Union([
+            recordStruct({
+                type: Schema.Literal('credentials'),
+                password: Schema.optional(Secret),
+                privateKey: Schema.optional(Secret),
+                passphrase: Schema.optional(Secret),
+            }),
+        ]).pipe(Schema.withDecodingDefault(Effect.succeed({ type: 'credentials' }))),
+        hostKeyFingerprints: Schema.optional(Schema.Array(NonEmptyString)),
+        algorithms: Schema.optional(SshAlgorithms),
+    })),
+    options: Schema.optional(Schema.String),
+});
+// The port is 1-65535 without leading zeros, as the API catalog requires; `\s` is spelled out for deploy's RE2.
+const KafkaBroker = Schema.String.check(Schema.isPattern(/^(\[[0-9A-Fa-f:.]+\]|[^\t\n\v\f\r\p{Z}:/@[\]]+):(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/u), Schema.makeFilter((broker) => !broker.includes(String.fromCodePoint(0xfeff)), {
+    expected: 'a broker without whitespace',
+    toJsonSchema: () => ({ not: { pattern: String.fromCodePoint(0xfeff) } }),
+}));
+const KafkaAuth = Schema.Union([
+    recordStruct({ type: Schema.Literal('none') }),
+    recordStruct({ type: Schema.Literal('sasl_plain'), username: Schema.String, password: Secret }),
+    recordStruct({
+        type: Schema.Literal('sasl_scram'),
+        mechanism: Schema.Literals(['SCRAM-SHA-256', 'SCRAM-SHA-512']).pipe(Schema.withDecodingDefault(Effect.succeed('SCRAM-SHA-512'))),
+        username: Schema.String,
+        password: Secret,
+    }),
+    recordStruct({ type: Schema.Literal('oauthbearer'), tokenRequest: OAuthTokenRequest }),
+    recordStruct({ type: Schema.Literal('aws_msk_iam'), region: NonEmptyString, awsAuth: AwsAuth }),
+]);
+/** A `kafka` record: bootstrap brokers, the `auth` variant, and `tls`, whose presence turns TLS on. */
+export const KafkaResource = recordStruct({
+    brokers: Schema.Array(KafkaBroker).check(Schema.isMinLength(1)),
+    clientId: Schema.optional(Schema.String),
+    // Closed: the type decides the SASL mechanism, and a client that falls back on an unknown one signs in without it.
+    auth: KafkaAuth,
+    tls: Schema.optional(TlsSettings),
+}).check(
+// MSK IAM and OAuth bearer send a token in the SASL payload; without `tls` it would cross the network in plaintext.
+Schema.makeFilter(({ auth, tls }) => (auth.type !== 'aws_msk_iam' && auth.type !== 'oauthbearer') ||
+    tls !== undefined || { path: ['tls'], issue: 'Expected tls with aws_msk_iam or oauthbearer' }));
+/** An `s3` record: bucket, region, an optional S3-compatible endpoint, and the AWS credential source under `auth`. */
+export const S3Resource = recordStruct({
+    bucket: NonEmptyString,
+    region: NonEmptyString.pipe(Schema.withDecodingDefault(Effect.succeed('us-east-1'))),
+    endpoint: Schema.optional(AbsoluteHttpUrl),
+    pathStyle: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
+    prefix: Schema.optional(Schema.String),
+    // Closed and required: `ambient` is an explicit choice (Temper-operated runtimes refuse it), never a fallback.
+    auth: AwsAuth,
+    tls: Schema.optional(TlsSettings),
+    proxy: Schema.optional(HttpProxy),
+});
+// Closed: the type decides which identity the client presents, and a guess could fall back to anonymous access.
+const AzureAuth = Schema.Union([
+    recordStruct({ type: Schema.Literal('shared_key'), accountKey: NonEmptySecret }),
+    recordStruct({ type: Schema.Literal('sas'), sasToken: NonEmptySecret }),
+    recordStruct({
+        type: Schema.Literal('service_principal'),
+        tenantId: NonEmptyString,
+        clientId: NonEmptyString,
+        clientSecret: NonEmptySecret,
+    }),
+    recordStruct({
+        type: Schema.Literal('service_principal_certificate'),
+        tenantId: NonEmptyString,
+        clientId: NonEmptyString,
+        certificatePem: NonEmptySecret,
+    }),
+    recordStruct({ type: Schema.Literal('ambient') }),
+]);
+/** An `azure_blob` record: account, container, endpoint, and the credential source under `auth`. */
+export const AzureBlobResource = recordStruct({
+    accountName: NonEmptyString,
+    containerName: NonEmptyString,
+    // A full Blob service URL (Azurite, a gateway, a custom domain); it overrides `endpointSuffix`.
+    endpoint: Schema.optional(AbsoluteHttpUrl),
+    endpointSuffix: NonEmptyString.pipe(Schema.withDecodingDefault(Effect.succeed('core.windows.net'))),
+    prefix: Schema.optional(Schema.String),
+    auth: AzureAuth,
+    tls: Schema.optional(TlsSettings),
+    proxy: Schema.optional(HttpProxy),
+});
+const sftpFields = {
+    host: NonEmptyString,
+    port: SshPort.pipe(Schema.withDecodingDefault(Effect.succeed(22))),
+    username: NonEmptyString,
+    // Closed: the type decides which credentials the client offers.
+    auth: Schema.Union([
+        recordStruct({ type: Schema.Literal('password'), password: Secret }),
+        recordStruct({
+            type: Schema.Literal('private_key'),
+            privateKey: Secret,
+            passphrase: Schema.optional(Secret),
+        }),
+        recordStruct({
+            type: Schema.Literal('private_key_and_password'),
+            privateKey: Secret,
+            passphrase: Schema.optional(Secret),
+            password: Secret,
+        }),
+    ]),
+    hostKeyFingerprints: Schema.optional(Schema.Array(NonEmptyString)),
+    algorithms: Schema.optional(SshAlgorithms),
+};
+const SftpLifted = Schema.toType(recordStruct({
+    ...sftpFields,
+    password: Schema.optional(Schema.Redacted(Schema.Unknown)),
+    privateKey: Schema.optional(Schema.Redacted(Schema.Unknown)),
+    passphrase: Schema.optional(Schema.Redacted(Schema.Unknown)),
+}));
+/**
+ * An `sftp` record; `hostKeyFingerprints` are the `SHA256:` fingerprints the client must pin when set. The
+ * credentials under `auth` are also lifted to the top level. Lifted values are Redacted<unknown>: legacy also copies
+ * undeclared credential fields; narrow those values before use, or read the typed fields of the auth variant.
+ */
+export const SftpResource = recordStruct(sftpFields).pipe(Schema.decodeTo(SftpLifted, SchemaTransformation.transform({
+    decode: (record) => {
+        const lifted = {};
+        for (const field of ['password', 'privateKey', 'passphrase']) {
+            const value = record.auth[field];
+            if (value !== undefined)
+                lifted[field] = Redacted.isRedacted(value) ? value : Redacted.make(value);
+        }
+        // Legacy lifting overwrites root credential copies, including stale fields the auth variant does not use.
+        const { password: _password, privateKey: _privateKey, passphrase: _passphrase, ...fields } = record;
+        return { ...fields, ...lifted };
+    },
+    encode: ({ password: _password, privateKey: _privateKey, passphrase: _passphrase, ...record }) => record,
+})));
+const CLIENT_NAME = '@ontemper/sdk';
+/**
+ * A built-in record holds a value this SDK does not know in a closed field: one that chooses TLS, where a key
+ * travels, or AS2 cryptography, where a guess would weaken security silently. The message names the fields and this
+ * SDK's version, never the value, which can be a mis-pointed secret.
+ */
+export class UnknownRecordValueError extends Schema.TaggedError()('UnknownRecordValueError', {
+    key: Schema.String,
+    fields: Schema.Array(Schema.String),
+    clientVersion: Schema.String,
+    message: Schema.String,
+}) {
+    static of(key, fields) {
+        const subject = fields.length === 1 ? `field ${fields[0]} uses a value` : `fields ${fields.join(', ')} use values`;
+        return new UnknownRecordValueError({
+            key,
+            fields,
+            clientVersion: SDK_VERSION,
+            message: `record ${key}: ${subject} this ${CLIENT_NAME} version (${SDK_VERSION}) does not know; ` +
+                'upgrade to a release that supports it',
+        });
+    }
+}
+// Only these schemas mirror the platform catalog; a caller's own closed value failing is not an outdated SDK.
+const BUILT_IN_RECORDS = new Set([
+    HttpApiResource,
+    SftpResource,
+    PostgresqlResource,
+    KafkaResource,
+    S3Resource,
+    AzureBlobResource,
+    As2IdentityResource,
+    As2PartnerResource,
+]);
+const isJsonObject = Schema.is(Schema.JsonObject);
+const isJsonArray = Schema.is(Schema.Array(Schema.Json));
+// The resolved value at an issue's path; closed values sit in objects, and arrays only hold brokers and fingerprints.
+const valueAt = (value, path) => path.reduce((current, segment) => {
+    if (isJsonArray(current))
+        return current[Number(segment)];
+    return isJsonObject(current) ? current[segment] : undefined;
+}, value);
+// The one property every member of a union of structs fixes to a literal, such as `type` or `mode`.
+const discriminatorOf = (types) => {
+    const literalKeys = (ast) => SchemaAST.isObjects(ast)
+        ? ast.propertySignatures.filter((field) => SchemaAST.isLiteral(field.type)).map((field) => String(field.name))
+        : [];
+    const [first, ...rest] = types;
+    if (first === undefined)
+        return undefined;
+    return literalKeys(first).find((key) => rest.every((member) => literalKeys(member).includes(key)));
+};
+// Never the received value: a secret mis-pointed at the field would land in the error.
+const leafMessage = (issue) => {
+    if (issue._tag === 'MissingKey')
+        return 'Missing key';
+    const invalid = issue._tag === 'Filter' ? issue.issue : issue;
+    const message = invalid._tag === 'InvalidValue' ? invalid.annotations?.message : undefined;
+    if (Predicate.isString(message))
+        return message;
+    const expected = issue._tag === 'Filter' ? issue.filter.annotations?.expected : undefined;
+    return Predicate.isString(expected) ? `Expected ${expected}` : 'Invalid value';
+};
+const unionFindings = (union, path, value) => {
+    if (!SchemaAST.isUnion(union))
+        return [{ path, message: 'Invalid value', unknownValue: false }];
+    const types = union.types.filter((member) => !SchemaAST.isUndefined(member));
+    const only = types[0];
+    if (types.length === 1 && only !== undefined && SchemaAST.isUnion(only))
+        return unionFindings(only, path, value);
+    const at = valueAt(value, path);
+    if (types.every(SchemaAST.isLiteral)) {
+        return [{ path, message: 'Invalid value', unknownValue: Predicate.isString(at) }];
+    }
+    const discriminator = discriminatorOf(types);
+    if (discriminator === undefined || !isJsonObject(at))
+        return [{ path, message: 'Invalid value', unknownValue: false }];
+    const received = at[discriminator];
+    return [
+        {
+            path: [...path, discriminator],
+            message: received === undefined ? 'Missing key' : 'Invalid value',
+            unknownValue: Predicate.isString(received),
+        },
+    ];
+};
+function findings(issue, path, value) {
+    switch (issue._tag) {
+        case 'Pointer':
+            return findings(issue.issue, [...path, ...issue.path.map(String)], value);
+        case 'Composite':
+            return issue.issues.flatMap((inner) => findings(inner, path, value));
+        case 'Encoding':
+            return findings(issue.issue, path, value);
+        case 'Filter':
+            // A filter that names a field (`{ path, issue }`) reports at that field.
+            return issue.issue._tag === 'Pointer'
+                ? findings(issue.issue, path, value)
+                : [{ path, message: leafMessage(issue), unknownValue: false }];
+        case 'AnyOf': {
+            if (issue.issues.length === 0)
+                return unionFindings(issue.ast, path, value);
+            const candidates = issue.issues.map((inner) => findings(inner, path, value));
+            // A catch-all member that fails only at `type` (`HttpApiAuth`'s unsupported variant) is not the intended one.
+            const intended = candidates.filter((found) => !found.every((finding) => finding.path.length === path.length + 1 && finding.path.at(-1) === 'type'));
+            return (intended.length > 0 ? intended : candidates).flat();
+        }
+        default:
+            return [{ path, message: leafMessage(issue), unknownValue: false }];
+    }
+}
+const PATTERN_MESSAGE = 'Expected a string matching the RegExp';
+/**
+ * Decodes a resolved record. A mismatch names the fields, never their values; a built-in record with a closed value
+ * this SDK does not know fails with `UnknownRecordValueError`.
+ */
+export const decodeRecord = (schema, key, value) => Schema.decodeUnknownEffect(schema)(value, { errors: 'all' }).pipe(Effect.mapError((error) => {
+    const found = findings(error.issue, [], value);
+    const unknown = [
+        ...new Set(found.filter((finding) => finding.unknownValue).map((finding) => finding.path.join('.'))),
+    ];
+    if (BUILT_IN_RECORDS.has(schema) && unknown.length > 0)
+        return UnknownRecordValueError.of(key, unknown);
+    const lines = found.map((finding) => ({
+        field: finding.path.join('.') || '<root>',
+        message: finding.message,
+    }));
+    // Overlapping patterns and custom checks can fail together; the custom message says why.
+    const shown = lines.filter(({ field, message }) => !message.startsWith(PATTERN_MESSAGE) ||
+        !lines.some((other) => other.field === field && !other.message.startsWith(PATTERN_MESSAGE)));
+    const issues = [...new Set(shown.map(({ field, message }) => `${field}: ${message}`))];
+    return new InvalidResourceError({
+        target: `key ${key}`,
+        message: `Resource ${key} does not match the expected schema: ${issues.join('; ')}`,
+    });
+}));
+//# sourceMappingURL=ResourceRecords.js.map

package/dist/ResourceRecords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceRecords.js","sourceRoot":"","sources":["../src/ResourceRecords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAoB,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAChH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EACL,eAAe,EACf,OAAO,EACP,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAS5D,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACjF,4GAA4G;AAC5G,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACjC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAC3G,CAAC;AAEF,MAAM,aAAa,GAAG,YAAY,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,cAAc;IACpB,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;QACjB,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACpE,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC3F,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;KAC/C,CAAC;IACF,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAsB,CAAC,CAAC,CACnE;IACD,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC,QAAQ,CACxB,YAAY,CAAC;QACX,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YACjB,YAAY,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;aACpC,CAAC;SACH,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,aAAsB,EAAE,CAAC,CAAC,CAAC;QACrF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;KAC3C,CAAC,CACH;IACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC;AAGH,gHAAgH;AAChH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACrC,MAAM,CAAC,SAAS,CACd,4IAA4I,CAC7I,EACD,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE;IAC5E,QAAQ,EAAE,6BAA6B;IACvC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;CACzE,CAAC,CACH,CAAC;AAEF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC/F,YAAY,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,eAAwB,CAAC,CAAC,CACrE;QACD,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IACtF,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;CAChG,CAAC,CAAC;AAEH,uGAAuG;AACvG,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,mHAAmH;IACnH,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;CAClC,CAAC,CAAC,KAAK;AACN,oHAAoH;AACpH,MAAM,CAAC,UAAU,CACf,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAChB,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC;IAC5D,GAAG,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAChG,CACF,CAAC;AAGF,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;IACrC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACpF,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,+GAA+G;IAC/G,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AAGH,gHAAgH;AAChH,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAChF,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;IACvE,YAAY,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACzC,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,cAAc;QACxB,YAAY,EAAE,cAAc;KAC7B,CAAC;IACF,YAAY,CAAC;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC;QACrD,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,cAAc;QACxB,cAAc,EAAE,cAAc;KAC/B,CAAC;IACF,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;IAC5C,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC1C,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnG,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,QAAQ,EAAE,cAAc;IACxB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;QACjB,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACpE,YAAY,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YACnC,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;SACpC,CAAC;QACF,YAAY,CAAC;YACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC;YAChD,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,MAAM;SACjB,CAAC;KACH,CAAC;IACF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAClE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;CAC3C,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,YAAY,CAAC;IACX,GAAG,UAAU;IACb,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CAC7D,CAAC,CACH,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CACb,UAAU,EACV,oBAAoB,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAU,EAAE,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrG,CAAC;QACD,0GAA0G;QAC1G,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;QACpG,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM;CACzG,CAAC,CACH,CACF,CAAC;AAGF,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CAAC,yBAAyB,EAAE;IACpH,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACA,MAAM,CAAC,EAAE,CAAC,GAAW,EAAE,MAA6B;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACnH,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG;YACH,MAAM;YACN,aAAa,EAAE,WAAW;YAC1B,OAAO,EACL,UAAU,GAAG,KAAK,OAAO,SAAS,WAAW,aAAa,WAAW,mBAAmB;gBACxF,uCAAuC;SAC1C,CAAC,CAAC;IACL,CAAC;CACF;AAED,8GAA8G;AAC9G,MAAM,gBAAgB,GAAyB,IAAI,GAAG,CAAC;IACrD,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAC;AASH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAClD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAEzD,sHAAsH;AACtH,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,IAA2B,EAA2B,EAAE,CAC3F,IAAI,CAAC,MAAM,CAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IACxD,IAAI,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC,EAAE,KAAK,CAAC,CAAC;AAEZ,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,KAAmC,EAAsB,EAAE;IAClF,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,EAAE,CACzC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9G,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,WAAW,GAAG,CAAC,KAAwB,EAAU,EAAE;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,aAAa,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAoB,EACpB,IAA2B,EAC3B,KAAkB,EACM,EAAE;IAC1B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO;QACL;YACE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC;YAC9B,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe;YACjE,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAwB,EAAE,IAA2B,EAAE,KAAkB;IACzF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5E,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,KAAK,QAAQ;YACX,yEAAyE;YACzE,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACnC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;gBACpC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,KAAK,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,8GAA8G;YAC9G,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAChH,CAAC;YACF,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;QACD;YACE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAKhE;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,MAAS,EACT,GAAW,EACX,KAAkB,EACwD,EAAE,CAC5E,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAkD,EAAE;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;KACrG,CAAC;IACF,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,uBAAuB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC,CAAC;IACJ,yFAAyF;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CACxB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrB,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAC9F,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,IAAI,oBAAoB,CAAC;QAC9B,MAAM,EAAE,OAAO,GAAG,EAAE;QACpB,OAAO,EAAE,YAAY,GAAG,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACpF,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/dist/Resources.d.ts

@@ -1,7 +1,17 @@
 /**
- * Readers for a workflow's Resources: `import { makePostgresqlPool } from '@temper/workflow/resources'`. PostgreSQL
- * pools load the optional `pg` and `ws` peers when a pool is built, so importing this module needs neither.
+ * Resource readers, records, Kafka client options, and a promise-style `env` for code outside Effect:
+ * `import { makePostgresqlPool, KafkaResource, kafkaConfig } from '@temper/workflow/resources'`. The surface of
+ * `@ontemper/resources` without its partner and connection state. PostgreSQL pools load the optional `pg` and `ws`
+ * peers when a pool is built, and Kafka's optional AWS peers load only for MSK IAM, so importing this module needs none.
  */
-export { createPostgresqlPool, makePostgresqlPool, PostgresqlResource, type PostgresqlPoolError, } from './PostgreSql.js';
+export { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+export { getDatabaseTunnelAuthorization } from './DatabaseTunnelAuthorization.js';
+export { HttpApiAuth, HttpApiResource, HttpApiUnsupportedAuth, HttpProxy, OAuthTokenRequest, TlsSettings, } from './HttpApiResource.js';
+export { createPostgresqlPool, makePostgresqlPool, type PostgresqlPoolError } from './PostgreSql.js';
+/** A resolved Variable value; the root's `Variable` export is the Effect declaration instead. */
+export type Variable = string;
+export { AzureBlobResource, type JsonObject, type JsonValue, KafkaResource, PostgresqlResource, S3Resource, SftpResource, UnknownRecordValueError, } from './ResourceRecords.js';
+export { kafkaConfig, type KafkaClientConfig, type KafkaClientSasl, type KafkaClientTlsOptions, type KafkaConfigOptions, OptionalKafkaDependencyError, UnsupportedKafkaAuthError, } from './Kafka.js';
+export { env, type RuntimeEnv, type RuntimeEnvConfig, type RuntimeEnvLogger, type RuntimeResourceReads, type RuntimeVariableReads, type RuntimeResolveOptions, type RuntimeResourceRecord, type RuntimeSelectResourceInput, type RuntimeSelectResourceOutput, } from './ResourcesEnv.js';
 export { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError, } from './ResourcesErrors.js';
 //# sourceMappingURL=Resources.d.ts.map

package/dist/Resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Resources.d.ts","sourceRoot":"","sources":["../src/Resources.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"Resources.d.ts","sourceRoot":"","sources":["../src/Resources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EACL,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAErG,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC9B,OAAO,EACL,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,GAAG,EACH,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/Resources.js

@@ -1,7 +1,15 @@
 /**
- * Readers for a workflow's Resources: `import { makePostgresqlPool } from '@temper/workflow/resources'`. PostgreSQL
- * pools load the optional `pg` and `ws` peers when a pool is built, so importing this module needs neither.
+ * Resource readers, records, Kafka client options, and a promise-style `env` for code outside Effect:
+ * `import { makePostgresqlPool, KafkaResource, kafkaConfig } from '@temper/workflow/resources'`. The surface of
+ * `@ontemper/resources` without its partner and connection state. PostgreSQL pools load the optional `pg` and `ws`
+ * peers when a pool is built, and Kafka's optional AWS peers load only for MSK IAM, so importing this module needs none.
  */
-export { createPostgresqlPool, makePostgresqlPool, PostgresqlResource, } from './PostgreSql.js';
+export { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+export { getDatabaseTunnelAuthorization } from './DatabaseTunnelAuthorization.js';
+export { HttpApiAuth, HttpApiResource, HttpApiUnsupportedAuth, HttpProxy, OAuthTokenRequest, TlsSettings, } from './HttpApiResource.js';
+export { createPostgresqlPool, makePostgresqlPool } from './PostgreSql.js';
+export { AzureBlobResource, KafkaResource, PostgresqlResource, S3Resource, SftpResource, UnknownRecordValueError, } from './ResourceRecords.js';
+export { kafkaConfig, OptionalKafkaDependencyError, UnsupportedKafkaAuthError, } from './Kafka.js';
+export { env, } from './ResourcesEnv.js';
 export { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError, } from './ResourcesErrors.js';
 //# sourceMappingURL=Resources.js.map

package/dist/Resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"Resources.js","sourceRoot":"","sources":["../src/Resources.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"Resources.js","sourceRoot":"","sources":["../src/Resources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EACL,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAA4B,MAAM,iBAAiB,CAAC;AAIrG,OAAO,EACL,iBAAiB,EAGjB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,WAAW,EAKX,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,GAAG,GAUJ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/ResourcesCache.d.ts

@@ -0,0 +1,33 @@
+import { type Schema } from 'effect';
+import type { RuntimeEnvConfig, RuntimeEnvLogger, RuntimeResolveOptions } from './ResourcesEnv.js';
+export interface CachePolicy {
+    readonly staleIfErrorMs: number;
+    readonly cacheMisses: boolean;
+}
+/** The legacy resolver cache, keyed by operation and target; every caller gets its own copy of a value. */
+export declare class RuntimeReadCache {
+    private readonly values;
+    private readonly misses;
+    private readonly inFlight;
+    private readonly defaultTtlMs;
+    readonly readPolicy: CachePolicy;
+    readonly selectPolicy: CachePolicy;
+    private readonly notFoundTtlMs;
+    private readonly missCapPerMinute;
+    private missWindowStart;
+    private readonly missedInWindow;
+    private holdingMisses;
+    private generation;
+    private readonly now;
+    private readonly logger;
+    constructor(config: RuntimeEnvConfig & {
+        readonly logger: RuntimeEnvLogger;
+    });
+    read<A extends Schema.Json>(target: string, options: RuntimeResolveOptions | undefined, policy: CachePolicy, fetch: () => Promise<A>): Promise<A>;
+    private nextGeneration;
+    private rollMissWindow;
+    private recordConfirmedMiss;
+    private invalidate;
+    private load;
+}
+//# sourceMappingURL=ResourcesCache.d.ts.map

package/dist/ResourcesCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesCache.d.ts","sourceRoot":"","sources":["../src/ResourcesCache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAsCnG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAmBD,2GAA2G;AAC3G,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,eAAe,CAA4B;IAEnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IAGpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAE1C,YAAY,MAAM,EAAE,gBAAgB,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,EA2B3E;IAEK,IAAI,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,CAAC,CAAC,CA6CZ;IAED,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,mBAAmB;IAsB3B,OAAO,CAAC,UAAU;YAaJ,IAAI;CAyCnB"}

package/dist/ResourcesCache.js

@@ -0,0 +1,205 @@
+import {} from 'effect';
+import { ExpiringMap } from './ExpiringMap.js';
+import { ResourceNotFoundError, ResourcesUnauthorizedError, ResourcesUnavailableError } from './ResourcesErrors.js';
+import { TOKEN_NOT_PUBLISHED } from './ResourcesToken.js';
+const DEFAULT_TTL_MS = 30_000;
+const DEFAULT_STALE_IF_ERROR_MS = 15 * 60_000;
+const DEFAULT_SELECT_STALE_IF_ERROR_MS = 5 * 60_000;
+const DEFAULT_NOT_FOUND_TTL_MS = 10_000;
+// One tenant costs a select, a resolve, and its Variables, so 1,000 entries held only ~450 tenants per process.
+const DEFAULT_MAX_ENTRIES = 10_000;
+const DEFAULT_MISS_CAP_PER_MINUTE = 60;
+const MISS_WINDOW_MS = 60_000;
+const RETRY_AFTER_UNAVAILABLE_MS = 5_000;
+const readEnvInteger = (name, fallback, min) => {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value >= min ? value : fallback;
+};
+// No usable answer: a transport fault, a timeout, a 5xx, or a token provider that stopped publishing (an API outage).
+// An undeclared 4xx carries its status: it is an answer, so it drops the cached value instead of serving it stale.
+const isOutage = (error) => (error instanceof ResourcesUnavailableError &&
+    (error.status === undefined || error.status >= 500 || error.status < 400)) ||
+    (error instanceof ResourcesUnauthorizedError && error.message === TOKEN_NOT_PUBLISHED);
+/** The legacy resolver cache, keyed by operation and target; every caller gets its own copy of a value. */
+export class RuntimeReadCache {
+    values;
+    // Misses live apart from values so a flood of unknown tenant keys cannot evict the known ones.
+    misses;
+    inFlight = new Map();
+    defaultTtlMs;
+    readPolicy;
+    selectPolicy;
+    notFoundTtlMs;
+    missCapPerMinute;
+    missWindowStart = Number.NEGATIVE_INFINITY;
+    // Distinct select keys the API answered 404 for in the current window, until the cap is reached.
+    missedInWindow = new Set();
+    // Past the cap a 404 is cached until the window ends: every unseen key still reaches the API once, but no key the API
+    // just refused is sent again that minute.
+    holdingMisses = false;
+    generation = 0;
+    now;
+    logger;
+    constructor(config) {
+        // Zero or a negative age would expire every entry on write and turn each read into a resolver call.
+        this.defaultTtlMs =
+            config.defaultTtlMs ?? readEnvInteger('UNNBOUND_RUNTIME_RESOLVE_CACHE_MAX_AGE', DEFAULT_TTL_MS, 1);
+        this.readPolicy = {
+            staleIfErrorMs: config.staleIfErrorMs ??
+                readEnvInteger('TEMPER_RUNTIME_RESOLVE_STALE_IF_ERROR_MAX_AGE', DEFAULT_STALE_IF_ERROR_MS, 0),
+            cacheMisses: false,
+        };
+        this.selectPolicy = {
+            staleIfErrorMs: config.selectStaleIfErrorMs ??
+                readEnvInteger('TEMPER_RUNTIME_RESOLVE_SELECT_STALE_IF_ERROR_MAX_AGE', DEFAULT_SELECT_STALE_IF_ERROR_MS, 0),
+            cacheMisses: true,
+        };
+        this.notFoundTtlMs =
+            config.notFoundTtlMs ?? readEnvInteger('TEMPER_RUNTIME_RESOLVE_NOT_FOUND_MAX_AGE', DEFAULT_NOT_FOUND_TTL_MS, 0);
+        this.missCapPerMinute =
+            config.missCapPerMinute ??
+                readEnvInteger('TEMPER_RUNTIME_RESOLVE_MISS_CAP_PER_MINUTE', DEFAULT_MISS_CAP_PER_MINUTE, 0);
+        const maxEntries = config.maxEntries ?? readEnvInteger('TEMPER_RUNTIME_RESOLVE_CACHE_MAX_ENTRIES', DEFAULT_MAX_ENTRIES, 1);
+        this.values = new ExpiringMap(maxEntries);
+        this.misses = new ExpiringMap(maxEntries);
+        this.now = config.now ?? Date.now;
+        this.logger = config.logger;
+    }
+    async read(target, options, policy, fetch) {
+        // A reader can serve multiple workflow identities during its life; a cache hit must belong to this one.
+        const key = JSON.stringify([
+            process.env.UNNBOUND_API_URL ?? '',
+            process.env.UNNBOUND_WORKFLOW_ID ?? '',
+            process.env.UNNBOUND_DEPLOYMENT_ID ?? '',
+            process.env.TEMPER_ENVIRONMENT ?? process.env.UNNBOUND_ENVIRONMENT ?? '',
+            target,
+        ]);
+        // SAFETY: `key` encodes the operation, so every value under it was stored by the same call site with the same `A`.
+        const deliver = (value) => structuredClone(value);
+        if (options?.cache === false) {
+            const started = this.nextGeneration();
+            try {
+                const value = await fetch();
+                this.invalidate(key, started);
+                return deliver(value);
+            }
+            catch (error) {
+                // Only an outage leaves the cache alone; any API answer replaces what the cache knew about this key.
+                if (!(error instanceof Error && isOutage(error)))
+                    this.invalidate(key, started);
+                throw error;
+            }
+        }
+        const now = this.now();
+        const entry = this.values.get(key, now);
+        if (entry && (now < entry.freshUntil || now < entry.retryAt))
+            return deliver(entry.value);
+        const miss = this.misses.get(key, now);
+        if (miss)
+            throw new ResourceNotFoundError({ target: miss.error.target, message: miss.error.message });
+        const existing = this.inFlight.get(key);
+        if (existing)
+            return deliver(await existing.promise);
+        const token = { superseded: false, generation: this.nextGeneration() };
+        const load = {
+            token,
+            promise: this.load(key, fetch, options?.ttlMs ?? this.defaultTtlMs, policy, token),
+        };
+        this.inFlight.set(key, load);
+        try {
+            return deliver(await load.promise);
+        }
+        finally {
+            if (this.inFlight.get(key) === load)
+                this.inFlight.delete(key);
+        }
+    }
+    nextGeneration() {
+        this.generation += 1;
+        return this.generation;
+    }
+    rollMissWindow(now) {
+        if (now - this.missWindowStart < MISS_WINDOW_MS)
+            return;
+        this.missWindowStart = now;
+        this.missedInWindow.clear();
+        this.holdingMisses = false;
+    }
+    // The cap limits the rate of distinct confirmed misses, never a first request: a valid tenant this process has not
+    // seen is indistinguishable from a rotating miss until the API answers. Returns when the 404 stops being cached.
+    recordConfirmedMiss(key, now) {
+        const expiresAt = now + this.notFoundTtlMs;
+        if (this.missCapPerMinute === 0)
+            return expiresAt;
+        this.rollMissWindow(now);
+        const windowEnd = this.missWindowStart + MISS_WINDOW_MS;
+        if (!this.holdingMisses) {
+            this.missedInWindow.add(key);
+            if (this.missedInWindow.size < this.missCapPerMinute)
+                return expiresAt;
+            this.holdingMisses = true;
+            // The 404s that filled the cap are held too, unless a newer answer or eviction already removed them.
+            for (const missed of this.missedInWindow)
+                this.misses.extend(missed, windowEnd, now);
+            this.missedInWindow.clear();
+            this.logger.warn({ missCapPerMinute: this.missCapPerMinute }, 'Runtime resolver select miss cap reached; keys answered 404 are not sent again until the minute ends.');
+        }
+        return Math.max(expiresAt, windowEnd);
+    }
+    // A `cache: false` answer replaces what older reads cached or still have in flight; a read that started after the
+    // bypass carries a newer answer and stays.
+    invalidate(key, started) {
+        const value = this.values.peek(key);
+        if (value && value.generation < started)
+            this.values.delete(key);
+        const miss = this.misses.peek(key);
+        if (miss && miss.generation < started)
+            this.misses.delete(key);
+        const pending = this.inFlight.get(key);
+        if (pending && pending.token.generation < started) {
+            pending.token.superseded = true;
+            this.inFlight.delete(key);
+        }
+    }
+    // An outage serves the last good value; any answer from the resolver (401, 403, 404, 409) drops it.
+    async load(key, fetch, ttlMs, policy, token) {
+        try {
+            const value = await fetch();
+            // A refresh that a newer `cache: false` answer superseded must not write its older answer back.
+            if (token.superseded)
+                return value;
+            const now = this.now();
+            const freshUntil = now + ttlMs;
+            const entry = { value, freshUntil, retryAt: 0, warned: false, generation: token.generation };
+            this.values.set(key, entry, freshUntil + policy.staleIfErrorMs, now, freshUntil);
+            return value;
+        }
+        catch (error) {
+            // A superseded answer is older than the bypass that replaced it: it neither counts as a miss nor changes the cache.
+            if (token.superseded)
+                throw error;
+            const now = this.now();
+            if (!(error instanceof Error && isOutage(error))) {
+                this.values.delete(key);
+                if (policy.cacheMisses && error instanceof ResourceNotFoundError) {
+                    const expiresAt = this.recordConfirmedMiss(key, now);
+                    this.misses.set(key, { error, generation: token.generation }, expiresAt, now);
+                }
+                throw error;
+            }
+            const last = this.values.get(key, now);
+            if (!last)
+                throw error;
+            last.retryAt = now + RETRY_AFTER_UNAVAILABLE_MS;
+            if (!last.warned) {
+                last.warned = true;
+                this.logger.warn({ err: error.message, staleForMs: now - last.freshUntil }, 'Runtime resolver unavailable; serving the last good value.');
+            }
+            return last.value;
+        }
+    }
+}
+//# sourceMappingURL=ResourcesCache.js.map