@ontemper/sdk 0.7.1-postgresql.2 → 0.7.1-postgresql.3

package/dist/ResourcesCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesCache.js","sourceRoot":"","sources":["../src/ResourcesCache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACpH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC9C,MAAM,gCAAgC,GAAG,CAAC,GAAG,MAAM,CAAC;AACpD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,gHAAgH;AAChH,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEzC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAW,EAAU,EAAE;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxE,CAAC,CAAC;AAEF,sHAAsH;AACtH,mHAAmH;AACnH,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAW,EAAE,CACzC,CAAC,KAAK,YAAY,yBAAyB;IACzC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5E,CAAC,KAAK,YAAY,0BAA0B,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB,CAAC,CAAC;AAkCzF,2GAA2G;AAC3G,MAAM,OAAO,gBAAgB;IACV,MAAM,CAA0B;IACjD,+FAA+F;IAC9E,MAAM,CAAyB;IAC/B,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,YAAY,CAAS;IAC7B,UAAU,CAAc;IACxB,YAAY,CAAc;IAClB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAClC,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,iGAAiG;IAChF,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACpD,sHAAsH;IACtH,0CAA0C;IAClC,aAAa,GAAG,KAAK,CAAC;IACtB,UAAU,GAAG,CAAC,CAAC;IACN,GAAG,CAAe;IAClB,MAAM,CAAmB;IAE1C,YAAY,MAAgE;QAC1E,oGAAoG;QACpG,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC,wCAAwC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,UAAU,GAAG;YAChB,cAAc,EACZ,MAAM,CAAC,cAAc;gBACrB,cAAc,CAAC,+CAA+C,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/F,WAAW,EAAE,KAAK;SACnB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG;YAClB,cAAc,EACZ,MAAM,CAAC,oBAAoB;gBAC3B,cAAc,CAAC,sDAAsD,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7G,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC,0CAA0C,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC,gBAAgB;YACnB,MAAM,CAAC,gBAAgB;gBACvB,cAAc,CAAC,4CAA4C,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,UAAU,GACd,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC,0CAA0C,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAc,EACd,OAA0C,EAC1C,MAAmB,EACnB,KAAuB;QAEvB,wGAAwG;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;YAClC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE;YACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;YACxE,MAAM;SACP,CAAC,CAAC;QACH,mHAAmH;QACnH,MAAM,OAAO,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,eAAe,CAAC,KAAU,CAAC,CAAC;QACpE,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qGAAqG;gBACrG,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI;YAAE,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErD,MAAM,KAAK,GAAc,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAClF,MAAM,IAAI,GAAiB;YACzB,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;SACnF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,IAAI,GAAG,GAAG,IAAI,CAAC,eAAe,GAAG,cAAc;YAAE,OAAO;QACxD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,mHAAmH;IACnH,iHAAiH;IACzG,mBAAmB,CAAC,GAAW,EAAE,GAAW;QAClD,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;QAC3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB;gBAAE,OAAO,SAAS,CAAC;YACvE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,qGAAqG;YACrG,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YACrF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAC3C,uGAAuG,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,kHAAkH;IAClH,2CAA2C;IACnC,UAAU,CAAC,GAAW,EAAE,OAAe;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,GAAG,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,EAAE,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,IAAI,CAChB,GAAW,EACX,KAAiC,EACjC,KAAa,EACb,MAAmB,EACnB,KAAgB;QAEhB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;YAC5B,gGAAgG;YAChG,IAAI,KAAK,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,GAAG,GAAG,KAAK,CAAC;YAC/B,MAAM,KAAK,GAAe,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACzG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oHAAoH;YACpH,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,KAAK,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;oBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,0BAA0B,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,EACzD,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;CACF"}

package/dist/ResourcesEnv.d.ts

@@ -0,0 +1,81 @@
+import { Effect, Schema } from 'effect';
+import { type JsonObject, type RecordSchema } from './ResourceRecords.js';
+import { RuntimeReadCache } from './ResourcesCache.js';
+import { type InspectedResource } from './RuntimeResources.js';
+/** Per-read cache control, as in `@ontemper/resources`. */
+export interface RuntimeResolveOptions {
+    /** `false` reads the resolver and replaces what the cache held for this read. */
+    cache?: boolean;
+    /** How long this answer stays fresh; default 30 s (`UNNBOUND_RUNTIME_RESOLVE_CACHE_MAX_AGE`). */
+    ttlMs?: number;
+}
+/** The resource record as `inspect` returns it: literal fields only, secrets left to `resolve`. */
+export type RuntimeResourceRecord = InspectedResource;
+export interface RuntimeSelectResourceInput {
+    resourceTypeKey: string;
+    match: Record<string, string>;
+}
+export interface RuntimeSelectResourceOutput {
+    key: string;
+}
+/** Where a warning goes; the SDK line logger on stdout by default. */
+export interface RuntimeEnvLogger {
+    readonly warn: (fields: Readonly<Record<string, string | number>>, message: string) => void;
+}
+/** Cache settings; each defaults to its `@ontemper/resources` environment variable, then to the legacy default. */
+export interface RuntimeEnvConfig {
+    readonly now?: () => number;
+    readonly defaultTtlMs?: number;
+    /** How long past its TTL a value still serves while the resolver is unavailable; 0 turns stale serving off. */
+    readonly staleIfErrorMs?: number;
+    /** The same window for `select`, shorter because a selection can authorize a tenant the API now refuses. */
+    readonly selectStaleIfErrorMs?: number;
+    readonly notFoundTtlMs?: number;
+    readonly maxEntries?: number;
+    /** Distinct `select` 404s per minute; past it, a 404 stays cached until the minute ends. 0 turns it off. */
+    readonly missCapPerMinute?: number;
+    readonly logger?: RuntimeEnvLogger;
+}
+declare const makeClient: Effect.Effect<{
+    tunnelToken: Effect.Effect<string, import("./ResourcesErrors.js").ResourcesUnauthorizedError, never>;
+    variable: (key: string) => Effect.Effect<string, import("./RuntimeResources.js").ReadError, never>;
+    resolve: (key: string) => Effect.Effect<Schema.Json, import("./RuntimeResources.js").ReadError, never>;
+    inspect: (key: string) => Effect.Effect<InspectedResource, import("./RuntimeResources.js").ReadError>;
+    select: (selector: import("./RuntimeResources.js").ResourceSelector) => Effect.Effect<string, import("./ResourcesErrors.js").ResourceNotSelectableError | import("./RuntimeResources.js").ReadError, never>;
+}, never, import("effect/http/HttpClient").HttpClient>;
+type Client = Effect.Success<typeof makeClient>;
+/** `env.resources`: the reads of `@ontemper/resources` `ResourceAccessor`. */
+export declare class RuntimeResourceReads {
+    private readonly cache;
+    private readonly connect;
+    constructor(cache: RuntimeReadCache, connect: () => Promise<Client>);
+    /** The record without its secret fields: type, scope, and literal values. */
+    inspect(key: string, options?: RuntimeResolveOptions): Promise<RuntimeResourceRecord>;
+    /** The value with every secret field filled in; given a `schema` (such as `SftpResource`), the decoded value. */
+    resolve(key: string, schema?: undefined, options?: RuntimeResolveOptions): Promise<JsonObject>;
+    resolve<S extends RecordSchema>(key: string, schema: S, options?: RuntimeResolveOptions): Promise<S['Type']>;
+    /** The key of the record whose selectable field matches; feed it to `resolve`. */
+    select(input: RuntimeSelectResourceInput, options?: RuntimeResolveOptions): Promise<RuntimeSelectResourceOutput>;
+}
+/** `env.variables`: live Variable reads through the runtime resolver. */
+export declare class RuntimeVariableReads {
+    private readonly cache;
+    private readonly connect;
+    constructor(cache: RuntimeReadCache, connect: () => Promise<Client>);
+    /** The Variable's live value. */
+    get(key: string, options?: RuntimeResolveOptions): Promise<string>;
+}
+/** One reader per process, with the Run token of `UNNBOUND_RUNTIME_TOKEN_FILE` or `UNNBOUND_RUNTIME_TOKEN`. */
+export declare class RuntimeEnv {
+    readonly resources: RuntimeResourceReads;
+    readonly variables: RuntimeVariableReads;
+    private client;
+    constructor(config?: RuntimeEnvConfig);
+}
+/**
+ * Promise reads of Resources and Variables, with the signatures of `@ontemper/resources` `env`. Errors reject with
+ * the SDK's Resource errors; `ResourceNotFoundError` means that no record answers the key or the `select` match.
+ */
+export declare const env: Pick<RuntimeEnv, 'resources' | 'variables'>;
+export {};
+//# sourceMappingURL=ResourcesEnv.d.ts.map

package/dist/ResourcesEnv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesEnv.d.ts","sourceRoot":"","sources":["../src/ResourcesEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,MAAM,EAAuB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGpF,OAAO,EAAgB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,KAAK,iBAAiB,EAAyB,MAAM,uBAAuB,CAAC;AAMtF,2DAA2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mGAAmG;AACnG,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEtD,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7F;AAED,mHAAmH;AACnH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+GAA+G;IAC/G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4GAA4G;IAC5G,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4GAA4G;IAC5G,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC;AA8CD,QAAA,MAAM,UAAU;;;;;;sDAAqC,CAAC;AACtD,KAAK,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,UAAU,CAAC,CAAC;AAiBhD,8EAA8E;AAC9E,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAF1B,YACmB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC7C;IAEJ,6EAA6E;IACvE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAK1F;IAED,iHAAiH;IACjH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC,SAAS,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAa7G,kFAAkF;IAC5E,MAAM,CACV,KAAK,EAAE,0BAA0B,EACjC,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,2BAA2B,CAAC,CAStC;CACF;AAED,yEAAyE;AACzE,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAF1B,YACmB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC7C;IAEJ,iCAAiC;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAKvE;CACF;AAED,+GAA+G;AAC/G,qBAAa,UAAU;IACrB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,OAAO,CAAC,MAAM,CAA8B;IAE5C,YAAY,MAAM,GAAE,gBAAqB,EAQxC;CACF;AAED;;;GAGG;AACH,eAAO,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,WAAW,CAAoB,CAAC"}

package/dist/ResourcesEnv.js

@@ -0,0 +1,104 @@
+import { Cause, ConfigProvider, Effect, Exit, Layer, Option, Schema } from 'effect';
+import { FetchHttpClient } from 'effect/http';
+import { loggerLayer, writeStdoutLine } from './Logger.js';
+import { decodeRecord } from './ResourceRecords.js';
+import { RuntimeReadCache } from './ResourcesCache.js';
+import { InvalidResourceError } from './ResourcesErrors.js';
+import { runtimeResourceClient } from './RuntimeResources.js';
+const normalizeKey = (key) => {
+    const normalized = key.trim();
+    if (!normalized)
+        throw new Error('Runtime resolver key is required.');
+    return normalized;
+};
+// Key order must not split the cache: `{a,b}` and `{b,a}` select the same record.
+const selectTarget = ({ resourceTypeKey, match }) => JSON.stringify([
+    resourceTypeKey,
+    Object.keys(match)
+        .sort()
+        .map((field) => [field, match[field]]),
+]);
+const decodeJsonObject = Schema.decodeUnknownOption(Schema.Record(Schema.String, Schema.MutableJson));
+// The resolver answers a record as a JSON object; anything else cannot serve the read.
+const asRecord = (key, value) => {
+    const record = Option.getOrUndefined(decodeJsonObject(value));
+    return record !== undefined
+        ? Effect.succeed(record)
+        : Effect.fail(new InvalidResourceError({ target: `key ${key}`, message: `Resource ${key} did not resolve to a JSON object` }));
+};
+// The live environment on every read, as `workflow()` provides it; Effect's default provider keeps a first-use copy.
+const liveConfig = Layer.unwrap(Effect.sync(() => ConfigProvider.layer(ConfigProvider.fromEnvRecord(process.env, { preserveEmptyStrings: true }))));
+const standalone = loggerLayer(writeStdoutLine).pipe(Layer.orDie, Layer.provideMerge(liveConfig));
+const run = async (effect) => {
+    const exit = await Effect.runPromiseExit(effect.pipe(Effect.provide(liveConfig)));
+    if (Exit.isSuccess(exit))
+        return exit.value;
+    throw Cause.squash(exit.cause);
+};
+const sdkLogger = {
+    warn: (fields, message) => Effect.runFork(Effect.logWarning(message).pipe(Effect.annotateLogs(fields), Effect.provide(standalone))),
+};
+const makeClient = runtimeResourceClient('unexpired');
+// A resolve 404 cannot tell a missing record from a broken reference inside a found one; inspect answers 404 only
+// for the first, as the `./resources` PostgreSQL pool reads it.
+const resolveRecord = (client, key) => client.resolve(key).pipe(Effect.catchTag('ResourceNotFoundError', (notFound) => client.inspect(key).pipe(Effect.catchTag('ResourceNotFoundError', () => Effect.fail(notFound)), Effect.flatMap(() => Effect.fail(new InvalidResourceError({ target: notFound.target, message: notFound.message }))))), Effect.flatMap((value) => asRecord(key, value)));
+/** `env.resources`: the reads of `@ontemper/resources` `ResourceAccessor`. */
+export class RuntimeResourceReads {
+    cache;
+    connect;
+    constructor(cache, connect) {
+        this.cache = cache;
+        this.connect = connect;
+    }
+    /** The record without its secret fields: type, scope, and literal values. */
+    async inspect(key, options) {
+        const normalized = normalizeKey(key);
+        return this.cache.read(`resource.inspect:${normalized}`, options, this.cache.readPolicy, async () => run((await this.connect()).inspect(normalized)));
+    }
+    async resolve(key, schema, options) {
+        const normalized = normalizeKey(key);
+        const value = await this.cache.read(`resource.resolve:${normalized}`, options, this.cache.readPolicy, async () => run(resolveRecord(await this.connect(), normalized)));
+        return schema === undefined ? value : run(decodeRecord(schema, normalized, value));
+    }
+    /** The key of the record whose selectable field matches; feed it to `resolve`. */
+    async select(input, options) {
+        const selector = { resourceTypeKey: input.resourceTypeKey, match: { ...input.match } };
+        const key = await this.cache.read(`resource.select:${selectTarget(selector)}`, options, this.cache.selectPolicy, async () => run((await this.connect()).select(selector)));
+        return { key };
+    }
+}
+/** `env.variables`: live Variable reads through the runtime resolver. */
+export class RuntimeVariableReads {
+    cache;
+    connect;
+    constructor(cache, connect) {
+        this.cache = cache;
+        this.connect = connect;
+    }
+    /** The Variable's live value. */
+    async get(key, options) {
+        const normalized = normalizeKey(key);
+        return this.cache.read(`variable.resolve:${normalized}`, options, this.cache.readPolicy, async () => run((await this.connect()).variable(normalized)));
+    }
+}
+/** One reader per process, with the Run token of `UNNBOUND_RUNTIME_TOKEN_FILE` or `UNNBOUND_RUNTIME_TOKEN`. */
+export class RuntimeEnv {
+    resources;
+    variables;
+    client;
+    constructor(config = {}) {
+        const cache = new RuntimeReadCache({ ...config, logger: config.logger ?? sdkLogger });
+        const connect = () => {
+            this.client ??= Effect.runPromise(makeClient.pipe(Effect.provide(FetchHttpClient.layer)));
+            return this.client;
+        };
+        this.resources = new RuntimeResourceReads(cache, connect);
+        this.variables = new RuntimeVariableReads(cache, connect);
+    }
+}
+/**
+ * Promise reads of Resources and Variables, with the signatures of `@ontemper/resources` `env`. Errors reject with
+ * the SDK's Resource errors; `ResourceNotFoundError` means that no record answers the key or the `select` match.
+ */
+export const env = new RuntimeEnv();
+//# sourceMappingURL=ResourcesEnv.js.map

package/dist/ResourcesEnv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourcesEnv.js","sourceRoot":"","sources":["../src/ResourcesEnv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAsC,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAA0B,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AA8CtF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAU,EAAE;IAC3C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,YAAY,GAAG,CAAC,EAAE,eAAe,EAAE,KAAK,EAA8B,EAAU,EAAE,CACtF,IAAI,CAAC,SAAS,CAAC;IACb,eAAe;IACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACf,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAEtG,uFAAuF;AACvF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,KAAkB,EAAmD,EAAE;IACpG,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,mCAAmC,EAAE,CAAC,CAChH,CAAC;AACR,CAAC,CAAC;AAEF,qHAAqH;AACrH,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CACnH,CAAC;AACF,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AAElG,MAAM,GAAG,GAAG,KAAK,EAAQ,MAA2B,EAAc,EAAE;IAClE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC5C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,SAAS,GAAqB;IAClC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;CAC3G,CAAC;AAEF,MAAM,UAAU,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;AAGtD,kHAAkH;AAClH,gEAAgE;AAChE,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CACtB,MAAM,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EACrE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAC9F,CACF,CACF,EACD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAChD,CAAC;AAEJ,8EAA8E;AAC9E,MAAM,OAAO,oBAAoB;IAEZ,KAAK;IACL,OAAO;IAF1B,YACmB,KAAuB,EACvB,OAA8B;qBAD9B,KAAK;uBACL,OAAO;IACvB,CAAC;IAEJ,6EAA6E;IAC7E,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,OAA+B;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAClG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,OAAO,CACX,GAAW,EACX,MAAU,EACV,OAA+B;QAE/B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAC/G,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC,CACrD,CAAC;QACF,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,MAAM,CACV,KAAiC,EACjC,OAA+B;QAE/B,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC/B,mBAAmB,YAAY,CAAC,QAAQ,CAAC,EAAE,EAC3C,OAAO,EACP,IAAI,CAAC,KAAK,CAAC,YAAY,EACvB,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,OAAO,oBAAoB;IAEZ,KAAK;IACL,OAAO;IAF1B,YACmB,KAAuB,EACvB,OAA8B;qBAD9B,KAAK;uBACL,OAAO;IACvB,CAAC;IAEJ,iCAAiC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAA+B;QACpD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAClG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;CACF;AAED,+GAA+G;AAC/G,MAAM,OAAO,UAAU;IACZ,SAAS,CAAuB;IAChC,SAAS,CAAuB;IACjC,MAAM,CAA8B;IAE5C,YAAY,MAAM,GAAqB,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,GAAG,GAAgD,IAAI,UAAU,EAAE,CAAC"}

package/dist/ResourcesErrors.d.ts

@@ -28,8 +28,12 @@ export declare class ResourcesUnauthorizedError extends ResourcesUnauthorizedErr
 }
 declare const ResourcesUnavailableError_base: Schema.Class<ResourcesUnavailableError, Schema.TaggedStruct<"ResourcesUnavailableError", {
     readonly message: Schema.String;
+    readonly status: Schema.optional<Schema.Number>;
 }>, import("effect/Cause").YieldableError>;
-/** The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, or a body the SDK cannot read. */
+/**
+ * The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, a status the contract does not
+ * declare, or a body the SDK cannot read. `status` is the HTTP status when an answer arrived.
+ */
 export declare class ResourcesUnavailableError extends ResourcesUnavailableError_base {
 }
 export {};

package/dist/ResourcesErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourcesErrors.d.ts","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;AAIhC,2HAA2H;AAC3H,qBAAa,qBAAsB,SAAQ,0BAGzC;CAAG;;;;;AAEL,+HAA+H;AAC/H,qBAAa,0BAA2B,SAAQ,+BAM/C;CAAG;;;;;AAEJ,sJAAsJ;AACtJ,qBAAa,oBAAqB,SAAQ,yBAGxC;CAAG;;;;AAEL,4IAA4I;AAC5I,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;;;;AAEJ,mHAAmH;AACnH,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG"}
+{"version":3,"file":"ResourcesErrors.d.ts","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;AAIhC,2HAA2H;AAC3H,qBAAa,qBAAsB,SAAQ,0BAGzC;CAAG;;;;;AAEL,+HAA+H;AAC/H,qBAAa,0BAA2B,SAAQ,+BAM/C;CAAG;;;;;AAEJ,sJAAsJ;AACtJ,qBAAa,oBAAqB,SAAQ,yBAGxC;CAAG;;;;AAEL,4IAA4I;AAC5I,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;;;;;AAEJ;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG"}

package/dist/ResourcesErrors.js

@@ -21,7 +21,10 @@ export class InvalidResourceError extends Schema.TaggedError()('InvalidResourceE
 /** The runtime identity is missing or refused: no API URL or runtime token, a provider that never published a fresh token, or a 401/403. */
 export class ResourcesUnauthorizedError extends Schema.TaggedError()('ResourcesUnauthorizedError', { message: Schema.String }) {
 }
-/** The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, or a body the SDK cannot read. */
-export class ResourcesUnavailableError extends Schema.TaggedError()('ResourcesUnavailableError', { message: Schema.String }) {
+/**
+ * The runtime API gave no usable answer: a transport failure, a timeout, a 5xx, a status the contract does not
+ * declare, or a body the SDK cannot read. `status` is the HTTP status when an answer arrived.
+ */
+export class ResourcesUnavailableError extends Schema.TaggedError()('ResourcesUnavailableError', { message: Schema.String, status: Schema.optional(Schema.Number) }) {
 }
 //# sourceMappingURL=ResourcesErrors.js.map

package/dist/ResourcesErrors.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResourcesErrors.js","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,gHAAgH;AAEhH,2HAA2H;AAC3H,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CAAC,uBAAuB,EAAE;IAC9G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,+HAA+H;AAC/H,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B;IACE,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ,sJAAsJ;AACtJ,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAAC,sBAAsB,EAAE;IAC3G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,4IAA4I;AAC5I,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG;AAEJ,mHAAmH;AACnH,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG"}
+{"version":3,"file":"ResourcesErrors.js","sourceRoot":"","sources":["../src/ResourcesErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,gHAAgH;AAEhH,2HAA2H;AAC3H,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CAAC,uBAAuB,EAAE;IAC9G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,+HAA+H;AAC/H,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B;IACE,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ,sJAAsJ;AACtJ,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAAC,sBAAsB,EAAE;IAC3G,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,4IAA4I;AAC5I,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACnE;CAAG"}

package/dist/ResourcesToken.d.ts

@@ -1,10 +1,19 @@
 import { Effect } from 'effect';
 import { ResourcesUnauthorizedError } from './ResourcesErrors.js';
+/** The provider published no usable token in time; the promise `env` reads it as an outage, as `@ontemper/resources` did. */
+export declare const TOKEN_NOT_PUBLISHED = "Runtime resolver token provider did not publish a fresh token.";
+/**
+ * Which token a read sends. `refreshWindow` waits for a token outside the refresh window: a database tunnel re-checks
+ * it every 2 s. `unexpired` sends any unexpired token at once and waits 2 s for an expired one, as the legacy
+ * resolver did, so a stalled provider costs a short wait and an outage instead of a 35 s stall.
+ */
+export type RuntimeTokenPolicy = 'refreshWindow' | 'unexpired';
 export interface RuntimeTokens {
     /** The provider's token when it outlives the refresh window, otherwise the next one it publishes. */
     readonly current: Effect.Effect<string, ResourcesUnauthorizedError>;
     /** The first usable token other than the one the runtime API just refused. */
     readonly replacing: (refused: string) => Effect.Effect<string, ResourcesUnauthorizedError>;
 }
+export declare const makeRuntimeTokensWith: (policy: RuntimeTokenPolicy) => Effect.Effect<RuntimeTokens>;
 export declare const makeRuntimeTokens: Effect.Effect<RuntimeTokens>;
 //# sourceMappingURL=ResourcesToken.d.ts.map

package/dist/ResourcesToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResourcesToken.d.ts","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,MAAM,EAAsC,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAwElE,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACpE,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CAC5F;AAED,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAWzD,CAAC"}
+{"version":3,"file":"ResourcesToken.d.ts","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,MAAM,EAAsC,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,6HAA6H;AAC7H,eAAO,MAAM,mBAAmB,mEAAmE,CAAC;AAqBpG;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,WAAW,CAAC;AAoD/D,MAAM,WAAW,aAAa;IAC5B,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IACpE,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CAC5F;AAED,eAAO,MAAM,qBAAqB,WAAY,kBAAkB,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAqB1F,CAAC;AAEL,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAA0C,CAAC"}

package/dist/ResourcesToken.js

@@ -1,6 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { Cache, Clock, Config, Duration, Effect, Option, Redacted, Schedule, Schema } from 'effect';
 import { ResourcesUnauthorizedError } from './ResourcesErrors.js';
+/** The provider published no usable token in time; the promise `env` reads it as an outage, as `@ontemper/resources` did. */
+export const TOKEN_NOT_PUBLISHED = 'Runtime resolver token provider did not publish a fresh token.';
 /** A token this close to `exp` could lapse mid-request, so it counts as spent. */
 const REFRESH_WINDOW_MS = 30_000;
 /** Providers republish well inside this: the k8s refresher every 30 s, the Firecracker host on every renewal. */
@@ -8,11 +10,13 @@ const PUBLISH_TIMEOUT = Duration.seconds(35);
 const POLL_INTERVAL = Duration.millis(100);
 const TokenExpiry = Schema.StringFromBase64Url.pipe(Schema.decodeTo(Schema.fromJsonString(Schema.Struct({ exp: Schema.Number }))));
 const decodeTokenExpiry = Schema.decodeUnknownOption(TokenExpiry);
-/** Only a JWT that outlives the refresh window is sent; one without `exp` never is, as in `@ontemper/resources`. */
-const outlivesRefreshWindow = (token, now) => Option.match(decodeTokenExpiry(token.split('.')[1]), {
+/** Whether a JWT outlives `marginMs` from `now`; one without `exp` never does, as in `@ontemper/resources`. */
+const outlives = (token, now, marginMs) => Option.match(decodeTokenExpiry(token.split('.')[1]), {
     onNone: () => false,
-    onSome: ({ exp }) => exp * 1000 - now > REFRESH_WINDOW_MS,
+    onSome: ({ exp }) => exp * 1000 - now > marginMs,
 });
+const outlivesRefreshWindow = (token, now) => outlives(token, now, REFRESH_WINDOW_MS);
+const EXPIRED_TOKEN_WAIT = Duration.seconds(2);
 const TokenSources = Config.all({
     file: Config.option(Config.String('UNNBOUND_RUNTIME_TOKEN_FILE')),
     token: Config.option(Config.Redacted('UNNBOUND_RUNTIME_TOKEN')),
@@ -47,19 +51,28 @@ const awaitPublished = (refused) => Effect.gen(function* () {
 // `until` stops only on Some; stable Effect no longer narrows the repeated value to it.
 Effect.map((published) => Option.getOrThrow(published)), Effect.timeoutOrElse({
     duration: PUBLISH_TIMEOUT,
-    orElse: () => Effect.fail(new ResourcesUnauthorizedError({ message: 'Runtime resolver token provider did not publish a fresh token.' })),
+    orElse: () => Effect.fail(new ResourcesUnauthorizedError({ message: TOKEN_NOT_PUBLISHED })),
 }));
-export const makeRuntimeTokens = Effect.gen(function* () {
+export const makeRuntimeTokensWith = (policy) => Effect.gen(function* () {
     // Waiters on one refused token share a single poll; a refusal of a newer token starts its own.
     const published = yield* Cache.makeWith(awaitPublished, { capacity: 8, timeToLive: () => Duration.zero });
     const replacing = (refused) => Cache.get(published, refused);
     const current = Effect.gen(function* () {
         const token = yield* readToken;
         const now = yield* Clock.currentTimeMillis;
-        if (Option.isSome(token) && outlivesRefreshWindow(token.value, now))
+        if (Option.isNone(token))
+            return yield* replacing('');
+        if (policy === 'refreshWindow') {
+            return outlivesRefreshWindow(token.value, now) ? token.value : yield* replacing(token.value);
+        }
+        if (outlives(token.value, now, 0))
             return token.value;
-        return yield* replacing(Option.getOrElse(token, () => ''));
+        return yield* replacing(token.value).pipe(Effect.timeoutOrElse({
+            duration: EXPIRED_TOKEN_WAIT,
+            orElse: () => Effect.fail(new ResourcesUnauthorizedError({ message: TOKEN_NOT_PUBLISHED })),
+        }));
     });
     return { current, replacing };
 });
+export const makeRuntimeTokens = makeRuntimeTokensWith('refreshWindow');
 //# sourceMappingURL=ResourcesToken.js.map

package/dist/ResourcesToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResourcesToken.js","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,iHAAiH;AACjH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAC9E,CAAC;AACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;AAElE,oHAAoH;AACpH,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAE,GAAW,EAAW,EAAE,CACpE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;IACnD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,iBAAiB;CAC1D,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;CAChE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,0CAA0C,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAClH,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,4FAA4F;SACtG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,IAAI,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7G,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAc,EAAE,CAAC;AACzF,wFAAwF;AACxF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EACvD,MAAM,CAAC,aAAa,CAAC;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAC9G;CACJ,CAAC,CACH,CAAC;AASJ,MAAM,CAAC,MAAM,iBAAiB,GAAiC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjF,+FAA+F;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACxF,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"ResourcesToken.js","sourceRoot":"","sources":["../src/ResourcesToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE,6HAA6H;AAC7H,MAAM,CAAC,MAAM,mBAAmB,GAAG,gEAAgE,CAAC;AAEpG,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,iHAAiH;AACjH,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAE3C,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAC9E,CAAC;AACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;AAElE,+GAA+G;AAC/G,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,QAAgB,EAAW,EAAE,CACzE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;IACnD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,QAAQ;CACjD,CAAC,CAAC;AACL,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAE,GAAW,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAQ/G,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;CAChE,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,0CAA0C,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAClH,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,4FAA4F;SACtG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,IAAI,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7G,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAc,EAAE,CAAC;AACzF,wFAAwF;AACxF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EACvD,MAAM,CAAC,aAAa,CAAC;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;CAC5F,CAAC,CACH,CAAC;AASJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAA0B,EAAgC,EAAE,CAChG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,+FAA+F;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,aAAa,CAAC;YACnB,QAAQ,EAAE,kBAAkB;YAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;SAC5F,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAiC,qBAAqB,CAAC,eAAe,CAAC,CAAC"}

package/dist/RuntimeResources.d.ts

@@ -2,20 +2,35 @@ import { Context, Effect, Layer, Redacted, Schema } from 'effect';
 import { HttpClient } from 'effect/http';
 import { type RuntimeInspectedResourceSchema, type SelectResourceRuntimeInputSchema } from './Contract/RuntimeApi.js';
 import { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError } from './ResourcesErrors.js';
+import { type RuntimeTokenPolicy } from './ResourcesToken.js';
 /** Finds the one record of a type whose `x-selectable` field equals the value a tenant presented. */
 export type ResourceSelector = typeof SelectResourceRuntimeInputSchema.Type;
-export type ReadError = ResourceNotFoundError | ResourcesUnauthorizedError | ResourcesUnavailableError;
+export type ReadError = ResourceNotFoundError | InvalidResourceError | ResourcesUnauthorizedError | ResourcesUnavailableError;
 /** The resolver's answer to `inspect`: literal fields and metadata, never a secret. */
 export type InspectedResource = typeof RuntimeInspectedResourceSchema.Type;
-/** Uncached runtime reads for the PostgreSQL subpath: a record, its metadata, and the current runtime token. */
+/** Uncached runtime reads and the current runtime token; the promise `env` sends any unexpired token, as legacy did. */
+export declare const runtimeResourceClient: (policy: RuntimeTokenPolicy) => Effect.Effect<{
+    /**
+     * The token for one database tunnel; re-read on every call, never cached by the caller. The tunnel re-checks it
+     * every 2 s, so a token in its 30 s refresh window would end the connection when it expires.
+     */
+    tunnelToken: Effect.Effect<string, ResourcesUnauthorizedError, never>;
+    variable: (key: string) => Effect.Effect<string, ReadError, never>;
+    resolve: (key: string) => Effect.Effect<Schema.Json, ReadError, never>;
+    inspect: (key: string) => Effect.Effect<InspectedResource, ReadError>;
+    select: (selector: ResourceSelector) => Effect.Effect<string, ResourceNotSelectableError | ReadError, never>;
+}, never, HttpClient.HttpClient>;
+/** The `./postgresql` client: tunnel tokens must outlive their refresh window. */
 export declare const makeRuntimeResourceClient: Effect.Effect<{
     /**
      * The token for one database tunnel; re-read on every call, never cached by the caller. The tunnel re-checks it
      * every 2 s, so a token in its 30 s refresh window would end the connection when it expires.
      */
     tunnelToken: Effect.Effect<string, ResourcesUnauthorizedError, never>;
-    resolve: (key: string) => Effect.Effect<Schema.Json, InvalidResourceError | ReadError, never>;
+    variable: (key: string) => Effect.Effect<string, ReadError, never>;
+    resolve: (key: string) => Effect.Effect<Schema.Json, ReadError, never>;
     inspect: (key: string) => Effect.Effect<InspectedResource, ReadError>;
+    select: (selector: ResourceSelector) => Effect.Effect<string, ResourceNotSelectableError | ReadError, never>;
 }, never, HttpClient.HttpClient>;
 /** What declared resources read through: the Temper runtime API in production, fixed values in tests. */
 export interface ResourceReader {

package/dist/RuntimeResources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RuntimeResources.d.ts","sourceRoot":"","sources":["../src/RuntimeResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,OAAO,EAAY,MAAM,EAAQ,KAAK,EAAU,QAAQ,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAErH,OAAO,EAAE,UAAU,EAA2C,MAAM,aAAa,CAAC;AAElF,OAAO,EAQL,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAY9B,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAC;AAE5E,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,0BAA0B,GAAG,yBAAyB,CAAC;AA0BvG,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAoG3E,gHAAgH;AAChH,eAAO,MAAM,yBAAyB;IACpC;;;OAGG;;mBAEY,MAAM;mBASN,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC;gCAQlE,CAAC;AAsDJ,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAAC,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,CACf,QAAQ,EAAE,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,0BAA0B,GAAG,oBAAoB,CAAC,CAAC;CAC3F;;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;IAEC,MAAM,CAAC,QAAQ,CAAC,KAAK,8DAAiD;CACvE"}
+{"version":3,"file":"RuntimeResources.d.ts","sourceRoot":"","sources":["../src/RuntimeResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,OAAO,EAAY,MAAM,EAAQ,KAAK,EAAU,QAAQ,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAErH,OAAO,EAAE,UAAU,EAA2C,MAAM,aAAa,CAAC;AAElF,OAAO,EAQL,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,EACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAWrF,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAC;AAE5E,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,0BAA0B,GAC1B,yBAAyB,CAAC;AA0B9B,uFAAuF;AACvF,MAAM,MAAM,iBAAiB,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AAuJ3E,wHAAwH;AACxH,eAAO,MAAM,qBAAqB,WAAY,kBAAkB;IAI1D;;;OAGG;;oBAEa,MAAM;mBACP,MAAM;mBACN,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC;uBAChD,gBAAgB;gCAErC,CAAC;AAEL,kFAAkF;AAClF,eAAO,MAAM,yBAAyB;IAbhC;;;OAGG;;oBAEa,MAAM;mBACP,MAAM;mBACN,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC;uBAChD,gBAAgB;gCAKsC,CAAC;AA8BhF,yGAAyG;AACzG,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAAC,CAAC;IAChG,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,CACf,QAAQ,EAAE,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,0BAA0B,GAAG,oBAAoB,CAAC,CAAC;CAC3F;;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAErC;IAEC,MAAM,CAAC,QAAQ,CAAC,KAAK,8DAAiD;CACvE"}

package/dist/RuntimeResources.js

@@ -5,7 +5,7 @@ import { HttpApiClient } from 'effect/http-api';
 import { ResourcesRuntimeApi, } from './Contract/RuntimeApi.js';
 import { registerSecrets } from './Redaction.js';
 import { InvalidResourceError, ResourceNotFoundError, ResourceNotSelectableError, ResourcesUnauthorizedError, ResourcesUnavailableError, } from './ResourcesErrors.js';
-import { makeRuntimeTokens } from './ResourcesToken.js';
+import { makeRuntimeTokensWith } from './ResourcesToken.js';
 // Resolved values are live configuration: an edit, or a revoked secret, reaches a warm process within this window.
 const CACHE_TTL = Duration.seconds(30);
 // Bounds memory for a workflow that selects across many tenants; the least recently read entry goes first.
@@ -27,8 +27,8 @@ const statusOfRuntimeError = {
     RuntimeResourcesUnavailableError: 503,
 };
 // One authenticated runtime API caller; `RuntimeResources` and the `@temper/workflow/resources` pools share it.
-const makeRuntimeCaller = Effect.gen(function* () {
-    const tokens = yield* makeRuntimeTokens;
+const runtimeCaller = (policy) => Effect.gen(function* () {
+    const tokens = yield* makeRuntimeTokensWith(policy);
     // Each attempt's scope owns its request: leaving the scope aborts it, so no response outlives its attempt.
     const platform = HttpClient.withScope(yield* HttpClient.HttpClient).pipe(HttpClient.mapRequestEffect((request) => Config.NonEmptyString('UNNBOUND_API_URL').pipe(Effect.map((apiUrl) => HttpClientRequest.prependUrl(request, apiUrl)), Effect.mapError(() => new ApiUrlMissing()))));
     // A 401's body is the fixed `Unauthorized`; failing before it is read lets a refused attempt end at once.
@@ -46,9 +46,13 @@ const makeRuntimeCaller = Effect.gen(function* () {
                 case 'TokenRefused':
                     return new ResourcesUnauthorizedError({ message: failed('401 Unauthorized') });
                 case 'HttpClientError':
-                    return new ResourcesUnavailableError({
-                        message: failed(error.response === undefined ? error.message : `${error.response.status}`),
-                    });
+                    // An undeclared 4xx is still an answer; the promise `env` drops its cached value on it, as legacy did.
+                    return error.response === undefined
+                        ? new ResourcesUnavailableError({ message: failed(error.message) })
+                        : new ResourcesUnavailableError({
+                            message: failed(`${error.response.status}`),
+                            status: error.response.status,
+                        });
                 case 'SchemaError':
                     return new ResourcesUnavailableError({ message: failed('unreadable answer') });
                 default: {
@@ -58,7 +62,10 @@ const makeRuntimeCaller = Effect.gen(function* () {
                         return new ResourcesUnauthorizedError({ message });
                     if (status === 404)
                         return new ResourceNotFoundError({ target, message });
-                    return refuse(status, message) ?? new ResourcesUnavailableError({ message });
+                    return (refuse(status, message) ??
+                        (status >= 400 && status < 500
+                            ? new InvalidResourceError({ target, message })
+                            : new ResourcesUnavailableError({ message })));
                 }
             }
         };
@@ -76,41 +83,58 @@ const makeRuntimeCaller = Effect.gen(function* () {
             const first = yield* attempt(client.resourcesRuntime, token).pipe(Effect.map(Option.some), Effect.catchTag('TokenRefused', () => Effect.succeedNone));
             if (Option.isSome(first))
                 return first.value;
-            return yield* attempt(client.resourcesRuntime, yield* tokens.replacing(token));
+            // A refused token stays a refusal if its provider cannot replace it; a cached credential must never outlive it.
+            const replacement = yield* tokens.replacing(token).pipe(Effect.mapError(() => new TokenRefused()));
+            return yield* attempt(client.resourcesRuntime, replacement);
         }).pipe(Effect.catchIf((error) => error._tag !== 'ResourcesUnauthorizedError' && error._tag !== 'ResourcesUnavailableError', (error) => Effect.fail(toReadError(error))));
     };
     return { tokens, call };
 });
 // Registers the answer's secrets in the caller's context, so a cached read masks them like a fresh one.
 const unwrap = (read) => read.pipe(Effect.tap(({ redactionMasks }) => registerSecrets(redactionMasks ?? [])), Effect.map(({ value }) => value));
-/** Uncached runtime reads for the PostgreSQL subpath: a record, its metadata, and the current runtime token. */
-export const makeRuntimeResourceClient = Effect.map(makeRuntimeCaller, ({ tokens, call }) => ({
-    /**
-     * The token for one database tunnel; re-read on every call, never cached by the caller. The tunnel re-checks it
-     * every 2 s, so a token in its 30 s refresh window would end the connection when it expires.
-     */
-    tunnelToken: tokens.current,
-    resolve: (key) => unwrap(call('resolveResource', `key ${key}`, (api, authorization) => api.resolveResource({ headers: { authorization }, payload: { key } }), (status, message) => (status === 409 ? new InvalidResourceError({ target: `key ${key}`, message }) : undefined))),
-    inspect: (key) => unwrap(call('inspectResource', `key ${key}`, (api, authorization) => api.inspectResource({ headers: { authorization }, payload: { key } }))),
-}));
-const ResourcesMake = Effect.gen(function* () {
-    const { call } = yield* makeRuntimeCaller;
-    const cache = (lookup) => Cache.makeWith(lookup, {
-        capacity: CACHE_CAPACITY,
-        // A failure is not kept: the next read asks the resolver again.
-        timeToLive: (exit) => (Exit.isSuccess(exit) ? CACHE_TTL : Duration.zero),
-    });
-    const variables = yield* cache((key) => call('resolveVariable', `key ${key}`, (api, authorization) => api.resolveVariable({ headers: { authorization }, payload: { key } })));
-    const values = yield* cache((key) => call('resolveResource', `key ${key}`, (api, authorization) => api.resolveResource({ headers: { authorization }, payload: { key } }), (status, message) => (status === 409 ? new InvalidResourceError({ target: `key ${key}`, message }) : undefined)));
-    // Keyed by value: `{a,b}` and `{b,a}` share one entry, and each tenant's presented value gets its own.
-    const selections = yield* cache((selector) => {
+const makeRuntimeCaller = runtimeCaller('refreshWindow');
+// The four runtime reads, uncached; each answer still carries its `redactionMasks`.
+const runtimeReads = (call) => ({
+    variable: (key) => call('resolveVariable', `key ${key}`, (api, authorization) => api.resolveVariable({ headers: { authorization }, payload: { key } })),
+    resolve: (key) => call('resolveResource', `key ${key}`, (api, authorization) => api.resolveResource({ headers: { authorization }, payload: { key } }), (status, message) => (status === 409 ? new InvalidResourceError({ target: `key ${key}`, message }) : undefined)),
+    inspect: (key) => call('inspectResource', `key ${key}`, (api, authorization) => api.inspectResource({ headers: { authorization }, payload: { key } })),
+    select: (selector) => {
         const target = `${selector.resourceTypeKey} matching ${Object.keys(selector.match).join(', ')}`;
         return call('selectResource', target, (api, authorization) => api.selectResource({ headers: { authorization }, payload: selector }), (status, message) => status === 400
             ? new ResourceNotSelectableError({ target, message })
             : status === 409
                 ? new InvalidResourceError({ target, message })
                 : undefined);
+    },
+});
+/** Uncached runtime reads and the current runtime token; the promise `env` sends any unexpired token, as legacy did. */
+export const runtimeResourceClient = (policy) => Effect.map(runtimeCaller(policy), ({ tokens, call }) => {
+    const reads = runtimeReads(call);
+    return {
+        /**
+         * The token for one database tunnel; re-read on every call, never cached by the caller. The tunnel re-checks it
+         * every 2 s, so a token in its 30 s refresh window would end the connection when it expires.
+         */
+        tunnelToken: tokens.current,
+        variable: (key) => unwrap(reads.variable(key)),
+        resolve: (key) => unwrap(reads.resolve(key)),
+        inspect: (key) => unwrap(reads.inspect(key)),
+        select: (selector) => Effect.map(unwrap(reads.select(selector)), (selected) => selected.key),
+    };
+});
+/** The `./postgresql` client: tunnel tokens must outlive their refresh window. */
+export const makeRuntimeResourceClient = runtimeResourceClient('refreshWindow');
+const ResourcesMake = Effect.gen(function* () {
+    const reads = runtimeReads((yield* makeRuntimeCaller).call);
+    const cache = (lookup) => Cache.makeWith(lookup, {
+        capacity: CACHE_CAPACITY,
+        // A failure is not kept: the next read asks the resolver again.
+        timeToLive: (exit) => (Exit.isSuccess(exit) ? CACHE_TTL : Duration.zero),
     });
+    const variables = yield* cache(reads.variable);
+    const values = yield* cache(reads.resolve);
+    // Keyed by value: `{a,b}` and `{b,a}` share one entry, and each tenant's presented value gets its own.
+    const selections = yield* cache(reads.select);
     return RuntimeResources.of({
         variable: (key) => Effect.map(unwrap(Cache.get(variables, key)), Redacted.make),
         // Each caller gets its own copy: the cached value is shared across requests for 30 s.