@ontemper/sdk 0.7.1-postgresql.5 → 0.8.0

package/LICENSE

@@ -0,0 +1,28 @@
+Temper SDK License
+
+Copyright (c) 2026 Temper. All rights reserved.
+
+Temper grants you a limited, non-exclusive, non-transferable, revocable license to
+install and use this package only to build, test, and run workflows on the Temper
+platform under your agreement with Temper. Temper grants no other rights.
+
+You may not:
+
+1. use this package, or any part of it, with a service other than the Temper
+   platform;
+2. copy, modify, distribute, sublicense, or publish this package, except as part
+   of a workflow that runs on the Temper platform;
+3. extract EDI standards content that this package contains or receives, such as
+   ASC X12 segment, element, and code definitions, or use that content outside
+   the Temper platform, including with any artificial intelligence system; or
+4. license this package, or software that contains it, under an open-source
+   license.
+
+EDI standards content belongs to its owners. You receive it only inside the
+Temper platform.
+
+This license ends when your agreement with Temper ends. You must then stop using
+this package.
+
+THIS PACKAGE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. TO THE EXTENT THE
+LAW ALLOWS, TEMPER IS NOT LIABLE FOR ANY DAMAGES THAT ARISE FROM ITS USE.

package/README.md

@@ -295,7 +295,8 @@ service's `/edifact/*` routes. `toEdifact` serializes the interchange as given,
 first; no platform counter numbers EDIFACT yet. `acknowledgeEdifact` returns the CONTRL interchanges, or none; set a new UNB 0020 and UNH 0062 on each before
 `toEdifact`, because the service fills in the same reference every time.
 
-Provide `Edi.layer`. The service URL is `UNNBOUND_EDI_BASE_URL`; `UNNBOUND_EDI_API_KEY`, when set, replaces the
+Provide `Edi.layer`. The service URL is `UNNBOUND_EDI_BASE_URL`, which Temper sets. The client has no default URL, so
+without it every call fails with `reason: 'configuration'`. `UNNBOUND_EDI_API_KEY`, when set, replaces the
 Run token. The Run token goes only to `<UNNBOUND_API_URL>/api/edi-gateway`, and no EDI call follows a redirect. Lines such as `JSON to X12 completed.` carry the envelope (sender, receiver, counts), not the
 document. A failure is an `EdiError` whose `reason` is `validation`, `unauthorized`, `service`,
 `control_number`, or `configuration`, and whose `retryable` says whether the same call may succeed later.
@@ -324,81 +325,6 @@ approved; another runtime refuses a partner with TLS settings or a proxy. In tes
 `@temper/workflow/as2/testing` and pass its `fetch` to `testPlatform`; it keeps the platform ledger rules and runs
 no crypto.
 
-## PostgreSQL
-
-`@temper/workflow/resources` opens a `pg.Pool` for a PostgreSQL Resource by key. A pool loads `pg`, and a builder's
-tunnel to a Temper-managed database loads `ws`, which the workflow installs; importing the entry point loads neither. TypeScript code also needs `@types/pg`.
-
-```ts
-import { createPostgresqlPool, makePostgresqlPool } from '@temper/workflow/resources';
-
-// A script or a module-level pool; the caller ends it with `pool.end()`.
-const pool = await createPostgresqlPool('orders-db');
-
-// In an Effect service: the pool ends with the scope, and its password masks the workflow's log lines.
-const Ledger = Layer.effect(LedgerService, Effect.map(makePostgresqlPool('orders-db'), makeLedger));
-```
-
-The pool resolves the Resource through the runtime API and opens no connection until the first query. It
-holds at most 5 connections, with a 10 s connect timeout, a 30 s idle timeout, and a 10 s statement timeout.
-A statement timeout logs `temper.database.query.timeout`, and an idle connection error logs
-`temper.database.connection.error`, without the query or the server text. `sslmode` maps to TLS as libpq does
-(`disable`, `require`, `verify-ca`, `verify-full`; default `verify-full`). A Resource without a password sends an
-empty one, never `PGPASSWORD` or `.pgpass`. A record with an SSH tunnel or RDS IAM authentication fails with
-`InvalidResourceError`.
-
-Deployed workflows and external databases connect over native TCP. In a builder sandbox
-(`TEMPER_DATABASE_TUNNEL=websocket`), a Temper-managed Resource connects through the Resources-authenticated
-WebSocket tunnel. Each physical connection reads the current runtime token, and a refused tunnel fails the
-connection without a TCP fallback. `createPostgresqlPool` registers the password in the process-wide secret
-registry; inside a workflow handler, prefer `makePostgresqlPool`, which registers it in the workflow's own.
-
-## Resource records and Kafka
-
-`@temper/workflow/resources` gives Effect workflows what `@ontemper/resources` gives legacy ones: record schemas
-(`KafkaResource`, `S3Resource`, `AzureBlobResource`, `SftpResource`, `PostgresqlResource`), `kafkaConfig`, and a promise
-`env` for code that cannot run an Effect. Declare the Resource with `Resource` from the root; its secrets arrive as
-`Redacted` values, and `kafkaConfig` unwraps them itself. It loads the optional peers `@aws-sdk/credential-providers` and
-`aws-msk-iam-sasl-signer-js` only for AWS MSK IAM.
-
-```ts
-import { Resource } from '@temper/workflow';
-import { KafkaResource, kafkaConfig } from '@temper/workflow/resources';
-import { Kafka } from 'kafkajs';
-
-class Events extends Resource<Events>()('events', { type: 'kafka', schema: KafkaResource }) {}
-
-// In an Effect: const kafka = new Kafka(kafkaConfig(yield* Events));
-```
-
-For scripts outside Effect, the subpath exports the promise-style `env`:
-
-```ts
-import { env, S3Resource } from '@temper/workflow/resources';
-
-const archive = await env.resources.resolve('archive', S3Resource);
-const metadata = await env.resources.inspect('archive');
-const { key } = await env.resources.select({ resourceTypeKey: 'http_api', match: { tenantKey } });
-const region = await env.variables.get('PARTNER_REGION');
-const timeout = (await env.variables.tryGet('PARTNER_TIMEOUT_MS')) ?? '30000';
-```
-
-Without a schema, `resolve` returns the JSON object; with one, it decodes it and keeps extension fields.
-`ResourceNotFoundError` means the key or selection has no record. A found record with a missing reference
-fails with `InvalidResourceError`; unknown closed values in a built-in schema fail with `UnknownRecordValueError`.
-Authorization failures use `ResourcesUnauthorizedError`; outages use `ResourcesUnavailableError`.
-
-Promise reads use the same runtime API and Run token as the declarations. Their cache matches the legacy
-resolver: a 30 s TTL, up to 15 min of stale reads through an outage (5 min for selections), and a separate
-10 s select-miss cache with a cap of 60 distinct misses per minute. `{ cache: false }` bypasses it;
-`{ ttlMs }` sets a read's TTL. The legacy cache environment settings still apply.
-
-`variables.tryGet` and `variables.has` read the runtime API like `get`, so they are awaited: `tryGet` answers
-`undefined` and `has` answers `false` when no Variable answers the key. Legacy read them from a boot snapshot that
-only `env.initialize()` filled. `initialize` and `reload` resolve at once, because every read is live. The legacy
-partners and connections APIs are excluded.
-Existing workflows can keep `@ontemper/resources`; this entry does not modify that package.
-
 ## Versions
 
 CI publishes every version to npm as `@ontemper/sdk`; nobody publishes by hand. Workflow code keeps
@@ -412,12 +338,9 @@ npm install --save-exact @temper/workflow@npm:@ontemper/sdk@<version>
 A published version never changes. The workflow template and the examples pin one exact
 version; `pnpm sdk:pin` moves them all together.
 
-The package has nine entry points: `@temper/workflow`, `@temper/workflow/testing`,
+The package has eight entry points: `@temper/workflow`, `@temper/workflow/testing`,
 `@temper/workflow/contract`, `@temper/workflow/sftp`, `@temper/workflow/sftp/testing`,
-`@temper/workflow/edi`, `@temper/workflow/as2`, `@temper/workflow/as2/testing`, and `@temper/workflow/resources`.
-Only `/sftp` loads `ssh2`. In `/resources`, only a PostgreSQL pool loads `pg` and `ws`, and only AWS MSK IAM loads
-`@aws-sdk/credential-providers` and `aws-msk-iam-sasl-signer-js` (optional peer dependencies).
-`@temper/workflow/contract` holds the runtime Resources HttpApi and the
+`@temper/workflow/edi`, `@temper/workflow/as2`, and `@temper/workflow/as2/testing`. Only `/sftp` loads `ssh2`. `@temper/workflow/contract` holds the runtime Resources HttpApi and the
 manifest, trigger, and invocation schemas that the platform imports. Workflow code rarely needs it.
 
 ## Develop and release
@@ -457,3 +380,7 @@ Raise `RUNTIME_API_VERSION` only when the SDK needs a changed platform runtime p
 
 Nothing more happens for prod. The template pin travels with the `stg` → `prod` release pull
 request, and customers get the version that the template pins on `prod`.
+
+## License
+
+This package is licensed for use with the Temper platform only. It is not open source. See [LICENSE](LICENSE).