@ontemper/sdk 0.7.1-postgresql.6 → 0.8.0

package/LICENSE

@@ -0,0 +1,28 @@
+Temper SDK License
+
+Copyright (c) 2026 Temper. All rights reserved.
+
+Temper grants you a limited, non-exclusive, non-transferable, revocable license to
+install and use this package only to build, test, and run workflows on the Temper
+platform under your agreement with Temper. Temper grants no other rights.
+
+You may not:
+
+1. use this package, or any part of it, with a service other than the Temper
+   platform;
+2. copy, modify, distribute, sublicense, or publish this package, except as part
+   of a workflow that runs on the Temper platform;
+3. extract EDI standards content that this package contains or receives, such as
+   ASC X12 segment, element, and code definitions, or use that content outside
+   the Temper platform, including with any artificial intelligence system; or
+4. license this package, or software that contains it, under an open-source
+   license.
+
+EDI standards content belongs to its owners. You receive it only inside the
+Temper platform.
+
+This license ends when your agreement with Temper ends. You must then stop using
+this package.
+
+THIS PACKAGE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. TO THE EXTENT THE
+LAW ALLOWS, TEMPER IS NOT LIABLE FOR ANY DAMAGES THAT ARISE FROM ITS USE.

package/README.md

@@ -295,7 +295,8 @@ service's `/edifact/*` routes. `toEdifact` serializes the interchange as given,
 first; no platform counter numbers EDIFACT yet. `acknowledgeEdifact` returns the CONTRL interchanges, or none; set a new UNB 0020 and UNH 0062 on each before
 `toEdifact`, because the service fills in the same reference every time.
 
-Provide `Edi.layer`. The service URL is `UNNBOUND_EDI_BASE_URL`; `UNNBOUND_EDI_API_KEY`, when set, replaces the
+Provide `Edi.layer`. The service URL is `UNNBOUND_EDI_BASE_URL`, which Temper sets. The client has no default URL, so
+without it every call fails with `reason: 'configuration'`. `UNNBOUND_EDI_API_KEY`, when set, replaces the
 Run token. The Run token goes only to `<UNNBOUND_API_URL>/api/edi-gateway`, and no EDI call follows a redirect. Lines such as `JSON to X12 completed.` carry the envelope (sender, receiver, counts), not the
 document. A failure is an `EdiError` whose `reason` is `validation`, `unauthorized`, `service`,
 `control_number`, or `configuration`, and whose `retryable` says whether the same call may succeed later.
@@ -324,59 +325,6 @@ approved; another runtime refuses a partner with TLS settings or a proxy. In tes
 `@temper/workflow/as2/testing` and pass its `fetch` to `testPlatform`; it keeps the platform ledger rules and runs
 no crypto.
 
-## PostgreSQL
-
-`@temper/workflow/resources` opens a `pg.Pool` for a PostgreSQL Resource by key. A pool loads `pg`, and a builder's
-tunnel to a Temper-managed database loads `ws`, which the workflow installs; importing the entry point loads neither. TypeScript code also needs `@types/pg`.
-
-```ts
-import { createPostgresqlPool, makePostgresqlPool } from '@temper/workflow/resources';
-
-// A script or a module-level pool; the caller ends it with `pool.end()`.
-const pool = await createPostgresqlPool('orders-db');
-
-// In an Effect service: the pool ends with the scope, and its password masks the workflow's log lines.
-const Ledger = Layer.effect(LedgerService, Effect.map(makePostgresqlPool('orders-db'), makeLedger));
-```
-
-The pool resolves the Resource through the runtime API and opens no connection until the first query. It
-holds at most 5 connections, with a 10 s connect timeout, a 30 s idle timeout, and a 10 s statement timeout.
-A statement timeout logs `temper.database.query.timeout`, and an idle connection error logs
-`temper.database.connection.error`, without the query or the server text. `sslmode` maps to TLS as libpq does
-(`disable`, `require`, `verify-ca`, `verify-full`; default `verify-full`). A Resource without a password sends an
-empty one, never `PGPASSWORD` or `.pgpass`. A record with an SSH tunnel or RDS IAM authentication fails with
-`InvalidResourceError`.
-
-Deployed workflows and external databases connect over native TCP. In a builder sandbox
-(`TEMPER_DATABASE_TUNNEL=websocket`), a Temper-managed Resource connects through the Resources-authenticated
-WebSocket tunnel. Each physical connection reads the current runtime token, and a refused tunnel fails the
-connection without a TCP fallback. `createPostgresqlPool` registers the password in the process-wide secret
-registry; inside a workflow handler, prefer `makePostgresqlPool`, which registers it in the workflow's own.
-
-## Resource records and Kafka
-
-`@temper/workflow/resources` gives Effect workflows the record schemas and Kafka options of `@ontemper/resources`:
-`KafkaResource`, `S3Resource`, `AzureBlobResource`, `SftpResource`, `PostgresqlResource`, and `kafkaConfig`. Declare the Resource with `Resource` from the root; its secrets arrive as
-`Redacted` values, and `kafkaConfig` unwraps them itself. It loads the optional peers `@aws-sdk/credential-providers` and
-`aws-msk-iam-sasl-signer-js` only for AWS MSK IAM.
-
-```ts
-import { Resource } from '@temper/workflow';
-import { KafkaResource, kafkaConfig } from '@temper/workflow/resources';
-import { Kafka } from 'kafkajs';
-
-class Events extends Resource<Events>()('events', { type: 'kafka', schema: KafkaResource }) {}
-
-// In an Effect: const kafka = new Kafka(kafkaConfig(yield* Events));
-```
-
-A record that a built-in schema rejects fails the read with the field name, never the value. An unknown closed
-value, such as a new `sslmode`, fails with `UnknownRecordValueError`.
-
-This release has no promise-style `env`: no `env.resources`, `env.variables`, `initialize`, or `reload`. Code that
-cannot run an Effect keeps `@ontemper/resources`; this entry does not modify that package. The legacy partners and
-connections APIs are excluded.
-
 ## Versions
 
 CI publishes every version to npm as `@ontemper/sdk`; nobody publishes by hand. Workflow code keeps
@@ -390,12 +338,9 @@ npm install --save-exact @temper/workflow@npm:@ontemper/sdk@<version>
 A published version never changes. The workflow template and the examples pin one exact
 version; `pnpm sdk:pin` moves them all together.
 
-The package has nine entry points: `@temper/workflow`, `@temper/workflow/testing`,
+The package has eight entry points: `@temper/workflow`, `@temper/workflow/testing`,
 `@temper/workflow/contract`, `@temper/workflow/sftp`, `@temper/workflow/sftp/testing`,
-`@temper/workflow/edi`, `@temper/workflow/as2`, `@temper/workflow/as2/testing`, and `@temper/workflow/resources`.
-Only `/sftp` loads `ssh2`. In `/resources`, only a PostgreSQL pool loads `pg` and `ws`, and only AWS MSK IAM loads
-`@aws-sdk/credential-providers` and `aws-msk-iam-sasl-signer-js` (optional peer dependencies).
-`@temper/workflow/contract` holds the runtime Resources HttpApi and the
+`@temper/workflow/edi`, `@temper/workflow/as2`, and `@temper/workflow/as2/testing`. Only `/sftp` loads `ssh2`. `@temper/workflow/contract` holds the runtime Resources HttpApi and the
 manifest, trigger, and invocation schemas that the platform imports. Workflow code rarely needs it.
 
 ## Develop and release
@@ -435,3 +380,7 @@ Raise `RUNTIME_API_VERSION` only when the SDK needs a changed platform runtime p
 
 Nothing more happens for prod. The template pin travels with the `stg` → `prod` release pull
 request, and customers get the version that the template pins on `prod`.
+
+## License
+
+This package is licensed for use with the Temper platform only. It is not open source. See [LICENSE](LICENSE).