@satorio/machinery 0.2.1

package/dist/postgres/settings.d.ts

@@ -0,0 +1,134 @@
+import { type EnvironmentEntry, type Refusal } from '@satorio/machinery/core';
+import { Config, type ConfigError, ConfigProvider, Either, Option, type Redacted } from 'effect';
+/**
+ * Every way a connection can be encrypted and verified, from no encryption at
+ * all to a fully verified chain.
+ */
+export declare const POSTGRES_SSL_MODES: readonly ["disable", "allow", "prefer", "require", "verify-ca", "verify-full"];
+/**
+ * One of the ways a connection can be encrypted and verified.
+ */
+export type PostgresSslMode = (typeof POSTGRES_SSL_MODES)[number];
+/**
+ * The port a Postgres server listens on when nobody says otherwise.
+ */
+export declare const DEFAULT_POSTGRES_PORT = 5432;
+/**
+ * The schema every statement runs against when nobody names one.
+ */
+export declare const DEFAULT_POSTGRES_SCHEMA = "app";
+/**
+ * How a connection is encrypted when nobody says otherwise: the chain is
+ * verified, so the safe choice is the one you get by saying nothing.
+ */
+export declare const DEFAULT_POSTGRES_SSL_MODE: PostgresSslMode;
+/**
+ * The name this service shows under in the database's own list of connections
+ * when nobody names it.
+ */
+export declare const DEFAULT_APPLICATION_NAME = "machinery";
+/**
+ * How a service proves who it is when nothing says otherwise. A password
+ * is what a newcomer already has on a local database; production names
+ * the stronger choice out loud with `AUTH_MODE=iam`.
+ */
+export declare const DEFAULT_AUTH_MODE: 'iam' | 'password';
+/**
+ * The two ways to prove to the database who you are: a short-lived IAM
+ * token or a password. The list is closed, so a third way never appears
+ * silently. The IAM region is optional, the way it is everywhere else in
+ * this package — the AWS SDK finds its own when nobody names one.
+ */
+export type PostgresAuthentication = {
+    readonly _tag: 'AwsIamAuthentication';
+    readonly region: Option.Option<string>;
+} | {
+    readonly _tag: 'PasswordAuthentication';
+    readonly password: Redacted.Redacted;
+};
+/**
+ * Everything one connection needs, read in one go: where the server is, who
+ * connects, and how the connection is proven and encrypted.
+ */
+export interface PostgresConnectionSettings {
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    readonly database: string;
+    readonly schema: string;
+    readonly applicationName: string;
+    readonly sslMode: PostgresSslMode;
+    readonly sslRootCertificatePath: Option.Option<string>;
+    readonly authentication: PostgresAuthentication;
+}
+/**
+ * The three parts a reader meets when the database address is missing.
+ *
+ * @internal
+ */
+export declare const hostRefusal: Refusal;
+/**
+ * The three parts a reader meets when nobody says who connects.
+ *
+ * @internal
+ */
+export declare const userRefusal: Refusal;
+/**
+ * The three parts a reader meets when nobody says which database.
+ *
+ * @internal
+ */
+export declare const databaseRefusal: Refusal;
+/**
+ * The three parts a reader meets when the password is missing. It names
+ * the default that put them on this path and both ways off it.
+ *
+ * @internal
+ */
+export declare const passwordRefusal: Refusal;
+/**
+ * Every variable this adapter reads, and the one state each of them
+ * stands in.
+ */
+export declare const ENVIRONMENT: readonly EnvironmentEntry[];
+interface AuthenticationCandidates {
+    readonly mode: 'iam' | 'password';
+    readonly password: Option.Option<Redacted.Redacted>;
+    readonly region: Option.Option<string>;
+}
+/**
+ * Reads both ways of proving who this service is, then keeps the one
+ * `AUTH_MODE` names. Both are read before either is chosen, so every
+ * refusal of this settings block reaches the reader in one answer
+ * instead of one at a time.
+ *
+ * @internal
+ */
+export declare const authenticationFrom: ({ mode, password, region, }: AuthenticationCandidates) => Either.Either<PostgresAuthentication, ConfigError.ConfigError>;
+/**
+ * Every variable of `ENVIRONMENT`, read in one go. A missing required
+ * variable refuses in three parts, and an environment missing several of
+ * them refuses about all of them at once, so an operator fixes one .env
+ * rather than restarting after every line.
+ */
+export declare const postgresConnectionSettings: Config.Config<PostgresConnectionSettings>;
+/**
+ * Builds a config provider that reads from `primary`, falling back to one
+ * fixed value when `primary` has no such key. Kept separate from
+ * `schemaDefaultingTo` so a test can check "environment wins, default is
+ * only a fallback" against an arbitrary `primary`, without touching the
+ * real `process.env`.
+ */
+export declare const configProviderPreferring: (primary: ConfigProvider.ConfigProvider, fallbackKey: string, fallbackValue: string) => ConfigProvider.ConfigProvider;
+/**
+ * Default schema for one service when `PGSCHEMA` isn't set. The
+ * environment always wins; this default only guards a local Postgres that
+ * several services share in turn. The migrations runner tracks the last
+ * applied migration per schema, not per service, so a shared schema
+ * without separate numbers would silently treat one service's
+ * migrations as already applied. A deployed service always has its own
+ * database or its own schema in the environment, so the mismatch never
+ * arises there.
+ */
+export declare const schemaDefaultingTo: (schema: string) => ConfigProvider.ConfigProvider;
+export {};

package/dist/postgres/settings.js

@@ -0,0 +1,210 @@
+import { fallsBackTo, handedOn, optionalSecret, optionalText, refusalFor, refuses, requiredText, } from '@satorio/machinery/core';
+import { Config, ConfigProvider, Either, Option, } from 'effect';
+const HOST = 'PGHOST';
+const PORT = 'PGPORT';
+const USER = 'PGUSER';
+const DATABASE = 'PGDATABASE';
+const SCHEMA = 'PGSCHEMA';
+const APPLICATION_NAME = 'PGAPPNAME';
+const SSL_MODE = 'PGSSLMODE';
+const SSL_ROOT_CERTIFICATE = 'PGSSLROOTCERT';
+const AUTHENTICATION_MODE = 'AUTH_MODE';
+const PASSWORD = 'PGPASSWORD';
+const REGION = 'AWS_REGION';
+/**
+ * Every way a connection can be encrypted and verified, from no encryption at
+ * all to a fully verified chain.
+ */
+export const POSTGRES_SSL_MODES = [
+    'disable',
+    'allow',
+    'prefer',
+    'require',
+    'verify-ca',
+    'verify-full',
+];
+/**
+ * The port a Postgres server listens on when nobody says otherwise.
+ */
+export const DEFAULT_POSTGRES_PORT = 5432;
+/**
+ * The schema every statement runs against when nobody names one.
+ */
+export const DEFAULT_POSTGRES_SCHEMA = 'app';
+/**
+ * How a connection is encrypted when nobody says otherwise: the chain is
+ * verified, so the safe choice is the one you get by saying nothing.
+ */
+export const DEFAULT_POSTGRES_SSL_MODE = 'verify-full';
+/**
+ * The name this service shows under in the database's own list of connections
+ * when nobody names it.
+ */
+export const DEFAULT_APPLICATION_NAME = 'machinery';
+/**
+ * How a service proves who it is when nothing says otherwise. A password
+ * is what a newcomer already has on a local database; production names
+ * the stronger choice out loud with `AUTH_MODE=iam`.
+ */
+export const DEFAULT_AUTH_MODE = 'password';
+/**
+ * The three parts a reader meets when the database address is missing.
+ *
+ * @internal
+ */
+export const hostRefusal = {
+    what: `${HOST} is not set, so this service does not know which database to open.`,
+    why: 'A connection pool needs an address before it can open anything, and there is no address a service could sensibly guess.',
+    whatToDo: `Set ${HOST} to the database host from your .env or your deployment, then start the service again.`,
+};
+/**
+ * The three parts a reader meets when nobody says who connects.
+ *
+ * @internal
+ */
+export const userRefusal = {
+    what: `${USER} is not set, so this service has no database user to connect as.`,
+    why: 'Postgres grants rights per role, so the connection cannot be opened under a role nobody named.',
+    whatToDo: `Set ${USER} to the role this service owns, then start the service again.`,
+};
+/**
+ * The three parts a reader meets when nobody says which database.
+ *
+ * @internal
+ */
+export const databaseRefusal = {
+    what: `${DATABASE} is not set, so this service does not know which database to connect to.`,
+    why: 'One Postgres server holds many databases, and the wrong one would answer every query with tables this service never wrote.',
+    whatToDo: `Set ${DATABASE} to the database name this service owns, then start the service again.`,
+};
+/**
+ * The three parts a reader meets when the password is missing. It names
+ * the default that put them on this path and both ways off it.
+ *
+ * @internal
+ */
+export const passwordRefusal = {
+    what: `${PASSWORD} is not set, and ${AUTHENTICATION_MODE} defaulted to password.`,
+    why: 'The connection has no way left to prove who it is to the database.',
+    whatToDo: `Set ${PASSWORD} to the database password, or set ${AUTHENTICATION_MODE}=iam to sign a short-lived AWS IAM token instead.`,
+};
+/**
+ * Every variable this adapter reads, and the one state each of them
+ * stands in.
+ */
+export const ENVIRONMENT = [
+    {
+        name: HOST,
+        what: 'The host this service opens its connection pool against.',
+        state: refuses(hostRefusal),
+    },
+    {
+        name: PORT,
+        what: 'The TCP port the database listens on.',
+        state: fallsBackTo(String(DEFAULT_POSTGRES_PORT)),
+    },
+    {
+        name: USER,
+        what: 'The Postgres role this service connects as.',
+        state: refuses(userRefusal),
+    },
+    {
+        name: DATABASE,
+        what: 'The database this service reads and writes.',
+        state: refuses(databaseRefusal),
+    },
+    {
+        name: SCHEMA,
+        what: "The schema every statement runs against, set as the connection's search_path.",
+        state: fallsBackTo(DEFAULT_POSTGRES_SCHEMA),
+    },
+    {
+        name: APPLICATION_NAME,
+        what: 'The name this service shows under in pg_stat_activity.',
+        state: fallsBackTo(DEFAULT_APPLICATION_NAME),
+    },
+    {
+        name: SSL_MODE,
+        what: `How the connection is encrypted and verified, one of ${POSTGRES_SSL_MODES.join(', ')}.`,
+        state: fallsBackTo(DEFAULT_POSTGRES_SSL_MODE),
+    },
+    {
+        name: SSL_ROOT_CERTIFICATE,
+        what: 'The path to a certificate authority file the database chain is verified against.',
+        state: handedOn("the driver verifies the chain against the machine's own trust store."),
+    },
+    {
+        name: AUTHENTICATION_MODE,
+        what: 'Which of the two ways this service proves who it is, iam or password.',
+        state: fallsBackTo(DEFAULT_AUTH_MODE),
+    },
+    {
+        name: PASSWORD,
+        what: 'The database password, read under the default password mode.',
+        state: refuses(passwordRefusal),
+    },
+    {
+        name: REGION,
+        what: 'The region the IAM token signer signs against, read under AUTH_MODE=iam.',
+        state: handedOn('the AWS SDK finds its own region from the machine it runs on.'),
+    },
+];
+const authenticationMode = Config.literal('iam', 'password')(AUTHENTICATION_MODE).pipe(Config.withDefault(DEFAULT_AUTH_MODE));
+/**
+ * Reads both ways of proving who this service is, then keeps the one
+ * `AUTH_MODE` names. Both are read before either is chosen, so every
+ * refusal of this settings block reaches the reader in one answer
+ * instead of one at a time.
+ *
+ * @internal
+ */
+export const authenticationFrom = ({ mode, password, region, }) => {
+    if (mode === 'iam') {
+        return Either.right({ _tag: 'AwsIamAuthentication', region });
+    }
+    return Option.match(password, {
+        onNone: () => Either.left(refusalFor(PASSWORD, passwordRefusal)),
+        onSome: (secret) => Either.right({ _tag: 'PasswordAuthentication', password: secret }),
+    });
+};
+const authentication = Config.all({
+    mode: authenticationMode,
+    password: optionalSecret(PASSWORD),
+    region: optionalText(REGION),
+}).pipe(Config.mapOrFail(authenticationFrom));
+/**
+ * Every variable of `ENVIRONMENT`, read in one go. A missing required
+ * variable refuses in three parts, and an environment missing several of
+ * them refuses about all of them at once, so an operator fixes one .env
+ * rather than restarting after every line.
+ */
+export const postgresConnectionSettings = Config.all({
+    host: requiredText(HOST, hostRefusal),
+    port: Config.integer(PORT).pipe(Config.withDefault(DEFAULT_POSTGRES_PORT)),
+    user: requiredText(USER, userRefusal),
+    database: requiredText(DATABASE, databaseRefusal),
+    schema: Config.string(SCHEMA).pipe(Config.withDefault(DEFAULT_POSTGRES_SCHEMA)),
+    applicationName: Config.string(APPLICATION_NAME).pipe(Config.withDefault(DEFAULT_APPLICATION_NAME)),
+    sslMode: Config.literal(...POSTGRES_SSL_MODES)(SSL_MODE).pipe(Config.withDefault(DEFAULT_POSTGRES_SSL_MODE)),
+    sslRootCertificatePath: optionalText(SSL_ROOT_CERTIFICATE),
+    authentication,
+});
+/**
+ * Builds a config provider that reads from `primary`, falling back to one
+ * fixed value when `primary` has no such key. Kept separate from
+ * `schemaDefaultingTo` so a test can check "environment wins, default is
+ * only a fallback" against an arbitrary `primary`, without touching the
+ * real `process.env`.
+ */
+export const configProviderPreferring = (primary, fallbackKey, fallbackValue) => primary.pipe(ConfigProvider.orElse(() => ConfigProvider.fromMap(new Map([[fallbackKey, fallbackValue]]))));
+/**
+ * Default schema for one service when `PGSCHEMA` isn't set. The
+ * environment always wins; this default only guards a local Postgres that
+ * several services share in turn. The migrations runner tracks the last
+ * applied migration per schema, not per service, so a shared schema
+ * without separate numbers would silently treat one service's
+ * migrations as already applied. A deployed service always has its own
+ * database or its own schema in the environment, so the mismatch never
+ * arises there.
+ */
+export const schemaDefaultingTo = (schema) => configProviderPreferring(ConfigProvider.fromEnv(), SCHEMA, schema);

package/dist/postgres/sql/0001_processed_event.sql

@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS processed_event (
+  event_id     text        PRIMARY KEY,
+  processed_at timestamptz NOT NULL
+);

package/dist/postgres/sql/0002_integration_event_outbox.sql

@@ -0,0 +1,13 @@
+CREATE TABLE IF NOT EXISTS integration_event_outbox (
+  sequence_number bigint      GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  message_id      text        NOT NULL UNIQUE,
+  event_type      text        NOT NULL,
+  schema_version  integer     NOT NULL,
+  occurred_at     timestamptz NOT NULL,
+  payload         jsonb       NOT NULL,
+  dispatched_at   timestamptz
+);
+
+CREATE INDEX IF NOT EXISTS integration_event_outbox_pending
+  ON integration_event_outbox (sequence_number)
+  WHERE dispatched_at IS NULL;

package/dist/postgres/sql/0003_document_number_counter.sql

@@ -0,0 +1,6 @@
+CREATE TABLE IF NOT EXISTS document_number_counter (
+  client_code     text    NOT NULL,
+  reporting_month text    NOT NULL,
+  issued          integer NOT NULL,
+  PRIMARY KEY (client_code, reporting_month)
+);

package/dist/postgres/sql-failure.d.ts

@@ -0,0 +1,19 @@
+import type { SqlError } from '@effect/sql/SqlError';
+import { Option } from 'effect';
+/**
+ * The SQLSTATE Postgres answers a duplicate key with.
+ *
+ * @internal
+ */
+export declare const UNIQUE_VIOLATION_SQL_STATE = "23505";
+/**
+ * The SQLSTATE a driver failure carries, when it carries one.
+ *
+ * @internal
+ */
+export declare const sqlStateOf: (error: SqlError) => Option.Option<string>;
+/**
+ * Whether this driver failure is a duplicate key rather than anything
+ * else the database could refuse.
+ */
+export declare const isUniqueViolation: (error: SqlError) => boolean;

package/dist/postgres/sql-failure.js

@@ -0,0 +1,22 @@
+import { Option } from 'effect';
+/**
+ * The SQLSTATE Postgres answers a duplicate key with.
+ *
+ * @internal
+ */
+export const UNIQUE_VIOLATION_SQL_STATE = '23505';
+const carriesStringCode = (cause) => typeof cause === 'object' &&
+    cause !== null &&
+    'code' in cause &&
+    typeof cause.code === 'string';
+/**
+ * The SQLSTATE a driver failure carries, when it carries one.
+ *
+ * @internal
+ */
+export const sqlStateOf = (error) => carriesStringCode(error.cause) ? Option.some(error.cause.code) : Option.none();
+/**
+ * Whether this driver failure is a duplicate key rather than anything
+ * else the database could refuse.
+ */
+export const isUniqueViolation = (error) => Option.contains(sqlStateOf(error), UNIQUE_VIOLATION_SQL_STATE);

package/dist/postgres/store-failure.d.ts

@@ -0,0 +1,17 @@
+import type { SqlError } from '@effect/sql/SqlError';
+import { Effect, Option } from 'effect';
+/**
+ * Splits a write path at the database boundary: a unique violation
+ * becomes a domain conflict, any other SqlError becomes "store
+ * unavailable". Pass a `unique` branch that builds the conflict failure
+ * and an `unavailable` branch, `portUnavailable` bound to `operation`.
+ */
+export declare const onUniqueViolation: <Conflict, Unavailable>(operation: string, branches: {
+    readonly unique: () => Conflict;
+    readonly unavailable: (operation: string) => (cause: unknown) => Unavailable;
+}) => <A, R>(effect: Effect.Effect<A, SqlError, R>) => Effect.Effect<A, Conflict | Unavailable, R>;
+/**
+ * Returns the first row, or `Option.none()` for an empty result. Use it
+ * for a lookup whose shape is `Option`.
+ */
+export declare const firstRow: <A>(rows: readonly A[]) => Option.Option<A>;

package/dist/postgres/store-failure.js

@@ -0,0 +1,16 @@
+import { Effect, Option } from 'effect';
+import { isUniqueViolation } from './sql-failure.js';
+/**
+ * Splits a write path at the database boundary: a unique violation
+ * becomes a domain conflict, any other SqlError becomes "store
+ * unavailable". Pass a `unique` branch that builds the conflict failure
+ * and an `unavailable` branch, `portUnavailable` bound to `operation`.
+ */
+export const onUniqueViolation = (operation, branches) => (effect) => effect.pipe(Effect.catchTag('SqlError', (error) => isUniqueViolation(error)
+    ? Effect.fail(branches.unique())
+    : Effect.fail(branches.unavailable(operation)(error))));
+/**
+ * Returns the first row, or `Option.none()` for an empty result. Use it
+ * for a lookup whose shape is `Option`.
+ */
+export const firstRow = (rows) => Option.fromNullable(rows[0]);

package/dist/postgres/transaction-boundary.d.ts

@@ -0,0 +1,13 @@
+import { SqlClient } from '@effect/sql';
+import { TransactionBoundaryUnavailableError } from '@satorio/machinery/ports';
+import { Effect } from 'effect';
+/**
+ * Builds the boundary on a real Postgres transaction: a `SqlError` on
+ * the way in or out becomes the port's own unavailability failure, and
+ * the work's own failures pass through untouched.
+ *
+ * @internal
+ */
+export declare const makePgTransactionBoundary: Effect.Effect<{
+    inTransaction: <A, E, R>(work: Effect.Effect<A, E, R>) => Effect.Effect<A, E | TransactionBoundaryUnavailableError, R>;
+}, never, SqlClient.SqlClient>;

package/dist/postgres/transaction-boundary.js

@@ -0,0 +1,21 @@
+import { SqlClient } from '@effect/sql';
+import { SqlError } from '@effect/sql/SqlError';
+import { TransactionBoundaryUnavailableError, } from '@satorio/machinery/ports';
+import { Effect } from 'effect';
+/**
+ * Builds the boundary on a real Postgres transaction: a `SqlError` on
+ * the way in or out becomes the port's own unavailability failure, and
+ * the work's own failures pass through untouched.
+ *
+ * @internal
+ */
+export const makePgTransactionBoundary = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const inTransaction = (work) => sql.withTransaction(work).pipe(Effect.mapError((failure) => failure instanceof SqlError
+        ? new TransactionBoundaryUnavailableError({
+            operation: 'inTransaction',
+            cause: failure,
+        })
+        : failure));
+    return { inTransaction };
+});

package/dist/publishing/event-publisher.sns.d.ts

@@ -0,0 +1,66 @@
+import { type Refusal } from '@satorio/machinery/core';
+import { type EventPublisherShape, type OutboxMessage } from '@satorio/machinery/ports';
+import { Effect, type Scope } from 'effect';
+import type { SnsPublisherSettings } from './settings.js';
+/**
+ * What one publish call asks for.
+ *
+ * @internal
+ */
+export interface SnsPublishRequest {
+    readonly TopicArn: string;
+    readonly Message: string;
+}
+/**
+ * The narrowest slice of the SDK the publisher uses: put one message on
+ * the topic. A test can substitute its own object of this shape.
+ *
+ * @internal
+ */
+export interface SnsPublishTransport {
+    readonly publish: (request: SnsPublishRequest, signal?: AbortSignal) => Promise<unknown>;
+}
+/**
+ * The transport plus the one call that closes the client behind it.
+ *
+ * @internal
+ */
+export interface ClosableSnsTransport extends SnsPublishTransport {
+    readonly close: () => void;
+}
+/**
+ * The message body a subscriber reads: the same envelope as the stdout
+ * line, minus the channel — here the topic itself plays that role.
+ */
+export declare const snsMessageBodyOf: (message: OutboxMessage) => string;
+/**
+ * The publisher over one SNS transport: every message goes to the topic
+ * this prefix named, one publish call each.
+ *
+ * @internal
+ */
+export declare const makeSnsEventPublisher: (transport: SnsPublishTransport, settings: SnsPublisherSettings) => EventPublisherShape;
+/**
+ * Holds one transport open for the length of a scope and closes it when
+ * the scope ends.
+ *
+ * @internal
+ */
+export declare const scopedSnsTransport: (openTransport: () => ClosableSnsTransport) => Effect.Effect<SnsPublishTransport, never, Scope.Scope>;
+/**
+ * Opens the real SNS client. This is the only place the SDK is
+ * constructed.
+ *
+ * @internal
+ */
+export declare const openSnsTransport: (settings: SnsPublisherSettings) => ClosableSnsTransport;
+/**
+ * Without a topic set, the publisher does not fail service startup: it
+ * mounts a stand that fails `publish` loudly with the same three-part
+ * refusal the mount desk logged. The rest of the service keeps running,
+ * and the outbox relay reports the missing topic honestly instead of
+ * silently losing events.
+ *
+ * @internal
+ */
+export declare const eventPublisherUnavailableWithoutConfiguration: (refusal: Refusal) => EventPublisherShape;

package/dist/publishing/event-publisher.sns.js

@@ -0,0 +1,75 @@
+import { PublishCommand, SNSClient } from '@aws-sdk/client-sns';
+import { bigIntsAsDecimalStrings, refusalText, } from '@satorio/machinery/core';
+import { EventPublisherUnavailableError, } from '@satorio/machinery/ports';
+import { DateTime, Effect, Option } from 'effect';
+/**
+ * The message body a subscriber reads: the same envelope as the stdout
+ * line, minus the channel — here the topic itself plays that role.
+ */
+export const snsMessageBodyOf = (message) => JSON.stringify({
+    messageId: message.messageId,
+    eventType: message.eventType,
+    schemaVersion: message.schemaVersion,
+    occurredAt: DateTime.formatIso(message.occurredAt),
+    payload: message.payload,
+}, bigIntsAsDecimalStrings);
+/**
+ * The publisher over one SNS transport: every message goes to the topic
+ * this prefix named, one publish call each.
+ *
+ * @internal
+ */
+export const makeSnsEventPublisher = (transport, settings) => ({
+    publish: (messages) => Effect.forEach(messages, (message) => Effect.tryPromise({
+        try: (signal) => transport.publish({
+            TopicArn: settings.topicArn,
+            Message: snsMessageBodyOf(message),
+        }, signal),
+        catch: (cause) => new EventPublisherUnavailableError({ operation: 'publish', cause }),
+    }), { discard: true }),
+});
+/**
+ * Holds one transport open for the length of a scope and closes it when
+ * the scope ends.
+ *
+ * @internal
+ */
+export const scopedSnsTransport = (openTransport) => Effect.acquireRelease(Effect.sync(openTransport), (transport) => Effect.sync(() => transport.close()));
+const clientConfigurationOf = (settings) => ({
+    ...Option.match(settings.region, {
+        onNone: () => ({}),
+        onSome: (clientRegion) => ({ region: clientRegion }),
+    }),
+    ...Option.match(settings.endpoint, {
+        onNone: () => ({}),
+        onSome: (clientEndpoint) => ({ endpoint: clientEndpoint }),
+    }),
+});
+/**
+ * Opens the real SNS client. This is the only place the SDK is
+ * constructed.
+ *
+ * @internal
+ */
+export const openSnsTransport = (settings) => {
+    const client = new SNSClient(clientConfigurationOf(settings));
+    return {
+        publish: (request, signal) => client.send(new PublishCommand(request), signal === undefined ? {} : { abortSignal: signal }),
+        close: () => client.destroy(),
+    };
+};
+/**
+ * Without a topic set, the publisher does not fail service startup: it
+ * mounts a stand that fails `publish` loudly with the same three-part
+ * refusal the mount desk logged. The rest of the service keeps running,
+ * and the outbox relay reports the missing topic honestly instead of
+ * silently losing events.
+ *
+ * @internal
+ */
+export const eventPublisherUnavailableWithoutConfiguration = (refusal) => ({
+    publish: () => Effect.fail(new EventPublisherUnavailableError({
+        operation: 'publish',
+        cause: refusalText(refusal),
+    })),
+});

package/dist/publishing/event-publisher.stdout.d.ts

@@ -0,0 +1,15 @@
+import type { EventPublisherShape, OutboxMessage } from '@satorio/machinery/ports';
+import { Effect } from 'effect';
+/**
+ * The simplest publisher: an event travels as one JSON line on stdout,
+ * where a log collector picks it up. It proves the outbox relay works
+ * before a real message bus exists.
+ */
+export declare const stdoutLineOf: (channel: string, message: OutboxMessage) => string;
+/**
+ * The publisher over one line writer: one line per message, in the order
+ * the batch holds them.
+ *
+ * @internal
+ */
+export declare const makeStdoutEventPublisher: (channel: string, writeLine: (line: string) => Effect.Effect<void>) => EventPublisherShape;

package/dist/publishing/event-publisher.stdout.js

@@ -0,0 +1,24 @@
+import { bigIntsAsDecimalStrings } from '@satorio/machinery/core';
+import { DateTime, Effect } from 'effect';
+/**
+ * The simplest publisher: an event travels as one JSON line on stdout,
+ * where a log collector picks it up. It proves the outbox relay works
+ * before a real message bus exists.
+ */
+export const stdoutLineOf = (channel, message) => JSON.stringify({
+    channel,
+    messageId: message.messageId,
+    eventType: message.eventType,
+    schemaVersion: message.schemaVersion,
+    occurredAt: DateTime.formatIso(message.occurredAt),
+    payload: message.payload,
+}, bigIntsAsDecimalStrings);
+/**
+ * The publisher over one line writer: one line per message, in the order
+ * the batch holds them.
+ *
+ * @internal
+ */
+export const makeStdoutEventPublisher = (channel, writeLine) => ({
+    publish: (messages) => Effect.forEach(messages, (message) => writeLine(stdoutLineOf(channel, message)), { discard: true }),
+});