PostgreSQL Resources

@ontemper/postgresql connects workflow code to a PostgreSQL Resource by key. It returns an unconnected pg.Pool. Keep one pool in the owning database module and call pool.end() when the workflow shuts down.

import { createPostgresqlPool } from '@ontemper/postgresql';

const pool = await createPostgresqlPool('orders-db');
const result = await pool.query('SELECT id FROM orders WHERE id = $1', [orderId]);

The SDK resolves and validates the record through @ontemper/resources. Managed Resources use the authenticated WebSocket tunnel in an E2B builder. Every physical connection reads current runtime authorization. The API checks current Resource access and chooses the private target. Rejected authorization never falls back to TCP. Deployed workflows and external databases use native TCP.

Resource passwords are registered with log redaction. An empty password does not fall back to PGPASSWORD or .pgpass. The pool allows five connections, a 10-second connection timeout, a 30-second idle timeout, and a 10-second statement timeout. Timeout reporting covers pooled, checked-out, and callback queries.

TLS follows the Resource: disable uses no TLS, require encrypts without certificate verification, verify-ca validates the CA, and verify-full also validates the hostname. Managed Resources use verified TLS inside the tunnel. Use parameterized SQL. A managed Resource's login can change data and schema in its own database. Author schema changes as reviewed migrations, not workflow startup code. Queries and agent read tools still enforce read-only transactions.

This package replaces the branch's env.resources.postgresql(key) factory. Resources itself remains a records-only SDK with no pg or ws dependency. Publish and verify compatible logger, events, Resources, and PostgreSQL packages before changing a workflow's dependency lockfile. Repository builds do not publish npm packages.