@beignet/core 0.0.31 → 0.0.33

package/CHANGELOG.md

@@ -1,5 +1,120 @@
 # @beignet/core
 
+## 0.0.33
+
+### Patch Changes
+
+- 379a351: Add outbox admin ports and CLI tooling to inspect, requeue, purge, and prune durable outbox messages.
+- c909142: Add per-attempt job timeouts, app-owned job execution hooks, and a locks-backed execution lease hook across inline, outbox-inline, BullMQ, and Inngest workers.
+- c514ffc: Document the Next.js cached request-context convention separately from React
+  Query prefetching, and update generated agent guidance to use
+  `lib/server-context.ts` for shared Server Component request state.
+- ae6d7f9: Document the Next.js server prefetch convention and teach generated agent
+  guidance to preserve contract query keys while replacing server query
+  functions with direct use-case calls.
+- efe16f4: Add active tracing spans and an OpenTelemetry provider with isolated,
+  low-cardinality duration, failure, and provider-operation metrics. Background
+  providers resolve lazy contexts inside real spans, and the task CLI now runs
+  through the traced task executor.
+- 0c6c0ee: Make generated app test and database scripts package-manager neutral by using
+  `tsx`, and refresh package testing docs to avoid Bun-specific snippets.
+- 450ce71: Add opt-in runtime integrity checks for workflow registries, teach the CLI a central listener registry, and document serverless-safe boot checks.
+- 2fe26a4: Add first-class security headers and CSRF server hooks, install the security
+  headers baseline in generated apps, and warn when production apps omit it.
+- ab8b288: Refresh package-shipped skills with current tenancy and runtime-integrity conventions.
+- de3e0d2: Tighten tenant-scope enforcement in doctor and generated billing code.
+
+  `beignet doctor --strict` now detects explicit raw `tenantId` repository
+  boundaries in hand-authored Drizzle ports and checks scoped tenant/workspace
+  predicates for `tenantScopeId(scope)` drift. The payments generator now uses
+  `TenantScope` for billing tenant lookups.
+
+- 08e2d3e: Add a branded tenant scope primitive and generate tenant-scoped repositories that accept `TenantScope` instead of raw tenant IDs.
+- 4341860: Add trusted proxy request metadata helpers and wire rate-limit and CSRF hooks to the shared policy.
+- 3b0f288: Add locks-backed unique job declarations and a dispatcher wrapper that suppresses duplicate dispatches for a bounded TTL.
+- 61d9053: Harden uploads with supported content-type signature checks, optional SHA-256 checksums, and app-owned file verification hooks.
+- f263650: Harden generic webhook verification with strict unknown-event defaults and opt-in HMAC timestamp tolerance.
+
+## 0.0.32
+
+### Patch Changes
+
+- 671b986: API coherence: definition kinds, app-bound uploads, honest inline retry, and
+  deterministic memory adapters.
+
+  - `FlagDef` now carries `kind: "flag"` as its definition discriminator, and
+    the value type moves to `valueKind` (`FlagEvaluationDetails.kind` is also
+    renamed `valueKind`; types `FlagKind` and `FlagKindForValue` are now
+    `FlagValueKind` and `FlagValueKindForValue`). `defineWebhook` results carry
+    `kind: "webhook"` and `defineSearchIndex` results carry
+    `kind: "search-index"`, so every definition subsystem shares the same
+    discriminator grammar. The OpenFeature provider and devtools flag panel
+    follow the rename.
+  - New `createUploads<AppContext>()` in `@beignet/core/uploads` returns an
+    app-bound `defineUpload`, matching the jobs/schedules/tasks/notifications/
+    listeners factories. The bound builder infers the upload name, metadata
+    schema, context, and `onComplete` result without explicit type arguments;
+    apps create it once in `lib/uploads.ts`.
+  - `createInlineJobDispatcher(...)` now honors a job's declared retry policy:
+    failed dispatches retry in-process with the policy's delays (injectable
+    `sleep` option for tests), payload validation failures never retry, and
+    jobs without a policy run exactly once.
+  - `createMemoryOutbox({ id, now })` and
+    `createMemoryIdempotencyStore({ now })` accept injectable ID and clock
+    factories instead of hardcoding `crypto.randomUUID()` and `new Date()`.
+  - The BullMQ provider validates unsupported retry options (`maxDelay`, custom
+    `factor`, `jitter`) eagerly at `createBullMQJobWorker(...)` creation instead
+    of only at first dispatch or processing.
+
+- f759611: Retry policies now run in exactly one layer for outbox-delivered jobs. The
+  inline job dispatcher exposes a single-attempt dispatch under a well-known
+  symbol; `drainOutbox(...)` detects it and runs the handler once per pass,
+  letting the outbox reschedule failures with the job's own policy instead of
+  stacking in-process retries (and their real backoff sleeps) inside every
+  delivery attempt. Durable providers are unaffected. The inline dispatcher
+  also gains a `retry: false` option for callers that own retries themselves,
+  and `createTestPorts(...)` now threads its frozen clock and ID generator
+  into the memory idempotency store and outbox.
+- f759611: Provider factory options now resolve through one framework-owned rule:
+  `ProviderConfigDef` gains an `overrides` map that merges defined values over
+  env-derived input before validation, and every first-party provider factory
+  uses it instead of hand-rolled schema defaults and setup-time fallbacks. The
+  precedence is now uniform — defined factory options win over environment
+  variables in all thirteen providers. This flips the previous env-wins
+  behavior of `provider-cache-redis`, `provider-locks-redis`, and the storage,
+  search, and blob providers; set the env var (or drop the option) if you
+  relied on env winning. `installProviderForTest(...)` gains an `env` option
+  that resolves config through the same loader, and unreachable missing-config
+  guards in the pino and inngest factories are gone.
+- eb680ef: Provider naming now follows one implementation-first order matching the
+  factories. `@beignet/provider-redis` is renamed `@beignet/provider-cache-redis`
+  (the package fills the cache port; the raw client stays as the
+  `ctx.ports.redis` escape hatch) with `redisCacheProvider`,
+  `createRedisCacheProvider`, and provider name `cache-redis` matching
+  `locks-redis`. Default consts flip to implementation-first:
+  `loggerPinoProvider` is now `pinoLoggerProvider`, `mailResendProvider` is now
+  `resendMailProvider`, and `mailSmtpProvider` is now `smtpMailProvider`.
+  CLI starter templates and the `redis-cache` provider preset wire the new
+  names. No aliases are kept.
+- 671b986: Remove the `defineDomainEvent` alias (and the `DomainEventDef`/
+  `InferEventPayload` re-exports) from `@beignet/core/domain`. Declare domain
+  events with the canonical `defineEvent(name, { payload })` from
+  `@beignet/core/events` — the alias returned the exact same `EventDef` and only
+  differed by its positional signature. The structural `DomainEventDef` port
+  type in `@beignet/core/ports` is unchanged.
+- 671b986: `defineEntity(...).methods((self) => ...)` now types `self` as the entity's
+  base instance (validated props plus `with` and `toJSON`) instead of `any`, so
+  method bodies are type-checked against the entity's own schema. The new
+  `EntityBaseInstance` type is exported from `@beignet/core/domain`.
+- 671b986: Upload failures now throw condition-specific error classes matching the
+  framework's class-per-condition convention: `UploadNotFoundError`,
+  `InvalidUploadActionError`, `InvalidUploadMetadataError`,
+  `InvalidUploadFileError`, `UnauthorizedUploadError`,
+  `UploadObjectNotFoundError`, `UploadBodyTooLargeError`, and
+  `InvalidUploadBodyError`. `UploadError` remains the shared base class (its
+  constructor is now protected), so existing `instanceof UploadError` checks
+  and `code`/`status` reads keep working unchanged.
+
 ## 0.0.31
 
 ### Patch Changes

package/README.md

@@ -58,7 +58,7 @@ name the framework area they depend on.
 | `@beignet/core/events` | Events and listeners |
 | `@beignet/core/flags` | Feature flag definitions, FlagsPort, memory/static adapters, and helpers |
 | `@beignet/core/idempotency` | Retry-safe command, webhook, and job primitives |
-| `@beignet/core/jobs` | Job definitions, retry policies, and inline job dispatch |
+| `@beignet/core/jobs` | Job definitions, retry policies, timeout guards, execution hooks, execution lease helpers, uniqueness guards, and inline job dispatch |
 | `@beignet/core/locks` | Lease-backed LocksPort, memory adapter, memory provider, and helpers |
 | `@beignet/core/mail` | Mail port, memory mailer, and memory mailer provider |
 | `@beignet/core/memo` | Request-scoped memoization for port lookups |
@@ -72,12 +72,13 @@ name the framework area they depend on.
 | `@beignet/core/providers` | Provider lifecycle and instrumentation primitives |
 | `@beignet/core/search` | Search index definitions, SearchPort, memory adapter, memory provider, and helpers |
 | `@beignet/core/schedules` | Schedule primitives |
-| `@beignet/core/server` | Framework-agnostic server runtime and hook helpers |
+| `@beignet/core/server` | Framework-agnostic server runtime, security headers, CSRF, and hook helpers |
 | `@beignet/core/server-only` | Static lint marker for modules that must stay out of client bundles |
 | `@beignet/core/tasks` | Operational task definitions and inline task execution |
+| `@beignet/core/tenancy` | Branded tenant scope helpers for repository boundaries |
 | `@beignet/core/testing` | Test context factories, memory port fixtures, provider install helper, factories, seeds, and database harnesses |
 | `@beignet/core/tracing` | Dependency-free W3C trace context primitives |
-| `@beignet/core/uploads` | Upload definitions, router, signer port, and test signer |
+| `@beignet/core/uploads` | Upload definitions (`createUploads<AppContext>()` app-bound builder), router, signer port, and test signer |
 | `@beignet/core/uploads/client` | Browser upload client for server and direct uploads |
 | `@beignet/core/webhooks` | Inbound webhook definitions, verifiers, memory test verifier, and HMAC verifier |
 
@@ -98,10 +99,100 @@ Jobs, outbox delivery, and schedule runners use the same terms:
 - `attempts` in a retry policy is the maximum total attempts, including the
   first try.
 - `backoff` is the delay before the next retry.
+- `timeout` is the maximum execution window for one handler attempt.
+- `hook` is app-owned behavior that wraps one handler attempt.
+- `execution lease` is a TTL-backed lock around one handler attempt for a
+  logical job key.
 - `terminal failure` means the work should not be retried automatically.
 - `dead letter` is a durable terminal delivery state, currently owned by the
   outbox.
 
+Jobs may also declare dispatch-time uniqueness and execution leases:
+
+```typescript
+import {
+  createJobExecutionLeaseHook,
+  createInlineJobDispatcher,
+  createJobs,
+  createUniqueJobDispatcher,
+  type JobDef,
+  retry,
+} from "@beignet/core/jobs";
+import type { LocksPort } from "@beignet/core/locks";
+import { z } from "zod";
+
+type AppContext = {
+  ports: {
+    billing: {
+      syncAccount(
+        accountId: string,
+        options?: { signal?: AbortSignal },
+      ): Promise<void>;
+    };
+    locks: LocksPort;
+  };
+};
+
+const { defineJob } = createJobs<AppContext>();
+
+const syncAccountPayloadSchema = z.object({
+  accountId: z.string().min(1),
+});
+
+const syncAccountExecutionLease = createJobExecutionLeaseHook<
+  JobDef<"billing.sync-account", typeof syncAccountPayloadSchema, AppContext>,
+  AppContext
+>({
+  locks: ({ ctx }) => ctx.ports.locks,
+  key: ({ payload }) => payload.accountId,
+  ttl: "5m",
+});
+
+export const SyncAccountJob = defineJob("billing.sync-account", {
+  payload: syncAccountPayloadSchema,
+  unique: ({ payload }) => ({
+    key: payload.accountId,
+    ttl: "10m",
+  }),
+  timeout: "30s",
+  retry: retry.exponential({ attempts: 3 }),
+  hooks: [syncAccountExecutionLease],
+  async handle({ payload, ctx, signal }) {
+    await ctx.ports.billing.syncAccount(payload.accountId, { signal });
+  },
+});
+
+export function createJobsPort(ctx: AppContext) {
+  return createUniqueJobDispatcher({
+    jobs: createInlineJobDispatcher<AppContext>({ ctx }),
+    locks: ctx.ports.locks,
+  });
+}
+```
+
+`unique` suppresses duplicate dispatches while the resolved lock key's TTL is
+active. It does not replace handler idempotency: providers may still execute a
+queued job more than once after a worker crash or retry.
+
+`timeout` bounds each handler attempt. When the timeout expires, Beignet throws
+`JobTimeoutError`, aborts the handler's `signal`, and lets the job retry policy
+decide whether the timeout should retry.
+
+`hooks` wrap each handler attempt when the job runs through a Beignet
+dispatcher or worker helper. Runner-level hooks, such as
+`createInlineJobDispatcher({ hooks })`, wrap job-local hooks. Hook failures are
+classified by the same retry policy as handler failures. When a runner can
+report attempt metadata, hooks receive Beignet's one-based `attempt` and
+`maxAttempts` values. Direct `job.handle(...)` calls bypass hooks; use
+`runJobHandler(...)` or a dispatcher when a test needs hook behavior.
+
+`createJobExecutionLeaseHook(...)` is the first built-in hook helper. It
+acquires a TTL-backed `LocksPort` lease for one handler attempt, then releases
+best effort in `finally`. It does not start renewal loops, so serverless
+entrypoints can use it with a shared locks provider; the TTL remains the safety
+boundary if the runtime terminates early. Unavailable leases skip by default,
+or can throw `JobExecutionLeaseUnavailableError` for retry classification.
+
 Schedules do not own retry policies. They can carry provider attempt metadata
 through `ScheduleRunContext.attempt`, then dispatch jobs or outbox messages when
 the work needs Beignet-managed retry and dead-letter behavior.
@@ -215,6 +306,8 @@ import {
   type EntitlementDecisionObserver,
   requireEntitlement,
 } from "@beignet/core/entitlements";
+import { createTenant } from "@beignet/core/ports";
+import { createTenantScope } from "@beignet/core/tenancy";
 
 function createBillingEntitlements(
   billing: BillingRepository,
@@ -222,7 +315,10 @@ function createBillingEntitlements(
 ) {
   return createEntitlements({
     async inspect(input) {
-      const account = await billing.findByTenantId(input.subject.id);
+      if (input.subject.type !== "tenant") return false;
+      const account = await billing.findByTenantScope(
+        createTenantScope(createTenant(input.subject.id)),
+      );
       return account?.status === "active";
     },
     onDecision: recordDecision,
@@ -353,6 +449,56 @@ Provider adapters may require query fields to be declared in the index
 metadata. For Meilisearch, `filters` and `facets` must use
 `filterableAttributes`, and `sort` must use `sortableAttributes`.
 
+## Uploads
+
+Use `@beignet/core/uploads` for typed file workflows above `StoragePort`.
+Upload definitions own metadata validation, authorization, storage keys, file
+constraints, direct-upload signing, and completion hooks.
+
+```typescript
+import { createUploads } from "@beignet/core/uploads";
+import { z } from "zod";
+
+const { defineUpload } = createUploads<AppContext>();
+
+export const issueAttachmentUpload = defineUpload("issues.attachment", {
+  metadata: z.object({ issueKey: z.string() }),
+  file: {
+    contentTypes: ["application/pdf", "text/plain"],
+    maxSizeBytes: 5 * 1024 * 1024,
+    checksum: { algorithm: "sha256" },
+  },
+  authorize({ ctx }) {
+    return ctx.actor.type === "user";
+  },
+  key({ metadata, uploadId }) {
+    return `issues/${metadata.issueKey}/attachments/${uploadId}`;
+  },
+  async verifyFile({ ctx, file }) {
+    const scan = await ctx.ports.fileScanner.scanObject(file.key);
+
+    return scan.clean
+      ? true
+      : { valid: false, reason: "Upload did not pass scanning." };
+  },
+  async onComplete({ ctx, files }) {
+    await ctx.ports.issueAttachments.create({
+      id: files[0]!.uploadId,
+      key: files[0]!.key,
+    });
+  },
+});
+```
+
+For supported media types, uploads verify the declared content type against the
+file signature before completion. Set `contentTypeVerification: false` only for
+workflows that intentionally accept mismatched supported file types. Direct
+uploads can require a SHA-256 checksum with `checksum: { algorithm: "sha256" }`;
+browser clients need a client-safe manifest so `@beignet/core/uploads/client`
+can compute the digest before `prepare`. Use `verifyFile(...)` for app-owned
+scanning, moderation, and quarantine decisions that run after the object exists
+in storage and before `onComplete(...)`.
+
 ## Webhooks
 
 Use `@beignet/core/webhooks` for provider-neutral inbound webhook definitions,
@@ -378,6 +524,10 @@ export const issueWebhook = defineWebhook("issues.provider", {
     secret: process.env.PROVIDER_WEBHOOK_SECRET ?? "",
     signatureHeader: "x-provider-signature",
     signaturePrefix: "sha256=",
+    timestamp: {
+      header: "x-provider-timestamp",
+      toleranceSec: 300,
+    },
   }),
 });
 ```
@@ -399,6 +549,13 @@ direction. Attach provider verifiers at the route boundary through the
 (`createHmacWebhookVerifier(...)`, `createMemoryWebhookVerifier(...)`) and for
 tests.
 
+Generic webhook catalogs reject verified event types that are not declared in
+`events` by default. Set `allowUnknownEvents: true` on
+`createWebhookRoute(...)` or `verifyWebhook(...)` only for broad provider
+endpoints that intentionally acknowledge valid events the app does not handle.
+When a generic HMAC provider signs a timestamp header or payload field, pass
+`timestamp` to reject replayed deliveries outside the configured tolerance.
+
 ## Provider metadata
 
 Reusable provider packages should declare static metadata in `package.json`
@@ -578,6 +735,45 @@ path with an unregistered method receives a framework-owned `405
 METHOD_NOT_ALLOWED` response with an `Allow` header listing the registered
 methods; `HEAD` is intentionally not served by `GET` handlers.
 
+### Runtime integrity
+
+Workflow artifacts are explicit too. Use `createRuntimeIntegrity(...)` when an
+app should fail startup if a listener, schedule, task, or outbox event/job is
+listed in the app manifest but missing from the runtime registries:
+
+```ts
+import {
+  createRuntimeIntegrity,
+  defineRuntimeManifest,
+  defineRuntimeRegistries,
+} from "@beignet/core/server";
+import { postEvents } from "@/features/posts/domain/events";
+import { postJobs } from "@/features/posts/jobs";
+import { postListeners } from "@/features/posts/listeners";
+import { listeners } from "@/server/listeners";
+import { outboxRegistry } from "@/server/outbox";
+
+export const runtimeIntegrity = createRuntimeIntegrity({
+  manifest: defineRuntimeManifest({
+    listeners: [...postListeners],
+    outbox: {
+      events: [...postEvents],
+      jobs: [...postJobs],
+    },
+  }),
+  registries: defineRuntimeRegistries({
+    listeners,
+    outbox: outboxRegistry,
+  }),
+});
+```
+
+Pass `integrity: runtimeIntegrity` to `createServer(...)` or
+`createNextServer(...)`. The check is pure and serverless-safe: it compares
+imported definitions and registries in memory, without filesystem scanning,
+provider calls, database access, worker startup, or background loops. Use
+`mode: "warn"` to log findings without failing boot.
+
 Contract path templates intentionally support concrete segments and
 single-segment params such as `:id` and `[id]`. Framework or platform
 catch-all route files can expose a central Beignet handler, but individual
@@ -785,7 +981,7 @@ The `service` factory powers two server entrypoints:
 
 - `server.createServiceContext(...)` returns the built context and enters the
   ambient correlation frame for the rest of the caller's async execution. Use
-  it from long-lived runtimes only: servers, workers, and `bun test`.
+  it from long-lived runtimes only: servers, workers, and test runners.
 - `server.runServiceContext(...)` builds the same context and runs a callback
   inside a scoped ambient frame, returning the callback's result. Use it from
   plain scripts such as seeds and one-off maintenance work — the
@@ -807,6 +1003,34 @@ Both entrypoints require `context.service` in the blueprint, generate fresh
 `tenant` on the ambient request context so audit and instrumentation wrappers
 observe them at record time.
 
+### Tenant scopes
+
+Use `@beignet/core/tenancy` when a repository method should be scoped to the
+current tenant without accepting arbitrary tenant IDs from callers:
+
+```ts
+import {
+  requireTenantScope,
+  tenantScopeId,
+  type TenantScope,
+} from "@beignet/core/tenancy";
+
+export interface TodoRepository {
+  create(input: CreateTodoInput, scope: TenantScope): Promise<Todo>;
+}
+
+const scope = requireTenantScope(ctx);
+await ctx.ports.todos.create(input, scope);
+
+const tenantId = tenantScopeId(scope); // adapter boundary
+```
+
+Apps still own tenant resolution and tenant data modeling. `TenantScope` only
+brands the already-resolved `ctx.tenant` value for app-facing repository
+boundaries. `beignet doctor --strict` checks generated tenant-scoped Drizzle
+repositories, explicit raw `tenantId` repository boundaries, and scoped
+`tenantId`/`workspaceId` predicates as a conservative drift detector.
+
 ### Testing providers
 
 Use `installProviderForTest(...)` to run provider setup against test ports
@@ -816,7 +1040,7 @@ without hand-rolling setup, port merge, and lifecycle plumbing:
 import { installProviderForTest } from "@beignet/core/testing";
 
 const { ports, result, start, stop } = await installProviderForTest(
-  redisProvider,
+  redisCacheProvider,
   {
     ports: { devtools },
     config: { URL: "redis://localhost:6379" },
@@ -1113,6 +1337,29 @@ For caching that must survive across requests, use the explicit tier —
 `ports.cache.remember` with keys that change when the data changes — and see
 the request lifecycle docs for context latency budgets.
 
+### Trusted proxy request metadata
+
+Beignet trusts no forwarding headers by default. Use
+`resolveTrustedRequest(...)` when app code needs external request metadata
+behind a platform edge or reverse proxy that strips or normalizes forwarding
+headers before they reach application code:
+
+```ts
+import { resolveTrustedRequest } from "@beignet/core/server";
+
+const requestInfo = resolveTrustedRequest(req, {
+  clientIp: "x-forwarded-for-last",
+});
+
+requestInfo.origin; // "https://app.example.com"
+requestInfo.clientIp; // resolved only when clientIp is configured
+```
+
+The same `trustedProxy` policy is accepted by `createRateLimitHooks(...)` for
+IP-scoped keys and by `createCsrfHooks(...)` for comparing browser origins
+against the external host and protocol. Configure it only when every request
+passes through your trusted edge.
+
 ### Rate limiting
 
 Use `createRateLimitHooks(...)` from `@beignet/core/server` to enforce
@@ -1131,14 +1378,15 @@ const server = await createServer<AppContext, AppPorts>({
 - `global` and `ip` scopes run in `onRequest` before parsing and context
   creation; `user` scope runs in `beforeHandle` after route hooks have resolved
   identity and `ctx.actor` exists.
-- `ip` scopes require an explicit `ipSource`. The hook's `validate` phase
-  fails `createServer(...)` startup when a registered contract declares an
-  `ip`-scoped rate limit without one, and enforcement throws the same
-  configuration error for contracts added later through `server.route(...)`.
-  Use `"x-forwarded-for-last"` only behind a trusted proxy that appends the
-  socket address, `"x-forwarded-for-first"` when a trusted edge normalizes
-  the header, or pass a function for platform headers such as
-  `cf-connecting-ip`.
+- `ip` scopes require an explicit `trustedProxy.clientIp`, `ipSource`, or
+  custom `earlyKey`. The hook's `validate` phase fails `createServer(...)`
+  startup when a registered contract declares an `ip`-scoped rate limit without
+  one, and enforcement throws the same configuration error for contracts added
+  later through `server.route(...)`. Prefer
+  `trustedProxy: { clientIp: "x-forwarded-for-last" }` behind a trusted proxy
+  that appends the socket address, `"x-forwarded-for-first"` when a trusted
+  edge normalizes the header, or
+  `trustedProxy: { clientIp: "cf-connecting-ip" }` for platform headers.
 - Pass `ipSource: "none"` to explicitly opt out of client-IP resolution:
   Beignet then trusts no forwarding headers and all `ip`-scoped traffic
   shares one `ip:unknown` bucket.
@@ -1230,12 +1478,17 @@ import {
   createOutboxEventRecorder,
   defineOutboxRegistry,
   drainOutbox,
+  type OutboxAdminPort,
 } from "@beignet/core/outbox";
 import {
+  createDrizzleSqliteOutboxAdminPort,
   createDrizzleSqliteOutboxPort,
   createDrizzleSqliteUnitOfWork,
 } from "@beignet/provider-db-drizzle/sqlite";
 
+const outboxAdmin: OutboxAdminPort =
+  createDrizzleSqliteOutboxAdminPort(db);
+
 const uow = createDrizzleSqliteUnitOfWork({
   db,
   createTransactionPorts: (tx) => {
@@ -1265,6 +1518,10 @@ await drainOutbox({
 The outbox is at-least-once delivery. Use idempotent listeners or jobs when a
 duplicate delivery would be harmful.
 
+Use `OutboxAdminPort` only from operational contexts. It lets `beignet outbox`
+list, show, requeue, purge dead-lettered rows, and prune delivered rows without
+exposing those destructive operations to transaction-scoped use cases.
+
 ### Schedules
 
 Use `@beignet/core/schedules` to define typed schedules and run them
@@ -1373,6 +1630,27 @@ const writerAuth = createAuthHooks<AppContext>()({
 });
 ```
 
+Use `createSecurityHeadersHooks(...)` for the default browser response-header
+baseline. The hook adds common headers such as `X-Content-Type-Options`,
+`X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`,
+`Cross-Origin-Opener-Policy`, and `Cross-Origin-Resource-Policy`; it does not
+guess your CSP or HSTS policy:
+
+```ts
+import { createSecurityHeadersHooks } from "@beignet/core/server";
+
+const securityHeaders = createSecurityHeadersHooks({
+  contentSecurityPolicy: "default-src 'self'; frame-ancestors 'none'",
+  strictTransportSecurity: {
+    maxAgeSec: 31_536_000,
+    includeSubDomains: true,
+  },
+});
+```
+
+Existing response headers win, so routes that stream files, render HTML, or need
+a different CSP can set their own policy.
+
 Use `createCorsHooks(...)` for app-wide CORS headers. Wildcard origins are
 accepted only for non-credentialed requests:
 
@@ -1390,6 +1668,31 @@ const browserAppCors = createCorsHooks({
 apps do not accidentally reflect arbitrary request origins for cookies or
 authorization headers.
 
+Use `createCsrfHooks(...)` when browser mutations depend on cookies. By default
+the hook protects unsafe methods by rejecting cross-origin `Origin` or `Referer`
+headers while still allowing requests that do not carry browser origin headers.
+Set `allowMissingOrigin: false` and enable token checks for stricter
+browser-only APIs:
+
+```ts
+import { createCsrfHooks } from "@beignet/core/server";
+
+const csrf = createCsrfHooks({
+  allowMissingOrigin: false,
+  trustedProxy: {},
+  trustedOrigins: ["https://app.example.com"],
+  token: {
+    cookieName: "csrf",
+    headerName: "x-csrf-token",
+  },
+  skip: ({ contract }) => contract.name.startsWith("webhooks."),
+});
+```
+
+Pass `trustedProxy: {}` only when Beignet should compare `Origin` or `Referer`
+against the external `x-forwarded-host` and `x-forwarded-proto` values written
+by your trusted edge.
+
 ### HTTP adapter boundary
 
 `@beignet/core/server` is framework-neutral. It owns route matching, hooks,
@@ -1471,15 +1774,37 @@ Service contexts created with `server.createServiceContext(...)` receive fresh
 sets its own `requestId`, headers and recorded events use it.
 
 Trace primitives live in `@beignet/core/tracing` (`TraceContext`,
-`createTraceContext`, `createChildTraceContext`, `parseTraceparent`,
-`createTraceparent`, `createTraceId`, `createSpanId`). The module is
-dependency-free so app context types can be imported from client bundles.
+`TracingPort`, `TraceOperation`, `TraceSpan`, `createTraceContext`,
+`createChildTraceContext`, `parseTraceparent`, `createTraceparent`,
+`createTraceId`, `createSpanId`). The module is dependency-free so app context
+types can be imported from client bundles.
+
+When final ports include `ports.tracing`, requests execute inside an active
+`beignet.request <contract>` span. Incoming `traceparent` and `tracestate`
+continue the trace; if the host already established an active span, Beignet's
+request span becomes its child. Use cases, listeners, job handlers, schedule
+handlers, and task handlers create nested active spans through the same port.
+Install `@beignet/provider-tracing-opentelemetry` to adapt this port to an
+app-owned OpenTelemetry SDK and emit baseline duration, error, and provider
+operation metrics.
+
+Listener, job, schedule, and task runners accept both a lazy `ctx` factory and
+an explicit `tracing` port. Provider-backed runtimes should pass the installed
+port so Beignet starts the workflow span before resolving
+`server.createServiceContext(...)`; the resulting context then inherits the
+real active span instead of treating local correlation IDs as a remote parent.
+
+For custom `TraceOperation` values, `attributes` are span-only. Use
+`metricAttributes` only for bounded operation dimensions such as a contract,
+use-case, job, schedule, or task name. Never add request, actor, tenant, or
+payload values to metric attributes.
 
 Use cases created with `createUseCase(...)` are instrumented by default. Each
-run resolves the instrumentation port from `ctx.ports`, creates a child span
-from the context's trace fields, and records `usecase` lifecycle events plus
-correlated `error` events for failures. Pass `instrumentation: false` to opt
-out.
+run resolves the instrumentation port from `ctx.ports` and records `usecase`
+lifecycle events plus correlated `error` events for failures. When a tracing
+port is installed, it also creates an active child span. Pass
+`instrumentation: false` to opt out of instrumentation events; tracing is
+controlled by whether the app installs `ports.tracing`.
 
 `createInstrumentedAuditLog({ audit, instrumentation })` from
 `@beignet/core/ports` writes durable audit entries first and mirrors sanitized

package/dist/application/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAU9D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,gBAAgB,IAChD,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,gBAAgB,IAC/C,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAGjC,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAE3E;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAEvC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,sBAAsB,CAAC;QAC9B,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;KAC3C;CAQF;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEnC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KACvC;CAaF;AAsBD;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAEvC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;KAC3C;CAQF;AAsBD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,eAAe,IAC5D,CAAC,CAAC,SAAS,CAAC,SAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,eAAe,EAC9B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,CAAC,CAAC,SAAS,eAAe,EAC/B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,SAAS,eAAe,EAAE;IAC3E;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAEzB;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IAE5C;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAE7C;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,EAC5B,QAAQ,EAAE,0BAA0B,EACpC,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,EAC7B,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAmFD;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,MAEzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,UAAU,CACzB,GAAG,EACH,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,EACpC,YAAY,SAAS,gBAAgB,EACrC,KAAK,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE;IAEtD;;OAEG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;OAEG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oEAAoE;IACpE,WAAW,EAAE,WAAW,CAAC;IACzB,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;IACb;;OAEG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KAChC,KAAK,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,GAAG;IAClC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IACjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,GAAG;IACvC;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IAE9C;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5D;AAED,KAAK,iBAAiB,GAAG;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAmIF;;GAEG;AACH,UAAU,oBAAoB,CAC5B,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,GAAG,SAAS,EAChD,YAAY,SAAS,gBAAgB,GAAG,SAAS,EACjD,KAAK,SAAS,SAAS,eAAe,EAAE;IAExC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;GAEG;AACH,cAAM,cAAc,CAClB,GAAG,EACH,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,GAAG,SAAS,EAChD,YAAY,SAAS,gBAAgB,GAAG,SAAS,EACjD,KAAK,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE;IAGpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAOvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAI3B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAZZ,MAAM,EAAE,oBAAoB,CAC3C,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,KAAK,CACN,EACgB,KAAK,CAAC,GAAE,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,aAAA,EAC7C,UAAU,GAAE,iBAG5B,EACgB,YAAY,GAAE,OAAc;IAG/C;;OAEG;IACH,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAC9B,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC;IAY1D;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,gBAAgB,EAC/B,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IAYzD;;OAEG;IACH,KAAK,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,EACxC,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAYhE;;OAEG;IACH,GAAG,CACD,EAAE,EAAE,WAAW,SAAS,gBAAgB,GACpC,YAAY,SAAS,gBAAgB,GACnC,CAAC,IAAI,EAAE;QACL,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;KACpC,KAAK,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,GACtE,KAAK,GACP,KAAK,GACR,WAAW,SAAS,gBAAgB,GACnC,YAAY,SAAS,gBAAgB,GACnC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,GAC7D,KAAK,GACP,KAAK;CA4HV;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,GAAG;IACrC;;OAEG;IACH,OAAO,CAAC,IAAI,SAAS,MAAM,EACzB,IAAI,EAAE,IAAI,GACT,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAE3E;;OAEG;IACH,KAAK,CAAC,IAAI,SAAS,MAAM,EACvB,IAAI,EAAE,IAAI,GACT,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACtD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,GAAG,CAAC;QACf,KAAK,EAAE,MAAM,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;CAC9B,GACG,GAAG,GACH,KAAK,CAAC;AAEV;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACpD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,IAAI,CAAC;QAChB,KAAK,EAAE,MAAM,KAAK,CAAC;KACpB,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;CAC9B,GACG,KAAK,GACL,KAAK,CAAC;AAEV;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,IAAI,CAAC;QAChB,KAAK,EAAE,MAAM,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;CAC7B,GACG,MAAM,GACN,KAAK,CAAC;AAEV,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,GAAG;IAChC;;OAEG;IACH,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpB;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,GAAG,CAAC;YAAC,KAAK,EAAE,KAAK,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACxD,EACD,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EACrC,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,GAC7C,aAAa,CAAC,GAAG,CAAC,CAqBpB;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAC/B,OAAO,CAAC,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAClC,kBAAkB,CAAC,GAAG,CAAC,CA4CzB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAY9D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEhE;;GAEG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,gBAAgB,IAChD,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAElC;;GAEG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,gBAAgB,IAC/C,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAGjC,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAE3E;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAEvC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,sBAAsB,CAAC;QAC9B,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;KAC3C;CAQF;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEnC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KACvC;CAaF;AAsBD;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;gBAEvC,IAAI,EAAE;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,SAAS,gBAAgB,CAAC,KAAK,EAAE,CAAC;KAC3C;CAQF;AAsBD;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,OAAO,EAAE,cAAc,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,eAAe,IAC5D,CAAC,CAAC,SAAS,CAAC,SAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,eAAe,EAC9B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,CAAC,CAAC,SAAS,eAAe,EAC/B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,SAAS,eAAe,EAAE;IAC3E;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAEzB;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;IAE5C;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAE7C;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,EAC5B,QAAQ,EAAE,0BAA0B,EACpC,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;OAEG;IACH,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,EAC7B,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAmFD;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,MAEzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,UAAU,CACzB,GAAG,EACH,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,EACpC,YAAY,SAAS,gBAAgB,EACrC,KAAK,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE;IAEtD;;OAEG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;OAEG;IACH,IAAI,EAAE,IAAI,CAAC;IACX,oEAAoE;IACpE,WAAW,EAAE,WAAW,CAAC;IACzB,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC;IACb;;OAEG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KAChC,KAAK,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,GAAG;IAClC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,EAAE,WAAW,CAAC;IAClB;;OAEG;IACH,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IACjC;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;OAEG;IACH,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,GAAG;IACvC;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IAE9C;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5D;AAED,KAAK,iBAAiB,GAAG;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAsIF;;GAEG;AACH,UAAU,oBAAoB,CAC5B,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,GAAG,SAAS,EAChD,YAAY,SAAS,gBAAgB,GAAG,SAAS,EACjD,KAAK,SAAS,SAAS,eAAe,EAAE;IAExC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;GAEG;AACH,cAAM,cAAc,CAClB,GAAG,EACH,IAAI,SAAS,MAAM,EACnB,IAAI,SAAS,WAAW,EACxB,WAAW,SAAS,gBAAgB,GAAG,SAAS,EAChD,YAAY,SAAS,gBAAgB,GAAG,SAAS,EACjD,KAAK,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE;IAGpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAOvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAI3B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAZZ,MAAM,EAAE,oBAAoB,CAC3C,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,KAAK,CACN,EACgB,KAAK,CAAC,GAAE,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,aAAA,EAC7C,UAAU,GAAE,iBAG5B,EACgB,YAAY,GAAE,OAAc;IAG/C;;OAEG;IACH,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAC9B,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC;IAY1D;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,gBAAgB,EAC/B,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IAYzD;;OAEG;IACH,KAAK,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,EACxC,MAAM,EAAE,CAAC,GACR,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAYhE;;OAEG;IACH,GAAG,CACD,EAAE,EAAE,WAAW,SAAS,gBAAgB,GACpC,YAAY,SAAS,gBAAgB,GACnC,CAAC,IAAI,EAAE;QACL,GAAG,EAAE,GAAG,CAAC;QACT,KAAK,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;KACpC,KAAK,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,GACtE,KAAK,GACP,KAAK,GACR,WAAW,SAAS,gBAAgB,GACnC,YAAY,SAAS,gBAAgB,GACnC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,GAC7D,KAAK,GACP,KAAK;CAuJV;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB,CAAC,GAAG;IACrC;;OAEG;IACH,OAAO,CAAC,IAAI,SAAS,MAAM,EACzB,IAAI,EAAE,IAAI,GACT,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAE3E;;OAEG;IACH,KAAK,CAAC,IAAI,SAAS,MAAM,EACvB,IAAI,EAAE,IAAI,GACT,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACtD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,GAAG,CAAC;QACf,KAAK,EAAE,MAAM,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;CAC9B,GACG,GAAG,GACH,KAAK,CAAC;AAEV;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACpD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,IAAI,CAAC;QAChB,KAAK,EAAE,MAAM,KAAK,CAAC;KACpB,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC;CAC9B,GACG,KAAK,GACL,KAAK,CAAC;AAEV;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,QAAQ,IAAI,QAAQ,SAAS;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE;QACV,GAAG,EAAE,MAAM,IAAI,CAAC;QAChB,KAAK,EAAE,MAAM,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;CAC7B,GACG,MAAM,GACN,KAAK,CAAC;AAEV,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,GAAG;IAChC;;OAEG;IACH,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpB;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,CAAC,IAAI,EAAE;YAAE,GAAG,EAAE,GAAG,CAAC;YAAC,KAAK,EAAE,KAAK,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACxD,EACD,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EACrC,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,GAC7C,aAAa,CAAC,GAAG,CAAC,CAqBpB;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAC/B,OAAO,CAAC,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAClC,kBAAkB,CAAC,GAAG,CAAC,CA4CzB"}