pipework 0.204.0 → 0.205.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.205.0
+
+- **Fixed: a PDF with bytes before `%PDF-` was refused as not a PDF** (#781). Byte detection now names a file `application/pdf` when `%PDF-` starts anywhere in its first 1024 bytes, as PDF readers do, so an upload with a leading CRLF, BOM or mail header passes `mediaTypes: ['application/pdf']`. The search runs only when no other signature matches, so a zip or PNG that contains `%PDF-` keeps its type, and every other signature is still read from the first 512 bytes. **Behavior change:** `SNIFF_BYTES` is now 1024, so `.upload()` and inbound email attachments hold the first 1024 bytes of a file to detect its type.
+
 ## 0.204.0
 
 - **Fixed: a read cut off by the page leaving was reported as a client fault** (#779). A link, reload or `location.href` cuts off the page's in-flight fetches, and their rejections reached `reportClientFault` as faults. `reportClientFault` now holds a report made after `beforeunload`: it is dropped if `pagehide` follows, and sent if the page stays (10 s with no `pagehide`, `LEAVING_HOLD_MS`, or a bfcache restore). A report made after `pagehide` is dropped. This covers every kind (`request`, `error`, `rejection`, `render`). Pass `{ whileLeaving: 'send' }` as the third argument to send at once, for a failure that matters even while leaving (a save cut off by leaving). `pageLeaving()` says whether the page is leaving. A failure while the page stays is reported as before.

package/dist/REFERENCE.md

@@ -1,7 +1,7 @@
 # Pipework API Reference
 
 > Auto-generated from source JSDoc. Do not edit manually.
-> Generated: 2026-10-09
+> Generated: 2026-10-25
 
 ## Contents
 
@@ -10,6 +10,7 @@
 - [jobs — Background Jobs](#jobs-background-jobs)
 - [pipeline — Multi-Step Pipelines](#pipeline-multi-step-pipelines)
 - [state — State Machines](#state-state-machines)
+- [steps](#steps)
 - [auth — Authentication](#auth-authentication)
 - [rbac — Access Control](#rbac-access-control)
 - [tenant — Multi-Tenancy](#tenant-multi-tenancy)
@@ -30,7 +31,10 @@
 - [cache — Caching](#cache-caching)
 - [credits](#credits)
 - [mail](#mail)
+- [untrustedFetch](#untrustedfetch)
+- [quota](#quota)
 - [storage](#storage)
+- [support](#support)
 - [webhook — Inbound & Outbound Webhooks](#webhook-inbound-outbound-webhooks)
 - [behavior — Resource Decorators](#behavior-resource-decorators)
 - [fitting — Dependency Injection](#fitting-dependency-injection)
@@ -42,6 +46,7 @@
 - [trace](#trace)
 - [data](#data)
 - [request](#request)
+- [async](#async)
 
 ## Core
 
@@ -74,7 +79,7 @@ export default manifold
 ```
 
 ```typescript
-function createManifold<const TEnv extends EnvDefs = EnvDefs>( raw: Omit<BlueprintInput, 'env'> &
+function createManifold<const TEnv extends EnvDefs = EnvDefs>( raw: AcceptReadonly<Omit<BlueprintInput, 'env'>> &
 ```
 
 ### Types
@@ -85,6 +90,24 @@ function createManifold<const TEnv extends EnvDefs = EnvDefs>( raw: Omit<Bluepri
 interface Manifold<TEnv extends EnvDefs = EnvDefs>
 ```
 
+**`StopResult`** — What {@link Manifold.stop} resolves with: `forced` is true when the drain deadline fired.
+
+```typescript
+interface StopResult
+```
+
+**`ScriptOptions`** — Options for {@link Manifold.script}.
+
+```typescript
+interface ScriptOptions
+```
+
+**`StartOptions`** — Options for {@link Manifold.start}.
+
+```typescript
+interface StartOptions
+```
+
 **`SeedOptions`** — ALS context the {@link Manifold.seed} callback runs under — tenant scope, auth principal, and job type.
 
 ```typescript
@@ -229,6 +252,14 @@ Creates a job queue with claim/complete/fail lifecycle, heartbeat, and dead lett
 
 Executes a fitting handler as a background job with its own Flow context.
 
+### `jobs.later`
+
+The error to throw to end an attempt as "later": pending again after `delayMs`, no attempt counted.
+
+### `jobs.permanent`
+
+The error to throw to dead-letter the job now, whatever attempts remain.
+
 ### `jobs.parseCron`
 
 Parses a 5-field cron expression into a CronSchedule (minute, hour, dom, month, dow).
@@ -269,6 +300,14 @@ Thrown when a transition is not allowed from the current state.
 
 Thrown when the state machine definition is internally inconsistent.
 
+## steps
+
+Step graphs over a job queue: results recorded by their inputs, only missing steps run.
+
+### `steps.define`
+
+Defines a graph of named steps over a jobs Queue. Pass it to `createWorkerSurface({ graphs })` to run its steps.
+
 ## auth — Authentication
 
 Authentication namespace — session management, multi-org support, auth chain resolution.
@@ -289,6 +328,14 @@ Hashes and verifies passwords with scrypt; reports when a stored hash needs reha
 
 Guarded password sign-in that slows, then refuses, repeated failures per account and per client.
 
+### `auth.guard`
+
+Guards wrong guesses at a secret the app checks itself: counted per key set before the check, reset on a right answer, refused with retryAfterSeconds.
+
+### `auth.emailLinks`
+
+Emailed single-use links that prove control of an address: password reset and address verification; the token is never stored.
+
 ### `auth.runChain`
 
 Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request.
@@ -323,7 +370,7 @@ interface AuthContext
 interface AuthStrategy<TAuth>
 ```
 
-**`AuthRequest`** — Normalized request shape passed to auth strategies — headers, cookies, method, url.
+**`AuthRequest`** — Normalized request shape passed to auth strategies — headers, the parsed `Cookie` header, and the upper-case HTTP method.
 
 ```typescript
 interface AuthRequest
@@ -353,6 +400,18 @@ interface TenantResolver<TAuth>
 interface AuthChainConfig<TAuth>
 ```
 
+**`SessionAuth`** — What `sessions.strategy()` authenticates: the token's user and org, its roles, and where the token came from.
+
+```typescript
+type SessionAuth = BaseAuth &
+```
+
+**`SessionStrategyOptions`** — Options for `sessions.strategy()`.
+
+```typescript
+interface SessionStrategyOptions
+```
+
 **`SessionConfig`** — Session configuration — signing keys, issuer, audience, token TTLs, refresh rotation.
 
 ```typescript
@@ -624,6 +683,18 @@ Base error class with code, statusCode, and suggestion fields.
 
 403 — authenticated but insufficient permissions.
 
+### `errors.CrossSiteRequest`
+
+403 `CROSS_SITE_REQUEST` — a cookie-authenticated request that did not come from the app's own site.
+
+### `errors.AuthConfiguration`
+
+500 `AUTH_CONFIGURATION` — the auth setup itself is faulty (a signing key that will not load); never a refusal of the caller.
+
+### `errors.AuthUnavailable`
+
+503 `AUTH_UNAVAILABLE` — authentication could not be decided (its database failed); never read as signed out.
+
 ### `errors.Validation`
 
 422 — input validation failed, carries field-level details.
@@ -644,13 +715,17 @@ Base error class with code, statusCode, and suggestion fields.
 
 415 — request body media type not accepted by the route.
 
+### `errors.MalformedMultipart`
+
+400 `MALFORMED_MULTIPART` — a multipart body that cannot be parsed or ends before its closing boundary.
+
 ## lifecycle — Startup & Shutdown
 
 Application lifecycle namespace — startup orchestration with hooks and timeouts.
 
 ### `lifecycle.orchestrate`
 
-Runs pre-start hooks (DB readiness checks, migrations, etc.) with a configurable timeout.
+Runs pre-start hooks (DB readiness checks, migrations, etc.) with a configurable timeout. The hooks run in one trace that names the process; the trace-partition hook runs first, outside it.
 
 ## log — Structured Logging
 
@@ -690,7 +765,7 @@ Creates a worker surface — a long-running process that claims and executes job
 
 ### `surface.script`
 
-Creates a script surface — a one-shot process that runs and exits (migrations, seeds, CLI tools).
+Creates a script surface — a one-shot process that runs and exits (migrations, seeds, CLI tools). The run is traced as a job-kind trace that names the surface.
 
 ## pipe — Database
 
@@ -700,6 +775,10 @@ Database accessor — returns a Drizzle DB instance scoped to the current reques
 
 The system channel — deliberate cross-tenant access for pre-tenant surfaces (auth membership resolution, public webhook ingress, admin tooling). Never tenant-scoped or tenant-guarded; runs on the owner-role connection outside the request transaction.
 
+### `pipe.door`
+
+A named cross-tenant read: `pipe.door(name, db => ...)`. The door is declared under `doors` in config; the callback runs in one transaction on the platform-role connection and may SELECT from the door's table and from non-tenant tables. Needs `rls.platformRole`.
+
 ### `pipe.filter`
 
 Query operators and aggregates — eq, gt, lt, and, or, count, sum, etc.
@@ -757,10 +836,18 @@ Returns excluded-column references for onConflictDoUpdate set clauses.
 
 Acquires a transaction-scoped advisory lock. Released at commit/rollback.
 
+### `pipe.tryAdvisoryLock`
+
+Non-blocking advisoryLock: true if the transaction-scoped lock was won, false if another transaction holds it.
+
 ### `pipe.serializable`
 
 Runs a function in a SERIALIZABLE transaction with automatic retry on serialization failures and deadlocks.
 
+### `pipe.withTimeouts`
+
+Sets statement_timeout and/or lock_timeout for the current transaction in one statement, then runs fn; a statement cancelled for them rejects with StatementTimeoutError or LockTimeoutError.
+
 ### `pipe.bulkSet`
 
 Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values in a single statement.
@@ -769,6 +856,10 @@ Bulk UPDATE ... FROM (VALUES ...) — updates multiple rows with per-row values
 
 Produces a typed VALUES clause for bulk operations — the base primitive for bulkSet and bulkUpsert.
 
+### `pipe.fn`
+
+A set-returning SQL function as a typed source for `.from()` and joins — `pipe.fn('schema.f', { args: [field.uuid()], columns: { path: field.text() } })`. Arguments are bound and cast to their declared types.
+
 ### `pipe.field`
 
 Field builders for domain definitions — uuid(), text(), integer(), etc.
@@ -781,13 +872,17 @@ Registers a domain definition with table, validators, and factory projections. T
 
 Returns the global registry of all domain definitions.
 
+### `pipe.external`
+
+Declares a table or view another service owns (`pipe.external(name, fields, { schema, table? })`): typed columns and every query operator, read-only, never migrated, not tenant-scoped.
+
 ### `pipe.update`
 
 Pipework-owned UPDATE builder — the only consumer-facing way to update pipework-managed tables (Q8).
 
 ### `pipe.insert`
 
-Pipework-owned INSERT builder — the only consumer-facing way to insert into pipework-managed tables (Q8).
+Pipework-owned INSERT builder — the only consumer-facing way to insert into pipework-managed tables (Q8). A list of any size is split into statements under Postgres's parameter limit, in one transaction.
 
 ### `pipe.delete`
 
@@ -795,7 +890,7 @@ Pipework-owned DELETE builder — the only consumer-facing way to delete from pi
 
 ### `pipe.upsert`
 
-Pipework-owned UPSERT builder — insert with conflict resolution (Q8).
+Pipework-owned UPSERT builder — insert with conflict resolution (Q8). A list of any size is split into statements under Postgres's parameter limit, in one transaction; rows repeating a conflict key across statements do not fail as one statement would.
 
 ### Types
 
@@ -805,25 +900,107 @@ Pipework-owned UPSERT builder — insert with conflict resolution (Q8).
 interface WindowSpec
 ```
 
+**`FrameBound`** — One end of a window frame. `{ preceding: n }` / `{ following: n }` take a non-negative integer.
+
+```typescript
+type FrameBound = 'unboundedPreceding' | 'currentRow' | 'unboundedFollowing' |
+```
+
+**`WindowFrame`** — A window frame: `rows|range|groups [between] start [and end]`.
+
+```typescript
+interface WindowFrame
+```
+
+**`Aggregate`** — An aggregate expression that can be narrowed with `FILTER (WHERE …)`; `undefined` leaves it unfiltered.
+
+```typescript
+type Aggregate<T> = SQL<T> &
+```
+
+**`EmptyableAggregate`** — An array or jsonb aggregate; `orEmpty()` replaces the no-rows NULL with an empty array.
+
+```typescript
+type EmptyableAggregate<T, E> = SQL<T> &
+```
+
+**`JsonOf`**
+
+The type a value takes after a round trip through jsonb: Date -> string (ISO text),
+bigint -> number, Buffer/Uint8Array -> string, objects and arrays mapped recursively,
+null kept. Column decoders are not applied inside jsonb.
+
+```typescript
+type JsonOf<T> =
+```
+
+**`AggregateOptions`** — `ORDER BY` terms inside an aggregate — `asc(col)` / `desc(col)` or an array of them.
+
+```typescript
+interface AggregateOptions
+```
+
 **`ValueColumnDef`** — One column of a typed `VALUES` clause: its name and the PostgreSQL type each value in that column is cast to. See {@link values}.
 
 ```typescript
 interface ValueColumnDef
 ```
 
+**`JsonbElements`** — A jsonb array read as its elements' text. Produced by {@link jsonbElements}.
+
+```typescript
+interface JsonbElements
+```
+
+**`ArraySource`** — Something whose elements `arrayAny` / `arrayAll` can test.
+
+```typescript
+type ArraySource =
+```
+
+**`ElementOf`** — The element type of an {@link ArraySource}.
+
+```typescript
+type ElementOf<S> =
+```
+
+**`FunctionSpec`** — Declares a SQL function's argument and result-column shapes. See {@link fn}.
+
+```typescript
+interface FunctionSpec<TArgs extends readonly AnyField[], TColumns extends Record<string, AnyField>>
+```
+
+**`FunctionSourceFields`** — The selected fields of a function source: each result column as a typed SQL expression.
+
+```typescript
+type FunctionSourceFields<TColumns extends Record<string, AnyField>> =
+```
+
+**`FunctionSource`** — A function call usable in `.from()` and joins; its result columns are properties of it.
+
+```typescript
+type FunctionSource<TAlias extends string, TColumns extends Record<string, AnyField>> =
+```
+
 **`SerializableOptions`** — Retry policy for {@link serializable}: how many attempts on a serialization failure / deadlock, and the base backoff between them.
 
 ```typescript
 interface SerializableOptions
 ```
 
+**`TimeoutOptions`** — Which timeouts {@link withTimeouts} sets; each a positive integer number of milliseconds.
+
+```typescript
+interface TimeoutOptions
+```
+
 **`ManagedConnection`** — A standalone pooled connection: the raw postgres.js client, its drizzle handle, and a `close()` that ends the pool.
 
 ```typescript
 interface ManagedConnection
 ```
 
-**`ConnectOptions`** — Options for `tap()` — pool size (default 1) and idle timeout in seconds.
+**`ConnectOptions`** — Options for `tap()` — pool size (default 1), idle timeout in seconds, and session settings (GUCs) sent in every connection's startup packet.
 
 ```typescript
 interface ConnectOptions
@@ -837,6 +1014,14 @@ JSONB query operators — typed helpers for PostgreSQL JSONB containment, key ch
 
 The @> containment operator — tests whether a JSONB column contains the given value.
 
+### `jsonb.merge`
+
+Merges an object into a JSONB column in `.set()`: `coalesce(col, '{}') || value`. Top-level keys overwrite; others are kept.
+
+### `jsonb.remove`
+
+Removes top-level keys from a JSONB column in `.set()`: `col - 'key'`. Composes as the column of `jsonb.merge`.
+
 ### `jsonb.containedBy`
 
 The <@ contained-by operator — tests whether a JSONB column is contained by the given value.
@@ -903,6 +1088,66 @@ type Schema<T = unknown> = z.ZodType<T>
 type Infer<T extends Schema> = z.infer<T>
 ```
 
+**`StringSchema`** — A string validator — what check.string() returns.
+
+```typescript
+type StringSchema = z.ZodString
+```
+
+**`NumberSchema`** — A number validator — what check.number() returns.
+
+```typescript
+type NumberSchema = z.ZodNumber
+```
+
+**`BooleanSchema`** — A boolean validator — what check.boolean() returns.
+
+```typescript
+type BooleanSchema = z.ZodBoolean
+```
+
+**`EnumSchema`** — An enum validator over string literals — what check.enum([...]) returns.
+
+```typescript
+type EnumSchema<V extends string = string> = z.ZodEnum<
+```
+
+**`LiteralSchema`** — A literal validator — what check.literal(v) returns.
+
+```typescript
+type LiteralSchema<V extends string | number | boolean | null = string> = z.ZodLiteral<V>
+```
+
+**`ArraySchema`** — An array validator — what check.array(item) returns.
+
+```typescript
+type ArraySchema<Item extends z.core.SomeType = z.core.SomeType> = z.ZodArray<Item>
+```
+
+**`OptionalSchema`** — An optional validator — what check.optional(inner) and .optional() return.
+
+```typescript
+type OptionalSchema<Inner extends z.core.SomeType = z.core.SomeType> = z.ZodOptional<Inner>
+```
+
+**`NullableSchema`** — A nullable validator — what check.nullable(inner) and .nullable() return.
+
+```typescript
+type NullableSchema<Inner extends z.core.SomeType = z.core.SomeType> = z.ZodNullable<Inner>
+```
+
+**`ObjectSchema`** — An object validator — what check.object({...}) returns; keeps .extend, .pick, .omit and .partial. For a shape with fields beyond the plain kinds, annotate with ObjectSchema<{ field: Schema<T> }>.
+
+```typescript
+type ObjectSchema<S extends Shape = Shape> = z.ZodObject<S, z.core.$strip>
+```
+
+**`ObjectOps`** — The object operations of ObjectSchema.
+
+```typescript
+type ObjectOps<S extends Shape> = Pick<ObjectSchema<S>, 'extend' | 'pick' | 'omit' | 'partial'>
+```
+
 ## temporal — Bitemporal Data
 
 Temporal (bitemporal) data namespace — version history with effective date ranges.
@@ -947,6 +1192,14 @@ Query all versions of temporal records (no date filter).
 
 Close the current version and create a new one with updated data.
 
+### `temporal.setVersion`
+
+Append the next version of an append-only-versions definition: serialised per scope, numbered, never back-dated, audited.
+
+### `temporal.versionAt`
+
+The version in force at a moment: the row with the greatest effectiveFrom at or before it.
+
 ## valve
 
 Valve namespace — typed, directional, gated boundaries between code silos.
@@ -1129,6 +1382,18 @@ Alerts namespace — raise and resolve keyed conditions, grouped, delivered to s
 
 Creates an alerts handle.
 
+### `alerts.http`
+
+Routes for an operations agent: list, get, totals, delivery health, acknowledge, resolve, link; bearer credentials.
+
+### `alerts.clientFaults`
+
+One POST route that records failures reported by browser code as a trace step and an alert; answers 204, no session needed. Send with `reportClientFault` from `pipework/client`.
+
+### `alerts.requestFaults`
+
+An `onInternalError` hook for the HTTP server: raises `request-fault:<METHOD> <route>` for each internal 500.
+
 ### `alerts.webhook`
 
 A sink that POSTs the alert as signed JSON to a URL.
@@ -1137,6 +1402,26 @@ A sink that POSTs the alert as signed JSON to a URL.
 
 A sink that keeps deliveries in `.delivered`, for tests.
 
+### `alerts.loopCheck`
+
+A `/ready` health check named `loops`: unhealthy while a background loop (the tick included) has not run or succeeded within its allowance.
+
+### `alerts.recordFault`
+
+Records a failure your code swallowed (logged and carried on) so `alerts.source.faults` can raise it; `void alerts.recordFault('my-kind', message, context?)`. Best effort, never throws, writes outside the caller's transaction. Does nothing without `alerts` in the blueprint.
+
+### `alerts.recordFaultFor`
+
+`recordFault` for code that holds the manifold and may run outside any Flow: `void alerts.recordFaultFor(manifold, kind, message, context?)`.
+
+### `alerts.useFaultTarget`
+
+Registers the manifold (or a `DB`, or a function returning one) that `alerts.recordFault` writes on outside any Flow; call once at boot in a process that is not a pipework surface, and keep the release for shutdown. A manifold without `alerts` registers nothing.
+
+### `alerts.recordBeat`
+
+Records one iteration of a background loop of your own for `alerts.source.loopStalled`: `void alerts.recordBeat(manifold, 'my-loop', { ok, error?, everyMs })`. Works outside any Flow; does nothing without `alerts`.
+
 ## audit — Audit Logging
 
 Audit logging namespace — structured audit trail for data changes.
@@ -1161,6 +1446,10 @@ The newest record's `{ seq, hash }` in the tenant's audit hash chain (blueprint
 
 Walks the tenant's audit hash chain and reports the first break (hash-mismatch, prev-mismatch, missing, head-mismatch, anchor-mismatch), or `{ ok: true }`.
 
+### `audit.removeTenant`
+
+Deletes every audit record of one tenant and its hash chain, for the closure of that tenant's account. Irreversible; returns the number of records removed. Other tenants' records and chains are untouched.
+
 ## cache — Caching
 
 In-memory caching namespace — TTL-based with stats, preload, and tenant-aware variants.
@@ -1213,6 +1502,64 @@ Inbound source: SES receipt rule storing raw messages in S3 and notifying a sign
 
 Inbound development source: `.eml` files dropped in a folder, received by `scan()`; refused in production.
 
+## untrustedFetch
+
+Untrusted fetch — fetch one URL a stranger gave without letting them reach the app's private network.
+
+### `untrustedFetch.get`
+
+Fetches `url` with GET and returns `{ ok: true, url, status, contentType, body, bytes }`, or `{ ok: false, reason, message }`
+naming the rule that refused: `scheme`, `address`, `redirects`, `too_large`, `timeout`, `status`, `rejected` or `network`.
+It does not throw for these.
+
+Rules, none of which can be switched off: only `http:` and `https:`; the name is resolved and every address is checked
+(loopback, private, link-local including cloud metadata, CGNAT, unique-local and site-local IPv6, multicast, reserved,
+unspecified, and IPv4-mapped or NAT64 forms of these; literal IP URLs likewise) and the connection goes to a checked
+address; redirects are followed up to `maxRedirects` and each hop is checked as the first, and the app's `headers` go only to the first origin;
+the body is stopped the moment it passes `maxBytes`, whatever Content-Length says; `timeoutMs` covers the whole fetch.
+`accept({ status, contentType, firstBytes })` sees the first 1024 bytes before the body is kept: return false, or a string
+(your own message), to refuse with `rejected`. Messages never contain an address or anything a server sent.
+
+`resolve` and `connect` are for tests: `resolve(hostname)` replaces DNS and `connect(target)` replaces the socket after the
+address check passed, so a test sends a fake public address to a local server. The address check always runs on what `resolve` returns.
+
+The call is the trace step `pipework/fetch:get`; its child `pipework/fetch:outcome` carries host, status, bytes and reason.
+The full URL is recorded only when `urlIsSafeToTrace` is true; otherwise only the host.
+
+```ts
+const got = await untrustedFetch.get(pasted, { maxBytes: 5_000_000, timeoutMs: 10_000, maxRedirects: 3,
+  accept: h => h.firstBytes[0] === 0x25 || 'That does not look like a PDF.' })
+if (!got.ok) return tell(got.message)
+```
+
+### `connectRetry.fetch`
+
+`fetch(input, init, opts)` that retries a fault in the connect phase (undici `UND_ERR_CONNECT_TIMEOUT`, `EAI_AGAIN`,
+`ENOTFOUND`, `ECONNREFUSED`, `ENETUNREACH`, `EHOSTUNREACH`), waiting `delaysMs` between tries (default 5 s, 15 s, 40 s: four
+tries over about a minute), then throws the last fault with its cause chain. A fault after the request was written
+(`ECONNRESET`, `UND_ERR_SOCKET`, a timeout, an abort) and a response of any status are never retried, because a POST may have taken effect.
+`signal` ends the waiting; `onRetry({ error, attempt, delayMs })` is called before each wait; `fetch` replaces the global fetch.
+
+```ts
+const res = await connectRetry.fetch('https://api.github.com/repos/o/r/issues', { method: 'POST', body })
+```
+
+### `connectRetry.call`
+
+Runs any `send()` with the same rule: retried only when `isUnsentFault(error)`; the last fault is thrown unchanged.
+
+### `connectRetry.isUnsentFault`
+
+True when the error, its `cause` chain or an `AggregateError`'s errors show a connect-phase fault and no sent-phase one.
+
+## quota
+
+Quota namespace — callers of one rate-limited upstream share its budget by class, read from the upstream's headers and kept in Postgres.
+
+### `quota.create`
+
+Creates a quota handle.
+
 ## storage
 
 Storage namespace — tenant-scoped, content-addressed file storage with signed URLs and retention.
@@ -1229,6 +1576,18 @@ S3-compatible backend (AWS S3, MinIO, R2): SigV4 over `fetch`, multipart streami
 
 Local-disk backend for development and tests; refused in production.
 
+## support
+
+Support namespace — tickets from email (and later chat), with replies sent only after an approval.
+
+### `support.create`
+
+Creates the support handle: tickets, messages, notes, links, drafts, `approve`, `receiveEmail`, and the events job.
+
+### `support.templates`
+
+The reply template to spread into `mail.create({ templates })`; it renders the approved draft verbatim.
+
 ## webhook — Inbound & Outbound Webhooks
 
 Webhook namespace — inbound verification, outbound delivery with retries, HMAC signing.
@@ -1319,9 +1678,13 @@ Returns the current Flow or undefined — use for optional context detection.
 
 Creates a Flow for test isolation with optional auth and tenant overrides.
 
+### `flow.actAs`
+
+Runs `fn` as a tenant and user chosen inside a tenantless Flow (sign-up, a public sign-in): RLS, audit and trace under that tenant, on the request's transaction.
+
 ## http — Server
 
-HTTP namespace: `http.file()` builds a file response; the server itself is managed by manifold.start().
+HTTP namespace: `http.file()` builds a file response; `http.detectMediaType()` names bytes the way uploads do; the server itself is managed by manifold.start().
 
 ### Types
 
@@ -1343,6 +1706,40 @@ interface SecurityConfig
 interface RateLimitConfig
 ```
 
+**`RateLimitWindow`** — One fixed window: at most `max` requests per `windowSeconds`.
+
+```typescript
+interface RateLimitWindow
+```
+
+**`RateLimitClass`**
+
+A named limit class: any of a per-user, per-tenant, per-address and total window, each counted on its own.
+Each key takes one window or an array of windows (distinct `windowSeconds`); a request is counted against
+all of a key's windows and refused if any is over.
+
+```typescript
+interface RateLimitClass
+```
+
+**`RateLimitRefusal`** — What `onRefused` is told about one refused window of one request.
+
+```typescript
+interface RateLimitRefusal
+```
+
+**`RateLimitClassesConfig`**
+
+Named limit classes, checked after auth and counted in Postgres (`pipework_rate_limit_counts`, opted in
+with the blueprint's `rateLimits: {}`), so every server process on the same database shares one count.
+Keys are counted perUser, perTenant, perAddress, total in turn, up to the first key with a window over its max, so one user's
+refused requests don't spend the tenant's budget. The 429's Retry-After is the longest wait of the windows that refused. A route is in `signedIn` (auth required, or optional with
+a user), `public` (no auth, or optional without a user) or the class its fitting names with `.rateLimit(name)`.
+
+```typescript
+interface RateLimitClassesConfig
+```
+
 **`InjectOptions`** — Options for server.inject() — method, url, headers, payload for testing without HTTP.
 
 ```typescript
@@ -1361,6 +1758,12 @@ interface InjectResponse
 interface ServerConfig
 ```
 
+**`InternalErrorFault`** — What `onInternalError` is told about one request that ended in an internal error.
+
+```typescript
+interface InternalErrorFault
+```
+
 **`HandlerResponse`** — Standard handler response shape — statusCode, headers, body.
 
 ```typescript
@@ -1419,7 +1822,7 @@ Generates an OpenAPI 3.1 document from route registrations — schemas derived f
 
 ## trace
 
-Trace namespace — hand the current trace to a process outside Node and record the steps it reports back.
+Trace namespace — hand the current trace to a process outside Node, record the steps it reports back, mark point events, and read a trace tree.
 
 ### `trace.traceparent`
 
@@ -1433,6 +1836,15 @@ W3C `traceparent` for the current trace and open step; `null` outside a traced f
 
 Records steps reported as JSON lines (or objects) by an outside process under the step open now. Synchronous; never throws.
 
+### `trace.event`
+
+Records one zero-length step `external:<name>` under the step open now, with an optional `capture` and `error`. A no-op outside a traced flow; never throws.
+
+### `trace.tree`
+
+Reads every hot trace sharing `rootId` (a request's trace and the jobs it queued) with their steps. Runs on the
+given `db`, so tenant policies apply: only an unrestricted connection (table owner, tests) sees every tenant's rows.
+
 ### Types
 
 **`FlowStepMeta`** — Trace metadata for one documented flow-step: its `path:symbol` graph node id and the per-argument capture projections.
@@ -1453,17 +1865,40 @@ type ExternalStepReport = z.infer<typeof externalStepReportSchema>
 interface ExternalRecordResult
 ```
 
+**`TraceStepNode`** — One step of a trace. `ref` is the flow step's `path:symbol`, or `external:<name>` for a recorded or point-event step.
+
+```typescript
+interface TraceStepNode
+```
+
+**`TraceNode`** — One trace of the tree, with its steps ordered by `seq`.
+
+```typescript
+interface TraceNode
+```
+
+**`TraceTree`** — The traces that share a root id, ordered by when they opened.
+
+```typescript
+interface TraceTree
+```
+
 ## data
 
-### `tap`
+### `StatementTimeoutError`
+
+A statement was cancelled by Postgres for running past the statement timeout a {@link withTimeouts} call set. `cause` is the driver error.
+
+```typescript
+class StatementTimeoutError extends Error constructor(readonly statementTimeoutMs: number, cause: unknown)
+```
 
-Opens a standalone managed connection outside the manifold's pools — the
-sanctioned door for contexts where `pipe()` structurally cannot resolve:
-`worker_threads`, detached monitors, one-off scripts. Callers own the
-lifecycle: always `await conn.close()`.
+### `LockTimeoutError`
+
+A statement gave up waiting for a lock past the lock timeout a {@link withTimeouts} call set. `cause` is the driver error.
 
 ```typescript
-function tap(url: string, options?: ConnectOptions): ManagedConnection
+class LockTimeoutError extends Error constructor(readonly lockTimeoutMs: number, cause: unknown)
 ```
 
 ## request
@@ -1475,3 +1910,24 @@ Creates a PipeworkServer — wraps Fastify with auto request IDs, CORS, rate lim
 ```typescript
 function createServer(instance: Manifold, config: ServerConfig = if (instance.config.environment === 'production')
 ```
+
+## async
+
+### `serializeError`
+
+Serialize an arbitrary thrown value for durable storage in a job's `error_payload`.
+
+A bare `{ message, stack }` capture is a diagnostics trap: wrapper errors hide the
+root cause. Drizzle throws `DrizzleQueryError` whose `.message` is only the failed
+SQL text; the real `PostgresError` — carrying `code`/`detail`/`constraint`/`table`
+— lives on `.cause`. This walks the full `cause` chain and copies each error's
+own-enumerable properties (where both Drizzle's `query` and Postgres' fields live),
+so a dead-lettered job records *why* it failed, not just *which query* failed.
+
+Parameters are never stored (`params`, `parameters`, `args`, `types`); `query` is cut
+to 2,000 characters and any other string to 4,000, ending `…[truncated N chars]`.
+Non-Error values pass through unchanged. Circular `cause` references are broken.
+
+```typescript
+function serializeError(error: unknown): unknown
+```

package/dist/request/di/builder.d.ts

@@ -154,7 +154,7 @@ export declare class Builder<TDeps extends Record<string, unknown>, TDb extends
      * extension }`.
      *
      * `mediaTypes` is matched against `mediaType`, the type found in the file's
-     * first 512 bytes (`detectedType`; null when no signature matches). A zip or
+     * first 1024 bytes (`detectedType`; null when no signature matches). A zip or
      * compound-file container takes the declared type or filename extension when
      * that names an Office, OpenDocument, epub, jar or apk file. With no
      * signature the declared type stands, except a type a signature would show
@@ -175,7 +175,7 @@ export declare class Builder<TDeps extends Record<string, unknown>, TDb extends
      * them (typed when `.params()` / `.query()` come before `.upload()`; the raw
      * values on a route with no schema; null when they fail it). A non-empty string it returns becomes the error
      * message; if it throws, the default message is sent. Nothing of the file is
-     * kept: only its first 512 bytes are held, to detect the type.
+     * kept: only its first 1024 bytes are held, to detect the type.
      *
      * Multipart: text fields must come before the file part, only names listed in
      * `fields` are accepted (another name gets 422), each at most 64 KiB; fields

package/dist/request/http/namespace.d.ts

@@ -5,6 +5,6 @@ export declare const http: {
     readonly file: typeof file;
     readonly detectMediaType: typeof detectMediaType;
     readonly resolveMediaType: typeof resolveMediaType;
-    readonly SNIFF_BYTES: 512;
+    readonly SNIFF_BYTES: 1024;
 };
 //# sourceMappingURL=namespace.d.ts.map

package/dist/request/http/sniff.d.ts

@@ -1,11 +1,12 @@
-/** Bytes of a file that decide its type. */
-export declare const SNIFF_BYTES = 512;
+/** Bytes of a file that decide its type: PDF uses all 1024, every other signature the first 512. */
+export declare const SNIFF_BYTES = 1024;
 /** Types whose files always show their signature. MP3 is left out: a file without an ID3 tag has none we detect. */
 export declare const sniffable: ReadonlySet<string>;
 /**
  * The media type the first bytes of a file say it is, or null when no signature
- * matches. Give it at least the first `SNIFF_BYTES` bytes; fewer may give null
- * (or, for a zip, plain `application/zip`).
+ * matches. A PDF is named when `%PDF-` starts anywhere in the first `SNIFF_BYTES`
+ * bytes, unless another signature matches first. Give it at least the first
+ * `SNIFF_BYTES` bytes; fewer may give null (or, for a zip, plain `application/zip`).
  */
 export declare function detectMediaType(bytes: Uint8Array | Buffer): string | null;
 /**

package/dist/request/http/sniff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sniff.d.ts","sourceRoot":"","sources":["../../../src/request/http/sniff.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,eAAO,MAAM,WAAW,MAAM,CAAA;AAsG9B,oHAAoH;AACpH,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAYxC,CAAA;AA6DF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAsCzE;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAerK;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAKlE"}
+{"version":3,"file":"sniff.d.ts","sourceRoot":"","sources":["../../../src/request/http/sniff.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,eAAO,MAAM,WAAW,OAAO,CAAA;AAuG/B,oHAAoH;AACpH,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAYxC,CAAA;AA6DF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCzE;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAerK;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAKlE"}

package/dist/request/http/sniff.js

@@ -1,5 +1,6 @@
-/** Bytes of a file that decide its type. */
-export const SNIFF_BYTES = 512;
+/** Bytes of a file that decide its type: PDF uses all 1024, every other signature the first 512. */
+export const SNIFF_BYTES = 1024;
+const SIGNATURE_BYTES = 512;
 const ZIP = 'application/zip';
 const CFB = 'application/x-cfb';
 const MACHO = 'application/x-mach-binary';
@@ -167,12 +168,13 @@ function isPortableExecutable(h) {
 }
 /**
  * The media type the first bytes of a file say it is, or null when no signature
- * matches. Give it at least the first `SNIFF_BYTES` bytes; fewer may give null
- * (or, for a zip, plain `application/zip`).
+ * matches. A PDF is named when `%PDF-` starts anywhere in the first `SNIFF_BYTES`
+ * bytes, unless another signature matches first. Give it at least the first
+ * `SNIFF_BYTES` bytes; fewer may give null (or, for a zip, plain `application/zip`).
  */
 export function detectMediaType(bytes) {
     const head = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    const h = head.length > SNIFF_BYTES ? head.subarray(0, SNIFF_BYTES) : head;
+    const h = head.length > SIGNATURE_BYTES ? head.subarray(0, SIGNATURE_BYTES) : head;
     if (h.length >= 12 && h.toString('latin1', 0, 4) === 'RIFF') {
         const form = RIFF_FORMS[h.toString('latin1', 8, 12)];
         if (form !== undefined)
@@ -217,7 +219,10 @@ export function detectMediaType(bytes) {
             return zipSubtype(h) ?? ZIP;
         return sig.type;
     }
-    return isMpegFrame(h) ? 'audio/mpeg' : null;
+    if (isMpegFrame(h))
+        return 'audio/mpeg';
+    const window = head.length > SNIFF_BYTES ? head.subarray(0, SNIFF_BYTES) : head;
+    return window.indexOf('%PDF-', 0, 'latin1') >= 0 ? 'application/pdf' : null;
 }
 function refinedBy(refinements, declared) {
     return refinements.some((r) => (r.endsWith('.') ? declared.startsWith(r) : declared === r));

package/dist/request/http/sniff.js.map

@@ -1 +1 @@
-{"version":3,"file":"sniff.js","sourceRoot":"","sources":["../../../src/request/http/sniff.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAA;AAE9B,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,GAAG,GAAG,mBAAmB,CAAA;AAC/B,MAAM,KAAK,GAAG,2BAA2B,CAAA;AACzC,MAAM,EAAE,GAAG,0BAA0B,CAAA;AAErC,MAAM,eAAe,GAAG;IACtB,gDAAgD;IAChD,qCAAqC;IACrC,sBAAsB;IACtB,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAA;AACD,MAAM,eAAe,GAAG;IACtB,oBAAoB;IACpB,0BAA0B;IAC1B,+BAA+B;IAC/B,4BAA4B;IAC5B,mBAAmB;CACpB,CAAA;AAED,MAAM,cAAc,GAAqC;IACvD,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,mEAAmE;IACzE,IAAI,EAAE,2EAA2E;IACjF,GAAG,EAAE,yCAAyC;IAC9C,GAAG,EAAE,gDAAgD;IACrD,GAAG,EAAE,iDAAiD;IACtD,IAAI,EAAE,sBAAsB;IAC5B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,yCAAyC;CAC/C,CAAA;AACD,MAAM,cAAc,GAAqC;IACvD,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,+BAA+B;IACpC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,mBAAmB;CACzB,CAAA;AAID,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AAEzE,MAAM,UAAU,GAAyB;IACvC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAClD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC9E,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACvD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACvD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;IACzD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,qBAAqB;IACpF,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IAC9C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IAC9C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IACtE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACpF,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACxD,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACnD,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,4BAA4B;IACpF,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,0BAA0B;IACtE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IACtG,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACzE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC/E,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;IAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;CACjD,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAC9F,MAAM,UAAU,GAAqC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAEtH,MAAM,WAAW,GAAqC;IACpD,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtH,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,MAAM,UAAU,GAAqC;IACnD,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,oHAAoH;AACpH,MAAM,CAAC,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IACpD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC;IAClE,WAAW;IACX,YAAY;IACZ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7B,YAAY;IACZ,WAAW;IACX,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,UAAU;IACV,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAc;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,GAA6C;IAC3D,CAAC,OAAO,EAAE,yEAAyE,CAAC;IACpF,CAAC,KAAK,EAAE,mEAAmE,CAAC;IAC5E,CAAC,MAAM,EAAE,2EAA2E,CAAC;CACtF,CAAA;AACD,MAAM,eAAe,GAAG,gFAAgF,CAAA;AAExG,sFAAsF;AACtF,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACxC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU;YAAE,OAAO,KAAK,CAAA;QACrD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAA;QACxE,IAAI,KAAK,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAA;YACjE,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,CAAC;QACD,KAAK,GAAG,KAAK,CAAA;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACjD,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,MAAK;QAC7C,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gGAAgG;AAChG,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC1E,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,2EAA2E;AAC3E,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACnE,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,UAAU,CAAA;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA0B;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3G,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,YAAY,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9H,OAAO,KAAK,IAAI,WAAW,CAAA;IAC7B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;IAC7D,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,WAAW,CAAA;IACvK,4FAA4F;IAC5F,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,UAAU,CAAA;IACpD,CAAC;IACD,IAAI,oBAAoB,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,mFAAmF;IACnF,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,cAAc;QAAE,OAAO,qBAAqB,CAAA;IACzK,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QACrG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;QACjD,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,WAA8B,EAAE,QAAgB;IACjE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgF;IAC/G,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC3C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,UAAU,GAA0F;QACxG,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC;QACtC,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC;KACvC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,SAAQ;QACnC,IAAI,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;QAClF,MAAM,WAAW,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC1E,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,CAAA;IAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,QAAuB;IACjD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAChC,CAAC"}
+{"version":3,"file":"sniff.js","sourceRoot":"","sources":["../../../src/request/http/sniff.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAA;AAC/B,MAAM,eAAe,GAAG,GAAG,CAAA;AAE3B,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,GAAG,GAAG,mBAAmB,CAAA;AAC/B,MAAM,KAAK,GAAG,2BAA2B,CAAA;AACzC,MAAM,EAAE,GAAG,0BAA0B,CAAA;AAErC,MAAM,eAAe,GAAG;IACtB,gDAAgD;IAChD,qCAAqC;IACrC,sBAAsB;IACtB,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAA;AACD,MAAM,eAAe,GAAG;IACtB,oBAAoB;IACpB,0BAA0B;IAC1B,+BAA+B;IAC/B,4BAA4B;IAC5B,mBAAmB;CACpB,CAAA;AAED,MAAM,cAAc,GAAqC;IACvD,IAAI,EAAE,yEAAyE;IAC/E,IAAI,EAAE,mEAAmE;IACzE,IAAI,EAAE,2EAA2E;IACjF,GAAG,EAAE,yCAAyC;IAC9C,GAAG,EAAE,gDAAgD;IACrD,GAAG,EAAE,iDAAiD;IACtD,IAAI,EAAE,sBAAsB;IAC5B,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,yCAAyC;CAC/C,CAAA;AACD,MAAM,cAAc,GAAqC;IACvD,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,+BAA+B;IACpC,GAAG,EAAE,4BAA4B;IACjC,GAAG,EAAE,mBAAmB;CACzB,CAAA;AAID,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;AAEzE,MAAM,UAAU,GAAyB;IACvC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAClD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC9E,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACjD,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACvD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IACvD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;IACzD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,qBAAqB;IACpF,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IAC9C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IAC9C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;IACtE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACjD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACpF,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACxD,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACnD,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC3D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,4BAA4B;IACpF,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,0BAA0B;IACtE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IACtG,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACzE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC7D,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC/E,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;IAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;IAC5C,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC9D,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;IAChD,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;CACjD,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAC9F,MAAM,UAAU,GAAqC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAEtH,MAAM,WAAW,GAAqC;IACpD,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtH,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACtC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,MAAM,UAAU,GAAqC;IACnD,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,iBAAiB;CAC1B,CAAA;AAED,oHAAoH;AACpH,MAAM,CAAC,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IACpD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC;IAClE,WAAW;IACX,YAAY;IACZ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;IAC7B,YAAY;IACZ,WAAW;IACX,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;IAC5B,UAAU;IACV,YAAY;IACZ,qBAAqB;CACtB,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,GAAc;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,GAA6C;IAC3D,CAAC,OAAO,EAAE,yEAAyE,CAAC;IACpF,CAAC,KAAK,EAAE,mEAAmE,CAAC;IAC5E,CAAC,MAAM,EAAE,2EAA2E,CAAC;CACtF,CAAA;AACD,MAAM,eAAe,GAAG,gFAAgF,CAAA;AAExG,sFAAsF;AACtF,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACxC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU;YAAE,OAAO,KAAK,CAAA;QACrD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAA;QACxE,IAAI,KAAK,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7F,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAA;YACjE,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACvD,CAAC;QACD,KAAK,GAAG,KAAK,CAAA;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACjD,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,MAAK;QAC7C,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gGAAgG;AAChG,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC1E,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,2EAA2E;AAC3E,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACnE,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,UAAU,CAAA;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAA0B;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3G,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClF,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;IACrC,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,YAAY,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9H,OAAO,KAAK,IAAI,WAAW,CAAA;IAC7B,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;IAC7D,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,WAAW,CAAA;IACvK,4FAA4F;IAC5F,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;YAAE,OAAO,UAAU,CAAA;IACpD,CAAC;IACD,IAAI,oBAAoB,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,mFAAmF;IACnF,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,cAAc;QAAE,OAAO,qBAAqB,CAAA;IACzK,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC;YAAE,SAAQ;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QACrG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;QACjD,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,YAAY,CAAA;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,WAA8B,EAAE,QAAgB;IACjE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgF;IAC/G,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC3C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,UAAU,GAA0F;QACxG,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC;QACtC,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC;KACvC,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI;YAAE,SAAQ;QACnC,IAAI,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;QAClF,MAAM,WAAW,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC1E,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;IAChF,CAAC;IACD,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,CAAA;IAC3E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,QAAuB;IACjD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipework",
-  "version": "0.204.0",
+  "version": "0.205.0",
   "description": "TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only.",
   "type": "module",
   "license": "MIT",

package/dist/infra/email/sigv4.d.ts

@@ -1,24 +0,0 @@
-export interface AwsCredentials {
-    readonly accessKeyId: string;
-    readonly secretAccessKey: string;
-    readonly sessionToken?: string;
-}
-export interface SigV4Request {
-    readonly method: string;
-    readonly url: string;
-    /** Headers to sign and send, other than host and x-amz-date, which are added. */
-    readonly headers: Readonly<Record<string, string>>;
-    readonly body: string | Buffer;
-    readonly region: string;
-    readonly service: string;
-    readonly credentials: AwsCredentials;
-    readonly now?: Date;
-}
-/**
- * Signs a request with AWS Signature Version 4 and returns the headers to send:
- * the given ones, `x-amz-date`, `x-amz-security-token` when the credentials carry
- * a session token, and `authorization`. `host` is signed but not returned; the
- * HTTP client sets it from the URL.
- */
-export declare function signV4(req: SigV4Request): Record<string, string>;
-//# sourceMappingURL=sigv4.d.ts.map

package/dist/infra/email/sigv4.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../../src/infra/email/sigv4.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAA;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAkBD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwChE"}

package/dist/infra/email/sigv4.js

@@ -1,55 +0,0 @@
-import { createHash, createHmac } from 'node:crypto';
-function sha256Hex(data) {
-    return createHash('sha256').update(data).digest('hex');
-}
-function hmac(key, data) {
-    return createHmac('sha256', key).update(data).digest();
-}
-function uriEncode(s) {
-    return encodeURIComponent(s).replace(/[!'()*]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
-}
-function amzDate(d) {
-    return d.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
-}
-/**
- * Signs a request with AWS Signature Version 4 and returns the headers to send:
- * the given ones, `x-amz-date`, `x-amz-security-token` when the credentials carry
- * a session token, and `authorization`. `host` is signed but not returned; the
- * HTTP client sets it from the URL.
- */
-export function signV4(req) {
-    const url = new URL(req.url);
-    const stamp = amzDate(req.now ?? new Date());
-    const day = stamp.slice(0, 8);
-    const headers = {};
-    for (const [name, value] of Object.entries(req.headers))
-        headers[name.toLowerCase()] = value.trim().replace(/\s+/g, ' ');
-    headers['x-amz-date'] = stamp;
-    if (req.credentials.sessionToken !== undefined)
-        headers['x-amz-security-token'] = req.credentials.sessionToken;
-    const signed = { ...headers, host: url.host };
-    const names = Object.keys(signed).sort();
-    const canonicalHeaders = names.map(n => `${n}:${signed[n]}\n`).join('');
-    const signedHeaders = names.join(';');
-    const canonicalPath = url.pathname.split('/').map(uriEncode).join('/');
-    const canonicalQuery = [...url.searchParams.entries()]
-        .map(([k, v]) => [uriEncode(k), uriEncode(v)])
-        .sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0) : (a[0] < b[0] ? -1 : 1)))
-        .map(([k, v]) => `${k}=${v}`)
-        .join('&');
-    const canonicalRequest = [
-        req.method.toUpperCase(), canonicalPath, canonicalQuery, canonicalHeaders, signedHeaders, sha256Hex(req.body),
-    ].join('\n');
-    const scope = `${day}/${req.region}/${req.service}/aws4_request`;
-    const stringToSign = ['AWS4-HMAC-SHA256', stamp, scope, sha256Hex(canonicalRequest)].join('\n');
-    const kDate = hmac(`AWS4${req.credentials.secretAccessKey}`, day);
-    const kRegion = hmac(kDate, req.region);
-    const kService = hmac(kRegion, req.service);
-    const kSigning = hmac(kService, 'aws4_request');
-    const signature = createHmac('sha256', kSigning).update(stringToSign).digest('hex');
-    return {
-        ...headers,
-        authorization: `AWS4-HMAC-SHA256 Credential=${req.credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
-    };
-}
-//# sourceMappingURL=sigv4.js.map

package/dist/infra/email/sigv4.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../../../src/infra/email/sigv4.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAoBpD,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AACzG,CAAC;AAED,SAAS,OAAO,CAAC,CAAO;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,GAAiB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE7B,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxH,OAAO,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;IAC7B,IAAI,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,YAAY,CAAA;IAE9G,MAAM,MAAM,GAA2B,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAErC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtE,MAAM,cAAc,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAU,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,MAAM,gBAAgB,GAAG;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;KAC9G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,eAAe,CAAA;IAChE,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE/F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAEnF,OAAO;QACL,GAAG,OAAO;QACV,aAAa,EACX,+BAA+B,GAAG,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;KAChI,CAAA;AACH,CAAC"}