pipework 0.62.0 → 0.64.0

package/dist/infra/email/sns.js

@@ -0,0 +1,173 @@
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { sql } from '../../data/db/sql.js';
+import { pipeSystem } from '../../data/db/db.js';
+import { Builder } from '../../request/di/builder.js';
+import { UnauthorizedError, ValidationError } from '../../core/errors/index.js';
+import { getBaseLogger } from '../../core/logging/index.js';
+import { __flowStep } from '../../trace/runtime/flow-step.js';
+import { auditEmail } from './audit.js';
+import { normalizeAddress } from './mail.js';
+const NOTIFICATION_FIELDS = ['Message', 'MessageId', 'Subject', 'Timestamp', 'TopicArn', 'Type'];
+const CONFIRMATION_FIELDS = ['Message', 'MessageId', 'SubscribeURL', 'Timestamp', 'Token', 'TopicArn', 'Type'];
+export function snsStringToSign(msg) {
+    const names = msg['Type'] === 'Notification' ? NOTIFICATION_FIELDS : CONFIRMATION_FIELDS;
+    return names.filter(n => msg[n] !== undefined).map(n => `${n}\n${msg[n]}\n`).join('');
+}
+function isSnsHost(url, region) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (u.protocol !== 'https:' || u.username !== '' || u.password !== '' || u.port !== '')
+        return false;
+    const host = region !== undefined ? `sns.${region}.amazonaws.com` : null;
+    return host !== null ? u.hostname === host : /^sns\.[a-z0-9-]+\.amazonaws\.com$/.test(u.hostname);
+}
+async function defaultFetchCert(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`certificate fetch answered HTTP ${res.status}`);
+    return res.text();
+}
+async function defaultConfirm(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`subscription confirmation answered HTTP ${res.status}`);
+}
+function refuse(reason) {
+    getBaseLogger().warn({ event: 'sns message refused', reason }, 'SNS message refused');
+    throw new UnauthorizedError('SNS message verification failed.\n');
+}
+function recipientsOf(event) {
+    const type = String(event['eventType'] ?? event['notificationType'] ?? '').toLowerCase();
+    const mailPart = event['mail'];
+    const sesMessageId = typeof mailPart?.messageId === 'string' ? mailPart.messageId : null;
+    const list = (v) => Array.isArray(v) ? v.flatMap(r => (typeof r?.emailAddress === 'string' ? [r.emailAddress] : [])) : [];
+    if (type === 'bounce') {
+        const bounce = event['bounce'];
+        const bounceType = typeof bounce?.bounceType === 'string' ? bounce.bounceType : null;
+        return { recipients: list(bounce?.bouncedRecipients).map(address => ({ address, bounceType, kind: 'bounce' })), sesMessageId };
+    }
+    if (type === 'complaint') {
+        const complaint = event['complaint'];
+        return { recipients: list(complaint?.complainedRecipients).map(address => ({ address, bounceType: null, kind: 'complaint' })), sesMessageId };
+    }
+    return { recipients: [], sesMessageId };
+}
+const processEvent = __flowStep({ ref: 'pipework/email:notification' }, async (event) => {
+    const { recipients, sesMessageId } = recipientsOf(event);
+    const db = pipeSystem();
+    for (const r of recipients) {
+        const address = normalizeAddress(r.address);
+        const found = sesMessageId === null ? [] : await db.execute(sql `
+      SELECT id, trace_id FROM pipework_email_messages WHERE provider_message_id = ${sesMessageId}`);
+        const messageId = found[0]?.['id'] ?? null;
+        const messageTraceId = found[0]?.['trace_id'] ?? null;
+        const permanent = r.kind === 'complaint' || r.bounceType === 'Permanent';
+        if (permanent) {
+            await db.execute(sql `
+        INSERT INTO pipework_email_suppressions (address, reason, detail)
+        VALUES (${address}, ${r.kind}, ${JSON.stringify({ bounceType: r.bounceType, sesMessageId })}::jsonb)
+        ON CONFLICT (address) DO UPDATE SET reason = EXCLUDED.reason, detail = EXCLUDED.detail`);
+            getBaseLogger().warn({ event: 'email suppressed', address, reason: r.kind }, 'email suppressed');
+        }
+        else {
+            getBaseLogger().info({ event: 'email bounce not suppressed', address, bounceType: r.bounceType }, 'transient bounce: address kept');
+        }
+        await auditEmail(r.kind, messageId, { address, bounceType: r.bounceType, suppressed: permanent, messageTraceId });
+    }
+});
+/**
+ * Receives SES bounce and complaint events delivered through SNS (HTTP/S subscription).
+ * A permanent bounce or any complaint puts the address (lowercased) on
+ * `pipework_email_suppressions`, which the send job checks; a transient or undetermined
+ * bounce is only logged. Each one is a trace step with an `Email:bounce` / `Email:complaint`
+ * audit record whose `after` carries `messageTraceId`, the trace of the original send.
+ * A suppression is logged at warn as `email suppressed`; the alert condition (#458) is not built yet.
+ *
+ * Only messages from the configured `topicArns` are accepted (401 otherwise, before any subscription is
+ * confirmed or event processed): SNS signs every topic, including an attacker's own.
+ * Every message's signature (SignatureVersion 1 or 2) is checked against the certificate
+ * at `SigningCertURL`, which must be `https://sns.<region>.amazonaws.com/...`; a failure is a 401.
+ * A SubscriptionConfirmation is confirmed by fetching its `SubscribeURL`.
+ * SES events delivered through EventBridge are not supported.
+ */
+export function snsWebhook(config) {
+    if (config.topicArns.length === 0)
+        throw new Error('[pipework] mail.snsWebhook needs at least one topic ARN in topicArns.');
+    const fetchCert = config.fetchCert ?? defaultFetchCert;
+    const confirm = config.confirm ?? defaultConfirm;
+    const certs = new Map();
+    async function verifySignature(msg) {
+        const url = msg['SigningCertURL'];
+        const signature = msg['Signature'];
+        const version = msg['SignatureVersion'];
+        if (url === undefined || signature === undefined)
+            refuse('missing signature fields');
+        if (version !== '1' && version !== '2')
+            refuse('unknown SignatureVersion');
+        if (!isSnsHost(url, config.region) || !new URL(url).pathname.endsWith('.pem'))
+            refuse('SigningCertURL is not an SNS certificate URL');
+        let pem = certs.get(url);
+        if (pem === undefined) {
+            try {
+                pem = await fetchCert(url);
+            }
+            catch {
+                refuse('certificate could not be fetched');
+            }
+            certs.set(url, pem);
+        }
+        let ok = false;
+        try {
+            ok = cryptoVerify(version === '1' ? 'RSA-SHA1' : 'RSA-SHA256', Buffer.from(snsStringToSign(msg)), createPublicKey(pem), Buffer.from(signature, 'base64'));
+        }
+        catch {
+            ok = false;
+        }
+        if (!ok)
+            refuse('signature does not match');
+        if (msg['TopicArn'] === undefined || !config.topicArns.includes(msg['TopicArn']))
+            refuse('TopicArn is not a configured topic');
+    }
+    return new Builder()
+        .public()
+        .rawBody()
+        .request()
+        .route('POST', config.path)
+        .fit(async ({ rawBody }) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(rawBody.toString('utf-8'));
+        }
+        catch {
+            throw new ValidationError({ body: ['is not JSON'] }, 'SNS message is not JSON.');
+        }
+        if (typeof parsed !== 'object' || parsed === null)
+            throw new ValidationError({ body: ['is not an object'] }, 'SNS message is not an object.');
+        const msg = parsed;
+        await verifySignature(msg);
+        if (msg['Type'] === 'SubscriptionConfirmation') {
+            const subscribeUrl = msg['SubscribeURL'];
+            if (subscribeUrl === undefined || !isSnsHost(subscribeUrl, config.region))
+                refuse('SubscribeURL is not an SNS URL');
+            await confirm(subscribeUrl);
+            return { status: 200, body: { ok: true, confirmed: true } };
+        }
+        if (msg['Type'] === 'Notification') {
+            let event;
+            try {
+                event = JSON.parse(msg['Message'] ?? '');
+            }
+            catch {
+                return { status: 200, body: { ok: true, ignored: true } };
+            }
+            await processEvent(event);
+        }
+        return { status: 200, body: { ok: true } };
+    });
+}
+//# sourceMappingURL=sns.js.map

package/dist/infra/email/sns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sns.js","sourceRoot":"","sources":["../../../src/infra/email/sns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAgB5C,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAChG,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;AAE9G,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,MAA0B;IACxD,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IACpG,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;AACnG,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IACrF,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAA;AACnE,CAAC;AAID,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAwC,CAAA;IACrE,MAAM,YAAY,GAAG,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IACxF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CACpC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA2C,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClJ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAsE,CAAA;QACnG,MAAM,UAAU,GAAG,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;QACpF,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAA;IACzI,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAmD,CAAA;QACtF,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAA;IACxJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAA;AACzC,CAAC;AAED,MAAM,YAAY,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAA8B,EAAiB,EAAE;IAC9H,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACxD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;qFACkB,YAAY,EAAE,CAAC,CAAA;QAChG,MAAM,SAAS,GAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAwB,IAAI,IAAI,CAAA;QAClE,MAAM,cAAc,GAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAwB,IAAI,IAAI,CAAA;QAC7E,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAA;QACxE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;kBAER,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC;+FACJ,CAAC,CAAA;YAC1F,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAA;QAClG,CAAC;aAAM,CAAC;YACN,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,gCAAgC,CAAC,CAAA;QACrI,CAAC;QACD,MAAM,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;IACnH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC3H,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAA;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,cAAc,CAAA;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEvC,KAAK,UAAU,eAAe,CAAC,GAAe;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACvC,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,0BAA0B,CAAC,CAAA;QACpF,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG;YAAE,MAAM,CAAC,0BAA0B,CAAC,CAAA;QAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,8CAA8C,CAAC,CAAA;QACrI,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBAAC,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAAC,CAAC;YACvF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACrB,CAAC;QACD,IAAI,EAAE,GAAG,KAAK,CAAA;QACd,IAAI,CAAC;YACH,EAAE,GAAG,YAAY,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3J,CAAC;QAAC,MAAM,CAAC;YAAC,EAAE,GAAG,KAAK,CAAA;QAAC,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,MAAM,CAAC,0BAA0B,CAAC,CAAA;QAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAAE,MAAM,CAAC,oCAAoC,CAAC,CAAA;IAChI,CAAC;IAED,OAAO,IAAI,OAAO,EAAE;SACjB,MAAM,EAAE;SACR,OAAO,EAAE;SACT,OAAO,EAAE;SACT,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;SAC1B,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACzB,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAA;QAClF,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAC7I,MAAM,GAAG,GAAG,MAAoB,CAAA;QAChC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAA;QAE1B,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;YAC/C,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,CAAA;YACxC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,gCAAgC,CAAC,CAAA;YACnH,MAAM,OAAO,CAAC,YAAY,CAAC,CAAA;YAC3B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAA;QAC7D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;YACnC,IAAI,KAA8B,CAAA;YAClC,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAA;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;YAC3D,CAAC;YACD,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipework",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only.",
   "type": "module",
   "license": "MIT",