pipework 0.69.0 → 0.71.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.71.0
+
+**Schema note: blueprint `email: {}` adds `pipework_email_inbound` and, to `pipework_email_messages`, `conversation_id` and `in_reply_to_inbound` (both nullable, `conversation_id` indexed) to generated migrations; not tenant-scoped. Run `pipework generate` and `pipework migrate` to add them.**
+
+- **New: `mail.inbound` receives email as a capability.** With `mail.sesReceipt` (SES stores the raw message in S3 and notifies a signed SNS topic; the notification is verified with the same checks as `mail.snsWebhook`) each message is recorded once, then a job fetches it, parses it (from, to, cc, subject, text, HTML, attachments, Message-ID, In-Reply-To, References; no new dependency) and calls the app's `onMessage` with a conversation id: a reply is matched by In-Reply-To/References to an earlier received message, or to a message sent with `mail.send(..., { conversationId })`. Attachments are stored as the resolved tenant's files (`storage`), SES's spam, virus, SPF, DKIM and DMARC verdicts are kept, a handler error retries without storing twice, each message is a trace step, and `sweep()` deletes raw copies after `rawRetentionDays` (30). `mail.inboundFolder` is the development stand-in: `.eml` files dropped in a folder are received by `scan()`.
+- **New: `mail.send` takes `conversationId` and `inReplyTo`.** A message sent as a reply carries `In-Reply-To` and `References` (over SES in `Content.Simple.Headers`; the dev stand-in writes them to its file) and joins the conversation of the message it answers.
+
+## 0.70.0
+
+**Schema note: blueprint `accessLinks: {}` adds `access_link_check_spent` (`challenge` primary key, `expires_at`) to generated migrations; not tenant-scoped, no row-level security. Run `pipework generate` and `pipework migrate` to add it.**
+
+- **New: `accessLinks.personCheck({ secret, ... })` is a self-hosted person check for access links, with no third-party script.** Proof-of-work challenges in the ALTCHA format (so the self-hosted ALTCHA widget, with its keyboard and screen-reader checkbox, solves them) are bound to a link code and an expiry and HMAC-signed. `verify(code, solution)` accepts a solution once across all processes and returns a short-lived signed pass, or `null` for anything malformed, tampered, expired, for another link or already used; `check` registers under `checks` so the pass is the proof for a `requireChecks` entry at `beginUse`. `personCheck.solve` solves a challenge for tests. The secret must be 32 bytes or more and the same in every process.
+
 ## 0.69.0
 
 **Schema note: blueprint `alerts: {}` adds `pipework_alerts`, `pipework_alert_deliveries` and `pipework_alert_source_state` to generated migrations; not tenant-scoped. Run `pipework generate` and `pipework migrate` to add them.**

package/REFERENCE.md

@@ -1143,15 +1143,15 @@ Signs a payload with HMAC for outbound delivery — returns body, signature, tim
 
 ## mail — Transactional Email
 
-Mail namespace — transactional email through a job queue, SES v2 or a dev stand-in, bounce and complaint suppression.
+Mail namespace — email through a job queue, SES v2 or a dev stand-in, bounce and complaint suppression, and receiving.
 
-Opt in with blueprint `email: {}`; the generated migration adds `pipework_email_messages` (`key` unique, `to_address`, `template`, `data`, `status` `queued | sending | sent | suppressed | failed`, `provider_message_id`, `error`, `trace_id`, `created_at`, `sent_at`, `sending_at`) and `pipework_email_suppressions` (`address` primary key, lowercased; `reason` `bounce | complaint`; `detail`; `created_at`), both `IF NOT EXISTS` and not tenant-scoped.
+Opt in with blueprint `email: {}`; the generated migration adds `pipework_email_messages` (`key` unique, `to_address`, `template`, `data`, `status` `queued | sending | sent | suppressed | failed`, `provider_message_id`, `error`, `trace_id`, `created_at`, `sent_at`, `sending_at`) and `pipework_email_suppressions` (`address` primary key, lowercased; `reason` `bounce | complaint`; `detail`; `created_at`), both `IF NOT EXISTS` and not tenant-scoped. `pipework_email_messages` also has `conversation_id` and `in_reply_to_inbound`. Receiving adds `pipework_email_inbound` (see `mail.inbound`).
 
 ### `mail.create`
 
 Creates the transactional email interface: `send(db, { to, template, data, key })` in the caller's transaction, and the `jobs` that deliver.
 
-`mail.create({ provider, templates, from, queue, configurationSet?, environment?, sendingStaleSeconds? })` returns `{ send, jobs }`. `templates` is `{ [name]: (data) => { subject, text, html? } }`; `send` checks the template name and the data type. `send(db, ...)` inserts the message row (`ON CONFLICT (key) DO NOTHING`) and enqueues a `pipework.email.send` job on `queue` in the same `db`, so the caller's rollback drops both; it returns `{ messageId, queued }`, with `queued: false` and the earlier id when the key was used. Spread `mail.jobs` into the worker surface's `jobs` (on the same queue). The job skips a message already `sent`, `suppressed` or `failed`, marks an address on the suppression list `suppressed` without calling the provider, and otherwise renders, sends and marks `sent`. A provider error returns the row to `queued` with `error` set and rethrows, so the queue retries per its `maxAttempts`; if it gives up, the row keeps the error. A template that is missing or throws marks the row `failed` without retrying. The job claims the message with a conditional update (`queued`, or `sending` for longer than `sendingStaleSeconds`, default 600), so a reaper re-run of a job still in flight does not call the provider; a run that cannot claim returns and logs at info. Residual window: a crash mid-send leaves the message `sending` for the stale window, after which a retry may send it once more; likewise if the provider accepted the message and the process died before the row was marked `sent`. SES v2 has no idempotency token. The job runs in the trace of the flow that called `send` (`continueFlow`); the delivery is the step `pipework/email:deliver`, with `Email:sent`, `Email:suppressed` or `Email:failed` audit records under it. Message bodies and template data are never logged. `create` throws when `environment` is `production` and the provider is the stand-in; the job checks the instance's environment too.
+`mail.create({ provider, templates, from, queue, configurationSet?, environment?, sendingStaleSeconds? })` returns `{ send, jobs }`. `send(db, { to, template, data, key, conversationId?, inReplyTo? })`: `conversationId` (a UUID) puts the message in a conversation, so a received reply threads there; `inReplyTo` is a received message's id (`ReceivedEmail.id`): the sent message carries `In-Reply-To: <its Message-ID>` and `References` (its references plus its Message-ID, at most 20 ids and about 900 characters, oldest dropped first), and joins its conversation when `conversationId` is not given (an unknown id is a 422). Over SES the headers go in `Content.Simple.Headers`. `templates` is `{ [name]: (data) => { subject, text, html? } }`; `send` checks the template name and the data type. `send(db, ...)` inserts the message row (`ON CONFLICT (key) DO NOTHING`) and enqueues a `pipework.email.send` job on `queue` in the same `db`, so the caller's rollback drops both; it returns `{ messageId, queued }`, with `queued: false` and the earlier id when the key was used. Spread `mail.jobs` into the worker surface's `jobs` (on the same queue). The job skips a message already `sent`, `suppressed` or `failed`, marks an address on the suppression list `suppressed` without calling the provider, and otherwise renders, sends and marks `sent`. A provider error returns the row to `queued` with `error` set and rethrows, so the queue retries per its `maxAttempts`; if it gives up, the row keeps the error. A template that is missing or throws marks the row `failed` without retrying. The job claims the message with a conditional update (`queued`, or `sending` for longer than `sendingStaleSeconds`, default 600), so a reaper re-run of a job still in flight does not call the provider; a run that cannot claim returns and logs at info. Residual window: a crash mid-send leaves the message `sending` for the stale window, after which a retry may send it once more; likewise if the provider accepted the message and the process died before the row was marked `sent`. SES v2 has no idempotency token. The job runs in the trace of the flow that called `send` (`continueFlow`); the delivery is the step `pipework/email:deliver`, with `Email:sent`, `Email:suppressed` or `Email:failed` audit records under it. Message bodies and template data are never logged. `create` throws when `environment` is `production` and the provider is the stand-in; the job checks the instance's environment too.
 
 ### `mail.ses`
 
@@ -1163,7 +1163,7 @@ Amazon SES v2 provider, SigV4-signed without the AWS SDK.
 
 Development provider that writes each message to a file instead of sending; refused in production.
 
-`mail.devStandIn({ dir })` writes `<dir>/<messageId>.json` (`from`, `to`, `subject`, `text`, `html`) and logs one line with the address and file path.
+`mail.devStandIn({ dir })` writes `<dir>/<messageId>.json` (`from`, `to`, `subject`, `text`, `html`, and `headers` for a reply) and logs one line with the address and file path.
 
 ### `mail.snsWebhook`
 
@@ -1171,15 +1171,46 @@ Inbound handler for SES bounce and complaint events delivered through SNS; suppr
 
 `mail.snsWebhook({ path, topicArns, region?, fetchCert?, confirm? })` returns a public POST handler for an SNS HTTP/S subscription to the SES event topic. `topicArns` is required: after the signature verifies, a message whose `TopicArn` is not listed is refused with 401, before a subscription is confirmed or an event processed (SNS signs every topic, so anyone could otherwise subscribe the endpoint to their own topic and forge bounces). Every message's signature (SignatureVersion 1 or 2) is verified against the certificate at `SigningCertURL`, which must be `https://sns.<region>.amazonaws.com/...pem` (any AWS region when `region` is omitted); otherwise the answer is 401. A `SubscriptionConfirmation` is confirmed by fetching its `SubscribeURL` (same host rule). A `Notification` with a permanent bounce or a complaint puts each recipient on `pipework_email_suppressions`; a transient or undetermined bounce is logged only. Each is the step `pipework/email:notification` with an `Email:bounce` or `Email:complaint` audit record (`entity_id` the message id when found by `provider_message_id`; `after` has `address`, `bounceType`, `suppressed`, `messageTraceId`, the trace of the original send). A suppression logs a warning `email suppressed`; the alert condition (#458) is not built yet. SES events delivered through EventBridge are not supported. `fetchCert` and `confirm` replace the default HTTP fetches (for tests).
 
+### `mail.inbound`
+
+Receiving email: `inbound({ source, queue, onMessage, ... })` returns `{ webhook, jobs, scan, sweep, get }`; messages arrive parsed, threaded into conversations, attachments stored as tenant files.
+
+`mail.inbound({ source, queue, onMessage, storage?, resolveTenant?, rawRetentionDays? = 30, maxRawBytes? = 41943040, environment? })`. Needs blueprint `email: {}`: the table `pipework_email_inbound` (`source_id` unique, `source` `ses | folder`, `raw_location`, `raw_expires_at`, `raw_deleted_at`, `status` `received | processed | failed`, `error`, `message_id_header`, `in_reply_to`, `references`, `from_address`, `subject`, `conversation_id`, `tenant_id`, `verdicts`, `recipients`, `attachment_files`, `received_at`, `processed_at`, `trace_id`; `references`, `recipients` and `attachment_files` are jsonb arrays). Not tenant-scoped (the row exists before a tenant is known). It holds no bodies: the raw message is the copy, deleted by `sweep` after `rawRetentionDays`.
+
+`webhook({ path })` (SES source) returns a public POST handler: the SNS message is verified exactly as for `mail.snsWebhook` (signature, certificate host, `topicArns`; 401 otherwise, nothing recorded), then one `pipework_email_inbound` row keyed by SES's `mail.messageId` and one `pipework.email.receive` job are written in one transaction; the same notification again adds nothing. A notification that is not `Received`, or whose receipt action is not `S3`, is answered 200 and ignored. Spread `jobs` into the worker surface's `jobs` (same queue).
+
+The receive job (trace step `pipework/email:receive`, `EmailInbound:received` audit record on success) reads the raw message from the source (over `maxRawBytes`: row `failed`, no handler call, no retry), parses it, assigns the conversation, calls `resolveTenant(email)` (`null` = none; it runs before threading and gets the message without `conversationId`, `isNewConversation` or `tenantId`), threads, stores attachments with `storage.putFor(tenant, ...)` when both `storage` and a tenant exist (otherwise `attachments[].file` is `null`, metadata kept), and calls `onMessage(email)`. A throw, or a failure reading the raw message, rethrows so the queue retries (set `maxAttempts`); the retry sees the same message, and attachments stored by the earlier attempt are reused, not stored again. A raw message that is definitely gone (S3 `NoSuchKey`, a missing file) marks the row `failed` at once, with no retry. `onMessage` is called at least once per message: a retry after a handler error, or a job re-run after a crash, calls it again with the same `id`, so make it idempotent on `id`.
+
+`ReceivedEmail`: `{ id, conversationId, isNewConversation, tenantId, messageId, inReplyTo, references, from: {address, name}, to[], cc[], replyTo[], subject, date, text, html, attachments: [{ filename, mediaType, size, sha256, contentId, inline, file: StoredFile | null }], verdicts: { spam, virus, spf, dkim, dmarc } | null, recipients }`. Message ids are without angle brackets; `from` has empty strings when the message has no readable From; `verdicts` values are SES's `PASS`, `FAIL`, `GRAY`, `PROCESSING_FAILED` (`null` for the folder stand-in).
+
+Threading: the ids of In-Reply-To then References are matched, first match winning, to (a) an earlier received message's Message-ID, or (b) for an id `<X@...amazonses.com>`, a sent message whose `provider_message_id` is `X` and which has a `conversation_id` (set by `mail.send`). No match: a new conversation id and `isNewConversation: true`. Ids are compared exactly (case-sensitive). A received message is matched only when its `tenant_id` equals the tenant `resolveTenant` named for this message or either is null; a sent message's conversation is refused when it holds a received message of another tenant (a forged In-Reply-To cannot join another tenant's conversation). Threading is not authentication: Message-IDs are not secret and From is forgeable, so before attaching a message to a conversation's participants the app checks `from` against them and the DKIM and DMARC verdicts.
+
+Parsing is hand-written and never throws: RFC 2047 encoded words, RFC 2231 filenames, quoted-printable and base64, charsets known to `TextDecoder` (utf-8 fallback), nested multipart with missing boundaries, `message/rfc822` kept as one attachment.
+
+`sweep({ limit? = 500 })` (for a cron; needs a Flow) deletes raw copies past `raw_expires_at` and sets `raw_deleted_at`; returns `{ deleted, failed }`. `scan()` (folder source; needs a Flow) receives each `.eml` in the folder; `get(id)` returns the row's metadata (needs a Flow).
+
+### `mail.sesReceipt`
+
+Inbound source: SES receipt rule storing raw messages in S3 and notifying a signed SNS topic.
+
+`mail.sesReceipt({ bucket, topicArns, region?, fetchCert?, confirm? })`. `bucket` is a `StorageBackend` over the receipt bucket with no prefix (`storage.s3({ bucket, region, credentials })`); the receive job reads, and `sweep` deletes, the object named by the S3 action's `objectKey`. The receipt rule needs an S3 action that also publishes to an SNS topic listed in `topicArns`.
+
+### `mail.inboundFolder`
+
+Inbound development source: `.eml` files dropped in a folder, received by `scan()`; refused in production.
+
+`mail.inboundFolder({ dir })`. `scan()` copies each `*.eml` in `dir` to `dir/received/<sha-prefix>-<name>` (the raw copy until `sweep`), records it and enqueues the receive job, then removes the original; the same bytes dropped again are counted as `duplicates` and not received twice. `mail.inbound` throws when `environment` is `production`.
+
 ## accessLinks — Access Links
 
 Short, revocable bearer links to a tenant's resource, for people with no account ("a public link that never expires", "a link for John that works once"). A tenant creates a link; anyone holding the code can resolve it on a public route with no tenant and no auth in the Flow; a use counts only when the app confirms it completed.
 
-Opt in with blueprint `accessLinks: {}`. The generated migration then includes three tables:
+Opt in with blueprint `accessLinks: {}`. The generated migration then includes four tables:
 
 - `access_link_code` — `code` (primary key), `tenant_id`, `link_id`, `created_at`. Not tenant-scoped, no row-level security: it maps a code to its tenant so a request that has no tenant can find where to look, and holds nothing else.
 - `access_link` — one row per link (target, permissions, note, expiry, `max_uses`, `require_checks`, `check_data`, revoked). Tenant-scoped; forced RLS.
 - `access_link_use` — one row per use (kind, status `pending | completed | abandoned`, `reserved_until`, client, location, `detail` jsonb, `claimed_at`). Tenant-scoped; forced RLS.
+- `access_link_check_spent` — `challenge` (primary key), `expires_at`: the person-check solutions already accepted. Not tenant-scoped, no row-level security.
 
 ### `accessLinks.create`
 
@@ -1255,6 +1286,44 @@ const preview = fitting.public().route('POST', '/s/preview')
   })
 ```
 
+### `accessLinks.personCheck`
+
+`accessLinks.personCheck({ secret, maxNumber?, challengeMs?, passMs?, database? })` returns a `PersonCheck`: a self-hosted "is this a person" check for `requireChecks`, with no third-party script. It uses proof-of-work in the ALTCHA challenge format (algorithm `SHA-256`; fields `challenge`, `maxnumber`, `salt`, `signature`), so the ALTCHA widget (MIT; serve its script yourself) solves it in the background with no puzzle, and falls back to a keyboard and screen-reader checkbox. pipework does not ship the widget.
+
+| field | meaning |
+|---|---|
+| `secret` | String or Buffer, 32 bytes or more, the same in every process. Shorter throws at creation; there is no random fallback, because a per-process secret breaks passes across processes. Read it in your config and pass it in. Challenge and pass keys are derived from it per purpose. |
+| `maxNumber` | The largest number the browser may have to try; the work is half this on average. Default 100 000; 1 to 10 000 000. |
+| `challengeMs` | How long a challenge can be solved for. Default 10 minutes. |
+| `passMs` | How long a pass is good for. Default 30 minutes. |
+| `database` | The database holding `access_link_check_spent`; default the default database. |
+
+- `challenge(code)` — a `PersonChallenge` for the widget. Its salt is `<random hex>?expires=<unix seconds>&link=<code>`, so the challenge is bound to one link code and an expiry; the signature is an HMAC of the challenge.
+- `verify(code, solution)` — `solution` is the widget's base64 payload (`{ algorithm, challenge, number, salt, signature, took }`). Returns `{ pass, expiresAt }`, or `null` for anything else: not a string, not base64 or JSON, wrong types, a negative or non-integer `number`, a bad signature, a wrong number, an expired challenge, a challenge made for another code, or a solution already used. It never throws on bad input. A solution is accepted once across all processes: the challenge is inserted into `access_link_check_spent` with `ON CONFLICT DO NOTHING` on the owner connection (`pipe.system()`), so of any number of racing verifies exactly one gets a pass. Rows are kept until an hour past the challenge's expiry and pruned (up to 100 per call) by later verifies. Needs a Flow.
+- `check` — an `AccessLinkCheck`: true when `proof` is a pass string with a valid signature, not expired, issued for this link's code. The pass is `base64url(JSON {code, exp}).base64url(HMAC)`.
+- `accessLinks.personCheck.solve(challenge)` — solves a challenge in code and returns the widget-format solution. For tests: it does the work the browser would.
+
+```ts
+const person = accessLinks.personCheck({ secret: appConfig.linkSecret })
+const links = accessLinks.create({ permissions: ['view'], checks: { person: person.check } })
+await links.link({ target, permissions: ['view'], requireChecks: ['person'] })
+
+// Public route 1: the widget's challengeurl.
+const challenge = fitting.public().route('GET', '/s/:code/challenge')
+  .fit(async ({ params }) => person.challenge(params.code))
+
+// Public route 2: the widget's payload in, a pass out.
+const verify = fitting.public().route('POST', '/s/verify')
+  .input(schema.check.object({ code: schema.check.string(), payload: schema.check.string() }))
+  .fit(async ({ input }) => {
+    const passed = await person.verify(input.code, input.payload)
+    return passed ?? { error: 'not-verified' }
+  })
+
+// Later: begin the use with the pass.
+await links.beginUse(code, { kind: 'view', proof: { person: pass } })
+```
+
 ## credits — Prepaid Usage Credits
 
 Prepaid credits per tenant, like CI minutes: a subscription grants an allocation each period, packs are bought on top, and work draws them down. Every grant has its own expiry; spending draws the soonest-expiring grant first. A job reserves before it starts, settles the actual amount when it ends, and releases on failure. Units are whole numbers (safe integers, bigint in SQL); the app decides what one unit is.

package/dist/REFERENCE.md

@@ -25,8 +25,12 @@
 - [valve](#valve)
 - [vector — Vector & Full-Text Search](#vector-vector-full-text-search)
 - [accessLinks](#accesslinks)
+- [alerts](#alerts)
 - [audit — Audit Logging](#audit-audit-logging)
 - [cache — Caching](#cache-caching)
+- [credits](#credits)
+- [mail](#mail)
+- [storage](#storage)
 - [webhook — Inbound & Outbound Webhooks](#webhook-inbound-outbound-webhooks)
 - [behavior — Resource Decorators](#behavior-resource-decorators)
 - [fitting — Dependency Injection](#fitting-dependency-injection)
@@ -632,6 +636,14 @@ Base error class with code, statusCode, and suggestion fields.
 
 429 — too many attempts; carries `retryAfterSeconds`, sent as a `Retry-After` header.
 
+### `errors.PayloadTooLarge`
+
+413 — request body over the route's size limit.
+
+### `errors.UnsupportedMediaType`
+
+415 — request body media type not accepted by the route.
+
 ## lifecycle — Startup & Shutdown
 
 Application lifecycle namespace — startup orchestration with hooks and timeouts.
@@ -1087,6 +1099,44 @@ Access links namespace — short revocable bearer links to a tenant's resource.
 
 Creates an access-link handle: tenant-scoped management plus the public resolve / beginUse / completeUse / abandonUse.
 
+### `accessLinks.personCheck`
+
+A self-hosted person check for `requireChecks`: ALTCHA-format proof-of-work challenges bound to a link code
+and an expiry, HMAC-signed with `secret` (32 bytes or more, the same in every process). A solution is accepted
+once across all processes (`access_link_check_spent`, in the `accessLinks` tables) and yields a short-lived
+signed pass that is the proof for the link's check at `beginUse`. `personCheck.solve(challenge)` solves a
+challenge in code, for tests.
+
+The app writes two public routes: GET returns `check.challenge(code)` for the widget (`challengeurl`, or
+`challengejson`); POST gives `check.verify(code, payload)` the widget's payload and returns the pass, or refuses
+when it is `null`. The page carries the ALTCHA widget (MIT; serve its script yourself, no third party sees the
+visitor), which solves in the background and falls back to a keyboard and screen-reader checkbox. pipework
+does not ship the widget.
+
+```ts
+const person = accessLinks.personCheck({ secret: config.linkSecret })
+const links = accessLinks.create({ permissions: ['view'], checks: { person: person.check } })
+await links.link({ target, permissions: ['view'], requireChecks: ['person'] })
+// public route: begin with the pass the visitor got from POST
+await links.beginUse(code, { kind: 'view', proof: { person: pass } })
+```
+
+## alerts
+
+Alerts namespace — raise and resolve keyed conditions, grouped, delivered to sinks through an outbox, traced.
+
+### `alerts.create`
+
+Creates an alerts handle.
+
+### `alerts.webhook`
+
+A sink that POSTs the alert as signed JSON to a URL.
+
+### `alerts.memory`
+
+A sink that keeps deliveries in `.delivered`, for tests.
+
 ## audit — Audit Logging
 
 Audit logging namespace — structured audit trail for data changes.
@@ -1123,6 +1173,62 @@ Creates a single-key cache with TTL, a loader function, and invalidation.
 
 Creates a per-tenant cache — each tenant gets its own TTL and loader keyed by tenant ID.
 
+## credits
+
+Credits namespace — prepaid usage credits per tenant: expiring grants, reserve / settle / release by job.
+
+### `credits.create`
+
+Creates a credits handle.
+
+## mail
+
+Mail namespace — email through a job queue, SES v2 or a dev stand-in, bounce and complaint suppression, and receiving.
+
+### `mail.create`
+
+Creates the mail interface: `send(db, { to, template, data, key })` in the caller's transaction, and the `jobs` that deliver.
+
+### `mail.ses`
+
+Amazon SES v2 provider, SigV4-signed without the AWS SDK.
+
+### `mail.devStandIn`
+
+Development provider that writes each message to a file instead of sending; refused in production.
+
+### `mail.snsWebhook`
+
+Inbound handler for SES bounce and complaint events delivered through SNS; suppresses the address.
+
+### `mail.inbound`
+
+Receiving email: `inbound({ source, queue, onMessage, ... })` returns `{ webhook, jobs, scan, sweep, get }`; messages arrive parsed, threaded into conversations, attachments stored as tenant files.
+
+### `mail.sesReceipt`
+
+Inbound source: SES receipt rule storing raw messages in S3 and notifying a signed SNS topic.
+
+### `mail.inboundFolder`
+
+Inbound development source: `.eml` files dropped in a folder, received by `scan()`; refused in production.
+
+## storage
+
+Storage namespace — tenant-scoped, content-addressed file storage with signed URLs and retention.
+
+### `storage.create`
+
+Creates a storage handle over a backend.
+
+### `storage.s3`
+
+S3-compatible backend (AWS S3, MinIO, R2): SigV4 over `fetch`, multipart streaming upload, optional server-side encryption.
+
+### `storage.local`
+
+Local-disk backend for development and tests; refused in production.
+
 ## webhook — Inbound & Outbound Webhooks
 
 Webhook namespace — inbound verification, outbound delivery with retries, HMAC signing.
@@ -1215,7 +1321,7 @@ Creates a Flow for test isolation with optional auth and tenant overrides.
 
 ## http — Server
 
-HTTP server namespace — managed by manifold.start(), not directly accessible.
+HTTP namespace: `http.file()` builds a file response; the server itself is managed by manifold.start().
 
 ### Types
 
@@ -1243,7 +1349,7 @@ interface RateLimitConfig
 interface InjectOptions
 ```
 
-**`InjectResponse`** — Response from server.inject() — statusCode, headers, body, json() helper.
+**`InjectResponse`** — Response from server.inject() — statusCode, headers, body, rawPayload, json() helper.
 
 ```typescript
 interface InjectResponse
@@ -1273,6 +1379,22 @@ interface ErrorResponse
 interface PipeworkServer
 ```
 
+**`FileResponseInit`** — What `http.file()` takes.
+
+```typescript
+interface FileResponseInit
+```
+
+**`FileResponse`**
+
+A file for a route to answer with, made by `http.file()`. Return it from a
+handler declared with `.file()`; it is sent as the response body, streamed
+when `body` is a Readable.
+
+```typescript
+interface FileResponse
+```
+
 **`HttpRequest`** — Fastify request with pipework extensions — req.id (UUID), typed headers, client address (`ip`, `ips`).
 
 ```typescript

package/dist/core/config/schema.js

@@ -217,14 +217,14 @@ export const trunkConfigSchema = z.object({
     trace: traceSchema.optional().describe('Trace substrate retention and partitioning'),
     audit: auditSchema.optional().describe('Audit substrate retention; independent of trace storage'),
     valve: valveSchema.optional().describe('Valve substrate — opts the valve_crossing ledger table into generated migrations'),
-    accessLinks: accessLinksSchema.optional().describe('Access links — opts the access_link_code, access_link and access_link_use tables into generated migrations'),
+    accessLinks: accessLinksSchema.optional().describe('Access links — opts the access_link_code, access_link, access_link_use and access_link_check_spent tables into generated migrations'),
     credits: creditsSchema.optional().describe('Prepaid usage credits — opts the credit_grant, credit_reservation, credit_draw and credit_ledger tables into generated migrations'),
     alerts: alertsSchema.optional().describe('Alerts — opts the pipework_alerts, pipework_alert_deliveries and pipework_alert_source_state tables into generated migrations'),
     storage: storageSchema.optional().describe('File storage — opts the storage_file table into generated migrations'),
     sessions: sessionsSchema.optional().describe('Sessions — opts the pipework_refresh_tokens and pipework_auth_versions tables into generated migrations'),
     orgs: orgsSchema.optional().describe('Multi-org — opts the pipework_user_orgs table into generated migrations'),
     passwords: passwordsSchema.optional().describe('Password sign-in — opts the pipework_signin_attempts table into generated migrations'),
-    email: emailSchema.optional().describe('Transactional email — opts the pipework_email_messages and pipework_email_suppressions tables into generated migrations'),
+    email: emailSchema.optional().describe('Email — opts the pipework_email_messages, pipework_email_suppressions and pipework_email_inbound tables into generated migrations'),
     fastPath: fastPathSchema.optional().describe('Opt-in fast path for `check` / `test` — affected-scoped, tier-trimmed iteration'),
     observability: observabilitySchema.optional(),
     env: z.record(z.string(), envVarDefSchema).optional().describe('Declared environment variables — the canonical home for runtime config (ports, service tokens, '

package/dist/core/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/core/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAG1B,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;IACpI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sNAAsN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IAC5G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mlBAAmlB,CAAC;IACjoB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6EAA6E,CAAC;IACrJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IACjG,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC,CAAC,QAAQ,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;AAE9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClE,0HAA0H,CAC3H;IACD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,6SAA6S,CAC9S;IACD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC3D,8MAA8M,CAC/M;IACD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpE,2QAA2Q,CAC5Q;IACD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5E,yLAAyL,CAC1L;IACD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACvE,4SAA4S,CAC7S;IACD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACvC,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;KAC5C,CAAC,CAAC,CAAC,QAAQ,EAAE;CACf,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;AAEvE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACnC,yDAAyD,EACzD,yFAAyF,CAC1F,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IAC3I,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,0FAA0F,CAAC;IAChK,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IAC9J,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4TAA4T,CAAC;IAC/X,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yJAAyJ,CAAC;IAC5M,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gLAAgL,CAAC;IACzP,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6OAA6O,CAAC;IACxT,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,2XAA2X,CAAC;CAChc,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wIAAwI,CAAC;IAC1M,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qSAAqS,CAAC;CAClV,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEhC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEtC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAElC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAClC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEjC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAE/B,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEhC,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAChI,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/E,+FAA+F;UAC7F,oGAAoG,CACvG;IACD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;QACzK,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yFAAyF,CAAC;KAC5J,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC7G,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC/H,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAoB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;SACvG,QAAQ,EAAE;SACV,QAAQ,CAAC,gIAAgI,CAAC;CAC9I,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;CACjP,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAChF,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CAClD,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC9H,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACxH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wLAAwL,CAAC;IAChQ,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAChI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAC3H,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACvG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC9F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;CAC3I,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,wFAAwF;QACxF,wFAAwF;QACxF,sFAAsF;QACtF,oCAAoC,CACrC;IACD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAClD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9E,qFAAqF;IACrF,wDAAwD,CACzD,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,sFAAsF;QACtF,iFAAiF,CAClF;IACD,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,uFAAuF;QACvF,wFAAwF;QACxF,0FAA0F,CAC3F;IACD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;CACtG,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,6EAA6E,CAAC,EACvH,mBAAmB,CACpB,CAAC,QAAQ,EAAE;CACb,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,yFAAyF;QACzF,oFAAoF;QACpF,qFAAqF,CACtF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,oFAAoF;QACpF,kFAAkF,CACnF;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,8EAA8E;QAC9E,sCAAsC,CACvC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,0FAA0F;QAC1F,sFAAsF;QACtF,oDAAoD,CACrD;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,uFAAuF;YACvF,sGAAsG,CACvG;QACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,mDAAmD;YACnD,sFAAsF,CACvF;QACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,2FAA2F;YAC3F,kFAAkF,CACnF;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpB,kFAAkF;QAClF,oGAAoG;QACpG,sGAAsG,CACvG;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACjE,yFAAyF;QACzF,+FAA+F;QAC/F,4FAA4F;QAC5F,gFAAgF,CACjF;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,sFAAsF;QACtF,iFAAiF,CAClF;IACD,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,uFAAuF;QACvF,qFAAqF,CACtF;IACD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChD,uFAAuF;QACvF,gFAAgF,CACjF;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,6DAA6D;QAC7D,qFAAqF;QACrF,4EAA4E;QAC5E,6EAA6E,CAC9E;CACF,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAC5B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC;IACN,kBAAkB;IAClB,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;CACpF,CAAC,CACH,CAAC,QAAQ,CAAC,mGAAmG,CAAC,CAAA;AAE/G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0MAA0M,CAAC;IAC3P,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IACnJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SACvB,KAAK,CACJ,0CAA0C,EAC1C,+FAA+F;UAC7F,0EAA0E,CAC7E;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,6KAA6K,CAAC;IAC1L,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC3H,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtF,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC1H,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0FAA0F,CAAC;IAChI,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACpF,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACjG,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IAC1H,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAChK,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mIAAmI,CAAC;IAC/K,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+HAA+H,CAAC;IACzK,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAClH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;IACvJ,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC/G,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACtI,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yHAAyH,CAAC;IACjK,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IAC/H,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,iGAAiG;UAC/F,uGAAuG;UACvG,2FAA2F,CAC9F;CACF,CAAC,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/core/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAG1B,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;IACpI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IAChI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sNAAsN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IAC5G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mlBAAmlB,CAAC;IACjoB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6EAA6E,CAAC;IACrJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IACjG,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAC5F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACtF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACvD,CAAC,CAAC,QAAQ,EAAE;IACb,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;AAE9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClE,0HAA0H,CAC3H;IACD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,6SAA6S,CAC9S;IACD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC3D,8MAA8M,CAC/M;IACD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpE,2QAA2Q,CAC5Q;IACD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5E,yLAAyL,CAC1L;IACD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACvE,4SAA4S,CAC7S;IACD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACvC,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;KAC5C,CAAC,CAAC,CAAC,QAAQ,EAAE;CACf,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;AAEvE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACnC,yDAAyD,EACzD,yFAAyF,CAC1F,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wEAAwE,CAAC;IAC3I,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,0FAA0F,CAAC;IAChK,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IAC9J,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC3K,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4TAA4T,CAAC;IAC/X,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,yJAAyJ,CAAC;IAC5M,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gLAAgL,CAAC;IACzP,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6OAA6O,CAAC;IACxT,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,2XAA2X,CAAC;CAChc,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wIAAwI,CAAC;IAC1M,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qSAAqS,CAAC;CAClV,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEhC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEtC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAElC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAClC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEjC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEnC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAE/B,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEhC,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAChI,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/E,+FAA+F;UAC7F,oGAAoG,CACvG;IACD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;QACzK,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yFAAyF,CAAC;KAC5J,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC7G,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC/H,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAoB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;SACvG,QAAQ,EAAE;SACV,QAAQ,CAAC,gIAAgI,CAAC;CAC9I,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrM,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;CACjP,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;IAChF,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CAClD,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IAC9H,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACxH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wLAAwL,CAAC;IAChQ,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAChI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAC3H,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACvG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IAC9F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;CAC3I,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,wFAAwF;QACxF,wFAAwF;QACxF,sFAAsF;QACtF,oCAAoC,CACrC;IACD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAClD,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAC9E,qFAAqF;IACrF,wDAAwD,CACzD,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,sFAAsF;QACtF,iFAAiF,CAClF;IACD,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,uFAAuF;QACvF,wFAAwF;QACxF,0FAA0F,CAC3F;IACD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;CACtG,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,6EAA6E,CAAC,EACvH,mBAAmB,CACpB,CAAC,QAAQ,EAAE;CACb,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,yFAAyF;QACzF,oFAAoF;QACpF,qFAAqF,CACtF;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,oFAAoF;QACpF,kFAAkF,CACnF;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,8EAA8E;QAC9E,sCAAsC,CACvC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,0FAA0F;QAC1F,sFAAsF;QACtF,oDAAoD,CACrD;IACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,uFAAuF;YACvF,sGAAsG,CACvG;QACD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,mDAAmD;YACnD,sFAAsF,CACvF;QACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC/C,2FAA2F;YAC3F,kFAAkF,CACnF;KACF,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACpB,kFAAkF;QAClF,oGAAoG;QACpG,sGAAsG,CACvG;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACjE,yFAAyF;QACzF,+FAA+F;QAC/F,4FAA4F;QAC5F,gFAAgF,CACjF;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC9C,sFAAsF;QACtF,iFAAiF,CAClF;IACD,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CACtC,uFAAuF;QACvF,qFAAqF,CACtF;IACD,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChD,uFAAuF;QACvF,gFAAgF,CACjF;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1D,6DAA6D;QAC7D,qFAAqF;QACrF,4EAA4E;QAC5E,6EAA6E,CAC9E;CACF,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAC5B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CAAC;IACN,kBAAkB;IAClB,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;CACpF,CAAC,CACH,CAAC,QAAQ,CAAC,mGAAmG,CAAC,CAAA;AAE/G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0MAA0M,CAAC;IAC3P,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IACnJ,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;SACvB,KAAK,CACJ,0CAA0C,EAC1C,+FAA+F;UAC7F,0EAA0E,CAC7E;SACA,QAAQ,EAAE;SACV,QAAQ,CAAC,6KAA6K,CAAC;IAC1L,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACrG,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC3H,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtF,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAC1H,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0FAA0F,CAAC;IAChI,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACpF,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACjG,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IAC1H,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qIAAqI,CAAC;IACzL,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mIAAmI,CAAC;IAC/K,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+HAA+H,CAAC;IACzK,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IAClH,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;IACvJ,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;IAC/G,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACtI,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mIAAmI,CAAC;IAC3K,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IAC/H,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC5D,iGAAiG;UAC/F,uGAAuG;UACvG,2FAA2F,CAC9F;CACF,CAAC,CAAA"}

package/dist/data/migrate/internal-definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-definitions.d.ts","sourceRoot":"","sources":["../../../src/data/migrate/internal-definitions.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAE5D,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA4FlC"}
+{"version":3,"file":"internal-definitions.d.ts","sourceRoot":"","sources":["../../../src/data/migrate/internal-definitions.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAE5D,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8FlC"}

package/dist/data/migrate/internal-definitions.js

@@ -28,10 +28,11 @@ export async function loadInternalDefinitions(blueprint, options) {
         result['__pipework_valve_crossing'] = valveCrossing;
     }
     if (blueprint.accessLinks !== undefined) {
-        const { accessLinkCode, accessLink, accessLinkUse } = await import('../../infra/access-links/schema.js');
+        const { accessLinkCode, accessLink, accessLinkUse, accessLinkCheckSpent } = await import('../../infra/access-links/schema.js');
         result['__pipework_access_link_code'] = accessLinkCode;
         result['__pipework_access_link'] = accessLink;
         result['__pipework_access_link_use'] = accessLinkUse;
+        result['__pipework_access_link_check_spent'] = accessLinkCheckSpent;
     }
     if (blueprint.credits !== undefined) {
         const { creditGrant, creditReservation, creditDraw, creditLedger } = await import('../../infra/credits/schema.js');
@@ -64,9 +65,10 @@ export async function loadInternalDefinitions(blueprint, options) {
         result['__pipework_signin_attempts'] = signinAttempts;
     }
     if (blueprint.email !== undefined) {
-        const { emailMessages, emailSuppressions } = await import('../../infra/email/schema.js');
+        const { emailMessages, emailSuppressions, emailInbound } = await import('../../infra/email/schema.js');
         result['__pipework_email_messages'] = emailMessages;
         result['__pipework_email_suppressions'] = emailSuppressions;
+        result['__pipework_email_inbound'] = emailInbound;
     }
     // Queue tables register at createQueue() time (worker surfaces create their
     // queue at construction, so config discovery populates the registry before

package/dist/data/migrate/internal-definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-definitions.js","sourceRoot":"","sources":["../../../src/data/migrate/internal-definitions.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAI1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAoB,EACpB,OAAuC;IAEvC,IAAI,CAAC,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAEzC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACtE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAA;QAC9E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAA;QACvF,MAAM,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAA;QAClC,MAAM,CAAC,uBAAuB,CAAC,GAAG,SAAS,CAAA;QAC3C,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,gCAAgC,CAAC,GAAG,iBAAiB,CAAA;IAC9D,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;IACjD,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAA;QAC3E,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QACxG,MAAM,CAAC,6BAA6B,CAAC,GAAG,cAAc,CAAA;QACtD,MAAM,CAAC,wBAAwB,CAAC,GAAG,UAAU,CAAA;QAC7C,MAAM,CAAC,4BAA4B,CAAC,GAAG,aAAa,CAAA;IACtD,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAA;QAClH,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;QAC/C,MAAM,CAAC,+BAA+B,CAAC,GAAG,iBAAiB,CAAA;QAC3D,MAAM,CAAC,wBAAwB,CAAC,GAAG,UAAU,CAAA;QAC7C,MAAM,CAAC,0BAA0B,CAAC,GAAG,YAAY,CAAA;IACnD,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAA;QACrE,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;IACjD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAClG,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;QACpC,MAAM,CAAC,6BAA6B,CAAC,GAAG,eAAe,CAAA;QACvD,MAAM,CAAC,+BAA+B,CAAC,GAAG,gBAAgB,CAAA;IAC5D,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACjF,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,0BAA0B,CAAC,GAAG,YAAY,CAAA;IACnD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAC9D,MAAM,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAA;IAC3C,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACpE,MAAM,CAAC,4BAA4B,CAAC,GAAG,cAAc,CAAA;IACvD,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QACxF,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,+BAA+B,CAAC,GAAG,iBAAiB,CAAA;IAC7D,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,iCAAiC;IACjC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;IACtE,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACpD,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,GAAG,UAAU,CAAA;IACjD,CAAC;IAED,uEAAuE;IACvE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAA;IACpF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,UAAU,CAAA;IAC3C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"internal-definitions.js","sourceRoot":"","sources":["../../../src/data/migrate/internal-definitions.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,0EAA0E;AAI1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAoB,EACpB,OAAuC;IAEvC,IAAI,CAAC,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAEzC,MAAM,MAAM,GAA4B,EAAE,CAAA;IAE1C,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACtE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAA;QAC9E,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAA;QACvF,MAAM,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAA;QAClC,MAAM,CAAC,uBAAuB,CAAC,GAAG,SAAS,CAAA;QAC3C,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,gCAAgC,CAAC,GAAG,iBAAiB,CAAA;IAC9D,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;IACjD,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAA;QAC3E,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC9H,MAAM,CAAC,6BAA6B,CAAC,GAAG,cAAc,CAAA;QACtD,MAAM,CAAC,wBAAwB,CAAC,GAAG,UAAU,CAAA;QAC7C,MAAM,CAAC,4BAA4B,CAAC,GAAG,aAAa,CAAA;QACpD,MAAM,CAAC,oCAAoC,CAAC,GAAG,oBAAoB,CAAA;IACrE,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAA;QAClH,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;QAC/C,MAAM,CAAC,+BAA+B,CAAC,GAAG,iBAAiB,CAAA;QAC3D,MAAM,CAAC,wBAAwB,CAAC,GAAG,UAAU,CAAA;QAC7C,MAAM,CAAC,0BAA0B,CAAC,GAAG,YAAY,CAAA;IACnD,CAAC;IAED,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAA;QACrE,MAAM,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAA;IACjD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAClG,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;QACpC,MAAM,CAAC,6BAA6B,CAAC,GAAG,eAAe,CAAA;QACvD,MAAM,CAAC,+BAA+B,CAAC,GAAG,gBAAgB,CAAA;IAC5D,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACjF,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,0BAA0B,CAAC,GAAG,YAAY,CAAA;IACnD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QAC9D,MAAM,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAA;IAC3C,CAAC;IAED,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACpE,MAAM,CAAC,4BAA4B,CAAC,GAAG,cAAc,CAAA;IACvD,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;QACtG,MAAM,CAAC,2BAA2B,CAAC,GAAG,aAAa,CAAA;QACnD,MAAM,CAAC,+BAA+B,CAAC,GAAG,iBAAiB,CAAA;QAC3D,MAAM,CAAC,0BAA0B,CAAC,GAAG,YAAY,CAAA;IACnD,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,iCAAiC;IACjC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAA;IACtE,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACpD,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,GAAG,UAAU,CAAA;IACjD,CAAC;IAED,uEAAuE;IACvE,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAA;IACpF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,UAAU,CAAA;IAC3C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/infra/access-links/index.d.ts

@@ -2,4 +2,5 @@ export { createAccessLinks } from './handle.js';
 export type { AccessLinks, AccessLinksConfig, AccessLink, PublicLink, AccessLinkUse, AccessLinkTarget, AccessLinkCheck, AccessLinkCheckArgs, LinkOptions, ResolveResult, BeginUseResult, CompleteUseResult, AbandonUseResult, } from './handle.js';
 export type { CodeConfig } from './code.js';
 export type { RateLimitConfig } from './rate-limit.js';
+export type { PersonCheck, PersonCheckConfig, PersonChallenge, PersonPass } from './person-check.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/infra/access-links/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EACV,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EACvF,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAChF,iBAAiB,EAAE,gBAAgB,GACpC,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EACV,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EACvF,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAChF,iBAAiB,EAAE,gBAAgB,GACpC,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/infra/access-links/namespace.d.ts

@@ -3,5 +3,29 @@ import { createAccessLinks } from './handle.js';
 export declare const accessLinks: {
     /** Creates an access-link handle: tenant-scoped management plus the public resolve / beginUse / completeUse / abandonUse. */
     readonly create: typeof createAccessLinks;
+    /**
+     * A self-hosted person check for `requireChecks`: ALTCHA-format proof-of-work challenges bound to a link code
+     * and an expiry, HMAC-signed with `secret` (32 bytes or more, the same in every process). A solution is accepted
+     * once across all processes (`access_link_check_spent`, in the `accessLinks` tables) and yields a short-lived
+     * signed pass that is the proof for the link's check at `beginUse`. `personCheck.solve(challenge)` solves a
+     * challenge in code, for tests.
+     *
+     * The app writes two public routes: GET returns `check.challenge(code)` for the widget (`challengeurl`, or
+     * `challengejson`); POST gives `check.verify(code, payload)` the widget's payload and returns the pass, or refuses
+     * when it is `null`. The page carries the ALTCHA widget (MIT; serve its script yourself, no third party sees the
+     * visitor), which solves in the background and falls back to a keyboard and screen-reader checkbox. pipework
+     * does not ship the widget.
+     *
+     * ```ts
+     * const person = accessLinks.personCheck({ secret: config.linkSecret })
+     * const links = accessLinks.create({ permissions: ['view'], checks: { person: person.check } })
+     * await links.link({ target, permissions: ['view'], requireChecks: ['person'] })
+     * // public route: begin with the pass the visitor got from POST
+     * await links.beginUse(code, { kind: 'view', proof: { person: pass } })
+     * ```
+     */
+    readonly personCheck: ((config: import("./person-check.js").PersonCheckConfig) => import("./person-check.js").PersonCheck) & {
+        solve: (c: import("./person-check.js").PersonChallenge) => string;
+    };
 };
 //# sourceMappingURL=namespace.d.ts.map

package/dist/infra/access-links/namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,oFAAoF;AACpF,eAAO,MAAM,WAAW;IACtB,6HAA6H;;CAErH,CAAA"}
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG/C,oFAAoF;AACpF,eAAO,MAAM,WAAW;IACtB,6HAA6H;;IAE7H;;;;;;;;;;;;;;;;;;;;OAoBG;;;;CAEK,CAAA"}

package/dist/infra/access-links/namespace.js

@@ -1,7 +1,30 @@
 import { createAccessLinks } from './handle.js';
+import { personCheck } from './person-check.js';
 /** Access links namespace — short revocable bearer links to a tenant's resource. */
 export const accessLinks = {
     /** Creates an access-link handle: tenant-scoped management plus the public resolve / beginUse / completeUse / abandonUse. */
     create: createAccessLinks,
+    /**
+     * A self-hosted person check for `requireChecks`: ALTCHA-format proof-of-work challenges bound to a link code
+     * and an expiry, HMAC-signed with `secret` (32 bytes or more, the same in every process). A solution is accepted
+     * once across all processes (`access_link_check_spent`, in the `accessLinks` tables) and yields a short-lived
+     * signed pass that is the proof for the link's check at `beginUse`. `personCheck.solve(challenge)` solves a
+     * challenge in code, for tests.
+     *
+     * The app writes two public routes: GET returns `check.challenge(code)` for the widget (`challengeurl`, or
+     * `challengejson`); POST gives `check.verify(code, payload)` the widget's payload and returns the pass, or refuses
+     * when it is `null`. The page carries the ALTCHA widget (MIT; serve its script yourself, no third party sees the
+     * visitor), which solves in the background and falls back to a keyboard and screen-reader checkbox. pipework
+     * does not ship the widget.
+     *
+     * ```ts
+     * const person = accessLinks.personCheck({ secret: config.linkSecret })
+     * const links = accessLinks.create({ permissions: ['view'], checks: { person: person.check } })
+     * await links.link({ target, permissions: ['view'], requireChecks: ['person'] })
+     * // public route: begin with the pass the visitor got from POST
+     * await links.beginUse(code, { kind: 'view', proof: { person: pass } })
+     * ```
+     */
+    personCheck,
 };
 //# sourceMappingURL=namespace.js.map

package/dist/infra/access-links/namespace.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,6HAA6H;IAC7H,MAAM,EAAE,iBAAiB;CACjB,CAAA"}
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/infra/access-links/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,6HAA6H;IAC7H,MAAM,EAAE,iBAAiB;IACzB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW;CACH,CAAA"}

package/dist/infra/access-links/person-check.d.ts

@@ -0,0 +1,45 @@
+import type { AccessLinkCheck } from './handle.js';
+/** A proof-of-work challenge in the shape the ALTCHA widget takes. */
+export interface PersonChallenge {
+    readonly algorithm: 'SHA-256';
+    readonly challenge: string;
+    readonly maxnumber: number;
+    readonly salt: string;
+    readonly signature: string;
+}
+export interface PersonCheckConfig {
+    /** Signs challenges and passes; 32 bytes or more, the same in every process. */
+    readonly secret: string | Buffer;
+    /** The largest number the browser may have to try; the work is half this on average. Default 100_000; 1 to 10_000_000. */
+    readonly maxNumber?: number;
+    /** How long a challenge can be solved for. Default 10 minutes. */
+    readonly challengeMs?: number;
+    /** How long a pass is good for. Default 30 minutes. */
+    readonly passMs?: number;
+    /** Database holding `access_link_check_spent`; default the default database. */
+    readonly database?: string;
+}
+export interface PersonPass {
+    readonly pass: string;
+    readonly expiresAt: Date;
+}
+export interface PersonCheck {
+    /** A challenge for one link's code, for the widget. */
+    challenge(code: string): PersonChallenge;
+    /**
+     * Accepts a widget solution (its base64 payload) for `code` once, across processes, and returns a pass;
+     * `null` for anything else: malformed, tampered, expired, for another link, or already spent. Never throws on bad input.
+     * Needs a Flow (it records the spent solution through `pipe.system()`).
+     */
+    verify(code: string, solution: unknown): Promise<PersonPass | null>;
+    /** The `AccessLinkCheck` to register under a name in `accessLinks.create({ checks })`: the proof is a pass issued for this link. */
+    readonly check: AccessLinkCheck;
+}
+declare function createPersonCheck(config: PersonCheckConfig): PersonCheck;
+/** Solves a challenge the way the widget does and returns its base64 payload. For tests: it does the work the browser would. */
+declare function solvePersonChallenge(c: PersonChallenge): string;
+export declare const personCheck: typeof createPersonCheck & {
+    solve: typeof solvePersonChallenge;
+};
+export {};
+//# sourceMappingURL=person-check.d.ts.map

package/dist/infra/access-links/person-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"person-check.d.ts","sourceRoot":"","sources":["../../../src/infra/access-links/person-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAOlD,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,0HAA0H;IAC1H,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAA;IACxC;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACnE,oIAAoI;IACpI,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAChC;AAmBD,iBAAS,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAwFjE;AAED,gIAAgI;AAChI,iBAAS,oBAAoB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAQxD;AAED,eAAO,MAAM,WAAW;;CAAoE,CAAA"}