@earendil-works/chord 1.4.0 → 1.5.1

package/dist/node/http/http.js

@@ -0,0 +1,524 @@
+// The HTTP component (slice 10 §2; decisions "The HTTP core is a fetch handler", "The HTTP server is a native object",
+// "The HTTP component's security baseline", "Settings are arguments, extensions are registries"): `createHttp` takes
+// the app's settings (where to listen, the links endpoint, the close bound) and builds one Web-standard handler,
+// `fetch`, from the registries its facet serves (`Http`, `Authenticators`), an upgrade adapter for Node (`upgrade`), and
+// the facet, whose host-lifetime listener object is Chord's own Node server. Every request is admitted (provenance), routed,
+// checked for foreign origins, authenticated unless foreign, and served in one `host.root` scope with its principal
+// that lasts until its body is delivered (a routed one in a `chord.http` span with an adapter, slice 9); every answer
+// carries the default headers.
+import { awaitWithContext, withAbortSignal, withoutAbortSignal, withTelemetry, } from "../../context/index.js";
+import { local } from "../../contracts/index.js";
+import { isChordError } from "../../data/index.js";
+import { defineFacet } from "../../host/index.js";
+import { hostAttribute, OpenSpan, parentOf, spanFailed, untraced } from "../../telemetry.js";
+import { admit, isForeign, isNavigation, originAccepted, refused, } from "./admission.js";
+import { Authenticators, authenticate, composeAuthenticators } from "./authenticate.js";
+import { DefaultHeaders, Nonces } from "./headers.js";
+import { webIncoming } from "./incoming.js";
+import { connectionOf, NodeIncoming, NodeListener } from "./node.js";
+import { HttpFailure, WebRequest } from "./request.js";
+import { answerOf, errorAnswer, webResponse } from "./response.js";
+import { composeRouter, Http } from "./router.js";
+import { Upgrades } from "./upgrades.js";
+/** Builds the HTTP component on `host` (a request's scope is a `host.root` with its principal). */
+export function createHttp(host, options, context) {
+    return new Component(host, options, context);
+}
+/** The listener: a host-lifetime object of plugin `chord.http` whose native is Chord's own Node server. */
+export const HttpListener = local("chord.http.listener", { version: 1, params: {}, members: {} });
+/** `close`'s bound unless `closeTimeout` says otherwise: 30 s. */
+const CLOSE_TIMEOUT = 30_000;
+/** Who threw out of a route itself (no wrap). */
+const ROUTE = { kind: "route" };
+class Component {
+    facet;
+    upgrade;
+    #host;
+    #options;
+    /** The `chord.host` of its `chord.http` spans: its host's. */
+    #spanHost;
+    #onError;
+    #context;
+    /** The component's context without its cancellation: each request's scope adds its own signal. */
+    #base;
+    #defaults = new DefaultHeaders();
+    #nonces = new Nonces();
+    #upgrades = new Upgrades();
+    #running = new Set();
+    /** The registries while they resolve (once; again after a failed try), then the values themselves. */
+    #resolving;
+    #registries;
+    /** Aborted at `close`: the router's watch. */
+    #closing = new AbortController();
+    #closed;
+    #listening = Promise.withResolvers();
+    constructor(host, options, context) {
+        this.#host = host;
+        this.#options = options;
+        this.#spanHost = hostAttribute(host.address);
+        this.#onError = options.onError;
+        this.#context = context;
+        this.#base = withoutAbortSignal(context);
+        this.#listening.promise.catch(() => { });
+        this.upgrade = (message, socket, head) => {
+            socket.on("error", () => socket.destroy());
+            void this.#upgrade(message, socket, head).catch(() => socket.destroy());
+        };
+        const { listen } = options;
+        this.facet = defineFacet((facet) => {
+            facet.serve(Http, { compose: composeRouter });
+            facet.serve(Authenticators, { compose: composeAuthenticators });
+            if (listen === undefined)
+                return;
+            facet.serve(HttpListener, (_params, self) => {
+                self.open((opening) => this.#listen(listen, opening), async (listener, _reason, closing) => {
+                    listener.stop();
+                    await this.close(closing);
+                    await listener.closed();
+                });
+                return {};
+            });
+        });
+    }
+    async fetch(request, connection = {}) {
+        const { answer, finished } = await this.serve(webIncoming(request), connection);
+        // A whole body is out of the component's hands once its `Response` is; a pulled one ends when it is read.
+        if (answer.body instanceof ReadableStream)
+            return webResponse({ ...answer, body: tracked(answer.body, finished) });
+        finished();
+        return webResponse(answer);
+    }
+    listening(context) {
+        return awaitWithContext(this.#listening.promise, context);
+    }
+    close(context) {
+        this.#closed ??= this.#close(context);
+        return this.#closed;
+    }
+    /**
+     * Serves `request`: its answer, and what its consumer calls once the body is written or abandoned. Never throws:
+     * whatever fails answers (503 before the host's `load` or while closing, 403, 404, 500 reported).
+     */
+    async serve(request, connection) {
+        const controller = new AbortController();
+        const finished = Promise.withResolvers();
+        const running = { controller, done: finished.promise };
+        this.#running.add(running);
+        request.cancelled((reason) => controller.abort(reason));
+        let answer;
+        try {
+            const served = await this.#serve(request, connection, controller, finished.promise);
+            answer = served.answer;
+            // The request is over once its consumer finished and its scope (if it got one) ended.
+            if (served.scope !== undefined)
+                running.done = Promise.all([finished.promise, served.scope]);
+        }
+        catch {
+            answer = this.refusal(500);
+        }
+        void running.done.then(() => this.#running.delete(running));
+        return { answer, finished: () => finished.resolve() };
+    }
+    /** The answer for a refused or failed request, outside any scope, with the default headers. */
+    refusal(status, admitted, router, head = false) {
+        return errorAnswer(status, this.#defaults.of(admitted, router, this.#nonces.next()), undefined, head);
+    }
+    /** The steps of `serve`: closing, the registries, admission, the route, origins, the principal, then the scope. */
+    async #serve(request, connection, controller, finished) {
+        const head = request.method === "HEAD";
+        if (this.#closing.signal.aborted)
+            return { answer: this.refusal(503, undefined, undefined, head) };
+        let registries;
+        try {
+            registries = this.#registries ?? (await this.#resolve());
+        }
+        catch {
+            return { answer: this.refusal(503, undefined, undefined, head) };
+        }
+        if (this.#closing.signal.aborted)
+            return { answer: this.refusal(503, undefined, undefined, head) };
+        const router = registries.router.value;
+        const admission = admit(request, connection, router.hosts, router.relays);
+        if (refused(admission)) {
+            if (admission.failed !== undefined)
+                this.#hookFailed("relay", admission.failed.relay, admission.failed.error);
+            return { answer: this.refusal(403, undefined, router, head) };
+        }
+        // A fresh script nonce per response (decision "A CSP nonce per response").
+        const webRequest = new WebRequest(request, admission, this.#nonces.next(), connection.remoteAddress);
+        const match = router.route(request.method, webRequest.path);
+        if (match === "bad_path" || match === undefined) {
+            return { answer: this.refusal(match === undefined ? 404 : 400, admission, router, head) };
+        }
+        webRequest.params = match.params;
+        const foreign = isForeign(request);
+        if (!match.crossSite && !originAccepted(request.method, request, admission.origin)) {
+            return { answer: this.refusal(403, admission, router, head) };
+        }
+        let principal;
+        // Foreign requests are never authenticated but a top-level navigation to a page; a cross-site route never is.
+        const authenticators = registries.authenticators.value;
+        if (authenticators.length > 0 &&
+            !match.crossSite &&
+            (!foreign || (match.page && isNavigation(request.method, request)))) {
+            principal = await this.#principal(registries, webRequest, controller.signal);
+            if (this.#closing.signal.aborted || controller.signal.aborted) {
+                return { answer: this.refusal(503, admission, router, head) };
+            }
+        }
+        // Deny by default (decision "The app kit, point 3"): no plugin code runs for nobody unless the route is public.
+        if (principal === undefined && !match.public)
+            return { answer: this.refusal(401, admission, router, head) };
+        const answered = Promise.withResolvers();
+        const span = this.#span(request, match, admission);
+        const base = withAbortSignal(controller.signal, this.#base);
+        const scope = this.#host
+            .root(async (ctx) => {
+            answered.resolve(await this.#run(request, webRequest, match, admission, router, foreign, ctx));
+            // The scope lasts until the body is written or abandoned (a `bytes` body reads in it).
+            await finished;
+        }, span === undefined ? base : withTelemetry(span.span, base), { principal })
+            .catch(() => {
+            // The scope was sealed (a disconnect, `close`) before it answered: the request is over.
+            answered.resolve(this.refusal(503, admission, router, head));
+        });
+        const answer = await answered.promise;
+        if (span !== undefined) {
+            span.span.setAttributes({ status: answer.status });
+            if (answer.status >= 500)
+                spanFailed(span.span, "http_failed", `status ${answer.status}`);
+            void scope.then(() => span.end());
+        }
+        return { answer, scope };
+    }
+    /**
+     * A routed request's `chord.http` span (its method and route pattern; its path never: it may carry ids or secrets):
+     * a root of the adapter, or the child of a W3C `traceparent` (and its `tracestate`) of a request a contributed relay
+     * verified, never a browser's; none without an adapter that records.
+     */
+    #span(request, match, admission) {
+        const adapter = this.#options.telemetry;
+        if (adapter === undefined || untraced(adapter))
+            return undefined;
+        const attributes = { "chord.host": this.#spanHost, method: request.method, route: match.pattern };
+        const traceparent = admission.provenance.kind === "relayed" ? traceHeader(request, "traceparent") : undefined;
+        if (traceparent === undefined)
+            return new OpenSpan(adapter, "chord.http", attributes);
+        const tracestate = traceHeader(request, "tracestate");
+        const carrier = tracestate === undefined ? { traceparent } : { traceparent, tracestate };
+        return new OpenSpan(parentOf(carrier, adapter), "chord.http", attributes);
+    }
+    /** Runs the wraps and the route in the request's scope `ctx`, and makes its answer (a failure: a reported 500). */
+    async #run(incoming, request, match, admitted, router, foreign, ctx) {
+        let response;
+        try {
+            response = await chainOf(match, ctx)(request);
+        }
+        catch (error) {
+            response = this.#failure(error, match);
+        }
+        // Downloads are never another site's to take (rule 6).
+        if (response.kind === "bytes" && foreign)
+            response = { kind: "error", status: 403 };
+        const failed = (error) => this.#onError({ kind: "response_failed", pattern: match.pattern, error });
+        try {
+            return answerOf(response, incoming, this.#defaults.of(admitted, router, request.nonce), ctx, failed);
+        }
+        catch (error) {
+            failed(error);
+            return this.refusal(500, admitted, router, request.method === "HEAD");
+        }
+    }
+    /** What an error escaping the chain answers: its `HttpFailure`'s status, else a reported 500 without its message. */
+    #failure(error, match) {
+        const thrown = error instanceof Thrown ? error : new Thrown(ROUTE, match.plugin, error);
+        if (thrown.cause instanceof HttpFailure)
+            return { kind: "error", status: thrown.cause.status };
+        // Chord refused the caller (an anonymous scope's remote object, a route's `authorize`): no failure of the route.
+        if (isChordError(thrown.cause, "forbidden"))
+            return { kind: "error", status: 403 };
+        if (thrown.by.kind === "route") {
+            this.#onError({ kind: "route_failed", pattern: match.pattern, plugin: thrown.plugin, error: thrown.cause });
+        }
+        else {
+            this.#onError({ kind: "wrap_failed", name: thrown.by.name, plugin: thrown.plugin, error: thrown.cause });
+        }
+        return { kind: "error", status: 500 };
+    }
+    /**
+     * The principal the authenticators give `request`; one that throws is reported and skipped. Raced against `signal`
+     * (a disconnect, `close`'s seal): an authenticator ignoring it no longer holds the request; the caller sees the
+     * abort and answers 503.
+     */
+    async #principal(registries, request, signal) {
+        const failed = (plugin, error) => this.#hookFailed("authenticate", plugin, error);
+        const context = withAbortSignal(signal, this.#base);
+        const authenticating = authenticate(registries.authenticators.value, request, failed, context);
+        // The registry's values are typed by no principal type: an app's authenticators return its principals.
+        return (await awaitWithContext(authenticating, context).catch(() => undefined));
+    }
+    #hookFailed(hook, plugin, error) {
+        this.#onError({ kind: "hook_failed", hook, ...(plugin === undefined ? {} : { plugin }), error });
+    }
+    /** The registries: resolved once, after the host's `load` (`not_ready` before it); a failed try is tried again later. */
+    #resolve() {
+        this.#resolving ??= Promise.all([
+            this.#host.registry(Http, this.#context),
+            this.#host.registry(Authenticators, this.#context),
+        ]).then(([router, authenticators]) => {
+            this.#registries = { router, authenticators };
+            // A close may come first: nothing to follow then (Astra's recheck R4: the stopped watch threw unhandled).
+            this.#follow(router).catch(() => { });
+            return this.#registries;
+        }, (error) => {
+            this.#resolving = undefined;
+            throw error;
+        });
+        return this.#resolving;
+    }
+    /** Follows the router until `close`: connections its changes no longer admit are terminated. */
+    async #follow(router) {
+        if (this.#closing.signal.aborted)
+            return;
+        const watch = await router.watch(withAbortSignal(this.#closing.signal, this.#base));
+        if (this.#closing.signal.aborted)
+            return;
+        watch.start(async (call) => {
+            if (call.kind === "value")
+                this.#upgrades.revoke(call.value);
+        });
+    }
+    /** One upgrade, tracked from its arrival: refused while closing, else admitted and checked, then handed out. */
+    async #upgrade(message, stream, head) {
+        const controller = new AbortController();
+        // A client gone while its upgrade authenticates aborts that work (Astra's recheck R1, Sol's N5).
+        const gone = () => controller.abort(new Error("http: the client disconnected"));
+        if (stream.destroyed)
+            gone();
+        else {
+            // A clean disconnect (FIN) is seen only by reading: nothing reads a detached upgrade socket, so start it
+            // (Fable's second recheck: `end()` while authenticating went unnoticed).
+            stream.once("close", gone);
+            stream.once("end", gone);
+            stream.read(0);
+        }
+        const running = { controller, done: Promise.resolve() };
+        const work = this.#upgradeSteps(message, stream, head, controller.signal);
+        running.done = work;
+        this.#running.add(running);
+        try {
+            await work;
+        }
+        finally {
+            stream.removeListener("close", gone);
+            stream.removeListener("end", gone);
+            this.#running.delete(running);
+        }
+    }
+    /** The steps of an upgrade (the same rules as a request's; a socket needs a principal), checked again at hand-out. */
+    async #upgradeSteps(message, stream, head, signal) {
+        if (this.#closing.signal.aborted)
+            return refuse(stream, 503);
+        const request = NodeIncoming.of(message);
+        if (!(request instanceof NodeIncoming))
+            return refuse(stream, request.status);
+        let registries;
+        try {
+            registries = this.#registries ?? (await this.#resolve());
+        }
+        catch {
+            return refuse(stream, 503);
+        }
+        if (this.#closing.signal.aborted || signal.aborted)
+            return refuse(stream, 503);
+        const before = registries.router.value;
+        const connection = connectionOf(message);
+        const admission = admit(request, connection, before.hosts, before.relays);
+        if (refused(admission)) {
+            if (admission.failed !== undefined)
+                this.#hookFailed("relay", admission.failed.relay, admission.failed.error);
+            return refuse(stream, 403);
+        }
+        const sent = request.header("origin");
+        if (isForeign(request) || (sent !== null && sent !== admission.origin))
+            return refuse(stream, 403);
+        const webRequest = new WebRequest(request, admission, this.#nonces.next(), connection.remoteAddress);
+        const principal = await this.#principal(registries, webRequest, signal);
+        if (this.#closing.signal.aborted || signal.aborted)
+            return refuse(stream, 503);
+        // The router now: a host, a relay or a socket removed while authenticating refuses the upgrade.
+        const router = registries.router.value;
+        const { allowed, relay } = admission;
+        if ((allowed !== undefined && !router.hosts.has(allowed)) ||
+            (relay !== undefined && !router.relays.includes(relay))) {
+            return refuse(stream, 403);
+        }
+        const { links } = this.#options;
+        if (links !== undefined && webRequest.path === links.path) {
+            // The links endpoint always needs a principal: a link acts as one.
+            if (principal === undefined)
+                return refuse(stream, 401);
+            let options;
+            try {
+                options =
+                    (typeof links.options === "function" ? links.options(webRequest, principal) : links.options) ?? {};
+            }
+            catch (error) {
+                this.#hookFailed("links.options", undefined, error);
+                return refuse(stream, 403);
+            }
+            const admitted = { allowed, relay, principal, ...options };
+            const opened = () => {
+                try {
+                    return links.opened?.(webRequest, principal);
+                }
+                catch (error) {
+                    this.#hookFailed("links.opened", undefined, error);
+                    return undefined;
+                }
+            };
+            return this.#upgrades.link(message, stream, head, admitted, this.#host, this.#context, opened);
+        }
+        const match = router.socket(webRequest.path);
+        if (match === "bad_path")
+            return refuse(stream, 400);
+        if (match === undefined)
+            return refuse(stream, 404);
+        if (principal === undefined && !match.public)
+            return refuse(stream, 401);
+        webRequest.params = match.params;
+        const fail = ({ pattern, plugin, error }) => this.#onError({ kind: "socket_failed", pattern, plugin, error });
+        const admitted = { allowed, relay, principal, match, request: webRequest };
+        this.#upgrades.socket(message, stream, head, admitted, this.#host, this.#context, fail);
+    }
+    /** The listener's open: Chord's own Node server listening at `listen`. */
+    async #listen(listen, context) {
+        const listener = await NodeListener.listen(this, listen, context);
+        this.#listening.resolve(listener.address);
+        return listener;
+    }
+    /** `close`: refuses from now on, then waits for sockets and running requests until the deadline, then seals. */
+    async #close(context) {
+        this.#closing.abort();
+        this.#listening.reject(new Error("http: closed"));
+        const timeout = this.#options.closeTimeout ?? CLOSE_TIMEOUT;
+        const signal = context.abortSignal;
+        let timer;
+        let aborted;
+        const deadline = new Promise((resolve) => {
+            // Already aborted: no wait at all (Sol's recheck N9).
+            if (signal?.aborted)
+                return resolve();
+            timer = setTimeout(resolve, timeout);
+            aborted = () => resolve();
+            signal?.addEventListener("abort", aborted, { once: true });
+        });
+        const running = Promise.all([...this.#running].map(({ done }) => done));
+        await Promise.race([Promise.all([this.#upgrades.close(deadline), running]), deadline]);
+        clearTimeout(timer);
+        if (aborted !== undefined)
+            signal?.removeEventListener("abort", aborted);
+        for (const { controller } of this.#running)
+            controller.abort(new Error("http: closed"));
+    }
+}
+/**
+ * `stream` as read by its consumer, `finished` called once it is read to its end, failed or cancelled (a mounted
+ * handler's `bytes` body: the request's scope lasts until then).
+ */
+function tracked(stream, finished) {
+    const reader = stream.getReader();
+    // The owned stream ending (read whole, or errored by the scope's seal) ends the request too, whether or not its
+    // consumer pulls again (Sol's second recheck B: an aborted `Response` nobody touched kept its request and scope).
+    reader.closed.then(finished, finished);
+    return new ReadableStream({
+        pull: async (controller) => {
+            try {
+                const next = await reader.read();
+                if (next.done) {
+                    controller.close();
+                    finished();
+                }
+                else {
+                    controller.enqueue(next.value);
+                }
+            }
+            catch (error) {
+                controller.error(error);
+                finished();
+            }
+        },
+        cancel: async (reason) => {
+            finished();
+            await reader.cancel(reason);
+        },
+    }, { highWaterMark: 0 });
+}
+/**
+ * The longest W3C trace header taken from a relayed request (`traceparent` is 55 characters, `tracestate` at most 512):
+ * the relay forwards what the browser sent unless it strips them, so they are bounded as a link's carrier is (review L2).
+ */
+const TRACE_HEADERS = { traceparent: 256, tracestate: 512 };
+/** Printable ASCII, as a link's carrier. */
+const PRINTABLE = /^[\x20-\x7e]*$/;
+/** A W3C trace header of `request`, when present, within its bound and printable; otherwise none (ignored). */
+function traceHeader(request, name) {
+    const value = request.header(name);
+    if (value === null || value.length > TRACE_HEADERS[name] || !PRINTABLE.test(value))
+        return undefined;
+    return value;
+}
+/** Refuses an upgrade with `status` and closes its connection. */
+function refuse(stream, status) {
+    stream.end(`HTTP/1.1 ${status} ${STATUS[status] ?? ""}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+}
+/** The reason phrases of the statuses an upgrade is refused with. */
+const STATUS = {
+    400: "Bad Request",
+    401: "Unauthorized",
+    403: "Forbidden",
+    404: "Not Found",
+    501: "Not Implemented",
+    503: "Service Unavailable",
+};
+/** Who threw out of a request's chain: the route, or a wrap (by name), with its plugin. */
+class Thrown extends Error {
+    by;
+    plugin;
+    constructor(by, plugin, cause) {
+        super("thrown", { cause });
+        this.by = by;
+        this.plugin = plugin;
+    }
+}
+/** The route of `match` inside its wraps (outermost first), each throw tagged with who threw it. */
+function chainOf(match, ctx) {
+    let next = tagged(match.handler, match.plugin, ctx);
+    for (let index = match.wraps.length - 1; index >= 0; index--) {
+        const { wrap, plugin } = match.wraps[index];
+        const inner = next;
+        next = async (request) => {
+            try {
+                return await wrap.wrap(request, inner, ctx);
+            }
+            catch (error) {
+                if (error instanceof Thrown)
+                    throw error;
+                throw new Thrown({ kind: "wrap", name: wrap.name }, plugin, error);
+            }
+        };
+    }
+    return next;
+}
+/** `route` with its throws tagged as the route's. */
+function tagged(route, plugin, ctx) {
+    return async (request) => {
+        try {
+            return await route(request, ctx);
+        }
+        catch (error) {
+            throw new Thrown(ROUTE, plugin, error);
+        }
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/node/http/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/node/http/http.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,qHAAqH;AACrH,iHAAiH;AACjH,yHAAyH;AACzH,6HAA6H;AAC7H,oHAAoH;AACpH,sHAAsH;AACtH,+BAA+B;AAK/B,OAAO,EACN,gBAAgB,EAEhB,eAAe,EACf,kBAAkB,EAClB,aAAa,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,YAAY,EAAkB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAY,WAAW,EAAyB,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAEN,KAAK,EAEL,SAAS,EACT,YAAY,EACZ,cAAc,EACd,OAAO,GACP,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA2B,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAiB,WAAW,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAoC,YAAY,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,WAAW,EAAoB,UAAU,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAe,QAAQ,EAAE,WAAW,EAAqB,WAAW,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,IAAI,EAAgD,MAAM,aAAa,CAAC;AAChG,OAAO,EAAoB,QAAQ,EAAE,MAAM,eAAe,CAAC;AAmE3D,mGAAmG;AACnG,MAAM,UAAU,UAAU,CACzB,IAAa,EACb,OAAoB,EACpB,OAAgB;IAEhB,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAWlG,kEAAkE;AAClE,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,iDAAiD;AACjD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,MAAM,SAAS;IACL,KAAK,CAAW;IAChB,OAAO,CAAmE;IAC1E,KAAK,CAAU;IACf,QAAQ,CAAc;IAC/B,8DAA8D;IACrD,SAAS,CAAS;IAClB,QAAQ,CAA6B;IACrC,QAAQ,CAAU;IAC3B,kGAAkG;IACzF,KAAK,CAAU;IACf,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;IACjC,OAAO,GAAG,IAAI,MAAM,EAAE,CAAC;IACvB,SAAS,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAAW,CAAC;IACvC,sGAAsG;IACtG,UAAU,CAAkC;IAC5C,WAAW,CAAyB;IACpC,8CAA8C;IACrC,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IAC1C,OAAO,CAA4B;IAC1B,UAAU,GAAG,OAAO,CAAC,aAAa,EAAiB,CAAC;IAE7D,YAAY,IAAa,EAAE,OAAoB,EAAE,OAAgB;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YACxC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAI,CAAC,KAAK,EAAE,EAAE;YACrC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC9C,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAChE,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;gBAC3C,IAAI,CAAC,IAAI,CACR,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;oBACpC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC1B,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACzB,CAAC,CACD,CAAC;gBACF,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,UAAU,GAAe,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;QAChF,0GAA0G;QAC1G,IAAI,MAAM,CAAC,IAAI,YAAY,cAAc;YACxC,OAAO,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,SAAS,CAAC,OAAgB;QACzB,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,OAAgB;QACrB,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,OAAiB,EAAE,UAAsB;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,MAAM,OAAO,GAAY,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,sFAAsF;YACtF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,+FAA+F;IAC/F,OAAO,CAAC,MAAc,EAAE,QAAmB,EAAE,MAAe,EAAE,IAAI,GAAG,KAAK;QACzE,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvG,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,MAAM,CACX,OAAiB,EACjB,UAAsB,EACtB,UAA2B,EAC3B,QAAuB;QAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACnG,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACJ,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACnG,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9G,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,2EAA2E;QAC3E,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,SAAwB,CAAC;QAC7B,8GAA8G;QAC9G,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC;QACvD,IACC,cAAc,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,KAAK,CAAC,SAAS;YAChB,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClE,CAAC;YACF,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/D,CAAC;QACF,CAAC;QACD,gHAAgH;QAChH,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAU,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;aACtB,IAAI,CACJ,KAAK,EAAE,GAAG,EAAE,EAAE;YACb,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/F,uFAAuF;YACvF,MAAM,QAAQ,CAAC;QAChB,CAAC,EACD,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAC1D,EAAE,SAAS,EAAE,CACb;aACA,KAAK,CAAC,GAAG,EAAE;YACX,wFAAwF;YACxF,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1F,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAiB,EAAE,KAAiB,EAAE,SAAmB;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACjE,MAAM,UAAU,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAClG,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACtD,MAAM,OAAO,GAAqB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QAC3G,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC3E,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,IAAI,CACT,QAAkB,EAClB,OAAmB,EACnB,KAAiB,EACjB,QAAkB,EAClB,MAAc,EACd,OAAgB,EAChB,GAAW;QAEX,IAAI,QAAsB,CAAC;QAC3B,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,uDAAuD;QACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO;YAAE,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAQ,EAAE,CACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACJ,OAAO,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAED,qHAAqH;IACrH,QAAQ,CAAC,KAAc,EAAE,KAAiB;QACzC,MAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,KAAK,YAAY,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/F,iHAAiH;QACjH,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,UAAsB,EAAE,OAAoB,EAAE,MAAmB;QACjF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/F,uGAAuG;QACvG,OAAO,CAAC,MAAM,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAkB,CAAC;IAClG,CAAC;IAED,WAAW,CAAC,IAAc,EAAE,MAA0B,EAAE,KAAc;QACrE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,yHAAyH;IACzH,QAAQ;QACP,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC;SAClD,CAAC,CAAC,IAAI,CACN,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,WAAW,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAC9C,0GAA0G;YAC1G,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,OAAO,IAAI,CAAC,WAAW,CAAC;QACzB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,MAAM,KAAK,CAAC;QACb,CAAC,CACD,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,OAAO,CAAC,MAA6B;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACzC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,gHAAgH;IAChH,KAAK,CAAC,QAAQ,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY;QACpE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,iGAAiG;QACjG,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,SAAS;YAAE,IAAI,EAAE,CAAC;aACxB,CAAC;YACL,yGAAyG;YACzG,yEAAyE;YACzE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAY,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC;QACZ,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAED,sHAAsH;IACtH,KAAK,CAAC,aAAa,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY,EAAE,MAAmB;QAC9F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,OAAO,YAAY,YAAY,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACJ,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9G,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACrG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/E,gGAAgG;QAChG,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;QACrC,IACC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACtD,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3D,mEAAmE;YACnE,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACJ,OAAO;oBACN,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACrG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACpD,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,GAA6B,EAAE;gBAC7C,IAAI,CAAC;oBACJ,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;oBACnD,OAAO,SAAS,CAAC;gBAClB,CAAC;YACF,CAAC,CAAC;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzE,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAuD,EAAE,EAAE,CAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO,CAAC,MAAqB,EAAE,OAAgB;QACpD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,gHAAgH;IAChH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,aAAa,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;QACnC,IAAI,KAAgD,CAAC;QACrD,IAAI,OAAiC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC9C,sDAAsD;YACtD,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,OAAO,EAAE,CAAC;YACtC,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrC,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvF,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzE,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ;YAAE,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACzF,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,MAAkC,EAAE,QAAoB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,gHAAgH;IAChH,kHAAkH;IAClH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,IAAI,cAAc,CACxB;QACC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC1B,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,QAAQ,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACP,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,QAAQ,EAAE,CAAC;YACZ,CAAC;QACF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,QAAQ,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;KACD,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACpB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAW,CAAC;AAErE,4CAA4C;AAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,+GAA+G;AAC/G,SAAS,WAAW,CAAC,OAAiB,EAAE,IAAgC;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrG,OAAO,KAAK,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,MAAc;IAC7C,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oDAAoD,CAAC,CAAC;AAC5G,CAAC;AAED,qEAAqE;AACrE,MAAM,MAAM,GAAqC;IAChD,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,iBAAiB;IACtB,GAAG,EAAE,qBAAqB;CAC1B,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAO,SAAQ,KAAK;IAChB,EAAE,CAAgF;IAClF,MAAM,CAAS;IAExB,YAAY,EAAgB,EAAE,MAAc,EAAE,KAAc;QAC3D,KAAK,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;CACD;AAED,oGAAoG;AACpG,SAAS,OAAO,CAAC,KAAiB,EAAE,GAAQ;IAC3C,IAAI,IAAI,GAAoD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrG,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,MAAM;oBAAE,MAAM,KAAK,CAAC;gBACzC,MAAM,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACF,CAAC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qDAAqD;AACrD,SAAS,MAAM,CAAC,KAAgB,EAAE,MAAc,EAAE,GAAQ;IACzD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,IAAI,CAAC;YACJ,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACF,CAAC,CAAC;AACH,CAAC","sourcesContent":["// The HTTP component (slice 10 §2; decisions \"The HTTP core is a fetch handler\", \"The HTTP server is a native object\",\n// \"The HTTP component's security baseline\", \"Settings are arguments, extensions are registries\"): `createHttp` takes\n// the app's settings (where to listen, the links endpoint, the close bound) and builds one Web-standard handler,\n// `fetch`, from the registries its facet serves (`Http`, `Authenticators`), an upgrade adapter for Node (`upgrade`), and\n// the facet, whose host-lifetime listener object is Chord's own Node server. Every request is admitted (provenance), routed,\n// checked for foreign origins, authenticated unless foreign, and served in one `host.root` scope with its principal\n// that lasts until its body is delivered (a routed one in a `chord.http` span with an adapter, slice 9); every answer\n// carries the default headers.\n\nimport type { IncomingMessage } from \"node:http\";\nimport type { Duplex } from \"node:stream\";\nimport type { TelemetryCarrier, TelemetryContext } from \"@earendil-works/pi-telemetry\";\nimport {\n\tawaitWithContext,\n\ttype Context,\n\twithAbortSignal,\n\twithoutAbortSignal,\n\twithTelemetry,\n} from \"../../context/index.ts\";\nimport { local } from \"../../contracts/index.ts\";\nimport { isChordError, type Principal } from \"../../data/index.ts\";\nimport { type Ctx, defineFacet, type Facet, type Host } from \"../../host/index.ts\";\nimport type { RegistryValue } from \"../../registries/index.ts\";\nimport { hostAttribute, OpenSpan, parentOf, spanFailed, untraced } from \"../../telemetry.ts\";\nimport {\n\ttype Admitted,\n\tadmit,\n\ttype Connection,\n\tisForeign,\n\tisNavigation,\n\toriginAccepted,\n\trefused,\n} from \"./admission.ts\";\nimport { type AuthenticatorEntry, Authenticators, authenticate, composeAuthenticators } from \"./authenticate.ts\";\nimport { DefaultHeaders, Nonces } from \"./headers.ts\";\nimport { type Incoming, webIncoming } from \"./incoming.ts\";\nimport { connectionOf, type Handler, type ListenAddress, NodeIncoming, NodeListener, type Served } from \"./node.ts\";\nimport { HttpFailure, type HttpRequest, WebRequest } from \"./request.ts\";\nimport { type Answer, answerOf, errorAnswer, type HttpResponse, webResponse } from \"./response.ts\";\nimport { composeRouter, Http, type HttpRoute, type RouteMatch, type Router } from \"./router.ts\";\nimport { type LinkOptions, Upgrades } from \"./upgrades.ts\";\n\n/** What `createHttp` takes: the app's settings, fixed for the component's life (changing one is a restart). */\nexport type HttpOptions = {\n\t/** Where Chord's own listener listens; none: no listener (an app mounting `fetch`). Port 0 picks one. */\n\treadonly listen?: ListenAddress;\n\t/** The links endpoint: its path, and each socket's options, a value or per request and principal. */\n\treadonly links?: LinksOptions;\n\t/** How long `close` waits for running requests and closing sockets: 30 s by default. */\n\treadonly closeTimeout?: number;\n\t/**\n\t * The telemetry adapter (the host's): each routed request is a `chord.http` root span, its scope's `ctx` under it; a\n\t * W3C `traceparent` is extracted only from a request a contributed relay verified. NOOP by default.\n\t */\n\treadonly telemetry?: TelemetryContext;\n\treadonly onError: (error: HttpError) => void;\n};\n\n/** The links endpoint's path and what it gives each socket (`maxPayload` 1 MiB by default). */\nexport type LinksOptions = {\n\treadonly path: string;\n\treadonly options?: LinkOptions | ((request: HttpRequest, principal: Principal) => LinkOptions);\n\t/**\n\t * Called when a link is accepted, with its request and principal; what it returns is called when that link closes\n\t * (the app tracking its clients' links: the kit ends an ephemeral session with its last link).\n\t */\n\treadonly opened?: (request: HttpRequest, principal: Principal) => (() => void) | undefined;\n};\n\n/** What the component reports. */\nexport type HttpError =\n\t| { readonly kind: \"route_failed\"; readonly pattern: string; readonly plugin: string; readonly error: unknown }\n\t| { readonly kind: \"wrap_failed\"; readonly name: string; readonly plugin: string; readonly error: unknown }\n\t| { readonly kind: \"socket_failed\"; readonly pattern: string; readonly plugin: string; readonly error: unknown }\n\t/** A response that could not be made (an invalid header, no JSON) or read whole (a `bytes` read that threw). */\n\t| { readonly kind: \"response_failed\"; readonly pattern: string; readonly error: unknown }\n\t/** A contributed hook threw (`plugin`), or the app's `links.options` (no plugin). */\n\t| { readonly kind: \"hook_failed\"; readonly hook: HookName; readonly plugin?: string; readonly error: unknown };\n\n/** The hooks the component calls. */\nexport type HookName = \"authenticate\" | \"relay\" | \"links.options\" | \"links.opened\";\n\n/** The running component. */\nexport interface HttpComponent<P extends Principal> {\n\t/**\n\t * Its facet (plugin `chord.http`): serves `Http` and `Authenticators`, and with `listen` the listener, a\n\t * host-lifetime object. The app loads it among its core facets, the same object at every reload.\n\t */\n\treadonly facet: Facet<P>;\n\t/**\n\t * Answers a Web `Request` (an app's own server mounts it: `hono.all(\"/*\", (c) => http.fetch(c.req.raw, …))`);\n\t * `connection` is what the server knows of the socket: without `localAddress` and `localPort` no request is local.\n\t * Requests before the host's `load` answer 503 at once (its `host.registry` throws `not_ready` then).\n\t */\n\tfetch(request: Request, connection?: Connection): Promise<Response>;\n\t/** Node's upgrade adapter (`server.on(\"upgrade\", http.upgrade)`): the links endpoint and plugin sockets. */\n\treadonly upgrade: (message: IncomingMessage, socket: Duplex, head: Buffer) => void;\n\t/** Where the listener listens, once it does (the real port when `listen.port` was 0). */\n\tlistening(context: Context): Promise<ListenAddress>;\n\t/**\n\t * Refuses new requests and upgrades (503), closes sockets and links (1001, terminated at `closeTimeout`), waits for\n\t * running requests up to `closeTimeout` (an aborted `context`: not at all), then seals them. Run it before\n\t * `host.close`, which seals every request's scope at once (the listener's close runs it then, too late to drain).\n\t */\n\tclose(context: Context): Promise<void>;\n}\n\n/** Builds the HTTP component on `host` (a request's scope is a `host.root` with its principal). */\nexport function createHttp<P extends Principal>(\n\thost: Host<P>,\n\toptions: HttpOptions,\n\tcontext: Context,\n): HttpComponent<P> {\n\treturn new Component(host, options, context);\n}\n\n/** The listener: a host-lifetime object of plugin `chord.http` whose native is Chord's own Node server. */\nexport const HttpListener = local(\"chord.http.listener\", { version: 1, params: {}, members: {} });\n\n/** The registries a request reads, resolved once. */\ntype Registries = {\n\treadonly router: RegistryValue<Router>;\n\treadonly authenticators: RegistryValue<readonly AuthenticatorEntry[]>;\n};\n\n/** A request or an upgrade from its arrival to its end: what `close` waits for, then seals. */\ntype Running = { readonly controller: AbortController; done: Promise<unknown> };\n\n/** `close`'s bound unless `closeTimeout` says otherwise: 30 s. */\nconst CLOSE_TIMEOUT = 30_000;\n\n/** Who threw out of a route itself (no wrap). */\nconst ROUTE = { kind: \"route\" } as const;\n\nclass Component<P extends Principal> implements HttpComponent<P>, Handler {\n\treadonly facet: Facet<P>;\n\treadonly upgrade: (message: IncomingMessage, socket: Duplex, head: Buffer) => void;\n\treadonly #host: Host<P>;\n\treadonly #options: HttpOptions;\n\t/** The `chord.host` of its `chord.http` spans: its host's. */\n\treadonly #spanHost: string;\n\treadonly #onError: (error: HttpError) => void;\n\treadonly #context: Context;\n\t/** The component's context without its cancellation: each request's scope adds its own signal. */\n\treadonly #base: Context;\n\treadonly #defaults = new DefaultHeaders();\n\treadonly #nonces = new Nonces();\n\treadonly #upgrades = new Upgrades();\n\treadonly #running = new Set<Running>();\n\t/** The registries while they resolve (once; again after a failed try), then the values themselves. */\n\t#resolving: Promise<Registries> | undefined;\n\t#registries: Registries | undefined;\n\t/** Aborted at `close`: the router's watch. */\n\treadonly #closing = new AbortController();\n\t#closed: Promise<void> | undefined;\n\treadonly #listening = Promise.withResolvers<ListenAddress>();\n\n\tconstructor(host: Host<P>, options: HttpOptions, context: Context) {\n\t\tthis.#host = host;\n\t\tthis.#options = options;\n\t\tthis.#spanHost = hostAttribute(host.address);\n\t\tthis.#onError = options.onError;\n\t\tthis.#context = context;\n\t\tthis.#base = withoutAbortSignal(context);\n\t\tthis.#listening.promise.catch(() => {});\n\t\tthis.upgrade = (message, socket, head) => {\n\t\t\tsocket.on(\"error\", () => socket.destroy());\n\t\t\tvoid this.#upgrade(message, socket, head).catch(() => socket.destroy());\n\t\t};\n\t\tconst { listen } = options;\n\t\tthis.facet = defineFacet<P>((facet) => {\n\t\t\tfacet.serve(Http, { compose: composeRouter });\n\t\t\tfacet.serve(Authenticators, { compose: composeAuthenticators });\n\t\t\tif (listen === undefined) return;\n\t\t\tfacet.serve(HttpListener, (_params, self) => {\n\t\t\t\tself.open(\n\t\t\t\t\t(opening) => this.#listen(listen, opening),\n\t\t\t\t\tasync (listener, _reason, closing) => {\n\t\t\t\t\t\tlistener.stop();\n\t\t\t\t\t\tawait this.close(closing);\n\t\t\t\t\t\tawait listener.closed();\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t\treturn {};\n\t\t\t});\n\t\t});\n\t}\n\n\tasync fetch(request: Request, connection: Connection = {}): Promise<Response> {\n\t\tconst { answer, finished } = await this.serve(webIncoming(request), connection);\n\t\t// A whole body is out of the component's hands once its `Response` is; a pulled one ends when it is read.\n\t\tif (answer.body instanceof ReadableStream)\n\t\t\treturn webResponse({ ...answer, body: tracked(answer.body, finished) });\n\t\tfinished();\n\t\treturn webResponse(answer);\n\t}\n\n\tlistening(context: Context): Promise<ListenAddress> {\n\t\treturn awaitWithContext(this.#listening.promise, context);\n\t}\n\n\tclose(context: Context): Promise<void> {\n\t\tthis.#closed ??= this.#close(context);\n\t\treturn this.#closed;\n\t}\n\n\t/**\n\t * Serves `request`: its answer, and what its consumer calls once the body is written or abandoned. Never throws:\n\t * whatever fails answers (503 before the host's `load` or while closing, 403, 404, 500 reported).\n\t */\n\tasync serve(request: Incoming, connection: Connection): Promise<Served> {\n\t\tconst controller = new AbortController();\n\t\tconst finished = Promise.withResolvers<void>();\n\t\tconst running: Running = { controller, done: finished.promise };\n\t\tthis.#running.add(running);\n\t\trequest.cancelled((reason) => controller.abort(reason));\n\t\tlet answer: Answer;\n\t\ttry {\n\t\t\tconst served = await this.#serve(request, connection, controller, finished.promise);\n\t\t\tanswer = served.answer;\n\t\t\t// The request is over once its consumer finished and its scope (if it got one) ended.\n\t\t\tif (served.scope !== undefined) running.done = Promise.all([finished.promise, served.scope]);\n\t\t} catch {\n\t\t\tanswer = this.refusal(500);\n\t\t}\n\t\tvoid running.done.then(() => this.#running.delete(running));\n\t\treturn { answer, finished: () => finished.resolve() };\n\t}\n\n\t/** The answer for a refused or failed request, outside any scope, with the default headers. */\n\trefusal(status: number, admitted?: Admitted, router?: Router, head = false): Answer {\n\t\treturn errorAnswer(status, this.#defaults.of(admitted, router, this.#nonces.next()), undefined, head);\n\t}\n\n\t/** The steps of `serve`: closing, the registries, admission, the route, origins, the principal, then the scope. */\n\tasync #serve(\n\t\trequest: Incoming,\n\t\tconnection: Connection,\n\t\tcontroller: AbortController,\n\t\tfinished: Promise<void>,\n\t): Promise<{ readonly answer: Answer; readonly scope?: Promise<void> }> {\n\t\tconst head = request.method === \"HEAD\";\n\t\tif (this.#closing.signal.aborted) return { answer: this.refusal(503, undefined, undefined, head) };\n\t\tlet registries: Registries;\n\t\ttry {\n\t\t\tregistries = this.#registries ?? (await this.#resolve());\n\t\t} catch {\n\t\t\treturn { answer: this.refusal(503, undefined, undefined, head) };\n\t\t}\n\t\tif (this.#closing.signal.aborted) return { answer: this.refusal(503, undefined, undefined, head) };\n\t\tconst router = registries.router.value;\n\t\tconst admission = admit(request, connection, router.hosts, router.relays);\n\t\tif (refused(admission)) {\n\t\t\tif (admission.failed !== undefined) this.#hookFailed(\"relay\", admission.failed.relay, admission.failed.error);\n\t\t\treturn { answer: this.refusal(403, undefined, router, head) };\n\t\t}\n\t\t// A fresh script nonce per response (decision \"A CSP nonce per response\").\n\t\tconst webRequest = new WebRequest(request, admission, this.#nonces.next(), connection.remoteAddress);\n\t\tconst match = router.route(request.method, webRequest.path);\n\t\tif (match === \"bad_path\" || match === undefined) {\n\t\t\treturn { answer: this.refusal(match === undefined ? 404 : 400, admission, router, head) };\n\t\t}\n\t\twebRequest.params = match.params;\n\t\tconst foreign = isForeign(request);\n\t\tif (!match.crossSite && !originAccepted(request.method, request, admission.origin)) {\n\t\t\treturn { answer: this.refusal(403, admission, router, head) };\n\t\t}\n\t\tlet principal: P | undefined;\n\t\t// Foreign requests are never authenticated but a top-level navigation to a page; a cross-site route never is.\n\t\tconst authenticators = registries.authenticators.value;\n\t\tif (\n\t\t\tauthenticators.length > 0 &&\n\t\t\t!match.crossSite &&\n\t\t\t(!foreign || (match.page && isNavigation(request.method, request)))\n\t\t) {\n\t\t\tprincipal = await this.#principal(registries, webRequest, controller.signal);\n\t\t\tif (this.#closing.signal.aborted || controller.signal.aborted) {\n\t\t\t\treturn { answer: this.refusal(503, admission, router, head) };\n\t\t\t}\n\t\t}\n\t\t// Deny by default (decision \"The app kit, point 3\"): no plugin code runs for nobody unless the route is public.\n\t\tif (principal === undefined && !match.public) return { answer: this.refusal(401, admission, router, head) };\n\t\tconst answered = Promise.withResolvers<Answer>();\n\t\tconst span = this.#span(request, match, admission);\n\t\tconst base = withAbortSignal(controller.signal, this.#base);\n\t\tconst scope = this.#host\n\t\t\t.root(\n\t\t\t\tasync (ctx) => {\n\t\t\t\t\tanswered.resolve(await this.#run(request, webRequest, match, admission, router, foreign, ctx));\n\t\t\t\t\t// The scope lasts until the body is written or abandoned (a `bytes` body reads in it).\n\t\t\t\t\tawait finished;\n\t\t\t\t},\n\t\t\t\tspan === undefined ? base : withTelemetry(span.span, base),\n\t\t\t\t{ principal },\n\t\t\t)\n\t\t\t.catch(() => {\n\t\t\t\t// The scope was sealed (a disconnect, `close`) before it answered: the request is over.\n\t\t\t\tanswered.resolve(this.refusal(503, admission, router, head));\n\t\t\t});\n\t\tconst answer = await answered.promise;\n\t\tif (span !== undefined) {\n\t\t\tspan.span.setAttributes({ status: answer.status });\n\t\t\tif (answer.status >= 500) spanFailed(span.span, \"http_failed\", `status ${answer.status}`);\n\t\t\tvoid scope.then(() => span.end());\n\t\t}\n\t\treturn { answer, scope };\n\t}\n\n\t/**\n\t * A routed request's `chord.http` span (its method and route pattern; its path never: it may carry ids or secrets):\n\t * a root of the adapter, or the child of a W3C `traceparent` (and its `tracestate`) of a request a contributed relay\n\t * verified, never a browser's; none without an adapter that records.\n\t */\n\t#span(request: Incoming, match: RouteMatch, admission: Admitted): OpenSpan<\"chord.http\"> | undefined {\n\t\tconst adapter = this.#options.telemetry;\n\t\tif (adapter === undefined || untraced(adapter)) return undefined;\n\t\tconst attributes = { \"chord.host\": this.#spanHost, method: request.method, route: match.pattern };\n\t\tconst traceparent = admission.provenance.kind === \"relayed\" ? traceHeader(request, \"traceparent\") : undefined;\n\t\tif (traceparent === undefined) return new OpenSpan(adapter, \"chord.http\", attributes);\n\t\tconst tracestate = traceHeader(request, \"tracestate\");\n\t\tconst carrier: TelemetryCarrier = tracestate === undefined ? { traceparent } : { traceparent, tracestate };\n\t\treturn new OpenSpan(parentOf(carrier, adapter), \"chord.http\", attributes);\n\t}\n\n\t/** Runs the wraps and the route in the request's scope `ctx`, and makes its answer (a failure: a reported 500). */\n\tasync #run(\n\t\tincoming: Incoming,\n\t\trequest: WebRequest,\n\t\tmatch: RouteMatch,\n\t\tadmitted: Admitted,\n\t\trouter: Router,\n\t\tforeign: boolean,\n\t\tctx: Ctx<P>,\n\t): Promise<Answer> {\n\t\tlet response: HttpResponse;\n\t\ttry {\n\t\t\tresponse = await chainOf(match, ctx)(request);\n\t\t} catch (error) {\n\t\t\tresponse = this.#failure(error, match);\n\t\t}\n\t\t// Downloads are never another site's to take (rule 6).\n\t\tif (response.kind === \"bytes\" && foreign) response = { kind: \"error\", status: 403 };\n\t\tconst failed = (error: unknown): void =>\n\t\t\tthis.#onError({ kind: \"response_failed\", pattern: match.pattern, error });\n\t\ttry {\n\t\t\treturn answerOf(response, incoming, this.#defaults.of(admitted, router, request.nonce), ctx, failed);\n\t\t} catch (error) {\n\t\t\tfailed(error);\n\t\t\treturn this.refusal(500, admitted, router, request.method === \"HEAD\");\n\t\t}\n\t}\n\n\t/** What an error escaping the chain answers: its `HttpFailure`'s status, else a reported 500 without its message. */\n\t#failure(error: unknown, match: RouteMatch): HttpResponse {\n\t\tconst thrown = error instanceof Thrown ? error : new Thrown(ROUTE, match.plugin, error);\n\t\tif (thrown.cause instanceof HttpFailure) return { kind: \"error\", status: thrown.cause.status };\n\t\t// Chord refused the caller (an anonymous scope's remote object, a route's `authorize`): no failure of the route.\n\t\tif (isChordError(thrown.cause, \"forbidden\")) return { kind: \"error\", status: 403 };\n\t\tif (thrown.by.kind === \"route\") {\n\t\t\tthis.#onError({ kind: \"route_failed\", pattern: match.pattern, plugin: thrown.plugin, error: thrown.cause });\n\t\t} else {\n\t\t\tthis.#onError({ kind: \"wrap_failed\", name: thrown.by.name, plugin: thrown.plugin, error: thrown.cause });\n\t\t}\n\t\treturn { kind: \"error\", status: 500 };\n\t}\n\n\t/**\n\t * The principal the authenticators give `request`; one that throws is reported and skipped. Raced against `signal`\n\t * (a disconnect, `close`'s seal): an authenticator ignoring it no longer holds the request; the caller sees the\n\t * abort and answers 503.\n\t */\n\tasync #principal(registries: Registries, request: HttpRequest, signal: AbortSignal): Promise<P | undefined> {\n\t\tconst failed = (plugin: string, error: unknown): void => this.#hookFailed(\"authenticate\", plugin, error);\n\t\tconst context = withAbortSignal(signal, this.#base);\n\t\tconst authenticating = authenticate(registries.authenticators.value, request, failed, context);\n\t\t// The registry's values are typed by no principal type: an app's authenticators return its principals.\n\t\treturn (await awaitWithContext(authenticating, context).catch(() => undefined)) as P | undefined;\n\t}\n\n\t#hookFailed(hook: HookName, plugin: string | undefined, error: unknown): void {\n\t\tthis.#onError({ kind: \"hook_failed\", hook, ...(plugin === undefined ? {} : { plugin }), error });\n\t}\n\n\t/** The registries: resolved once, after the host's `load` (`not_ready` before it); a failed try is tried again later. */\n\t#resolve(): Promise<Registries> {\n\t\tthis.#resolving ??= Promise.all([\n\t\t\tthis.#host.registry(Http, this.#context),\n\t\t\tthis.#host.registry(Authenticators, this.#context),\n\t\t]).then(\n\t\t\t([router, authenticators]) => {\n\t\t\t\tthis.#registries = { router, authenticators };\n\t\t\t\t// A close may come first: nothing to follow then (Astra's recheck R4: the stopped watch threw unhandled).\n\t\t\t\tthis.#follow(router).catch(() => {});\n\t\t\t\treturn this.#registries;\n\t\t\t},\n\t\t\t(error: unknown) => {\n\t\t\t\tthis.#resolving = undefined;\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\treturn this.#resolving;\n\t}\n\n\t/** Follows the router until `close`: connections its changes no longer admit are terminated. */\n\tasync #follow(router: RegistryValue<Router>): Promise<void> {\n\t\tif (this.#closing.signal.aborted) return;\n\t\tconst watch = await router.watch(withAbortSignal(this.#closing.signal, this.#base));\n\t\tif (this.#closing.signal.aborted) return;\n\t\twatch.start(async (call) => {\n\t\t\tif (call.kind === \"value\") this.#upgrades.revoke(call.value);\n\t\t});\n\t}\n\n\t/** One upgrade, tracked from its arrival: refused while closing, else admitted and checked, then handed out. */\n\tasync #upgrade(message: IncomingMessage, stream: Duplex, head: Buffer): Promise<void> {\n\t\tconst controller = new AbortController();\n\t\t// A client gone while its upgrade authenticates aborts that work (Astra's recheck R1, Sol's N5).\n\t\tconst gone = (): void => controller.abort(new Error(\"http: the client disconnected\"));\n\t\tif (stream.destroyed) gone();\n\t\telse {\n\t\t\t// A clean disconnect (FIN) is seen only by reading: nothing reads a detached upgrade socket, so start it\n\t\t\t// (Fable's second recheck: `end()` while authenticating went unnoticed).\n\t\t\tstream.once(\"close\", gone);\n\t\t\tstream.once(\"end\", gone);\n\t\t\tstream.read(0);\n\t\t}\n\t\tconst running: Running = { controller, done: Promise.resolve() };\n\t\tconst work = this.#upgradeSteps(message, stream, head, controller.signal);\n\t\trunning.done = work;\n\t\tthis.#running.add(running);\n\t\ttry {\n\t\t\tawait work;\n\t\t} finally {\n\t\t\tstream.removeListener(\"close\", gone);\n\t\t\tstream.removeListener(\"end\", gone);\n\t\t\tthis.#running.delete(running);\n\t\t}\n\t}\n\n\t/** The steps of an upgrade (the same rules as a request's; a socket needs a principal), checked again at hand-out. */\n\tasync #upgradeSteps(message: IncomingMessage, stream: Duplex, head: Buffer, signal: AbortSignal): Promise<void> {\n\t\tif (this.#closing.signal.aborted) return refuse(stream, 503);\n\t\tconst request = NodeIncoming.of(message);\n\t\tif (!(request instanceof NodeIncoming)) return refuse(stream, request.status);\n\t\tlet registries: Registries;\n\t\ttry {\n\t\t\tregistries = this.#registries ?? (await this.#resolve());\n\t\t} catch {\n\t\t\treturn refuse(stream, 503);\n\t\t}\n\t\tif (this.#closing.signal.aborted || signal.aborted) return refuse(stream, 503);\n\t\tconst before = registries.router.value;\n\t\tconst connection = connectionOf(message);\n\t\tconst admission = admit(request, connection, before.hosts, before.relays);\n\t\tif (refused(admission)) {\n\t\t\tif (admission.failed !== undefined) this.#hookFailed(\"relay\", admission.failed.relay, admission.failed.error);\n\t\t\treturn refuse(stream, 403);\n\t\t}\n\t\tconst sent = request.header(\"origin\");\n\t\tif (isForeign(request) || (sent !== null && sent !== admission.origin)) return refuse(stream, 403);\n\t\tconst webRequest = new WebRequest(request, admission, this.#nonces.next(), connection.remoteAddress);\n\t\tconst principal = await this.#principal(registries, webRequest, signal);\n\t\tif (this.#closing.signal.aborted || signal.aborted) return refuse(stream, 503);\n\t\t// The router now: a host, a relay or a socket removed while authenticating refuses the upgrade.\n\t\tconst router = registries.router.value;\n\t\tconst { allowed, relay } = admission;\n\t\tif (\n\t\t\t(allowed !== undefined && !router.hosts.has(allowed)) ||\n\t\t\t(relay !== undefined && !router.relays.includes(relay))\n\t\t) {\n\t\t\treturn refuse(stream, 403);\n\t\t}\n\t\tconst { links } = this.#options;\n\t\tif (links !== undefined && webRequest.path === links.path) {\n\t\t\t// The links endpoint always needs a principal: a link acts as one.\n\t\t\tif (principal === undefined) return refuse(stream, 401);\n\t\t\tlet options: LinkOptions;\n\t\t\ttry {\n\t\t\t\toptions =\n\t\t\t\t\t(typeof links.options === \"function\" ? links.options(webRequest, principal) : links.options) ?? {};\n\t\t\t} catch (error) {\n\t\t\t\tthis.#hookFailed(\"links.options\", undefined, error);\n\t\t\t\treturn refuse(stream, 403);\n\t\t\t}\n\t\t\tconst admitted = { allowed, relay, principal, ...options };\n\t\t\tconst opened = (): (() => void) | undefined => {\n\t\t\t\ttry {\n\t\t\t\t\treturn links.opened?.(webRequest, principal);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tthis.#hookFailed(\"links.opened\", undefined, error);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t};\n\t\t\treturn this.#upgrades.link(message, stream, head, admitted, this.#host, this.#context, opened);\n\t\t}\n\t\tconst match = router.socket(webRequest.path);\n\t\tif (match === \"bad_path\") return refuse(stream, 400);\n\t\tif (match === undefined) return refuse(stream, 404);\n\t\tif (principal === undefined && !match.public) return refuse(stream, 401);\n\t\twebRequest.params = match.params;\n\t\tconst fail = ({ pattern, plugin, error }: { pattern: string; plugin: string; error: unknown }) =>\n\t\t\tthis.#onError({ kind: \"socket_failed\", pattern, plugin, error });\n\t\tconst admitted = { allowed, relay, principal, match, request: webRequest };\n\t\tthis.#upgrades.socket(message, stream, head, admitted, this.#host, this.#context, fail);\n\t}\n\n\t/** The listener's open: Chord's own Node server listening at `listen`. */\n\tasync #listen(listen: ListenAddress, context: Context): Promise<NodeListener> {\n\t\tconst listener = await NodeListener.listen(this, listen, context);\n\t\tthis.#listening.resolve(listener.address);\n\t\treturn listener;\n\t}\n\n\t/** `close`: refuses from now on, then waits for sockets and running requests until the deadline, then seals. */\n\tasync #close(context: Context): Promise<void> {\n\t\tthis.#closing.abort();\n\t\tthis.#listening.reject(new Error(\"http: closed\"));\n\t\tconst timeout = this.#options.closeTimeout ?? CLOSE_TIMEOUT;\n\t\tconst signal = context.abortSignal;\n\t\tlet timer: ReturnType<typeof setTimeout> | undefined;\n\t\tlet aborted: (() => void) | undefined;\n\t\tconst deadline = new Promise<void>((resolve) => {\n\t\t\t// Already aborted: no wait at all (Sol's recheck N9).\n\t\t\tif (signal?.aborted) return resolve();\n\t\t\ttimer = setTimeout(resolve, timeout);\n\t\t\taborted = () => resolve();\n\t\t\tsignal?.addEventListener(\"abort\", aborted, { once: true });\n\t\t});\n\t\tconst running = Promise.all([...this.#running].map(({ done }) => done));\n\t\tawait Promise.race([Promise.all([this.#upgrades.close(deadline), running]), deadline]);\n\t\tclearTimeout(timer);\n\t\tif (aborted !== undefined) signal?.removeEventListener(\"abort\", aborted);\n\t\tfor (const { controller } of this.#running) controller.abort(new Error(\"http: closed\"));\n\t}\n}\n\n/**\n * `stream` as read by its consumer, `finished` called once it is read to its end, failed or cancelled (a mounted\n * handler's `bytes` body: the request's scope lasts until then).\n */\nfunction tracked(stream: ReadableStream<Uint8Array>, finished: () => void): ReadableStream<Uint8Array> {\n\tconst reader = stream.getReader();\n\t// The owned stream ending (read whole, or errored by the scope's seal) ends the request too, whether or not its\n\t// consumer pulls again (Sol's second recheck B: an aborted `Response` nobody touched kept its request and scope).\n\treader.closed.then(finished, finished);\n\treturn new ReadableStream<Uint8Array>(\n\t\t{\n\t\t\tpull: async (controller) => {\n\t\t\t\ttry {\n\t\t\t\t\tconst next = await reader.read();\n\t\t\t\t\tif (next.done) {\n\t\t\t\t\t\tcontroller.close();\n\t\t\t\t\t\tfinished();\n\t\t\t\t\t} else {\n\t\t\t\t\t\tcontroller.enqueue(next.value);\n\t\t\t\t\t}\n\t\t\t\t} catch (error) {\n\t\t\t\t\tcontroller.error(error);\n\t\t\t\t\tfinished();\n\t\t\t\t}\n\t\t\t},\n\t\t\tcancel: async (reason) => {\n\t\t\t\tfinished();\n\t\t\t\tawait reader.cancel(reason);\n\t\t\t},\n\t\t},\n\t\t{ highWaterMark: 0 },\n\t);\n}\n\n/**\n * The longest W3C trace header taken from a relayed request (`traceparent` is 55 characters, `tracestate` at most 512):\n * the relay forwards what the browser sent unless it strips them, so they are bounded as a link's carrier is (review L2).\n */\nconst TRACE_HEADERS = { traceparent: 256, tracestate: 512 } as const;\n\n/** Printable ASCII, as a link's carrier. */\nconst PRINTABLE = /^[\\x20-\\x7e]*$/;\n\n/** A W3C trace header of `request`, when present, within its bound and printable; otherwise none (ignored). */\nfunction traceHeader(request: Incoming, name: keyof typeof TRACE_HEADERS): string | undefined {\n\tconst value = request.header(name);\n\tif (value === null || value.length > TRACE_HEADERS[name] || !PRINTABLE.test(value)) return undefined;\n\treturn value;\n}\n\n/** Refuses an upgrade with `status` and closes its connection. */\nfunction refuse(stream: Duplex, status: number): void {\n\tstream.end(`HTTP/1.1 ${status} ${STATUS[status] ?? \"\"}\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\n\\r\\n`);\n}\n\n/** The reason phrases of the statuses an upgrade is refused with. */\nconst STATUS: Readonly<Record<number, string>> = {\n\t400: \"Bad Request\",\n\t401: \"Unauthorized\",\n\t403: \"Forbidden\",\n\t404: \"Not Found\",\n\t501: \"Not Implemented\",\n\t503: \"Service Unavailable\",\n};\n\n/** Who threw out of a request's chain: the route, or a wrap (by name), with its plugin. */\nclass Thrown extends Error {\n\treadonly by: { readonly kind: \"route\" } | { readonly kind: \"wrap\"; readonly name: string };\n\treadonly plugin: string;\n\n\tconstructor(by: Thrown[\"by\"], plugin: string, cause: unknown) {\n\t\tsuper(\"thrown\", { cause });\n\t\tthis.by = by;\n\t\tthis.plugin = plugin;\n\t}\n}\n\n/** The route of `match` inside its wraps (outermost first), each throw tagged with who threw it. */\nfunction chainOf(match: RouteMatch, ctx: Ctx): (request: HttpRequest) => Promise<HttpResponse> {\n\tlet next: (request: HttpRequest) => Promise<HttpResponse> = tagged(match.handler, match.plugin, ctx);\n\tfor (let index = match.wraps.length - 1; index >= 0; index--) {\n\t\tconst { wrap, plugin } = match.wraps[index]!;\n\t\tconst inner = next;\n\t\tnext = async (request) => {\n\t\t\ttry {\n\t\t\t\treturn await wrap.wrap(request, inner, ctx);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof Thrown) throw error;\n\t\t\t\tthrow new Thrown({ kind: \"wrap\", name: wrap.name }, plugin, error);\n\t\t\t}\n\t\t};\n\t}\n\treturn next;\n}\n\n/** `route` with its throws tagged as the route's. */\nfunction tagged(route: HttpRoute, plugin: string, ctx: Ctx): (request: HttpRequest) => Promise<HttpResponse> {\n\treturn async (request) => {\n\t\ttry {\n\t\t\treturn await route(request, ctx);\n\t\t} catch (error) {\n\t\t\tthrow new Thrown(ROUTE, plugin, error);\n\t\t}\n\t};\n}\n"]}