@nifrajs/image 3.1.0 → 3.3.0

package/dist/server.d.ts

@@ -41,8 +41,11 @@ export interface ImageHandlerOptions {
     readonly sourceConcurrency?: number;
     /** Maximum queued image requests beyond the admission width. Default `concurrency * 16`. */
     readonly maxQueue?: number;
-    /** `Cache-Control: public, max-age=<n>, immutable` seconds. Default 1 year. */
+    /** `Cache-Control: public, max-age=<n>` seconds. Default 1 hour. */
     readonly cacheMaxAge?: number;
+    /** Add `immutable` to Cache-Control. Off by default: enable only when every source URL changes with
+     * its content, otherwise browsers are allowed to retain a changed image until the full max-age. */
+    readonly immutable?: boolean;
     /** Quality used when `?q` is absent. Default 75. */
     readonly defaultQuality?: number;
     /** Remote-fetch timeout (ms). Default 10 000. */

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAA;AAOrB,cAAc,cAAc,CAAA;AAE5B,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B;sEACkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;+FAC2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;sCACkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B;;0FAEsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAkCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGrC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAA;AAOrB,cAAc,cAAc,CAAA;AAE5B,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B;sEACkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB;+FAC2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B;uGACmG;IACnG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;sCACkC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B;;0FAEsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAmCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAGrC"}

package/dist/server.js

@@ -10,7 +10,8 @@
  * edge. On Workers / Vercel-Edge / Deno-Deploy there is no native codec - use the CDN `cloudflareLoader`
  * from `@nifrajs/image` instead. The dependency-free core (`@nifrajs/image`) never imports this module.
  */
-import { readFile, realpath, stat } from "node:fs/promises";
+import { constants as FS } from "node:fs";
+import { open, realpath } from "node:fs/promises";
 import { resolve as resolvePath, sep } from "node:path";
 import { bunImageBackend, ImageProcessingError, } from "./backend.js";
 import { verifyImageParams } from "./sign.js";
@@ -47,11 +48,24 @@ function resolveConfig(options) {
     const concurrency = options.concurrency ?? 4;
     const sourceConcurrency = options.sourceConcurrency ?? concurrency * 2;
     const maxQueue = options.maxQueue ?? concurrency * 16;
+    const maxWidth = options.maxWidth ?? 3840;
+    const cacheMaxAge = options.cacheMaxAge ?? 3_600;
+    const defaultQuality = options.defaultQuality ?? 75;
+    const fetchTimeoutMs = options.fetchTimeoutMs ?? 10_000;
+    const immutable = options.immutable ?? false;
     assertNonNegativeSafeInteger(maxSourceBytes, "maxSourceBytes");
     assertPositiveSafeInteger(maxSourcePixels, "maxSourcePixels");
     assertPositiveSafeInteger(concurrency, "concurrency");
     assertPositiveSafeInteger(sourceConcurrency, "sourceConcurrency");
     assertNonNegativeSafeInteger(maxQueue, "maxQueue");
+    assertPositiveSafeInteger(maxWidth, "maxWidth");
+    assertNonNegativeSafeInteger(cacheMaxAge, "cacheMaxAge");
+    assertPositiveSafeInteger(fetchTimeoutMs, "fetchTimeoutMs");
+    if (!Number.isSafeInteger(defaultQuality) || defaultQuality < 1 || defaultQuality > 100) {
+        throw new RangeError("image: defaultQuality must be a safe integer from 1 to 100");
+    }
+    if (typeof immutable !== "boolean")
+        throw new TypeError("image: immutable must be a boolean");
     if (sourceConcurrency < concurrency) {
         // Otherwise the codec lane can never fill, and `concurrency` silently means something narrower.
         throw new RangeError("image: sourceConcurrency must be >= concurrency");
@@ -62,10 +76,11 @@ function resolveConfig(options) {
         allowedOrigins: new Set(options.allowedOrigins ?? []),
         maxSourceBytes,
         maxSourcePixels,
-        maxWidth: options.maxWidth ?? 3840,
-        cacheMaxAge: options.cacheMaxAge ?? 31_536_000,
-        defaultQuality: options.defaultQuality ?? 75,
-        fetchTimeoutMs: options.fetchTimeoutMs ?? 10_000,
+        maxWidth,
+        cacheMaxAge,
+        immutable,
+        defaultQuality,
+        fetchTimeoutMs,
         fetchImpl: options.fetch ?? globalThis.fetch,
         signing: options.signing ?? null,
         admit: createSemaphore(sourceConcurrency, maxQueue),
@@ -113,30 +128,25 @@ async function handle(req, cfg) {
         if (!ok)
             return errorResponse(403, "invalid_signature");
     }
-    // 3. Strong validator from the request-deterministic inputs, computed BEFORE any fetch/decode so a
-    //    conditional request short-circuits all expensive work. The clamped width is a pure function of
-    //    (src, requestedWidth), so (src, requestedWidth, quality, wantsWebp) fully keys the response.
-    const etag = `"${fnv1a(`${src}|${requestedWidth}|${quality}|${wantsWebp ? 1 : 0}`)}"`;
-    const cacheHeaders = {
-        "Cache-Control": `public, max-age=${cfg.cacheMaxAge}, immutable`,
-        ETag: etag,
-        Vary: "Accept",
-    };
-    if (ifNoneMatch(req, etag)) {
-        return new Response(null, { status: 304, headers: cacheHeaders });
-    }
-    // 4/5. Admission precedes source reads so queued requests do not retain large buffers. It is a
+    // 3/4. Admission precedes source reads so queued requests do not retain large buffers. It is a
     //      separate, wider lane from the codec one below: a remote source is a network wait, and letting
     //      it hold a codec slot would let `concurrency` slow origins stall every transform on the box.
-    if (!(await cfg.admit.acquire()))
+    const admission = await cfg.admit.acquire(req.signal);
+    if (admission === "full")
         return errorResponse(503, "image_queue_full");
+    if (admission === "aborted")
+        return errorResponse(499, "request_cancelled");
     try {
-        const source = await readSource(src, cfg);
+        const source = await readSource(src, cfg, req.signal);
         if (!source.ok)
             return errorResponse(source.status, source.code);
         // The bytes are in hand; now queue for CPU. This semaphore never refuses - its waiter bound is the
         // admission width - so a wait here is a wait, not a 503.
-        await cfg.codec.acquire();
+        const codecAdmission = await cfg.codec.acquire(req.signal);
+        if (codecAdmission === "full")
+            return errorResponse(503, "image_queue_full");
+        if (codecAdmission === "aborted")
+            return errorResponse(499, "request_cancelled");
         let out;
         try {
             // Probe → enforce the portable pixel cap → clamp to intrinsic (never upscale) → transform.
@@ -144,6 +154,8 @@ async function handle(req, cfg) {
             if (probe.width * probe.height > cfg.maxSourcePixels) {
                 return errorResponse(413, "source_too_large");
             }
+            if (req.signal.aborted)
+                return errorResponse(499, "request_cancelled");
             const targetWidth = Math.max(1, Math.min(width, probe.width));
             const format = negotiateFormat(probe.format, wantsWebp);
             out = await cfg.backend.transform({
@@ -152,14 +164,25 @@ async function handle(req, cfg) {
                 quality,
                 format,
             });
+            if (req.signal.aborted)
+                return errorResponse(499, "request_cancelled");
         }
         finally {
             cfg.codec.release();
         }
-        const headers = new Headers(cacheHeaders);
+        // A strong validator describes the bytes actually emitted. Hashing request parameters here would
+        // falsely return 304 when a mutable local/remote source changes at the same URL.
+        const etag = `"${await sha256(out.bytes)}"`;
+        const headers = new Headers({
+            "Cache-Control": `public, max-age=${cfg.cacheMaxAge}${cfg.immutable ? ", immutable" : ""}`,
+            ETag: etag,
+            Vary: "Accept",
+        });
         headers.set("Content-Type", out.contentType);
         headers.set("Content-Length", String(out.bytes.byteLength));
         headers.set("X-Content-Type-Options", "nosniff"); // never let a client sniff the re-encoded bytes
+        if (ifNoneMatch(req, etag))
+            return new Response(null, { status: 304, headers });
         // HEAD: identical headers, no body.
         if (req.method === "HEAD")
             return new Response(null, { status: 200, headers });
@@ -183,7 +206,9 @@ async function handle(req, cfg) {
  * must be `http(s)` **and** on the `allowedOrigins` allowlist; anything else is a local path resolved
  * under `root` with traversal + symlink containment checks. Both branches fail closed.
  */
-async function readSource(src, cfg) {
+async function readSource(src, cfg, signal) {
+    if (signal.aborted)
+        return { ok: false, status: 499, code: "request_cancelled" };
     const asUrl = tryParseUrl(src);
     if (asUrl !== null) {
         if (asUrl.protocol !== "http:" && asUrl.protocol !== "https:") {
@@ -192,33 +217,52 @@ async function readSource(src, cfg) {
         if (!cfg.allowedOrigins.has(asUrl.origin)) {
             return { ok: false, status: 403, code: "source_not_allowed" };
         }
-        return fetchRemote(asUrl, cfg);
+        return fetchRemote(asUrl, cfg, signal);
     }
-    return readLocal(src, cfg);
+    return readLocal(src, cfg, signal);
 }
-async function fetchRemote(url, cfg) {
-    let res;
+async function fetchRemote(url, cfg, requestSignal) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const onRequestAbort = () => controller.abort(requestSignal.reason);
+    requestSignal.addEventListener("abort", onRequestAbort, { once: true });
+    // Close the add/check race: a signal that aborted immediately before listener registration still
+    // cancels the fetch rather than running an abandoned request to completion.
+    if (requestSignal.aborted)
+        onRequestAbort();
+    const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, cfg.fetchTimeoutMs);
     try {
-        res = await cfg.fetchImpl(url, {
+        const res = await cfg.fetchImpl(url, {
             redirect: "error", // a redirect could bounce to a disallowed origin - refuse it.
-            signal: AbortSignal.timeout(cfg.fetchTimeoutMs),
+            signal: controller.signal,
             headers: { Accept: "image/*" },
         });
+        if (!res.ok)
+            return { ok: false, status: 502, code: "upstream_error" };
+        const bytes = await readBoundedBytes(res, cfg.maxSourceBytes);
+        if (bytes === null)
+            return { ok: false, status: 413, code: "source_too_large" };
+        if (requestSignal.aborted)
+            return { ok: false, status: 499, code: "request_cancelled" };
+        return { ok: true, bytes };
     }
     catch (err) {
         const name = err instanceof Error ? err.name : "";
-        return name === "TimeoutError"
+        if (requestSignal.aborted)
+            return { ok: false, status: 499, code: "request_cancelled" };
+        return timedOut || name === "TimeoutError"
             ? { ok: false, status: 504, code: "upstream_timeout" }
             : { ok: false, status: 502, code: "upstream_unreachable" };
     }
-    if (!res.ok)
-        return { ok: false, status: 502, code: "upstream_error" };
-    const bytes = await readBoundedBytes(res, cfg.maxSourceBytes);
-    if (bytes === null)
-        return { ok: false, status: 413, code: "source_too_large" };
-    return { ok: true, bytes };
+    finally {
+        clearTimeout(timer);
+        requestSignal.removeEventListener("abort", onRequestAbort);
+    }
 }
-async function readLocal(src, cfg) {
+async function readLocal(src, cfg, signal) {
     if (cfg.root === null)
         return { ok: false, status: 403, code: "source_not_allowed" };
     // `src` is already percent-decoded by URLSearchParams - do NOT decode again (double-decode bypass).
@@ -231,29 +275,57 @@ async function readLocal(src, cfg) {
     if (resolved !== cfg.root && !resolved.startsWith(cfg.root + sep)) {
         return { ok: false, status: 403, code: "source_not_allowed" };
     }
-    let info;
+    // Resolve containment, then open that verified name exactly once. Reopening `resolved` after these
+    // checks would let a writable source tree swap a symlink between verification and read.
+    let real;
     try {
-        info = await stat(resolved);
+        real = await realpath(resolved);
+        const realRoot = await realpath(cfg.root);
+        if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+            return { ok: false, status: 403, code: "source_not_allowed" };
+        }
     }
     catch {
         return { ok: false, status: 404, code: "source_not_found" };
     }
-    if (!info.isFile())
-        return { ok: false, status: 404, code: "source_not_found" };
-    if (info.size > cfg.maxSourceBytes)
-        return { ok: false, status: 413, code: "source_too_large" };
-    // Defense-in-depth: a symlink inside root could point outside it - re-check the real path.
+    let handle;
     try {
-        const real = await realpath(resolved);
-        const realRoot = await realpath(cfg.root);
-        if (real !== realRoot && !real.startsWith(realRoot + sep)) {
-            return { ok: false, status: 403, code: "source_not_allowed" };
+        handle = await open(real, FS.O_RDONLY | FS.O_NOFOLLOW);
+        const info = await handle.stat();
+        if (!info.isFile())
+            return { ok: false, status: 404, code: "source_not_found" };
+        if (info.size > cfg.maxSourceBytes) {
+            return { ok: false, status: 413, code: "source_too_large" };
+        }
+        // Read no more than the descriptor size that passed the cap. If the file grows concurrently, the
+        // appended bytes are deliberately ignored; if it shrinks, return only the bytes actually read.
+        const bytes = new Uint8Array(info.size);
+        let offset = 0;
+        while (offset < bytes.byteLength) {
+            if (signal.aborted)
+                return { ok: false, status: 499, code: "request_cancelled" };
+            const { bytesRead } = await handle.read(bytes, offset, bytes.byteLength - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
         }
+        if (signal.aborted)
+            return { ok: false, status: 499, code: "request_cancelled" };
+        return { ok: true, bytes: offset === bytes.byteLength ? bytes : bytes.slice(0, offset) };
     }
     catch {
         return { ok: false, status: 404, code: "source_not_found" };
     }
-    return { ok: true, bytes: new Uint8Array(await readFile(resolved)) };
+    finally {
+        if (handle !== undefined) {
+            try {
+                await handle.close();
+            }
+            catch {
+                // The response has already been decided; descriptor-close failure cannot change it.
+            }
+        }
+    }
 }
 /** Read a response body, aborting (→ null) once `limit` bytes are exceeded. Trusts neither the
  * `Content-Length` header (checked as a fast reject) nor an absent one - the running total is the gate. */
@@ -321,14 +393,13 @@ function ifNoneMatch(req, etag) {
         return true;
     return header.split(",").some((t) => t.trim() === etag);
 }
-/** 32-bit FNV-1a over a short key string → hex. Used only as a cache validator (ETag), not security. */
-function fnv1a(input) {
-    let h = 0x811c9dc5;
-    for (let i = 0; i < input.length; i++) {
-        h ^= input.charCodeAt(i);
-        h = Math.imul(h, 0x01000193);
-    }
-    return (h >>> 0).toString(16);
+/** Collision-resistant content digest for a strong representation validator. */
+async function sha256(bytes) {
+    // Copy so a backend-owned mutable buffer cannot change while Web Crypto is reading it.
+    const stable = new Uint8Array(bytes.byteLength);
+    stable.set(bytes);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", stable));
+    return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function errorResponse(status, code, extraHeaders = {}) {
     return new Response(JSON.stringify({ error: code }), {
@@ -339,20 +410,41 @@ function errorResponse(status, code, extraHeaders = {}) {
 function createSemaphore(max, maxWaiters) {
     let active = 0;
     const waiters = [];
-    const acquire = async () => {
+    const acquire = async (signal) => {
+        if (signal?.aborted === true)
+            return "aborted";
         if (active < max) {
             active++;
-            return true;
+            return "acquired";
         }
         if (waiters.length >= maxWaiters)
-            return false;
-        await new Promise((res) => waiters.push(res)); // slot handed over by release(), active unchanged
-        return true;
+            return "full";
+        return new Promise((resolve) => {
+            const cleanup = () => signal?.removeEventListener("abort", onAbort);
+            const waiter = {
+                grant: () => {
+                    cleanup();
+                    resolve("acquired"); // slot handed over by release(); active remains unchanged
+                },
+            };
+            const onAbort = () => {
+                const index = waiters.indexOf(waiter);
+                if (index === -1)
+                    return; // already granted synchronously by release()
+                waiters.splice(index, 1);
+                cleanup();
+                resolve("aborted");
+            };
+            waiters.push(waiter);
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted === true)
+                onAbort(); // close the add/check race
+        });
     };
     const release = () => {
         const next = waiters.shift();
         if (next !== undefined) {
-            next(); // hand the slot to the waiter without touching `active`
+            next.grant(); // hand the slot to the waiter without touching `active`
         }
         else {
             active--;

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEvD,OAAO,EACL,eAAe,EAEf,oBAAoB,GAErB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,gGAAgG;AAChG,0GAA0G;AAC1G,gGAAgG;AAChG,cAAc,cAAc,CAAA;AA8C5B,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,SAAS,4BAA4B,CAAC,KAAa,EAAE,IAAY;IAC/D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC,UAAU,IAAI,sCAAsC,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,IAAY;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAAC,UAAU,IAAI,yCAAyC,CAAC,CAAA;IAC/E,CAAC;AACH,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B;IACjD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,UAAU,CAAA;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAA;IAC5C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,WAAW,GAAG,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG,EAAE,CAAA;IACrD,4BAA4B,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAC9D,yBAAyB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;IAC7D,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACrD,yBAAyB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACjE,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAClD,IAAI,iBAAiB,GAAG,WAAW,EAAE,CAAC;QACpC,gGAAgG;QAChG,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,EAAE;QAC7C,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACnE,cAAc,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACrD,cAAc;QACd,eAAe;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,UAAU;QAC9C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;QAC5C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,MAAM;QAChD,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;QAChC,KAAK,EAAE,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QACnD,2FAA2F;QAC3F,gGAAgG;QAChG,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;KACvD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,GAAmB;IACrD,4FAA4F;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,8FAA8F;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACjE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAClE,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,GAAG,GAAG,CAAC,cAAc,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;QAC5D,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAE1E,gGAAgG;IAChG,mGAAmG;IACnG,2FAA2F;IAC3F,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,EAAE,GACN,GAAG,KAAK,IAAI;YACZ,iBAAiB,CACf,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB;gBACE,GAAG;gBACH,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;gBAClC,CAAC,EAAE,MAAM,IAAI,SAAS;gBACtB,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;aAC9C,EACD,GAAG,EACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAC9B,CAAA;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACzD,CAAC;IAED,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,cAAc,IAAI,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA;IACrF,MAAM,YAAY,GAA2B;QAC3C,eAAe,EAAE,mBAAmB,GAAG,CAAC,WAAW,aAAa;QAChE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,+FAA+F;IAC/F,qGAAqG;IACrG,mGAAmG;IACnG,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAChE,mGAAmG;QACnG,yDAAyD;QACzD,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACzB,IAAI,GAAmD,CAAA;QACvD,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACnD,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;gBACrD,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/C,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACvD,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,WAAW;gBAClB,OAAO;gBACP,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACrB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA,CAAC,gDAAgD;QACjG,oCAAoC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9E,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC3E,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA,CAAC,uBAAuB;QAC7E,CAAC;QACD,mDAAmD;QACnD,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC;AACH,CAAC;AAMD;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,GAAmB;IACxD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,GAAmB;IACtD,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAC7B,QAAQ,EAAE,OAAO,EAAE,8DAA8D;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACjD,OAAO,IAAI,KAAK,cAAc;YAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE;YACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;IACtE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IAC7D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,GAAmB;IACvD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IACpF,oGAAoG;IACpG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAC9E,iGAAiG;IACjG,qGAAqG;IACrG,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,IAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC/E,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC/F,2FAA2F;IAC3F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAA;AACtE,CAAC;AAED;2GAC2G;AAC3G,KAAK,UAAU,gBAAgB,CAAC,GAAa,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK;QAAE,OAAO,IAAI,CAAA;IACxF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5C,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;2DAE2D;AAC3D,SAAS,eAAe,CAAC,YAAoB,EAAE,SAAkB;IAC/D,IAAI,SAAS;QAAE,OAAO,MAAM,CAAA;IAC5B,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,KAAK;QAAE,OAAO,MAAM,CAAA;IACpE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;kEACkE;AAClE,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,IAAY;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAA;AACzD,CAAC;AAED,wGAAwG;AACxG,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,CAAC,GAAG,UAAU,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACxB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,eAAuC,EAAE;IAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;QACnD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,GAAG,YAAY,EAAE;KAChF,CAAC,CAAA;AACJ,CAAC;AAYD,SAAS,eAAe,CAAC,GAAW,EAAE,UAAkB;IACtD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,KAAK,IAAsB,EAAE;QAC3C,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,EAAE,CAAA;YACR,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,KAAK,CAAA;QAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC,kDAAkD;QACtG,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,EAAE,CAAA,CAAC,wDAAwD;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC,CAAA;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEvD,OAAO,EACL,eAAe,EAEf,oBAAoB,GAErB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAE7C,gGAAgG;AAChG,0GAA0G;AAC1G,gGAAgG;AAChG,cAAc,cAAc,CAAA;AAiD5B,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,SAAS,4BAA4B,CAAC,KAAa,EAAE,IAAY;IAC/D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC,UAAU,IAAI,sCAAsC,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,IAAY;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAAC,UAAU,IAAI,yCAAyC,CAAC,CAAA;IAC/E,CAAC;AACH,CAAC;AAqBD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,OAA4B;IACjD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IACjE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,UAAU,CAAA;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAA;IAC5C,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,WAAW,GAAG,CAAC,CAAA;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,GAAG,EAAE,CAAA;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAA;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAChD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,MAAM,CAAA;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,4BAA4B,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAC9D,yBAAyB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;IAC7D,yBAAyB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACrD,yBAAyB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACjE,4BAA4B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAClD,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC/C,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IACxD,yBAAyB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;QACxF,MAAM,IAAI,UAAU,CAAC,4DAA4D,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAA;IAC7F,IAAI,iBAAiB,GAAG,WAAW,EAAE,CAAC;QACpC,gGAAgG;QAChG,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,EAAE;QAC7C,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACnE,cAAc,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACrD,cAAc;QACd,eAAe;QACf,QAAQ;QACR,WAAW;QACX,SAAS;QACT,cAAc;QACd,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;QAChC,KAAK,EAAE,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QACnD,2FAA2F;QAC3F,gGAAgG;QAChG,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC;KACvD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAY,EAAE,GAAmB;IACrD,4FAA4F;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,8FAA8F;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACjE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAClE,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,GAAG,GAAG,CAAC,cAAc,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;QAC5D,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAE1E,gGAAgG;IAChG,mGAAmG;IACnG,2FAA2F;IAC3F,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,EAAE,GACN,GAAG,KAAK,IAAI;YACZ,iBAAiB,CACf,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB;gBACE,GAAG;gBACH,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;gBAClC,CAAC,EAAE,MAAM,IAAI,SAAS;gBACtB,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;aAC9C,EACD,GAAG,EACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAC9B,CAAA;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;IACzD,CAAC;IAED,+FAA+F;IAC/F,qGAAqG;IACrG,mGAAmG;IACnG,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACvE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAChE,mGAAmG;QACnG,yDAAyD;QACzD,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,cAAc,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC5E,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QAChF,IAAI,GAAmD,CAAA;QACvD,IAAI,CAAC;YACH,2FAA2F;YAC3F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACnD,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;gBACrD,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/C,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;YACtE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YACvD,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,WAAW;gBAClB,OAAO;gBACP,MAAM;aACP,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QACxE,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACrB,CAAC;QAED,iGAAiG;QACjG,iFAAiF;QACjF,MAAM,IAAI,GAAG,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,eAAe,EAAE,mBAAmB,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1F,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,QAAQ;SACf,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA,CAAC,gDAAgD;QACjG,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAC/E,oCAAoC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9E,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC3E,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA,CAAC,uBAAuB;QAC7E,CAAC;QACD,mDAAmD;QACnD,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC7C,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC;AACH,CAAC;AAMD;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,GAAmB,EACnB,MAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAChF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAQ,EACR,GAAmB,EACnB,aAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,cAAc,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IACzE,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,iGAAiG;IACjG,4EAA4E;IAC5E,IAAI,aAAa,CAAC,OAAO;QAAE,cAAc,EAAE,CAAA;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAA;QACf,UAAU,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACnC,QAAQ,EAAE,OAAO,EAAE,8DAA8D;YACjF,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;SAC/B,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAA;QAC7D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/E,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACjD,IAAI,aAAa,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QACvF,OAAO,QAAQ,IAAI,IAAI,KAAK,cAAc;YACxC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE;YACtD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAA;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,aAAa,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,GAAmB,EACnB,MAAmB;IAEnB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IACpF,oGAAoG;IACpG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAC9E,iGAAiG;IACjG,qGAAqG;IACrG,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;IAC/D,CAAC;IACD,mGAAmG;IACnG,wFAAwF;IACxF,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAA;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,MAAoD,CAAA;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC/E,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;QAC7D,CAAC;QACD,iGAAiG;QACjG,+FAA+F;QAC/F,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;YAChF,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;YACzF,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAK;YAC1B,MAAM,IAAI,SAAS,CAAA;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;QAChF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAA;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAA;IAC7D,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,oFAAoF;YACtF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;2GAC2G;AAC3G,KAAK,UAAU,gBAAgB,CAAC,GAAa,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK;QAAE,OAAO,IAAI,CAAA;IACxF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5C,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;2DAE2D;AAC3D,SAAS,eAAe,CAAC,YAAoB,EAAE,SAAkB;IAC/D,IAAI,SAAS;QAAE,OAAO,MAAM,CAAA;IAC5B,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,KAAK;QAAE,OAAO,MAAM,CAAA;IACpE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;kEACkE;AAClE,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,IAAY;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAA;AACzD,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,MAAM,CAAC,KAAiB;IACrC,uFAAuF;IACvF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,eAAuC,EAAE;IAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;QACnD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,GAAG,YAAY,EAAE;KAChF,CAAC,CAAA;AACJ,CAAC;AAYD,SAAS,eAAe,CAAC,GAAW,EAAE,UAAkB;IACtD,IAAI,MAAM,GAAG,CAAC,CAAA;IAId,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAA4C,EAAE;QACvF,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAC9C,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,EAAE,CAAA;YACR,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,MAAM,CAAA;QAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACzE,MAAM,MAAM,GAAW;gBACrB,KAAK,EAAE,GAAG,EAAE;oBACV,OAAO,EAAE,CAAA;oBACT,OAAO,CAAC,UAAU,CAAC,CAAA,CAAC,0DAA0D;gBAChF,CAAC;aACF,CAAA;YACD,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACrC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,OAAM,CAAC,6CAA6C;gBACtE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;gBACxB,OAAO,EAAE,CAAA;gBACT,OAAO,CAAC,SAAS,CAAC,CAAA;YACpB,CAAC,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC1D,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAA,CAAC,2BAA2B;QACrE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAA,CAAC,wDAAwD;QACvE,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC,CAAA;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/image",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "description": "Image optimization for nifra - a CLS-safe responsive <Image> + pluggable loaders (CDN or self-hosted) + pure-JS dimension reading. Zero-dependency core; optional Bun.Image-backed resize endpoint at @nifrajs/image/server.",
   "keywords": [
     "bun",

package/src/server.ts

@@ -11,7 +11,8 @@
  * from `@nifrajs/image` instead. The dependency-free core (`@nifrajs/image`) never imports this module.
  */
 
-import { readFile, realpath, stat } from "node:fs/promises"
+import { constants as FS } from "node:fs"
+import { open, realpath } from "node:fs/promises"
 import { resolve as resolvePath, sep } from "node:path"
 
 import {
@@ -57,8 +58,11 @@ export interface ImageHandlerOptions {
   readonly sourceConcurrency?: number
   /** Maximum queued image requests beyond the admission width. Default `concurrency * 16`. */
   readonly maxQueue?: number
-  /** `Cache-Control: public, max-age=<n>, immutable` seconds. Default 1 year. */
+  /** `Cache-Control: public, max-age=<n>` seconds. Default 1 hour. */
   readonly cacheMaxAge?: number
+  /** Add `immutable` to Cache-Control. Off by default: enable only when every source URL changes with
+   * its content, otherwise browsers are allowed to retain a changed image until the full max-age. */
+  readonly immutable?: boolean
   /** Quality used when `?q` is absent. Default 75. */
   readonly defaultQuality?: number
   /** Remote-fetch timeout (ms). Default 10 000. */
@@ -94,6 +98,7 @@ interface ResolvedConfig {
   readonly maxSourcePixels: number
   readonly maxWidth: number
   readonly cacheMaxAge: number
+  readonly immutable: boolean
   readonly defaultQuality: number
   readonly fetchTimeoutMs: number
   readonly fetchImpl: typeof fetch
@@ -125,11 +130,23 @@ function resolveConfig(options: ImageHandlerOptions): ResolvedConfig {
   const concurrency = options.concurrency ?? 4
   const sourceConcurrency = options.sourceConcurrency ?? concurrency * 2
   const maxQueue = options.maxQueue ?? concurrency * 16
+  const maxWidth = options.maxWidth ?? 3840
+  const cacheMaxAge = options.cacheMaxAge ?? 3_600
+  const defaultQuality = options.defaultQuality ?? 75
+  const fetchTimeoutMs = options.fetchTimeoutMs ?? 10_000
+  const immutable = options.immutable ?? false
   assertNonNegativeSafeInteger(maxSourceBytes, "maxSourceBytes")
   assertPositiveSafeInteger(maxSourcePixels, "maxSourcePixels")
   assertPositiveSafeInteger(concurrency, "concurrency")
   assertPositiveSafeInteger(sourceConcurrency, "sourceConcurrency")
   assertNonNegativeSafeInteger(maxQueue, "maxQueue")
+  assertPositiveSafeInteger(maxWidth, "maxWidth")
+  assertNonNegativeSafeInteger(cacheMaxAge, "cacheMaxAge")
+  assertPositiveSafeInteger(fetchTimeoutMs, "fetchTimeoutMs")
+  if (!Number.isSafeInteger(defaultQuality) || defaultQuality < 1 || defaultQuality > 100) {
+    throw new RangeError("image: defaultQuality must be a safe integer from 1 to 100")
+  }
+  if (typeof immutable !== "boolean") throw new TypeError("image: immutable must be a boolean")
   if (sourceConcurrency < concurrency) {
     // Otherwise the codec lane can never fill, and `concurrency` silently means something narrower.
     throw new RangeError("image: sourceConcurrency must be >= concurrency")
@@ -140,10 +157,11 @@ function resolveConfig(options: ImageHandlerOptions): ResolvedConfig {
     allowedOrigins: new Set(options.allowedOrigins ?? []),
     maxSourceBytes,
     maxSourcePixels,
-    maxWidth: options.maxWidth ?? 3840,
-    cacheMaxAge: options.cacheMaxAge ?? 31_536_000,
-    defaultQuality: options.defaultQuality ?? 75,
-    fetchTimeoutMs: options.fetchTimeoutMs ?? 10_000,
+    maxWidth,
+    cacheMaxAge,
+    immutable,
+    defaultQuality,
+    fetchTimeoutMs,
     fetchImpl: options.fetch ?? globalThis.fetch,
     signing: options.signing ?? null,
     admit: createSemaphore(sourceConcurrency, maxQueue),
@@ -198,29 +216,20 @@ async function handle(req: Request, cfg: ResolvedConfig): Promise<Response> {
     if (!ok) return errorResponse(403, "invalid_signature")
   }
 
-  // 3. Strong validator from the request-deterministic inputs, computed BEFORE any fetch/decode so a
-  //    conditional request short-circuits all expensive work. The clamped width is a pure function of
-  //    (src, requestedWidth), so (src, requestedWidth, quality, wantsWebp) fully keys the response.
-  const etag = `"${fnv1a(`${src}|${requestedWidth}|${quality}|${wantsWebp ? 1 : 0}`)}"`
-  const cacheHeaders: Record<string, string> = {
-    "Cache-Control": `public, max-age=${cfg.cacheMaxAge}, immutable`,
-    ETag: etag,
-    Vary: "Accept",
-  }
-  if (ifNoneMatch(req, etag)) {
-    return new Response(null, { status: 304, headers: cacheHeaders })
-  }
-
-  // 4/5. Admission precedes source reads so queued requests do not retain large buffers. It is a
+  // 3/4. Admission precedes source reads so queued requests do not retain large buffers. It is a
   //      separate, wider lane from the codec one below: a remote source is a network wait, and letting
   //      it hold a codec slot would let `concurrency` slow origins stall every transform on the box.
-  if (!(await cfg.admit.acquire())) return errorResponse(503, "image_queue_full")
+  const admission = await cfg.admit.acquire(req.signal)
+  if (admission === "full") return errorResponse(503, "image_queue_full")
+  if (admission === "aborted") return errorResponse(499, "request_cancelled")
   try {
-    const source = await readSource(src, cfg)
+    const source = await readSource(src, cfg, req.signal)
     if (!source.ok) return errorResponse(source.status, source.code)
     // The bytes are in hand; now queue for CPU. This semaphore never refuses - its waiter bound is the
     // admission width - so a wait here is a wait, not a 503.
-    await cfg.codec.acquire()
+    const codecAdmission = await cfg.codec.acquire(req.signal)
+    if (codecAdmission === "full") return errorResponse(503, "image_queue_full")
+    if (codecAdmission === "aborted") return errorResponse(499, "request_cancelled")
     let out: Awaited<ReturnType<ImageBackend["transform"]>>
     try {
       // Probe → enforce the portable pixel cap → clamp to intrinsic (never upscale) → transform.
@@ -228,6 +237,7 @@ async function handle(req: Request, cfg: ResolvedConfig): Promise<Response> {
       if (probe.width * probe.height > cfg.maxSourcePixels) {
         return errorResponse(413, "source_too_large")
       }
+      if (req.signal.aborted) return errorResponse(499, "request_cancelled")
       const targetWidth = Math.max(1, Math.min(width, probe.width))
       const format = negotiateFormat(probe.format, wantsWebp)
       out = await cfg.backend.transform({
@@ -236,14 +246,23 @@ async function handle(req: Request, cfg: ResolvedConfig): Promise<Response> {
         quality,
         format,
       })
+      if (req.signal.aborted) return errorResponse(499, "request_cancelled")
     } finally {
       cfg.codec.release()
     }
 
-    const headers = new Headers(cacheHeaders)
+    // A strong validator describes the bytes actually emitted. Hashing request parameters here would
+    // falsely return 304 when a mutable local/remote source changes at the same URL.
+    const etag = `"${await sha256(out.bytes)}"`
+    const headers = new Headers({
+      "Cache-Control": `public, max-age=${cfg.cacheMaxAge}${cfg.immutable ? ", immutable" : ""}`,
+      ETag: etag,
+      Vary: "Accept",
+    })
     headers.set("Content-Type", out.contentType)
     headers.set("Content-Length", String(out.bytes.byteLength))
     headers.set("X-Content-Type-Options", "nosniff") // never let a client sniff the re-encoded bytes
+    if (ifNoneMatch(req, etag)) return new Response(null, { status: 304, headers })
     // HEAD: identical headers, no body.
     if (req.method === "HEAD") return new Response(null, { status: 200, headers })
     return new Response(out.bytes, { status: 200, headers })
@@ -268,7 +287,12 @@ type SourceResult =
  * must be `http(s)` **and** on the `allowedOrigins` allowlist; anything else is a local path resolved
  * under `root` with traversal + symlink containment checks. Both branches fail closed.
  */
-async function readSource(src: string, cfg: ResolvedConfig): Promise<SourceResult> {
+async function readSource(
+  src: string,
+  cfg: ResolvedConfig,
+  signal: AbortSignal,
+): Promise<SourceResult> {
+  if (signal.aborted) return { ok: false, status: 499, code: "request_cancelled" }
   const asUrl = tryParseUrl(src)
   if (asUrl !== null) {
     if (asUrl.protocol !== "http:" && asUrl.protocol !== "https:") {
@@ -277,32 +301,55 @@ async function readSource(src: string, cfg: ResolvedConfig): Promise<SourceResul
     if (!cfg.allowedOrigins.has(asUrl.origin)) {
       return { ok: false, status: 403, code: "source_not_allowed" }
     }
-    return fetchRemote(asUrl, cfg)
+    return fetchRemote(asUrl, cfg, signal)
   }
-  return readLocal(src, cfg)
+  return readLocal(src, cfg, signal)
 }
 
-async function fetchRemote(url: URL, cfg: ResolvedConfig): Promise<SourceResult> {
-  let res: Response
+async function fetchRemote(
+  url: URL,
+  cfg: ResolvedConfig,
+  requestSignal: AbortSignal,
+): Promise<SourceResult> {
+  const controller = new AbortController()
+  let timedOut = false
+  const onRequestAbort = (): void => controller.abort(requestSignal.reason)
+  requestSignal.addEventListener("abort", onRequestAbort, { once: true })
+  // Close the add/check race: a signal that aborted immediately before listener registration still
+  // cancels the fetch rather than running an abandoned request to completion.
+  if (requestSignal.aborted) onRequestAbort()
+  const timer = setTimeout(() => {
+    timedOut = true
+    controller.abort()
+  }, cfg.fetchTimeoutMs)
   try {
-    res = await cfg.fetchImpl(url, {
+    const res = await cfg.fetchImpl(url, {
       redirect: "error", // a redirect could bounce to a disallowed origin - refuse it.
-      signal: AbortSignal.timeout(cfg.fetchTimeoutMs),
+      signal: controller.signal,
       headers: { Accept: "image/*" },
     })
+    if (!res.ok) return { ok: false, status: 502, code: "upstream_error" }
+    const bytes = await readBoundedBytes(res, cfg.maxSourceBytes)
+    if (bytes === null) return { ok: false, status: 413, code: "source_too_large" }
+    if (requestSignal.aborted) return { ok: false, status: 499, code: "request_cancelled" }
+    return { ok: true, bytes }
   } catch (err) {
     const name = err instanceof Error ? err.name : ""
-    return name === "TimeoutError"
+    if (requestSignal.aborted) return { ok: false, status: 499, code: "request_cancelled" }
+    return timedOut || name === "TimeoutError"
       ? { ok: false, status: 504, code: "upstream_timeout" }
       : { ok: false, status: 502, code: "upstream_unreachable" }
+  } finally {
+    clearTimeout(timer)
+    requestSignal.removeEventListener("abort", onRequestAbort)
   }
-  if (!res.ok) return { ok: false, status: 502, code: "upstream_error" }
-  const bytes = await readBoundedBytes(res, cfg.maxSourceBytes)
-  if (bytes === null) return { ok: false, status: 413, code: "source_too_large" }
-  return { ok: true, bytes }
 }
 
-async function readLocal(src: string, cfg: ResolvedConfig): Promise<SourceResult> {
+async function readLocal(
+  src: string,
+  cfg: ResolvedConfig,
+  signal: AbortSignal,
+): Promise<SourceResult> {
   if (cfg.root === null) return { ok: false, status: 403, code: "source_not_allowed" }
   // `src` is already percent-decoded by URLSearchParams - do NOT decode again (double-decode bypass).
   if (src.includes("\0")) return { ok: false, status: 400, code: "invalid_src" }
@@ -313,25 +360,49 @@ async function readLocal(src: string, cfg: ResolvedConfig): Promise<SourceResult
   if (resolved !== cfg.root && !resolved.startsWith(cfg.root + sep)) {
     return { ok: false, status: 403, code: "source_not_allowed" }
   }
-  let info: Awaited<ReturnType<typeof stat>>
+  // Resolve containment, then open that verified name exactly once. Reopening `resolved` after these
+  // checks would let a writable source tree swap a symlink between verification and read.
+  let real: string
   try {
-    info = await stat(resolved)
+    real = await realpath(resolved)
+    const realRoot = await realpath(cfg.root)
+    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
+      return { ok: false, status: 403, code: "source_not_allowed" }
+    }
   } catch {
     return { ok: false, status: 404, code: "source_not_found" }
   }
-  if (!info.isFile()) return { ok: false, status: 404, code: "source_not_found" }
-  if (info.size > cfg.maxSourceBytes) return { ok: false, status: 413, code: "source_too_large" }
-  // Defense-in-depth: a symlink inside root could point outside it - re-check the real path.
+  let handle: Awaited<ReturnType<typeof open>> | undefined
   try {
-    const real = await realpath(resolved)
-    const realRoot = await realpath(cfg.root)
-    if (real !== realRoot && !real.startsWith(realRoot + sep)) {
-      return { ok: false, status: 403, code: "source_not_allowed" }
+    handle = await open(real, FS.O_RDONLY | FS.O_NOFOLLOW)
+    const info = await handle.stat()
+    if (!info.isFile()) return { ok: false, status: 404, code: "source_not_found" }
+    if (info.size > cfg.maxSourceBytes) {
+      return { ok: false, status: 413, code: "source_too_large" }
+    }
+    // Read no more than the descriptor size that passed the cap. If the file grows concurrently, the
+    // appended bytes are deliberately ignored; if it shrinks, return only the bytes actually read.
+    const bytes = new Uint8Array(info.size)
+    let offset = 0
+    while (offset < bytes.byteLength) {
+      if (signal.aborted) return { ok: false, status: 499, code: "request_cancelled" }
+      const { bytesRead } = await handle.read(bytes, offset, bytes.byteLength - offset, offset)
+      if (bytesRead === 0) break
+      offset += bytesRead
     }
+    if (signal.aborted) return { ok: false, status: 499, code: "request_cancelled" }
+    return { ok: true, bytes: offset === bytes.byteLength ? bytes : bytes.slice(0, offset) }
   } catch {
     return { ok: false, status: 404, code: "source_not_found" }
+  } finally {
+    if (handle !== undefined) {
+      try {
+        await handle.close()
+      } catch {
+        // The response has already been decided; descriptor-close failure cannot change it.
+      }
+    }
   }
-  return { ok: true, bytes: new Uint8Array(await readFile(resolved)) }
 }
 
 /** Read a response body, aborting (→ null) once `limit` bytes are exceeded. Trusts neither the
@@ -397,14 +468,13 @@ function ifNoneMatch(req: Request, etag: string): boolean {
   return header.split(",").some((t) => t.trim() === etag)
 }
 
-/** 32-bit FNV-1a over a short key string → hex. Used only as a cache validator (ETag), not security. */
-function fnv1a(input: string): string {
-  let h = 0x811c9dc5
-  for (let i = 0; i < input.length; i++) {
-    h ^= input.charCodeAt(i)
-    h = Math.imul(h, 0x01000193)
-  }
-  return (h >>> 0).toString(16)
+/** Collision-resistant content digest for a strong representation validator. */
+async function sha256(bytes: Uint8Array): Promise<string> {
+  // Copy so a backend-owned mutable buffer cannot change while Web Crypto is reading it.
+  const stable = new Uint8Array(bytes.byteLength)
+  stable.set(bytes)
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", stable))
+  return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("")
 }
 
 function errorResponse(
@@ -424,26 +494,47 @@ function errorResponse(
  * past the limit in the microtask gap. Bounds concurrent codec work.
  */
 interface Semaphore {
-  acquire(): Promise<boolean>
+  acquire(signal?: AbortSignal): Promise<"acquired" | "full" | "aborted">
   release(): void
 }
 
 function createSemaphore(max: number, maxWaiters: number): Semaphore {
   let active = 0
-  const waiters: Array<() => void> = []
-  const acquire = async (): Promise<boolean> => {
+  interface Waiter {
+    readonly grant: () => void
+  }
+  const waiters: Waiter[] = []
+  const acquire = async (signal?: AbortSignal): Promise<"acquired" | "full" | "aborted"> => {
+    if (signal?.aborted === true) return "aborted"
     if (active < max) {
       active++
-      return true
+      return "acquired"
     }
-    if (waiters.length >= maxWaiters) return false
-    await new Promise<void>((res) => waiters.push(res)) // slot handed over by release(), active unchanged
-    return true
+    if (waiters.length >= maxWaiters) return "full"
+    return new Promise((resolve) => {
+      const cleanup = (): void => signal?.removeEventListener("abort", onAbort)
+      const waiter: Waiter = {
+        grant: () => {
+          cleanup()
+          resolve("acquired") // slot handed over by release(); active remains unchanged
+        },
+      }
+      const onAbort = (): void => {
+        const index = waiters.indexOf(waiter)
+        if (index === -1) return // already granted synchronously by release()
+        waiters.splice(index, 1)
+        cleanup()
+        resolve("aborted")
+      }
+      waiters.push(waiter)
+      signal?.addEventListener("abort", onAbort, { once: true })
+      if (signal?.aborted === true) onAbort() // close the add/check race
+    })
   }
   const release = (): void => {
     const next = waiters.shift()
     if (next !== undefined) {
-      next() // hand the slot to the waiter without touching `active`
+      next.grant() // hand the slot to the waiter without touching `active`
     } else {
       active--
     }