approval-md 0.0.1 → 0.2.0

package/dist/src/core/token.js

@@ -0,0 +1,561 @@
+/**
+ * Execution tokens (SPEC.md §10.4, §11) — the hard-enforcement primitive.
+ *
+ * An adapter holds credentials and "MUST require a valid, unexpired, single-use
+ * execution token bound to the action's `idempotency_key`" (SPEC.md §10.4).
+ * This module mints those tokens, decides whether a presented one is still good,
+ * and spends it. Everything it knows it derives from the append-only log.
+ *
+ * ## The five settled properties (human decision, 2026-08-06)
+ *
+ * 1. **Minted at grant.** There is exactly one mint site: the grant path of
+ *    `core/gate.ts`'s {@link import("./gate.js").decide}. No other code path
+ *    creates a token, so a token's existence *is* a human's yes.
+ * 2. **Single-use.** Consumption is an `execution.started` event, so the second
+ *    attempt is refused by reading the log rather than by remembering anything.
+ *    Double-spend detection is chain-native: it survives a process restart, a
+ *    different machine, and a lost in-memory cache, because the evidence is the
+ *    log itself.
+ * 3. **Bound to the request, its `idempotency_key`, and its `payload_hash`**
+ *    (amended SPEC.md §10, A1). A token is looked up by `action_key` — the
+ *    envelope's `idempotency_key` — and is compared against the hash on *that*
+ *    action's grant. A token minted for action A therefore cannot be presented
+ *    for action B: B's grant carries a different hash (or no grant at all), and
+ *    the comparison fails. The third binding is to the bytes: a consumer states
+ *    the hash of the payload it is about to execute, and anything but the hash
+ *    the grant recorded is refused `payload-mismatch`. A grant approves specific
+ *    bytes; changing them after grant requires a new request. A grant that
+ *    recorded *no* bytes is refused too — see {@link consumeToken}.
+ * 4. **Hash-only in the log.** `approval.granted` carries
+ *    `payload.token_sha256`; the raw token is returned to the caller of `decide`
+ *    and to nothing else. Possession is proven by presenting a preimage. An
+ *    attacker with a copy of the log — the one artifact this system deliberately
+ *    makes durable, copyable, and auditable — gains no ability to execute.
+ * 5. **No separate token TTL in v0.1.** A token dies exactly three ways:
+ *    execution ({@link consumeToken}), revocation (`approval.revoked`), and the
+ *    lapse of the *parent request's* TTL (`defaults.approval_ttl`, measured from
+ *    the `approval.requested` timestamp). Inventing a second, independent clock
+ *    would create a state where a request is live and its token is not, which no
+ *    operator could explain from the log.
+ *
+ * ## Why the parent TTL bounds a *granted* request
+ *
+ * `requestState` deliberately stops applying the TTL once a decision lands: an
+ * answered request is answered. Token liveness is a stricter question than
+ * request state, and the settled design gives an approval a shelf life. So
+ * {@link tokenStatus} re-applies `requestTs + approval_ttl` to a *granted*
+ * request and refuses with `token-expired` past it. This never mutates the
+ * derived request state and never writes anything — an aged-out token is simply
+ * not spendable, and re-requesting the action is the repair. (Contrast
+ * `core/gate.ts`, which materialises `approval.expired` when it discovers a
+ * lapse on an *undecided* request. That branch belongs to the gate and this
+ * module does not duplicate it: a granted request's `approval.expired` would
+ * claim the human never answered.)
+ *
+ * ## Where this module sits between APRV-16 and APRV-18
+ *
+ * `core/gate.ts` deliberately appends no `execution.*` event. {@link
+ * consumeToken} is the **only sanctioned appender of `execution.started` on the
+ * manual path**, and it appends one only after a live token verifies — closing
+ * the gap APRV-16 flagged, where a manual action's start event had no guard at
+ * all.
+ *
+ * The supervised/autonomous paths are **not** this function's business. Under
+ * the amended SPEC.md §6.3 they produce no approval events and therefore no
+ * token; their `execution.started` is appended by APRV-18's `approval run`
+ * wrapper, which is also where their budget is charged (see the consumption
+ * contract in `core/budgets.ts`). One rule, stated once: *manual actions spend a
+ * token here; non-manual actions start there.*
+ *
+ * ## The budgets contract
+ *
+ * The appended `execution.started` carries `payload.class` and
+ * `payload.est_cost_usd`, **copied from the grant's payload** rather than
+ * re-derived. `core/budgets.ts` counts an `execution.started` only when the
+ * window holds no `approval.granted` with the same `action_key`, so a manual
+ * action that is granted and then consumed is charged exactly once — the grant.
+ * Copying rather than re-deriving keeps the two records agreeing about what was
+ * authorized even if the task file changed in between.
+ *
+ * ## Time
+ *
+ * {@link tokenStatus} and {@link verifyToken} are pure and take `now` as a
+ * parameter: they answer a question and write nothing, so a caller asking "was
+ * this token live at time T?" is asking something legitimate. {@link
+ * consumeToken} *writes*, and `execution.started` is a gate-typed event, so
+ * amended SPEC.md §8 (A2) gives its timestamp to the runtime: no `ts`
+ * parameter, one read of {@link TokenOptions.clock} at the top, and a spender
+ * that cannot choose the moment its own TTL is judged at.
+ */
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { tick } from "./clock.js";
+import { appendEvent, } from "./log.js";
+import { usdOrZero } from "./money.js";
+import { isPayloadHash } from "./payload.js";
+import { loadPolicy } from "./policy-load.js";
+import { humanOnlyRefusal, resolve } from "./policy-match.js";
+import { asSealedToken, openSealedToken, readPrivateKey, SEALED_TOKEN_FIELD, } from "./seal.js";
+import { readVerifiedRecords, requestState, } from "./state.js";
+/** Token entropy. 32 bytes = 256 bits, rendered as 64 lowercase hex chars. */
+export const TOKEN_BYTES = 32;
+/** The payload key carrying the token's digest, on both grant and start. */
+export const TOKEN_HASH_FIELD = "token_sha256";
+/** The payload key carrying the content binding (amended SPEC.md §6.2, §10). */
+export const PAYLOAD_HASH_FIELD = "payload_hash";
+/**
+ * Mint a token: 32 cryptographically random bytes as lowercase hex.
+ *
+ * `randomBytes` (CSPRNG), never `Math.random`. The value is a bearer credential
+ * for a real-world side effect; 256 bits makes guessing irrelevant next to every
+ * other attack in SPEC.md §11's "not defended" list.
+ */
+export function mintToken() {
+    return randomBytes(TOKEN_BYTES).toString("hex");
+}
+/** The token's SHA-256, lowercase hex — the only form that ever reaches the log. */
+export function tokenHash(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+/**
+ * Constant-time comparison of two 64-hex digests.
+ *
+ * Both operands are digests, so a timing leak reveals a prefix of a *hash*, not
+ * of a token — but this CLI runs on a shared developer machine beside the very
+ * agents it polices, and an oracle that says "your first N hex digits were
+ * right" is the kind of affordance that should not exist at all. `timingSafeEqual`
+ * costs nothing here and removes the question.
+ *
+ * Digests are compared as decoded bytes: a malformed stored digest decodes to a
+ * different length, which `timingSafeEqual` rejects by throwing, so the length
+ * guard comes first and a malformed digest simply fails to match.
+ */
+export function digestsEqual(a, b) {
+    if (!/^[a-f0-9]{64}$/u.test(a) || !/^[a-f0-9]{64}$/u.test(b))
+        return false;
+    const left = Buffer.from(a, "hex");
+    const right = Buffer.from(b, "hex");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+// ---------------------------------------------------------------------------
+// Refusals
+// ---------------------------------------------------------------------------
+/**
+ * The token refusals proper — the closed set an agent branches on to learn *why*
+ * a token will not execute. Frozen public API, in the same sense the gate's
+ * codes and the exit codes are.
+ *
+ * The four death conditions are distinguishable on purpose: "you presented the
+ * wrong string", "this token was already spent", "a human took it back", and
+ * "it aged out" call for four different responses (fix the caller, stop
+ * retrying, escalate to the human, re-request).
+ */
+export const TOKEN_VERIFY_REFUSAL_CODES = [
+    /** No grant governs this action key: never requested, awaiting, or rejected. */
+    "not-granted",
+    /** A grant exists, but the presented token is not its preimage. */
+    "token-mismatch",
+    /** The token was already spent: an `execution.started` exists for this key. */
+    "token-consumed",
+    /** The parent request's TTL lapsed. There is no separate token TTL. */
+    "token-expired",
+    /** A human withdrew the grant (`approval.revoked`). */
+    "token-revoked",
+    /**
+     * The bytes do not match (amended SPEC.md §10, A1). The grant recorded a
+     * `payload_hash` and the consumer presented a different one — or none at all,
+     * which is the same fact stated by omission: an executor that cannot say what
+     * it is about to run has not shown that it is running what was approved.
+     *
+     * Distinct from `token-mismatch` on purpose. That one says "you are not the
+     * party who was approved"; this one says "you are, but that is not what was
+     * approved", and the repair is different: request the new payload rather than
+     * hunt for a lost token.
+     */
+    "payload-mismatch",
+    /**
+     * The grant was for a harness-executed request and minted no token
+     * (APRV-106). Nothing is wrong: the requesting process runs the command
+     * itself and never had a token to spend, so there is nothing to present here
+     * and nothing to recover. Distinct from `token-mismatch`, which says a
+     * digest exists and does not match, and from `not-granted`, which says no
+     * authorization exists at all — this one says the authorization exists, is
+     * complete, and is not the kind that is spent.
+     */
+    "harness-executed",
+];
+/**
+ * Everything {@link consumeToken} can refuse: the verification codes plus the
+ * three log/append failures, whose names and meanings are borrowed verbatim from
+ * `core/gate.ts` so the CLI can map them onto the frozen exit table identically.
+ */
+export const TOKEN_REFUSAL_CODES = [
+    ...TOKEN_VERIFY_REFUSAL_CODES,
+    /**
+     * The action's class resolves to `human-only` (APRV-185, amended SPEC.md
+     * §5.2): the policy reserves it to human hands, so no token may be spent for
+     * it and none should ever have existed.
+     *
+     * Deliberately NOT a member of {@link TOKEN_VERIFY_REFUSAL_CODES}, and the
+     * split is the point. Verification is pure over the log and answers what the
+     * records say about one grant; this is a fact about the POLICY, which
+     * {@link verifyToken} does not read and must not start reading — a
+     * verification replayable from a log plus the policy that was in force is
+     * what makes an audit reproducible. So the check lives at the two places that
+     * hold a policy already: {@link consumeToken}, which spends, and the
+     * `approval token` verb, which would otherwise report a live token for an
+     * action nothing may execute.
+     *
+     * `core/gate.ts` refuses the request that would mint such a token, so a grant
+     * under a human-only class means the class was raised by a policy amendment
+     * after the grant. The token becomes unspendable at that moment, which is the
+     * fail-closed direction: the human who amended the policy took the class out
+     * of agent hands, and an authorization minted under the older rules is not
+     * the exception to that.
+     */
+    "class-human-only",
+    /** The log could not be read, or holds a line that is not a record. */
+    "log-unreadable",
+    /** The log's final line is unterminated (a crashed write). */
+    "log-torn-tail",
+    /** The chain does not verify; nothing may be spent from an untrustworthy log. */
+    "log-corrupt",
+    /**
+     * The append itself failed; `append` carries the underlying error. Its `code`
+     * is `head-moved` when a record landed between this module's read and its
+     * append — the double-spend case, refused under `appendEvent`'s lock.
+     */
+    "append-failed",
+];
+function refuse(code, message, extra = {}) {
+    return { ok: false, code, message, ...extra };
+}
+/**
+ * Narrow a verified-read refusal onto this module's codes, unchanged.
+ *
+ * The three names are shared verbatim with `core/state.ts` (and with the gate
+ * and the executor) so the CLI maps all of them onto the frozen exit table with
+ * one function.
+ */
+function fromReadRefusal(refusal) {
+    return refuse(refusal.code, refusal.message);
+}
+function payloadOf(record) {
+    const payload = record.payload;
+    return typeof payload === "object" && payload !== null ? payload : {};
+}
+/**
+ * Is there a live, unspent token for `actionKey` — and what is its digest?
+ *
+ * Pure: no I/O, no clock. `now` is the moment the question is asked; `ttlMs` is
+ * `defaults.approval_ttl` as the policy loader parsed it, or `null` for a policy
+ * that declares no lapse (in which case a granted token stays spendable until it
+ * is used or revoked, exactly as an undecided request stays live).
+ *
+ * Check order, and why:
+ *
+ * 1. **Revoked**, then **expired-by-derivation**, then **anything not granted**.
+ *    A withdrawn authorization and a lapsed one are different facts and get
+ *    different codes; everything else — never requested, still awaiting,
+ *    rejected — is `not-granted`, because from a token's point of view they are
+ *    the same absence.
+ * 2. **The parent TTL, re-applied to the grant.** See the module header.
+ * 3. **The recorded digest.** A grant with no usable `token_sha256` is a grant
+ *    minted before this module existed (or by something else); it cannot
+ *    authenticate anything, so it fails closed as `token-mismatch`.
+ * 4. **Consumption.** Any `execution.started` for this action key spends it —
+ *    matching digest or not. The narrow rule (same digest) is what makes
+ *    double-spend detection chain-native; the broader rule (same action key)
+ *    enforces SPEC.md §7's single-use idempotency key even against a start event
+ *    that named no token, and both answer `token-consumed`.
+ */
+export function tokenStatus(records, actionKey, now, ttlMs = null) {
+    const derivation = requestState(records, actionKey, now, ttlMs);
+    if (derivation.state === "revoked") {
+        return refuse("token-revoked", `action ${actionKey} was revoked at seq ${String(derivation.decisionSeq)}; a revoked grant's token is dead`, {
+            state: derivation.state,
+            ...(derivation.decisionSeq === null ? {} : { seq: derivation.decisionSeq }),
+        });
+    }
+    if (derivation.state === "expired") {
+        return refuse("token-expired", `action ${actionKey} expired: the request at ${String(derivation.requestTs)} lapsed before ${now}, so no token governs it`, { state: derivation.state });
+    }
+    if (derivation.state !== "granted") {
+        return refuse("not-granted", `action ${actionKey} is ${derivation.state === "none" ? "not requested" : derivation.state}; a token exists only for a granted action`, { state: derivation.state });
+    }
+    // The parent request's TTL bounds the token even though the request itself is
+    // decided. No separate token TTL exists; this is that one clock, re-read.
+    if (ttlMs !== null) {
+        const requestedAt = Date.parse(derivation.requestTs ?? "");
+        const asked = Date.parse(now);
+        if (Number.isNaN(requestedAt) || Number.isNaN(asked) || asked > requestedAt + ttlMs) {
+            return refuse("token-expired", `action ${actionKey}'s token expired: the request at ${String(derivation.requestTs)} lapsed its ${String(ttlMs)}ms TTL before ${now}. There is no separate token TTL — a token lives exactly as long as its parent request.`, { state: derivation.state });
+        }
+    }
+    let grant = null;
+    const started = [];
+    for (const record of records) {
+        if (record.action_key !== actionKey)
+            continue;
+        if (record.event === "approval.granted")
+            grant = record;
+        if (record.event === "execution.started")
+            started.push(record);
+    }
+    if (grant === null) {
+        // Unreachable through `requestState`, which only reports `granted` when it
+        // saw the record. Kept as a fail-closed backstop rather than a `!`.
+        return refuse("not-granted", `action ${actionKey} derives as granted but carries no approval.granted record`, { state: derivation.state });
+    }
+    // APRV-106. Checked BEFORE the digest check, because "no digest was minted,
+    // on purpose, and the record says so" and "no digest is usable" are different
+    // facts with different repairs. A harness-executed grant is a complete grant:
+    // the human decided, and the decision was a permission answer to a process
+    // that runs the command itself. There is no key because there was never a
+    // door for one. Telling an agent `token-mismatch` here would send it hunting
+    // for a token that was deliberately never created.
+    if (payloadOf(grant)["execution"] === "harness") {
+        return refuse("harness-executed", `action ${actionKey} was granted at seq ${grant.seq} as a harness-executed request: no execution token was minted, because the requesting process runs the command itself and never spends one. There is nothing to present to \`approval run\` or \`approval consume\`. The grant is complete and the authorization it records is the harness's permission to proceed.`, { state: derivation.state, seq: grant.seq });
+    }
+    const recorded = payloadOf(grant)[TOKEN_HASH_FIELD];
+    if (typeof recorded !== "string" || !/^[a-f0-9]{64}$/u.test(recorded)) {
+        return refuse("token-mismatch", `the approval.granted record for ${actionKey} at seq ${grant.seq} carries no usable ${TOKEN_HASH_FIELD}; nothing can be proven against it and it authorizes no execution`, { state: derivation.state, seq: grant.seq });
+    }
+    for (const record of started) {
+        const presented = payloadOf(record)[TOKEN_HASH_FIELD];
+        const sameToken = typeof presented === "string" && digestsEqual(presented, recorded);
+        if (sameToken || record.seq > grant.seq) {
+            return refuse("token-consumed", `action ${actionKey} already executed: execution.started at seq ${record.seq} spent this token. A token is single-use and the log is the proof.`, { state: derivation.state, seq: record.seq });
+        }
+    }
+    const payload = payloadOf(grant);
+    const cls = payload["class"];
+    const cost = payload["est_cost_usd"];
+    const bytes = payload[PAYLOAD_HASH_FIELD];
+    return {
+        ok: true,
+        actionKey,
+        task: derivation.task,
+        grantSeq: grant.seq,
+        tokenSha256: recorded,
+        class: typeof cls === "string" ? cls : derivation.declared.class ?? "",
+        est_cost_usd: usdOrZero(cost),
+        payloadHash: isPayloadHash(bytes) ? bytes : derivation.declared.payload_hash,
+        requestTs: derivation.requestTs,
+    };
+}
+// ---------------------------------------------------------------------------
+// Sealed delivery (amended SPEC.md §10.4 — APRV-105)
+// ---------------------------------------------------------------------------
+/**
+ * The raw token for `actionKey`, recovered from the log's `token_sealed` with
+ * the private key this machine holds — or `null`.
+ *
+ * `null` means "no token was delivered here", and it means it for every reason
+ * at once: the policy is `manual` and nothing was sealed, this is a different
+ * machine from the one that requested, the key file has already been unlinked
+ * because the token was spent, or the ciphertext does not authenticate. The
+ * caller's response is identical in all four cases — fall back to the raw token
+ * the granting surface printed — and distinguishing them would be an oracle for
+ * a decryption capability nobody should be probing.
+ *
+ * Recovering a minted token is not minting one. The token still exists only
+ * because a human granted it, still binds to the payload, and is still spendable
+ * exactly once; what this function replaces is the human carrying it in a
+ * clipboard. Nothing here consults, relaxes, or substitutes for
+ * {@link verifyToken}: the value returned goes on to be verified against the
+ * log's digest like any pasted one.
+ *
+ * Pure with respect to the LOG (it appends nothing) and reads exactly one file.
+ * Never throws.
+ */
+export function deliveredToken(records, actionKey, keyDir) {
+    let grant = null;
+    for (const record of records) {
+        if (record.event === "approval.granted" && record.action_key === actionKey)
+            grant = record;
+    }
+    if (grant === null)
+        return null;
+    const sealed = asSealedToken(payloadOf(grant)[SEALED_TOKEN_FIELD]);
+    if (sealed === null)
+        return null;
+    const privateKey = readPrivateKey(keyDir, actionKey);
+    if (privateKey === null)
+        return null;
+    return openSealedToken(sealed, privateKey, actionKey);
+}
+// ---------------------------------------------------------------------------
+// verify
+// ---------------------------------------------------------------------------
+/**
+ * Does `presentedToken` authorize `actionKey` right now?
+ *
+ * Accepts **iff** all five hold: the latest cycle for the key derives as
+ * `granted`; the parent request's TTL has not lapsed; the grant has not been
+ * revoked; no `execution.started` has spent it; and `sha256(presentedToken)`
+ * equals the digest recorded on the grant, compared in constant time.
+ *
+ * `ttlMs` is the parsed `defaults.approval_ttl`. It is a parameter rather than a
+ * policy read because this function is pure — {@link consumeToken} and the CLI
+ * load the policy and hand it in, so a verification can be replayed from the log
+ * plus the policy that was in force.
+ */
+export function verifyToken(records, actionKey, presentedToken, now, ttlMs = null) {
+    const status = tokenStatus(records, actionKey, now, ttlMs);
+    if (!status.ok)
+        return status;
+    if (!digestsEqual(tokenHash(presentedToken), status.tokenSha256)) {
+        return refuse("token-mismatch", `the token presented for ${actionKey} is not the one minted at seq ${status.grantSeq}. The raw token is printed once, by \`approval grant\`, and is stored nowhere — if it was lost, revoke the grant and request again.`, { state: "granted", seq: status.grantSeq });
+    }
+    return status;
+}
+function loadOptionsOf(options) {
+    const load = {};
+    if (options.policyFile !== undefined)
+        load.file = options.policyFile;
+    else
+        load.dir = options.policyDir ?? process.cwd();
+    if (options.schemaDir !== undefined)
+        load.schemaDir = options.schemaDir;
+    return load;
+}
+/** The parsed TTL, or `null` when the policy declares (or can declare) none. */
+export function tokenTtlMs(options) {
+    const load = loadPolicy(loadOptionsOf(options));
+    return load.ok ? load.durations.approvalTtlMs : null;
+}
+/** The policy this module reads, loaded once per operation. */
+export function tokenPolicy(options) {
+    return loadPolicy(loadOptionsOf(options));
+}
+/**
+ * Is `actionClass` reserved to human hands under `load` (APRV-185)?
+ *
+ * Returns the refusal to emit, or `null`. Shared by {@link consumeToken} and by
+ * the `approval token` verb, which report the same fact about the same class
+ * and must not word it two ways.
+ *
+ * The §7 irreversibility floor is deliberately not consulted: it raises to
+ * `manual` at most and can neither produce `human-only` nor remove it, so the
+ * grant's declared `reversible` — which this module does not carry anyway —
+ * cannot change this answer.
+ */
+export function humanOnlyClassRefusal(load, actionClass, whatWasRefused) {
+    if (actionClass === null || actionClass.length === 0)
+        return null;
+    if (resolve(load, actionClass).autonomy !== "human-only")
+        return null;
+    return refuse("class-human-only", humanOnlyRefusal(actionClass, whatWasRefused));
+}
+export function verifyTokenSpend(records, actionKey, presentedToken, now, load, presentedPayloadHash) {
+    const verified = verifyToken(records, actionKey, presentedToken, now, load.ok ? load.durations.approvalTtlMs : null);
+    if (!verified.ok)
+        return verified;
+    const reserved = humanOnlyClassRefusal(load, verified.class, `the token for action ${actionKey}, granted at seq ${verified.grantSeq}, may not be spent and no execution.started was written`);
+    if (reserved !== null)
+        return reserved;
+    if (verified.payloadHash === null) {
+        return refuse("payload-mismatch", `the approval.granted record for ${actionKey} at seq ${verified.grantSeq} carries no payload_hash: it predates content binding, or was written by something other than this gate. Amended SPEC.md §6.2 makes the hash MUST for manual actions and §10 binds the token to it, so there is nothing here for an execution to be checked against and nothing that can be shown to be the approved bytes. This grant cannot be spent — revoke it and request the action again, which will bind to the payload.`, { state: "granted", seq: verified.grantSeq });
+    }
+    if (!isPayloadHash(presentedPayloadHash) || !digestsEqual(presentedPayloadHash, verified.payloadHash)) {
+        return refuse("payload-mismatch", presentedPayloadHash === undefined
+            ? `the grant for ${actionKey} at seq ${verified.grantSeq} binds to payload_hash ${verified.payloadHash} and this consumer presented none. Amended SPEC.md §10: an executor MUST recompute the hash of the payload it is about to execute; a spend that cannot state its bytes cannot be shown to be executing the approved ones.`
+            : `the payload presented for ${actionKey} is not the one approved: the grant at seq ${verified.grantSeq} binds to ${verified.payloadHash}, this consumer presented ${JSON.stringify(presentedPayloadHash)}. A grant approves specific bytes; changing the payload after grant requires a new request. Nothing was appended and the token is still live.`, { state: "granted", seq: verified.grantSeq });
+    }
+    if (verified.task === null) {
+        return refuse("not-granted", `action ${actionKey} has a grant but no task id in its request cycle; execution.started requires one`, { state: "granted", seq: verified.grantSeq });
+    }
+    return { ...verified, task: verified.task, payloadHash: verified.payloadHash };
+}
+/**
+ * Spend a token: verify it, then append `execution.started`.
+ *
+ * **This is the only sanctioned way to append `execution.started` for a manual
+ * action.** APRV-16 left that gap open deliberately — the gate appends no
+ * execution events — and this function closes it: on the manual path a start
+ * event now requires a live, verified, unspent token, so an agent cannot record
+ * an execution the human never authorized. Supervised and autonomous actions
+ * have no grant and therefore no token; their start event is APRV-18's `approval
+ * run` wrapper's job, and calling this for them correctly refuses `not-granted`.
+ *
+ * The payload is exactly `{class, est_cost_usd, token_sha256, payload_hash}`:
+ * the first two because `core/budgets.ts` meters authorization from them, the
+ * third because it is what makes the second consumption attempt refusable from
+ * the log alone, and the fourth because an auditor should be able to see from
+ * the log that what ran is what was approved. All four are copied from the
+ * grant, never re-derived. `payload_hash` is unconditional because a grant
+ * carrying none is refused (see below) rather than spent.
+ *
+ * Verification and append are made atomic by compare-and-append (APRV-20 finding
+ * B1): this function reads the log itself — never records handed in by a caller —
+ * and passes the head it read as `appendEvent`'s `expectedHead`. Two genuinely
+ * concurrent consumers of one token therefore cannot both start. Whichever takes
+ * the lockfile first appends `execution.started`; the loser finds the head moved
+ * under the lock and is refused `append-failed`/`head-moved` with nothing
+ * written. The loser is **not** retried here: re-reading would report
+ * `token-consumed`, but deciding to look again is the caller's call, and a core
+ * that silently retried would hide a double-spend attempt behind a tidy error.
+ *
+ * `actor` is not pre-validated: the event schema is the authority on actor
+ * shape, and a malformed one is refused at the write boundary as
+ * `append-failed`, with the schema's own error attached. One rule about actors,
+ * enforced in one place.
+ */
+export function consumeToken(logPath, actionKey, presentedToken, actor, options = {}) {
+    const ts = tick(options);
+    const read = readVerifiedRecords(logPath, options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir });
+    if (!read.ok)
+        return fromReadRefusal(read);
+    // One read of the policy for the whole spend: the TTL the verification
+    // applies and the class check below come from the same bytes.
+    const load = tokenPolicy(options);
+    const verified = verifyTokenSpend(read.records, actionKey, presentedToken, ts, load, options.presentedPayloadHash);
+    if (!verified.ok)
+        return verified;
+    const appended = appendEvent(logPath, {
+        ts,
+        event: "execution.started",
+        actor,
+        task: verified.task,
+        action_key: actionKey,
+        payload: {
+            class: verified.class,
+            est_cost_usd: verified.est_cost_usd,
+            [TOKEN_HASH_FIELD]: verified.tokenSha256,
+            // A1: the bytes that actually ran, recorded beside the token that
+            // authorized them, so an auditor reading the log alone can see that the
+            // execution and the approval named the same payload. Unconditional: a
+            // grant with no binding was refused above and never reaches this line.
+            [PAYLOAD_HASH_FIELD]: verified.payloadHash,
+            // APRV-205: how many credential-bearing variables the child was starved
+            // of. Optional and additive; an execution with no child records none,
+            // because "none withheld" and "no child" are different facts.
+            ...(options.envStripped === undefined ? {} : { env_stripped: options.envStripped }),
+            // APRV-193: which room the child ran in. Same additive shape, and the
+            // manual path's usual value is `granted-egress` — a human approved
+            // these exact bytes, and `approval run` on a grant is the one door to
+            // the world the design leaves open.
+            ...(options.sandbox === undefined ? {} : { sandbox: options.sandbox }),
+        },
+    }, {
+        ...options.append,
+        ...(options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir }),
+        // Compare-and-append (APRV-20 finding B1): the verification above was made
+        // against the log ending at this head. If anything landed since — another
+        // consumer spending the same token, most of all — the append is refused
+        // `head-moved` under the lock and this token is not spent twice.
+        expectedHead: read.head,
+    });
+    if (!appended.ok) {
+        return refuse("append-failed", `execution.started could not be appended: ${appended.error.message}`, { append: appended.error });
+    }
+    return {
+        ok: true,
+        record: appended.record,
+        tokenSha256: verified.tokenSha256,
+        grantSeq: verified.grantSeq,
+    };
+}
+//# sourceMappingURL=token.js.map

package/dist/src/core/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/core/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,WAAW,GAIZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,YAAY,GAGb,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,gFAAgF;IAChF,aAAa;IACb,mEAAmE;IACnE,gBAAgB;IAChB,+EAA+E;IAC/E,gBAAgB;IAChB,uEAAuE;IACvE,eAAe;IACf,uDAAuD;IACvD,eAAe;IACf;;;;;;;;;;OAUG;IACH,kBAAkB;IAClB;;;;;;;;OAQG;IACH,kBAAkB;CACV,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,0BAA0B;IAC7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,kBAAkB;IAClB,uEAAuE;IACvE,gBAAgB;IAChB,8DAA8D;IAC9D,eAAe;IACf,iFAAiF;IACjF,aAAa;IACb;;;;OAIG;IACH,eAAe;CACP,CAAC;AAiBX,SAAS,MAAM,CACb,IAAsB,EACtB,OAAe,EACf,KAAK,GAAkD,EAAE;IAEzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAuB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AA2CD,SAAS,SAAS,CAAC,MAAmB;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAEhE,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,uBAAuB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,mCAAmC,EAC3G;YACE,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SAC5E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,4BAA4B,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,GAAG,0BAA0B,EAC1H,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,OAAO,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,4CAA4C,EACtI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,WAAW,GAAG,KAAK,EAAE,CAAC;YACpF,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,oCAAoC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,yFAAyF,EAC5N,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB;YAAE,KAAK,GAAG,MAAM,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,4DAA4D,EAC/E,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CACX,kBAAkB,EAClB,UAAU,SAAS,uBAAuB,KAAK,CAAC,GAAG,qTAAqT,EACxW,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CACX,gBAAgB,EAChB,mCAAmC,SAAS,WAAW,KAAK,CAAC,GAAG,sBAAsB,gBAAgB,mEAAmE,EACzK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxC,OAAO,MAAM,CACX,gBAAgB,EAChB,UAAU,SAAS,+CAA+C,MAAM,CAAC,GAAG,oEAAoE,EAChJ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;QACtE,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC;QAC7B,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY;QAC5E,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,SAAiB,EACjB,MAAc;IAEd,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,KAAK,GAAG,MAAM,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CACX,gBAAgB,EAChB,2BAA2B,SAAS,iCAAiC,MAAM,CAAC,QAAQ,qIAAqI,EACzN,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAiED,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;;QAChE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,WAA0B,EAC1B,cAAsB;IAEtB,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACnF,CAAC;AAWD,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,GAAW,EACX,IAAsB,EACtB,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP,SAAS,EACT,cAAc,EACd,GAAG,EACH,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,IAAI,EACJ,QAAQ,CAAC,KAAK,EACd,wBAAwB,SAAS,oBAAoB,QAAQ,CAAC,QAAQ,yDAAyD,CAChI,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvC,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CACX,kBAAkB,EAClB,mCAAmC,SAAS,WAAW,QAAQ,CAAC,QAAQ,kaAAka,EAC1e,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtG,OAAO,MAAM,CACX,kBAAkB,EAClB,oBAAoB,KAAK,SAAS;YAChC,CAAC,CAAC,iBAAiB,SAAS,WAAW,QAAQ,CAAC,QAAQ,0BAA0B,QAAQ,CAAC,WAAW,2NAA2N;YACjU,CAAC,CAAC,6BAA6B,SAAS,8CAA8C,QAAQ,CAAC,QAAQ,aAAa,QAAQ,CAAC,WAAW,6BAA6B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,+IAA+I,EAC1V,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,kFAAkF,EACrG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,cAAsB,EACtB,KAAa,EACb,OAAO,GAAiB,EAAE;IAE1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,cAAc,EACd,EAAE,EACF,IAAI,EACJ,OAAO,CAAC,oBAAoB,CAC7B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP;QACE,EAAE;QACF,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,WAAW;YACxC,kEAAkE;YAClE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,WAAW;YAC1C,wEAAwE;YACxE,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACnF,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SACvE;KACF,EACD;QACE,GAAG,OAAO,CAAC,MAAM;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,iEAAiE;QACjE,YAAY,EAAE,IAAI,CAAC,IAAI;KACxB,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,eAAe,EACf,4CAA4C,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC"}