approval-md 0.1.0 → 0.2.0

package/dist/src/core/token.d.ts

@@ -0,0 +1,409 @@
+/**
+ * Execution tokens (SPEC.md §10.4, §11) — the hard-enforcement primitive.
+ *
+ * An adapter holds credentials and "MUST require a valid, unexpired, single-use
+ * execution token bound to the action's `idempotency_key`" (SPEC.md §10.4).
+ * This module mints those tokens, decides whether a presented one is still good,
+ * and spends it. Everything it knows it derives from the append-only log.
+ *
+ * ## The five settled properties (human decision, 2026-08-06)
+ *
+ * 1. **Minted at grant.** There is exactly one mint site: the grant path of
+ *    `core/gate.ts`'s {@link import("./gate.js").decide}. No other code path
+ *    creates a token, so a token's existence *is* a human's yes.
+ * 2. **Single-use.** Consumption is an `execution.started` event, so the second
+ *    attempt is refused by reading the log rather than by remembering anything.
+ *    Double-spend detection is chain-native: it survives a process restart, a
+ *    different machine, and a lost in-memory cache, because the evidence is the
+ *    log itself.
+ * 3. **Bound to the request, its `idempotency_key`, and its `payload_hash`**
+ *    (amended SPEC.md §10, A1). A token is looked up by `action_key` — the
+ *    envelope's `idempotency_key` — and is compared against the hash on *that*
+ *    action's grant. A token minted for action A therefore cannot be presented
+ *    for action B: B's grant carries a different hash (or no grant at all), and
+ *    the comparison fails. The third binding is to the bytes: a consumer states
+ *    the hash of the payload it is about to execute, and anything but the hash
+ *    the grant recorded is refused `payload-mismatch`. A grant approves specific
+ *    bytes; changing them after grant requires a new request. A grant that
+ *    recorded *no* bytes is refused too — see {@link consumeToken}.
+ * 4. **Hash-only in the log.** `approval.granted` carries
+ *    `payload.token_sha256`; the raw token is returned to the caller of `decide`
+ *    and to nothing else. Possession is proven by presenting a preimage. An
+ *    attacker with a copy of the log — the one artifact this system deliberately
+ *    makes durable, copyable, and auditable — gains no ability to execute.
+ * 5. **No separate token TTL in v0.1.** A token dies exactly three ways:
+ *    execution ({@link consumeToken}), revocation (`approval.revoked`), and the
+ *    lapse of the *parent request's* TTL (`defaults.approval_ttl`, measured from
+ *    the `approval.requested` timestamp). Inventing a second, independent clock
+ *    would create a state where a request is live and its token is not, which no
+ *    operator could explain from the log.
+ *
+ * ## Why the parent TTL bounds a *granted* request
+ *
+ * `requestState` deliberately stops applying the TTL once a decision lands: an
+ * answered request is answered. Token liveness is a stricter question than
+ * request state, and the settled design gives an approval a shelf life. So
+ * {@link tokenStatus} re-applies `requestTs + approval_ttl` to a *granted*
+ * request and refuses with `token-expired` past it. This never mutates the
+ * derived request state and never writes anything — an aged-out token is simply
+ * not spendable, and re-requesting the action is the repair. (Contrast
+ * `core/gate.ts`, which materialises `approval.expired` when it discovers a
+ * lapse on an *undecided* request. That branch belongs to the gate and this
+ * module does not duplicate it: a granted request's `approval.expired` would
+ * claim the human never answered.)
+ *
+ * ## Where this module sits between APRV-16 and APRV-18
+ *
+ * `core/gate.ts` deliberately appends no `execution.*` event. {@link
+ * consumeToken} is the **only sanctioned appender of `execution.started` on the
+ * manual path**, and it appends one only after a live token verifies — closing
+ * the gap APRV-16 flagged, where a manual action's start event had no guard at
+ * all.
+ *
+ * The supervised/autonomous paths are **not** this function's business. Under
+ * the amended SPEC.md §6.3 they produce no approval events and therefore no
+ * token; their `execution.started` is appended by APRV-18's `approval run`
+ * wrapper, which is also where their budget is charged (see the consumption
+ * contract in `core/budgets.ts`). One rule, stated once: *manual actions spend a
+ * token here; non-manual actions start there.*
+ *
+ * ## The budgets contract
+ *
+ * The appended `execution.started` carries `payload.class` and
+ * `payload.est_cost_usd`, **copied from the grant's payload** rather than
+ * re-derived. `core/budgets.ts` counts an `execution.started` only when the
+ * window holds no `approval.granted` with the same `action_key`, so a manual
+ * action that is granted and then consumed is charged exactly once — the grant.
+ * Copying rather than re-deriving keeps the two records agreeing about what was
+ * authorized even if the task file changed in between.
+ *
+ * ## Time
+ *
+ * {@link tokenStatus} and {@link verifyToken} are pure and take `now` as a
+ * parameter: they answer a question and write nothing, so a caller asking "was
+ * this token live at time T?" is asking something legitimate. {@link
+ * consumeToken} *writes*, and `execution.started` is a gate-typed event, so
+ * amended SPEC.md §8 (A2) gives its timestamp to the runtime: no `ts`
+ * parameter, one read of {@link TokenOptions.clock} at the top, and a spender
+ * that cannot choose the moment its own TTL is judged at.
+ */
+import { type ClockOptions } from "./clock.js";
+import { type AppendError, type AppendOptions, type EventRecord } from "./log.js";
+import { type PolicyLoadResult } from "./policy-load.js";
+import type { SandboxState } from "./sandbox.js";
+import { type RequestState } from "./state.js";
+/** Token entropy. 32 bytes = 256 bits, rendered as 64 lowercase hex chars. */
+export declare const TOKEN_BYTES = 32;
+/** The payload key carrying the token's digest, on both grant and start. */
+export declare const TOKEN_HASH_FIELD = "token_sha256";
+/** The payload key carrying the content binding (amended SPEC.md §6.2, §10). */
+export declare const PAYLOAD_HASH_FIELD = "payload_hash";
+/**
+ * Mint a token: 32 cryptographically random bytes as lowercase hex.
+ *
+ * `randomBytes` (CSPRNG), never `Math.random`. The value is a bearer credential
+ * for a real-world side effect; 256 bits makes guessing irrelevant next to every
+ * other attack in SPEC.md §11's "not defended" list.
+ */
+export declare function mintToken(): string;
+/** The token's SHA-256, lowercase hex — the only form that ever reaches the log. */
+export declare function tokenHash(token: string): string;
+/**
+ * Constant-time comparison of two 64-hex digests.
+ *
+ * Both operands are digests, so a timing leak reveals a prefix of a *hash*, not
+ * of a token — but this CLI runs on a shared developer machine beside the very
+ * agents it polices, and an oracle that says "your first N hex digits were
+ * right" is the kind of affordance that should not exist at all. `timingSafeEqual`
+ * costs nothing here and removes the question.
+ *
+ * Digests are compared as decoded bytes: a malformed stored digest decodes to a
+ * different length, which `timingSafeEqual` rejects by throwing, so the length
+ * guard comes first and a malformed digest simply fails to match.
+ */
+export declare function digestsEqual(a: string, b: string): boolean;
+/**
+ * The token refusals proper — the closed set an agent branches on to learn *why*
+ * a token will not execute. Frozen public API, in the same sense the gate's
+ * codes and the exit codes are.
+ *
+ * The four death conditions are distinguishable on purpose: "you presented the
+ * wrong string", "this token was already spent", "a human took it back", and
+ * "it aged out" call for four different responses (fix the caller, stop
+ * retrying, escalate to the human, re-request).
+ */
+export declare const TOKEN_VERIFY_REFUSAL_CODES: readonly [
+/** No grant governs this action key: never requested, awaiting, or rejected. */
+"not-granted", 
+/** A grant exists, but the presented token is not its preimage. */
+"token-mismatch", 
+/** The token was already spent: an `execution.started` exists for this key. */
+"token-consumed", 
+/** The parent request's TTL lapsed. There is no separate token TTL. */
+"token-expired", 
+/** A human withdrew the grant (`approval.revoked`). */
+"token-revoked", 
+/**
+ * The bytes do not match (amended SPEC.md §10, A1). The grant recorded a
+ * `payload_hash` and the consumer presented a different one — or none at all,
+ * which is the same fact stated by omission: an executor that cannot say what
+ * it is about to run has not shown that it is running what was approved.
+ *
+ * Distinct from `token-mismatch` on purpose. That one says "you are not the
+ * party who was approved"; this one says "you are, but that is not what was
+ * approved", and the repair is different: request the new payload rather than
+ * hunt for a lost token.
+ */
+"payload-mismatch", 
+/**
+ * The grant was for a harness-executed request and minted no token
+ * (APRV-106). Nothing is wrong: the requesting process runs the command
+ * itself and never had a token to spend, so there is nothing to present here
+ * and nothing to recover. Distinct from `token-mismatch`, which says a
+ * digest exists and does not match, and from `not-granted`, which says no
+ * authorization exists at all — this one says the authorization exists, is
+ * complete, and is not the kind that is spent.
+ */
+"harness-executed"];
+export type TokenVerifyRefusalCode = (typeof TOKEN_VERIFY_REFUSAL_CODES)[number];
+/**
+ * Everything {@link consumeToken} can refuse: the verification codes plus the
+ * three log/append failures, whose names and meanings are borrowed verbatim from
+ * `core/gate.ts` so the CLI can map them onto the frozen exit table identically.
+ */
+export declare const TOKEN_REFUSAL_CODES: readonly ["not-granted", "token-mismatch", "token-consumed", "token-expired", "token-revoked", "payload-mismatch", "harness-executed", "class-human-only", "log-unreadable", "log-torn-tail", "log-corrupt", "append-failed"];
+export type TokenRefusalCode = (typeof TOKEN_REFUSAL_CODES)[number];
+/** Every token failure is one of these. Nothing here throws. */
+export interface TokenRefusal {
+    ok: false;
+    code: TokenRefusalCode;
+    message: string;
+    /** The derived request state at refusal time, when one could be derived. */
+    state?: RequestState;
+    /** The seq of the record that produced the refusal (grant, start, revoke). */
+    seq?: number;
+    /** The underlying append error, when `code` is `append-failed`. */
+    append?: AppendError;
+}
+/** A live, unspent grant and everything a consumer needs to spend it. */
+export interface TokenStatus {
+    ok: true;
+    actionKey: string;
+    /** The task id the grant names; `execution.started` requires it. */
+    task: string | null;
+    /** The `approval.granted` record's seq — the mint site, for audit. */
+    grantSeq: number;
+    /** The digest recorded at mint. The raw token is not stored anywhere. */
+    tokenSha256: string;
+    /** Copied from the grant payload, per the budgets consumption contract. */
+    class: string;
+    /**
+     * Canonical decimal USD string (APRV-121), copied from the grant and written
+     * verbatim onto `execution.started`. The value is hashed material at both
+     * ends, so it is carried as the string the grant recorded rather than parsed
+     * into a number and reserialized.
+     */
+    est_cost_usd: string;
+    /**
+     * The bytes this grant approved (amended SPEC.md §10), or `null` for a grant
+     * that recorded none. Unreachable through the gate for a manual action —
+     * `request` refuses `payload-hash-required` — so `null` here means a log
+     * written by something other than this runtime, or one predating A1.
+     *
+     * `null` does not mean "unbound and therefore free": {@link consumeToken}
+     * refuses such a grant `payload-mismatch` and it can never be spent. This
+     * field is `string | null` so a *reader* (`approval token`, a channel) can
+     * report the fact; it is never a permission.
+     */
+    payloadHash: string | null;
+    /** The `approval.requested` timestamp the TTL is measured from. */
+    requestTs: string | null;
+}
+export type TokenStatusResult = TokenStatus | TokenRefusal;
+/**
+ * Is there a live, unspent token for `actionKey` — and what is its digest?
+ *
+ * Pure: no I/O, no clock. `now` is the moment the question is asked; `ttlMs` is
+ * `defaults.approval_ttl` as the policy loader parsed it, or `null` for a policy
+ * that declares no lapse (in which case a granted token stays spendable until it
+ * is used or revoked, exactly as an undecided request stays live).
+ *
+ * Check order, and why:
+ *
+ * 1. **Revoked**, then **expired-by-derivation**, then **anything not granted**.
+ *    A withdrawn authorization and a lapsed one are different facts and get
+ *    different codes; everything else — never requested, still awaiting,
+ *    rejected — is `not-granted`, because from a token's point of view they are
+ *    the same absence.
+ * 2. **The parent TTL, re-applied to the grant.** See the module header.
+ * 3. **The recorded digest.** A grant with no usable `token_sha256` is a grant
+ *    minted before this module existed (or by something else); it cannot
+ *    authenticate anything, so it fails closed as `token-mismatch`.
+ * 4. **Consumption.** Any `execution.started` for this action key spends it —
+ *    matching digest or not. The narrow rule (same digest) is what makes
+ *    double-spend detection chain-native; the broader rule (same action key)
+ *    enforces SPEC.md §7's single-use idempotency key even against a start event
+ *    that named no token, and both answer `token-consumed`.
+ */
+export declare function tokenStatus(records: EventRecord[], actionKey: string, now: string, ttlMs?: number | null): TokenStatusResult;
+/**
+ * The raw token for `actionKey`, recovered from the log's `token_sealed` with
+ * the private key this machine holds — or `null`.
+ *
+ * `null` means "no token was delivered here", and it means it for every reason
+ * at once: the policy is `manual` and nothing was sealed, this is a different
+ * machine from the one that requested, the key file has already been unlinked
+ * because the token was spent, or the ciphertext does not authenticate. The
+ * caller's response is identical in all four cases — fall back to the raw token
+ * the granting surface printed — and distinguishing them would be an oracle for
+ * a decryption capability nobody should be probing.
+ *
+ * Recovering a minted token is not minting one. The token still exists only
+ * because a human granted it, still binds to the payload, and is still spendable
+ * exactly once; what this function replaces is the human carrying it in a
+ * clipboard. Nothing here consults, relaxes, or substitutes for
+ * {@link verifyToken}: the value returned goes on to be verified against the
+ * log's digest like any pasted one.
+ *
+ * Pure with respect to the LOG (it appends nothing) and reads exactly one file.
+ * Never throws.
+ */
+export declare function deliveredToken(records: readonly EventRecord[], actionKey: string, keyDir: string): string | null;
+/**
+ * Does `presentedToken` authorize `actionKey` right now?
+ *
+ * Accepts **iff** all five hold: the latest cycle for the key derives as
+ * `granted`; the parent request's TTL has not lapsed; the grant has not been
+ * revoked; no `execution.started` has spent it; and `sha256(presentedToken)`
+ * equals the digest recorded on the grant, compared in constant time.
+ *
+ * `ttlMs` is the parsed `defaults.approval_ttl`. It is a parameter rather than a
+ * policy read because this function is pure — {@link consumeToken} and the CLI
+ * load the policy and hand it in, so a verification can be replayed from the log
+ * plus the policy that was in force.
+ */
+export declare function verifyToken(records: EventRecord[], actionKey: string, presentedToken: string, now: string, ttlMs?: number | null): TokenStatusResult;
+/**
+ * Where to find the policy whose `approval_ttl` bounds the token — plus the two
+ * things a spend now carries that a status read does not.
+ *
+ * `ts` is not among them, and no longer a parameter of {@link consumeToken}:
+ * `execution.started` is a gate-typed event, so amended SPEC.md §8 gives its
+ * timestamp to the runtime at the write boundary ({@link ClockOptions}).
+ */
+export interface TokenOptions extends ClockOptions {
+    /** Schema directory, passed to the append's write-boundary validation. */
+    schemaDir?: string;
+    /** Directory to discover `APPROVAL.md` in. Ignored when `policyFile` is set. */
+    policyDir?: string;
+    /** An explicit policy file, overriding discovery. */
+    policyFile?: string;
+    /** Lock tuning for the append path. */
+    append?: AppendOptions;
+    /**
+     * The hash of the payload the caller is **about to execute** (amended
+     * SPEC.md §10, A1).
+     *
+     * "Adapters and `approval run` MUST recompute the hash of the payload they
+     * are about to execute and MUST refuse, with a distinct machine-readable
+     * reason (`payload-mismatch`), when it differs from the hash the grant
+     * recorded." That is this field: it is not read from the log, because a value
+     * read from the log would prove nothing — the point is that the executor
+     * states, independently, what it holds, and the runtime compares.
+     *
+     * REQUIRED for every spend. Under A1 every manual grant this runtime mints
+     * records a `payload_hash`, and a grant that somehow records none is refused
+     * outright rather than treated as unbound — so there is no case in which
+     * omitting this field succeeds. Omitting it is a mismatch.
+     */
+    presentedPayloadHash?: string;
+    /**
+     * How many credential-bearing variables the executor withheld from the child
+     * it is about to spawn (APRV-205), recorded on the `execution.started` this
+     * spend appends.
+     *
+     * The manual path's copy of `ExecuteOptions.envStripped`, and it exists
+     * because the manual path's `execution.started` is written HERE rather than
+     * in `core/execute.ts`. A count recorded on one of the two start events and
+     * not the other would be a field an auditor could not rely on. A count, never
+     * a name and never a value.
+     */
+    envStripped?: number;
+    /**
+     * The room the child ran in (APRV-193), recorded on the `execution.started`
+     * this spend appends. The manual path's copy of `ExecuteOptions.sandbox`, for
+     * the same reason the count above is: a field recorded on one of the two
+     * start events and not the other is a field an auditor cannot rely on.
+     */
+    sandbox?: SandboxState;
+}
+export type ConsumeResult = {
+    ok: true;
+    record: EventRecord;
+    tokenSha256: string;
+    grantSeq: number;
+} | TokenRefusal;
+/** The parsed TTL, or `null` when the policy declares (or can declare) none. */
+export declare function tokenTtlMs(options: TokenOptions): number | null;
+/** The policy this module reads, loaded once per operation. */
+export declare function tokenPolicy(options: TokenOptions): PolicyLoadResult;
+/**
+ * Is `actionClass` reserved to human hands under `load` (APRV-185)?
+ *
+ * Returns the refusal to emit, or `null`. Shared by {@link consumeToken} and by
+ * the `approval token` verb, which report the same fact about the same class
+ * and must not word it two ways.
+ *
+ * The §7 irreversibility floor is deliberately not consulted: it raises to
+ * `manual` at most and can neither produce `human-only` nor remove it, so the
+ * grant's declared `reversible` — which this module does not carry anyway —
+ * cannot change this answer.
+ */
+export declare function humanOnlyClassRefusal(load: PolicyLoadResult, actionClass: string | null, whatWasRefused: string): TokenRefusal | null;
+/**
+ * Verify every read-only condition of a token spend.
+ *
+ * Shared by {@link consumeToken} and adapter execution preflight. It appends
+ * nothing and grants no authority to act; `consumeToken` re-reads and repeats
+ * this check immediately before its compare-and-append.
+ */
+export type TokenSpendStatus = TokenStatus & {
+    task: string;
+    payloadHash: string;
+};
+export declare function verifyTokenSpend(records: EventRecord[], actionKey: string, presentedToken: string, now: string, load: PolicyLoadResult, presentedPayloadHash?: string): TokenSpendStatus | TokenRefusal;
+/**
+ * Spend a token: verify it, then append `execution.started`.
+ *
+ * **This is the only sanctioned way to append `execution.started` for a manual
+ * action.** APRV-16 left that gap open deliberately — the gate appends no
+ * execution events — and this function closes it: on the manual path a start
+ * event now requires a live, verified, unspent token, so an agent cannot record
+ * an execution the human never authorized. Supervised and autonomous actions
+ * have no grant and therefore no token; their start event is APRV-18's `approval
+ * run` wrapper's job, and calling this for them correctly refuses `not-granted`.
+ *
+ * The payload is exactly `{class, est_cost_usd, token_sha256, payload_hash}`:
+ * the first two because `core/budgets.ts` meters authorization from them, the
+ * third because it is what makes the second consumption attempt refusable from
+ * the log alone, and the fourth because an auditor should be able to see from
+ * the log that what ran is what was approved. All four are copied from the
+ * grant, never re-derived. `payload_hash` is unconditional because a grant
+ * carrying none is refused (see below) rather than spent.
+ *
+ * Verification and append are made atomic by compare-and-append (APRV-20 finding
+ * B1): this function reads the log itself — never records handed in by a caller —
+ * and passes the head it read as `appendEvent`'s `expectedHead`. Two genuinely
+ * concurrent consumers of one token therefore cannot both start. Whichever takes
+ * the lockfile first appends `execution.started`; the loser finds the head moved
+ * under the lock and is refused `append-failed`/`head-moved` with nothing
+ * written. The loser is **not** retried here: re-reading would report
+ * `token-consumed`, but deciding to look again is the caller's call, and a core
+ * that silently retried would hide a double-spend attempt behind a tidy error.
+ *
+ * `actor` is not pre-validated: the event schema is the authority on actor
+ * shape, and a malformed one is refused at the write boundary as
+ * `append-failed`, with the schema's own error attached. One rule about actors,
+ * enforced in one place.
+ */
+export declare function consumeToken(logPath: string, actionKey: string, presentedToken: string, actor: string, options?: TokenOptions): ConsumeResult;

package/dist/src/core/token.js

@@ -449,6 +449,26 @@ export function humanOnlyClassRefusal(load, actionClass, whatWasRefused) {
         return null;
     return refuse("class-human-only", humanOnlyRefusal(actionClass, whatWasRefused));
 }
+export function verifyTokenSpend(records, actionKey, presentedToken, now, load, presentedPayloadHash) {
+    const verified = verifyToken(records, actionKey, presentedToken, now, load.ok ? load.durations.approvalTtlMs : null);
+    if (!verified.ok)
+        return verified;
+    const reserved = humanOnlyClassRefusal(load, verified.class, `the token for action ${actionKey}, granted at seq ${verified.grantSeq}, may not be spent and no execution.started was written`);
+    if (reserved !== null)
+        return reserved;
+    if (verified.payloadHash === null) {
+        return refuse("payload-mismatch", `the approval.granted record for ${actionKey} at seq ${verified.grantSeq} carries no payload_hash: it predates content binding, or was written by something other than this gate. Amended SPEC.md §6.2 makes the hash MUST for manual actions and §10 binds the token to it, so there is nothing here for an execution to be checked against and nothing that can be shown to be the approved bytes. This grant cannot be spent — revoke it and request the action again, which will bind to the payload.`, { state: "granted", seq: verified.grantSeq });
+    }
+    if (!isPayloadHash(presentedPayloadHash) || !digestsEqual(presentedPayloadHash, verified.payloadHash)) {
+        return refuse("payload-mismatch", presentedPayloadHash === undefined
+            ? `the grant for ${actionKey} at seq ${verified.grantSeq} binds to payload_hash ${verified.payloadHash} and this consumer presented none. Amended SPEC.md §10: an executor MUST recompute the hash of the payload it is about to execute; a spend that cannot state its bytes cannot be shown to be executing the approved ones.`
+            : `the payload presented for ${actionKey} is not the one approved: the grant at seq ${verified.grantSeq} binds to ${verified.payloadHash}, this consumer presented ${JSON.stringify(presentedPayloadHash)}. A grant approves specific bytes; changing the payload after grant requires a new request. Nothing was appended and the token is still live.`, { state: "granted", seq: verified.grantSeq });
+    }
+    if (verified.task === null) {
+        return refuse("not-granted", `action ${actionKey} has a grant but no task id in its request cycle; execution.started requires one`, { state: "granted", seq: verified.grantSeq });
+    }
+    return { ...verified, task: verified.task, payloadHash: verified.payloadHash };
+}
 /**
  * Spend a token: verify it, then append `execution.started`.
  *
@@ -491,46 +511,9 @@ export function consumeToken(logPath, actionKey, presentedToken, actor, options
     // One read of the policy for the whole spend: the TTL the verification
     // applies and the class check below come from the same bytes.
     const load = tokenPolicy(options);
-    const verified = verifyToken(read.records, actionKey, presentedToken, ts, load.ok ? load.durations.approvalTtlMs : null);
+    const verified = verifyTokenSpend(read.records, actionKey, presentedToken, ts, load, options.presentedPayloadHash);
     if (!verified.ok)
         return verified;
-    // APRV-185, amended SPEC.md §5.2. The grant exists and the token is the right
-    // one; the class it authorizes is one the policy now reserves to human hands,
-    // so it may not be spent. Checked immediately after verification and before
-    // the binding, because a token that cannot be spent at all should not send its
-    // holder off to reconcile payload hashes. Nothing is appended.
-    const reserved = humanOnlyClassRefusal(load, verified.class, `the token for action ${actionKey}, granted at seq ${verified.grantSeq}, may not be spent and no execution.started was written`);
-    if (reserved !== null)
-        return reserved;
-    // Content binding (amended SPEC.md §10, A1). A grant approves specific bytes,
-    // so the executor must say which bytes it holds and they must be the ones the
-    // human saw. Checked before the append and after token verification: a
-    // mismatch spends nothing, appends nothing, and leaves the token live — the
-    // repair is to request the new payload, not to hunt for the token.
-    //
-    // A grant that recorded NO binding is refused outright, not waved through.
-    // The current gate cannot produce one — `request` refuses
-    // `payload-hash-required` for every manual action — so such a record reached
-    // the log some other way: a hand-built line, or a log predating A1. Accepting
-    // it would make content binding bypassable by log construction, which is the
-    // one attack the binding exists to stop. Ambiguity resolves to the stricter
-    // path: the grant is permanently unspendable, and that is correct for an
-    // authorization this runtime could not have issued.
-    const presented = options.presentedPayloadHash;
-    if (verified.payloadHash === null) {
-        return refuse("payload-mismatch", `the approval.granted record for ${actionKey} at seq ${verified.grantSeq} carries no payload_hash: it predates content binding, or was written by something other than this gate. Amended SPEC.md §6.2 makes the hash MUST for manual actions and §10 binds the token to it, so there is nothing here for an execution to be checked against and nothing that can be shown to be the approved bytes. This grant cannot be spent — revoke it and request the action again, which will bind to the payload.`, { state: "granted", seq: verified.grantSeq });
-    }
-    if (!isPayloadHash(presented) || !digestsEqual(presented, verified.payloadHash)) {
-        return refuse("payload-mismatch", presented === undefined
-            ? `the grant for ${actionKey} at seq ${verified.grantSeq} binds to payload_hash ${verified.payloadHash} and this consumer presented none. Amended SPEC.md §10: an executor MUST recompute the hash of the payload it is about to execute; a spend that cannot state its bytes cannot be shown to be executing the approved ones.`
-            : `the payload presented for ${actionKey} is not the one approved: the grant at seq ${verified.grantSeq} binds to ${verified.payloadHash}, this consumer presented ${JSON.stringify(presented)}. A grant approves specific bytes; changing the payload after grant requires a new request. Nothing was appended and the token is still live.`, { state: "granted", seq: verified.grantSeq });
-    }
-    if (verified.task === null) {
-        // `execution.started` requires `task` (event.schema.json). A granted action
-        // whose cycle names no task cannot produce a valid start event; refusing
-        // here says so in this module's vocabulary rather than as a schema failure.
-        return refuse("not-granted", `action ${actionKey} has a grant but no task id in its request cycle; execution.started requires one`, { state: "granted", seq: verified.grantSeq });
-    }
     const appended = appendEvent(logPath, {
         ts,
         event: "execution.started",

package/dist/src/core/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/core/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,WAAW,GAIZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,YAAY,GAGb,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,gFAAgF;IAChF,aAAa;IACb,mEAAmE;IACnE,gBAAgB;IAChB,+EAA+E;IAC/E,gBAAgB;IAChB,uEAAuE;IACvE,eAAe;IACf,uDAAuD;IACvD,eAAe;IACf;;;;;;;;;;OAUG;IACH,kBAAkB;IAClB;;;;;;;;OAQG;IACH,kBAAkB;CACV,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,0BAA0B;IAC7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,kBAAkB;IAClB,uEAAuE;IACvE,gBAAgB;IAChB,8DAA8D;IAC9D,eAAe;IACf,iFAAiF;IACjF,aAAa;IACb;;;;OAIG;IACH,eAAe;CACP,CAAC;AAiBX,SAAS,MAAM,CACb,IAAsB,EACtB,OAAe,EACf,KAAK,GAAkD,EAAE;IAEzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAuB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AA2CD,SAAS,SAAS,CAAC,MAAmB;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAEhE,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,uBAAuB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,mCAAmC,EAC3G;YACE,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SAC5E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,4BAA4B,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,GAAG,0BAA0B,EAC1H,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,OAAO,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,4CAA4C,EACtI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,WAAW,GAAG,KAAK,EAAE,CAAC;YACpF,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,oCAAoC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,yFAAyF,EAC5N,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB;YAAE,KAAK,GAAG,MAAM,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,4DAA4D,EAC/E,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CACX,kBAAkB,EAClB,UAAU,SAAS,uBAAuB,KAAK,CAAC,GAAG,qTAAqT,EACxW,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CACX,gBAAgB,EAChB,mCAAmC,SAAS,WAAW,KAAK,CAAC,GAAG,sBAAsB,gBAAgB,mEAAmE,EACzK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxC,OAAO,MAAM,CACX,gBAAgB,EAChB,UAAU,SAAS,+CAA+C,MAAM,CAAC,GAAG,oEAAoE,EAChJ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;QACtE,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC;QAC7B,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY;QAC5E,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,SAAiB,EACjB,MAAc;IAEd,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,KAAK,GAAG,MAAM,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CACX,gBAAgB,EAChB,2BAA2B,SAAS,iCAAiC,MAAM,CAAC,QAAQ,qIAAqI,EACzN,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAiED,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;;QAChE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,WAA0B,EAC1B,cAAsB;IAEtB,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,cAAsB,EACtB,KAAa,EACb,OAAO,GAAiB,EAAE;IAE1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,cAAc,EACd,EAAE,EACF,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,qBAAqB,CACpC,IAAI,EACJ,QAAQ,CAAC,KAAK,EACd,wBAAwB,SAAS,oBAAoB,QAAQ,CAAC,QAAQ,yDAAyD,CAChI,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvC,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,EAAE;IACF,2EAA2E;IAC3E,0DAA0D;IAC1D,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAC/C,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CACX,kBAAkB,EAClB,mCAAmC,SAAS,WAAW,QAAQ,CAAC,QAAQ,kaAAka,EAC1e,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChF,OAAO,MAAM,CACX,kBAAkB,EAClB,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,iBAAiB,SAAS,WAAW,QAAQ,CAAC,QAAQ,0BAA0B,QAAQ,CAAC,WAAW,2NAA2N;YACjU,CAAC,CAAC,6BAA6B,SAAS,8CAA8C,QAAQ,CAAC,QAAQ,aAAa,QAAQ,CAAC,WAAW,6BAA6B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,+IAA+I,EAC/U,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,kFAAkF,EACrG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP;QACE,EAAE;QACF,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,WAAW;YACxC,kEAAkE;YAClE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,WAAW;YAC1C,wEAAwE;YACxE,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACnF,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SACvE;KACF,EACD;QACE,GAAG,OAAO,CAAC,MAAM;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,iEAAiE;QACjE,YAAY,EAAE,IAAI,CAAC,IAAI;KACxB,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,eAAe,EACf,4CAA4C,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/core/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,IAAI,EAAqB,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,WAAW,GAIZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,YAAY,GAGb,MAAM,YAAY,CAAC;AAEpB,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,gFAAgF;IAChF,aAAa;IACb,mEAAmE;IACnE,gBAAgB;IAChB,+EAA+E;IAC/E,gBAAgB;IAChB,uEAAuE;IACvE,eAAe;IACf,uDAAuD;IACvD,eAAe;IACf;;;;;;;;;;OAUG;IACH,kBAAkB;IAClB;;;;;;;;OAQG;IACH,kBAAkB;CACV,CAAC;AAIX;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,GAAG,0BAA0B;IAC7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,kBAAkB;IAClB,uEAAuE;IACvE,gBAAgB;IAChB,8DAA8D;IAC9D,eAAe;IACf,iFAAiF;IACjF,aAAa;IACb;;;;OAIG;IACH,eAAe;CACP,CAAC;AAiBX,SAAS,MAAM,CACb,IAAsB,EACtB,OAAe,EACf,KAAK,GAAkD,EAAE;IAEzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAuB;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AA2CD,SAAS,SAAS,CAAC,MAAmB;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAEhE,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,uBAAuB,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,mCAAmC,EAC3G;YACE,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SAC5E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,4BAA4B,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,GAAG,0BAA0B,EAC1H,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,OAAO,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,4CAA4C,EACtI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,WAAW,GAAG,KAAK,EAAE,CAAC;YACpF,OAAO,MAAM,CACX,eAAe,EACf,UAAU,SAAS,oCAAoC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,iBAAiB,GAAG,yFAAyF,EAC5N,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,SAAS;QAC9C,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB;YAAE,KAAK,GAAG,MAAM,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,2EAA2E;QAC3E,oEAAoE;QACpE,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,4DAA4D,EAC/E,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CACX,kBAAkB,EAClB,UAAU,SAAS,uBAAuB,KAAK,CAAC,GAAG,qTAAqT,EACxW,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CACX,gBAAgB,EAChB,mCAAmC,SAAS,WAAW,KAAK,CAAC,GAAG,sBAAsB,gBAAgB,mEAAmE,EACzK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrF,IAAI,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxC,OAAO,MAAM,CACX,gBAAgB,EAChB,UAAU,SAAS,+CAA+C,MAAM,CAAC,GAAG,oEAAoE,EAChJ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;QACtE,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC;QAC7B,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY;QAC5E,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA+B,EAC/B,SAAiB,EACjB,MAAc;IAEd,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,KAAK,GAAG,MAAM,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,GAAW,EACX,KAAK,GAAkB,IAAI;IAE3B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CACX,gBAAgB,EAChB,2BAA2B,SAAS,iCAAiC,MAAM,CAAC,QAAQ,qIAAqI,EACzN,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAiED,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;;QAChE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,WAA0B,EAC1B,cAAsB;IAEtB,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACnF,CAAC;AAWD,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,SAAiB,EACjB,cAAsB,EACtB,GAAW,EACX,IAAsB,EACtB,oBAA6B;IAE7B,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP,SAAS,EACT,cAAc,EACd,GAAG,EACH,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,IAAI,EACJ,QAAQ,CAAC,KAAK,EACd,wBAAwB,SAAS,oBAAoB,QAAQ,CAAC,QAAQ,yDAAyD,CAChI,CAAC;IACF,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvC,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,MAAM,CACX,kBAAkB,EAClB,mCAAmC,SAAS,WAAW,QAAQ,CAAC,QAAQ,kaAAka,EAC1e,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtG,OAAO,MAAM,CACX,kBAAkB,EAClB,oBAAoB,KAAK,SAAS;YAChC,CAAC,CAAC,iBAAiB,SAAS,WAAW,QAAQ,CAAC,QAAQ,0BAA0B,QAAQ,CAAC,WAAW,2NAA2N;YACjU,CAAC,CAAC,6BAA6B,SAAS,8CAA8C,QAAQ,CAAC,QAAQ,aAAa,QAAQ,CAAC,WAAW,6BAA6B,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,+IAA+I,EAC1V,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,aAAa,EACb,UAAU,SAAS,kFAAkF,EACrG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,SAAiB,EACjB,cAAsB,EACtB,KAAa,EACb,OAAO,GAAiB,EAAE;IAE1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,IAAI,CAAC,OAAO,EACZ,SAAS,EACT,cAAc,EACd,EAAE,EACF,IAAI,EACJ,OAAO,CAAC,oBAAoB,CAC7B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,QAAQ,GAAG,WAAW,CAC1B,OAAO,EACP;QACE,EAAE;QACF,KAAK,EAAE,mBAAmB;QAC1B,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,WAAW;YACxC,kEAAkE;YAClE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,WAAW;YAC1C,wEAAwE;YACxE,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACnF,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,oCAAoC;YACpC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SACvE;KACF,EACD;QACE,GAAG,OAAO,CAAC,MAAM;QACjB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,iEAAiE;QACjE,YAAY,EAAE,IAAI,CAAC,IAAI;KACxB,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,eAAe,EACf,4CAA4C,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EACpE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC"}