@elaraai/e3-rack 0.0.0-bootstrap.0 → 1.0.94

package/dist/src/identity/in-memory-identity-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { DateTimeType, DictType, NullType, OptionType, StringType, StructType, VariantType, type ValueTypeOf } from '@elaraai/east';
+import { MutationQueue } from '../mutation-queue.js';
+import type { MachineIdentityStore, RackTokenRecord } from './machine-identity.js';
+/** The hub's credentials, hashed at rest. */
+export declare const IdentityFileType: StructType<{
+    readonly enrollmentTokens: DictType<StringType, DateTimeType>;
+    readonly rackTokens: DictType<StringType, StructType<{
+        readonly rackId: StringType;
+        readonly status: VariantType<{
+            readonly current: NullType;
+            readonly pending: NullType;
+            readonly grace: NullType;
+        }>;
+        readonly issuedAt: DateTimeType;
+        readonly graceUntil: OptionType<DateTimeType>;
+    }>>;
+}>;
+/** The credentials' persisted value. */
+export type IdentityFile = ValueTypeOf<typeof IdentityFileType>;
+/**
+ * Keeps machine identities in memory, with atomic single-use enrollment.
+ * @example
+ * const store = new InMemoryMachineIdentityStore();
+ * await store.putEnrollmentToken(hashToken(token), expiresAt);
+ */
+export declare class InMemoryMachineIdentityStore implements MachineIdentityStore {
+    protected state: IdentityFile;
+    protected readonly mutations: MutationQueue;
+    protected ready: Promise<void>;
+    /** Persists a candidate state before it becomes visible. @internal */
+    protected persist(_state: IdentityFile): Promise<void>;
+    private change;
+    putEnrollmentToken(hash: string, expiresAt: Date): Promise<void>;
+    consumeEnrollmentToken(hash: string, now: Date): Promise<boolean>;
+    putRackToken(hash: string, rackId: string, issuedAt: Date, status: 'current' | 'pending'): Promise<void>;
+    getRackToken(hash: string): Promise<RackTokenRecord | null>;
+    listRackTokens(rackId: string): Promise<Array<RackTokenRecord & {
+        tokenHash: string;
+    }>>;
+    promoteRackToken(rackId: string, hash: string, graceUntil: Date): Promise<void>;
+    deleteRackToken(hash: string): Promise<void>;
+    deleteRackTokens(rackId: string): Promise<void>;
+}
+//# sourceMappingURL=in-memory-identity-store.d.ts.map

package/dist/src/identity/in-memory-identity-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-identity-store.d.ts","sourceRoot":"","sources":["../../../src/identity/in-memory-identity-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAqE,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACvM,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAQ3B,CAAC;AACH,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAKhE;;;;;GAKG;AACH,qBAAa,4BAA6B,YAAW,oBAAoB;IACvE,SAAS,CAAC,KAAK,EAAE,YAAY,CAA0D;IACvF,SAAS,CAAC,QAAQ,CAAC,SAAS,gBAAuB;IACnD,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAqB;IAEnD,sEAAsE;IACtE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtD,OAAO,CAAC,MAAM;IAgBd,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAU3D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAS7F,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/E,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhD"}

package/dist/src/identity/in-memory-identity-store.js

@@ -0,0 +1,102 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { DateTimeType, DictType, NullType, OptionType, StringType, StructType, VariantType, compareFor, decodeBeast2For, encodeBeast2For, none, some, variant } from '@elaraai/east';
+import { MutationQueue } from '../mutation-queue.js';
+/** The hub's credentials, hashed at rest. */
+export const IdentityFileType = StructType({
+    enrollmentTokens: DictType(StringType, DateTimeType),
+    rackTokens: DictType(StringType, StructType({
+        rackId: StringType,
+        status: VariantType({ current: NullType, pending: NullType, grace: NullType }),
+        issuedAt: DateTimeType,
+        graceUntil: OptionType(DateTimeType),
+    })),
+});
+const encode = encodeBeast2For(IdentityFileType);
+const decode = decodeBeast2For(IdentityFileType);
+const compareTime = compareFor(DateTimeType);
+/**
+ * Keeps machine identities in memory, with atomic single-use enrollment.
+ * @example
+ * const store = new InMemoryMachineIdentityStore();
+ * await store.putEnrollmentToken(hashToken(token), expiresAt);
+ */
+export class InMemoryMachineIdentityStore {
+    state = { enrollmentTokens: new Map(), rackTokens: new Map() };
+    mutations = new MutationQueue();
+    ready = Promise.resolve();
+    /** Persists a candidate state before it becomes visible. @internal */
+    persist(_state) { return Promise.resolve(); }
+    change(edit, now = new Date()) {
+        return this.mutations.run(async () => {
+            await this.ready;
+            const next = decode(encode(this.state));
+            const prune = () => {
+                for (const [hash, expires] of next.enrollmentTokens)
+                    if (compareTime(expires, now) <= 0)
+                        next.enrollmentTokens.delete(hash);
+            };
+            prune();
+            const result = edit(next);
+            prune();
+            await this.persist(next);
+            this.state = decode(encode(next));
+            return result;
+        });
+    }
+    putEnrollmentToken(hash, expiresAt) {
+        return this.change((state) => { state.enrollmentTokens.set(hash, expiresAt); });
+    }
+    consumeEnrollmentToken(hash, now) {
+        return this.change((state) => state.enrollmentTokens.delete(hash), now);
+    }
+    putRackToken(hash, rackId, issuedAt, status) {
+        return this.change((state) => {
+            state.rackTokens.set(hash, { rackId, issuedAt, status: variant(status, null), graceUntil: none });
+        });
+    }
+    async getRackToken(hash) {
+        await this.ready;
+        await this.mutations.idle();
+        const record = this.state.rackTokens.get(hash);
+        return record === undefined ? null : {
+            rackId: record.rackId, status: record.status.type, issuedAt: new Date(record.issuedAt),
+            ...(record.graceUntil.type === 'some' && { graceUntil: new Date(record.graceUntil.value) }),
+        };
+    }
+    async listRackTokens(rackId) {
+        await this.ready;
+        await this.mutations.idle();
+        return [...this.state.rackTokens].flatMap(([tokenHash, record]) => record.rackId !== rackId ? [] : [{
+                tokenHash, rackId, status: record.status.type, issuedAt: new Date(record.issuedAt),
+                ...(record.graceUntil.type === 'some' && { graceUntil: new Date(record.graceUntil.value) }),
+            }]);
+    }
+    promoteRackToken(rackId, hash, graceUntil) {
+        return this.change((state) => {
+            if (state.rackTokens.get(hash)?.rackId !== rackId)
+                throw new Error('Cannot promote an unknown rack token');
+            for (const [key, record] of state.rackTokens) {
+                if (record.rackId !== rackId)
+                    continue;
+                if (key === hash)
+                    state.rackTokens.set(key, { ...record, status: variant('current', null), graceUntil: none });
+                else if (record.status.type !== 'grace')
+                    state.rackTokens.set(key, { ...record, status: variant('grace', null), graceUntil: some(graceUntil) });
+            }
+        });
+    }
+    deleteRackToken(hash) {
+        return this.change((state) => { state.rackTokens.delete(hash); });
+    }
+    deleteRackTokens(rackId) {
+        return this.change((state) => {
+            for (const [hash, record] of state.rackTokens)
+                if (record.rackId === rackId)
+                    state.rackTokens.delete(hash);
+        });
+    }
+}
+//# sourceMappingURL=in-memory-identity-store.js.map

package/dist/src/identity/in-memory-identity-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-identity-store.js","sourceRoot":"","sources":["../../../src/identity/in-memory-identity-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAoB,MAAM,eAAe,CAAC;AACvM,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;IACzC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IACpD,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;QAC1C,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC9E,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACjD,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,OAAO,4BAA4B;IAC7B,KAAK,GAAiB,EAAE,gBAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpE,SAAS,GAAG,IAAI,aAAa,EAAE,CAAC;IACzC,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,sEAAsE;IAC5D,OAAO,CAAC,MAAoB,IAAmB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5E,MAAM,CAAI,IAAgC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB;oBAAE,IAAI,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;wBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9H,CAAC,CAAC;YACF,KAAK,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,KAAK,EAAE,CAAC;YACR,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,SAAe;QAC9C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,sBAAsB,CAAC,IAAY,EAAE,GAAS;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,QAAc,EAAE,MAA6B;QACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAClF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;aAC5F,CAAC,CAAC,CAAC;IACN,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,UAAgB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC3G,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;oBAAE,SAAS;gBACvC,IAAI,GAAG,KAAK,IAAI;oBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;qBAC1G,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;oBAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,IAAY;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;oBAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/identity/machine-identity.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/** Prefix distinguishing rack machine tokens from human JWTs at a glance. */
+export declare const RACK_TOKEN_PREFIX = "e3rk_";
+/** Prefix for single-use enrollment tokens. */
+export declare const ENROLLMENT_TOKEN_PREFIX = "e3rk_enroll_";
+/** Default enrollment-token lifetime: long enough to paste one command. */
+export declare const DEFAULT_ENROLLMENT_TTL_MS: number;
+/**
+ * Token rotation (D12, #90). A current token older than ROTATION_AGE has a
+ * successor minted and offered via the heartbeat response. The offer is
+ * repeated (with a fresh successor) at most every ROTATION_REOFFER until
+ * the agent demonstrably switches — the successor's FIRST authenticated use
+ * promotes it and starts the old token's ROTATION_GRACE fuse. Activation-
+ * based expiry means a lost heartbeat response can never strand an agent:
+ * until the successor is seen, the old token remains fully valid.
+ */
+export declare const ROTATION_AGE_MS: number;
+export declare const ROTATION_REOFFER_MS: number;
+export declare const ROTATION_GRACE_MS: number;
+/**
+ * One rack token's lifecycle state:
+ * - `current` — the rack's working credential
+ * - `pending` — a minted successor the agent has not used yet
+ * - `grace` — superseded; valid only until `graceUntil`
+ */
+export interface RackTokenRecord {
+    rackId: string;
+    status: 'current' | 'pending' | 'grace';
+    issuedAt: Date;
+    /** Hard cutoff for `grace` tokens; absent otherwise. */
+    graceUntil?: Date;
+}
+/**
+ * Persistence for machine credentials, hashed at rest. Implementations:
+ * `InMemoryMachineIdentityStore` (testing) and `DynamoMachineIdentityStore`
+ * (e3-aws; `PK=ENROLLTOKEN|RACKTOKEN`, `SK={tokenHash}`).
+ */
+export interface MachineIdentityStore {
+    /**
+     * Record a freshly minted enrollment token.
+     *
+     * @param tokenHash - SHA-256 hex of the plaintext token
+     * @param expiresAt - When the token stops being exchangeable
+     */
+    putEnrollmentToken(tokenHash: string, expiresAt: Date): Promise<void>;
+    /**
+     * Atomically consume an enrollment token: exactly one caller ever
+     * receives `true` for a given token, and only before its expiry.
+     *
+     * @param tokenHash - SHA-256 hex of the presented token
+     * @param now - Current time (injected for testability)
+     * @returns Whether the token was valid, unexpired, and not yet used
+     */
+    consumeEnrollmentToken(tokenHash: string, now: Date): Promise<boolean>;
+    /**
+     * Bind a rack token (hashed) to a rack identity.
+     *
+     * @param tokenHash - SHA-256 hex of the plaintext rack token
+     * @param rackId - The rack the token authenticates
+     * @param issuedAt - Mint time (the rotation clock)
+     * @param status - `current` at enrollment, `pending` for a rotation offer
+     */
+    putRackToken(tokenHash: string, rackId: string, issuedAt: Date, status: 'current' | 'pending'): Promise<void>;
+    /**
+     * Resolve a presented rack token. Validity (grace expiry) is the
+     * caller's judgement — this returns the raw record.
+     *
+     * @param tokenHash - SHA-256 hex of the presented token
+     * @returns The token record, or null when unknown
+     */
+    getRackToken(tokenHash: string): Promise<RackTokenRecord | null>;
+    /**
+     * All tokens bound to a rack (a handful: current + at most one pending
+     * + expiring grace rows).
+     *
+     * @param rackId - The rack whose tokens are listed
+     */
+    listRackTokens(rackId: string): Promise<Array<RackTokenRecord & {
+        tokenHash: string;
+    }>>;
+    /**
+     * Activate a successor: `tokenHash` becomes `current`; every OTHER
+     * `current`/`pending` token of the rack drops to `grace` with the given
+     * cutoff. Tokens already in grace keep their earlier cutoff.
+     *
+     * @param rackId - The rack rotating
+     * @param tokenHash - The successor's hash (first use just observed)
+     * @param graceUntil - When the superseded token(s) die
+     */
+    promoteRackToken(rackId: string, tokenHash: string, graceUntil: Date): Promise<void>;
+    /**
+     * Remove one token row (a stale pending offer being replaced).
+     *
+     * @param tokenHash - SHA-256 hex of the token to remove
+     */
+    deleteRackToken(tokenHash: string): Promise<void>;
+    /**
+     * Remove every token bound to a rack — deregistration hygiene. Security
+     * does not depend on this (the middleware checks the registration), but
+     * it keeps the credential table honest.
+     *
+     * @param rackId - The rack whose tokens are purged
+     */
+    deleteRackTokens(rackId: string): Promise<void>;
+}
+/**
+ * Hash a token for at-rest storage and lookups.
+ *
+ * @param token - The plaintext token
+ * @returns SHA-256 hex digest
+ */
+export declare function hashToken(token: string): string;
+/**
+ * Generate a single-use enrollment token (256 bits of entropy).
+ *
+ * @returns The plaintext token and its at-rest hash
+ */
+export declare function generateEnrollmentToken(): {
+    token: string;
+    tokenHash: string;
+};
+/**
+ * Generate a long-lived rack token (256 bits of entropy).
+ *
+ * @returns The plaintext token and its at-rest hash
+ */
+export declare function generateRackToken(): {
+    token: string;
+    tokenHash: string;
+};
+//# sourceMappingURL=machine-identity.d.ts.map

package/dist/src/identity/machine-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-identity.d.ts","sourceRoot":"","sources":["../../../src/identity/machine-identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AACzC,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,QAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAmB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACxC,QAAQ,EAAE,IAAI,CAAC;IACf,wDAAwD;IACxD,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9G;;;;;;OAMG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAExF;;;;;;;;OAQG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAG9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGxE"}

package/dist/src/identity/machine-identity.js

@@ -0,0 +1,65 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/**
+ * Rack machine identity (#72, epic #67 design §9.1) — the minimal
+ * machine-credential scheme beside the human Cognito JWTs:
+ *
+ * - An admin mints a **single-use, short-TTL enrollment token** (Phase-1
+ *   mint endpoint; `StoreEnrollmentTokenMinter` is its real implementation).
+ * - The agent exchanges it once (`POST /rack/enroll`) for a **long-lived,
+ *   revocable rack token** bound to a generated rackId.
+ * - Both tokens are stored **hashed at rest** (SHA-256); the plaintext
+ *   exists only in the mint/exchange responses.
+ * - Revocation = deregister (delete the `RackRegistration`): the auth
+ *   middleware re-resolves the registration on every request, so a token
+ *   whose rack is gone is dead even if its hash row lingers.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+/** Prefix distinguishing rack machine tokens from human JWTs at a glance. */
+export const RACK_TOKEN_PREFIX = 'e3rk_';
+/** Prefix for single-use enrollment tokens. */
+export const ENROLLMENT_TOKEN_PREFIX = 'e3rk_enroll_';
+/** Default enrollment-token lifetime: long enough to paste one command. */
+export const DEFAULT_ENROLLMENT_TTL_MS = 15 * 60_000;
+/**
+ * Token rotation (D12, #90). A current token older than ROTATION_AGE has a
+ * successor minted and offered via the heartbeat response. The offer is
+ * repeated (with a fresh successor) at most every ROTATION_REOFFER until
+ * the agent demonstrably switches — the successor's FIRST authenticated use
+ * promotes it and starts the old token's ROTATION_GRACE fuse. Activation-
+ * based expiry means a lost heartbeat response can never strand an agent:
+ * until the successor is seen, the old token remains fully valid.
+ */
+export const ROTATION_AGE_MS = 24 * 60 * 60_000;
+export const ROTATION_REOFFER_MS = 60 * 60_000;
+export const ROTATION_GRACE_MS = 15 * 60_000;
+/**
+ * Hash a token for at-rest storage and lookups.
+ *
+ * @param token - The plaintext token
+ * @returns SHA-256 hex digest
+ */
+export function hashToken(token) {
+    return createHash('sha256').update(token, 'utf8').digest('hex');
+}
+/**
+ * Generate a single-use enrollment token (256 bits of entropy).
+ *
+ * @returns The plaintext token and its at-rest hash
+ */
+export function generateEnrollmentToken() {
+    const token = `${ENROLLMENT_TOKEN_PREFIX}${randomBytes(32).toString('hex')}`;
+    return { token, tokenHash: hashToken(token) };
+}
+/**
+ * Generate a long-lived rack token (256 bits of entropy).
+ *
+ * @returns The plaintext token and its at-rest hash
+ */
+export function generateRackToken() {
+    const token = `${RACK_TOKEN_PREFIX}${randomBytes(32).toString('hex')}`;
+    return { token, tokenHash: hashToken(token) };
+}
+//# sourceMappingURL=machine-identity.js.map

package/dist/src/identity/machine-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-identity.js","sourceRoot":"","sources":["../../../src/identity/machine-identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AA+F7C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,uBAAuB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,iBAAiB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+export * from './protocol/index.js';
+export * from './tls/tls.js';
+export * from './lease/lease-store.js';
+export * from './lease/rack-dispatch.js';
+export * from './identity/machine-identity.js';
+export * from './identity/in-memory-identity-store.js';
+export * from './identity/file-identity-store.js';
+export * from './lease/in-memory-lease-store.js';
+export * from './registry/rack-registry.js';
+export * from './registry/file-rack-registry.js';
+export * from './paths.js';
+export * from './version.js';
+export * from './routing/policy.js';
+export * from './routing/eligibility.js';
+export * from './routing/tiers.js';
+export * from './client/connect.js';
+export * from './client/hub-client.js';
+export * from './client/session.js';
+export * from './hub/hub.js';
+export * from './hub/config.js';
+export { readHubLock } from './hub/lock.js';
+export * from './server/dispatch.js';
+export * from './server/rack-routes.js';
+export * from './server/storage-bridge.js';
+export * from './server/env-publication.js';
+export * from './lease/coordinator.js';
+export * from './runner/rack-body.js';
+export * from './runner/rack-runner.js';
+export * from './runner/api-server.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+export * from './protocol/index.js';
+export * from './tls/tls.js';
+export * from './lease/lease-store.js';
+export * from './lease/rack-dispatch.js';
+export * from './identity/machine-identity.js';
+export * from './identity/in-memory-identity-store.js';
+export * from './identity/file-identity-store.js';
+export * from './lease/in-memory-lease-store.js';
+export * from './registry/rack-registry.js';
+export * from './registry/file-rack-registry.js';
+export * from './paths.js';
+export * from './version.js';
+export * from './routing/policy.js';
+export * from './routing/eligibility.js';
+export * from './routing/tiers.js';
+export * from './client/connect.js';
+export * from './client/hub-client.js';
+export * from './client/session.js';
+export * from './hub/hub.js';
+export * from './hub/config.js';
+export { readHubLock } from './hub/lock.js';
+export * from './server/dispatch.js';
+export * from './server/rack-routes.js';
+export * from './server/storage-bridge.js';
+export * from './server/env-publication.js';
+export * from './lease/coordinator.js';
+export * from './runner/rack-body.js';
+export * from './runner/rack-runner.js';
+export * from './runner/api-server.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wCAAwC,CAAC;AACvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC"}

package/dist/src/lease/closure.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { type DetachedArg, type SplitUnit, type StorageBackend } from '@elaraai/e3-core';
+import { type TaskObject } from '@elaraai/e3-types';
+import type { RackLeaseClosure } from '../protocol/task-envelope.js';
+/** The most hashes a lease's event carries inline: past it, the closure is an object. */
+export declare const INLINE_CLOSURE_MAX = 512;
+/**
+ * A closure object's bytes.
+ *
+ * @param hashes - The closure's hashes
+ * @returns The object's bytes
+ */
+export declare function encodeClosure(hashes: readonly string[]): Uint8Array;
+/**
+ * The hashes a closure object lists.
+ *
+ * @param bytes - The object's bytes
+ * @returns The hashes
+ * @throws {Error} When the bytes are not a closure object
+ */
+export declare function decodeClosure(bytes: Uint8Array): string[];
+/**
+ * What a unit's execution stages: a piece's inputs, or a merge's key range
+ * and its parts (e3-core's `taskExecuteBody`).
+ *
+ * @param inputs - The unit's inputs, as its record names them
+ * @param merge - What a merge unit merges, or null for a piece
+ * @returns The staged objects' hashes
+ */
+export declare function stagedObjects(inputs: readonly string[], merge: SplitUnit['merge']): string[];
+/**
+ * The closure of a task's or a unit's execution.
+ *
+ * @param storage - The repository's storage
+ * @param repo - Repository identifier
+ * @param taskHash - The task object's hash
+ * @param task - The task object
+ * @param staged - What the execution stages ({@link stagedObjects})
+ * @param parts - Collects the closure's collection parts (each staged
+ *   manifest's entries): what a unit fetches only as it reads them
+ * @returns The objects it reads, sorted
+ * @throws {Error} When an object it names cannot be read
+ */
+export declare function taskClosure(storage: StorageBackend, repo: string, taskHash: string, task: TaskObject, staged: readonly string[], parts?: Set<string>): Promise<string[]>;
+/**
+ * The closure of a function call's execution.
+ *
+ * @param storage - The repository's storage
+ * @param repo - Repository identifier
+ * @param program - The program's object hash
+ * @param args - The call's arguments: a stored dataset's objects are staged
+ * @param environment - The environment the call declares
+ * @returns The objects it reads, sorted
+ * @throws {Error} When an object it names cannot be read
+ */
+export declare function detachedClosure(storage: StorageBackend, repo: string, program: string, args: readonly DetachedArg[], environment?: string): Promise<string[]>;
+/**
+ * The closure of a function call whose program travels with it, not as an
+ * object: its environment, and each stored dataset argument (#225, a
+ * sandbox's call).
+ *
+ * @param storage - The repository's storage
+ * @param repo - Repository identifier
+ * @param args - The call's arguments: a stored dataset's objects are staged
+ * @param environment - The environment the call declares
+ * @param parts - Collects the closure's collection parts, as {@link taskClosure}'s
+ * @returns The objects it reads, sorted
+ * @throws {Error} When an object it names cannot be read
+ */
+export declare function callClosure(storage: StorageBackend, repo: string, args: readonly DetachedArg[], environment?: string, parts?: Set<string>): Promise<string[]>;
+/**
+ * Records a closure on a lease: its hashes inline, or, when there are more
+ * than {@link INLINE_CLOSURE_MAX}, an object in the repository's store that
+ * lists them.
+ *
+ * @param storage - The repository's storage
+ * @param repo - Repository identifier
+ * @param hashes - The closure
+ * @returns What the lease's event carries
+ */
+export declare function recordClosure(storage: StorageBackend, repo: string, hashes: readonly string[]): Promise<RackLeaseClosure>;
+/**
+ * Every object a lease may read, as its closure names them: the hashes, and,
+ * for a closure recorded as an object, that object too.
+ *
+ * @param closure - The lease's closure
+ * @param read - Reads the closure object, for one recorded as an object
+ * @returns The hashes
+ * @throws {Error} When the closure object cannot be read, or lists another
+ *   number of hashes than the lease says
+ */
+export declare function closureHashes(closure: RackLeaseClosure, read: (hash: string) => Promise<Uint8Array>): Promise<string[]>;
+//# sourceMappingURL=closure.d.ts.map

package/dist/src/lease/closure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"closure.d.ts","sourceRoot":"","sources":["../../../src/lease/closure.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAwBH,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAoD,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAQtC;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAEnE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAEzD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAE5F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI/H;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAO7H"}