@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/grokEngineBroker.d.ts

@@ -0,0 +1,88 @@
+import { needsBrokerTaskClockReconciliation, writeBrokerTaskClock } from "./grokBrokerTaskClock.js";
+import { DurableGrokBrokerCredentialAuthority } from "./grokBrokerCredentialAuthority.js";
+import { runNativeBrokerTurn } from "./engineBrokerNativeClient.js";
+import type { EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
+import type { EngineBrokerTurnLimitOverrides } from "./engineBrokerTurnAccounting.js";
+import { startGrokBrokerProxy } from "./grokBrokerProxy.js";
+import { acquireGrokBrokerRealmLease } from "./grokBrokerRealmLease.js";
+import { type GrokEngineBrokerTurnDependencies, type GrokEngineBrokerTurnResult } from "./grokEngineBrokerTurn.js";
+import { createGrokWorkerIsolationGuard, prepareGrokWorkerAttestation } from "./grokWorkerAttestation.js";
+import { grokWorkerIdentityEmpty } from "./grokEngineBrokerTurnEnd.js";
+import { type GrokInferenceGrantRequest } from "./grokInferenceGrants.js";
+export { EngineBrokerTurnFailure, type GrokEngineBrokerTurnResult } from "./grokEngineBrokerTurn.js";
+export { finishBrokerTurnWithUsage } from "./grokEngineBrokerMetering.js";
+export type GrokEngineBrokerRegistration = EngineBrokerServiceRegistration;
+export type GrokEngineBroker = Awaited<ReturnType<typeof startGrokEngineBroker>>;
+/**
+ * The Grok engine broker: one credential realm, one provider proxy, one MCP
+ * facade, and the root-provisioned registrations. Each registration declares
+ * its own model/effort (whose worker config bytes are attested), usage ledger,
+ * and turn limits (`engineBrokerServiceConfig.ts`).
+ *
+ * With an `inferenceLedgerPath` the broker also issues evaluator inference
+ * grants (`grokInferenceGrants.ts`) over the same credential authority and
+ * proxy; their rows go only to that ledger. A stale realm refuses a grant as
+ * `auth_stale`, exactly as it fails subject turns.
+ */
+/** Internal seams exercise the production startup and per-turn admission paths. */
+export type GrokEngineBrokerDependencies = Readonly<{
+    acquireLease: typeof acquireGrokBrokerRealmLease;
+    createAuthority: (command: string, home: string) => Pick<DurableGrokBrokerCredentialAuthority, "initialize" | "accessToken" | "markRejected" | "isStale">;
+    startProxy: (...args: Parameters<typeof startGrokBrokerProxy>) => Promise<GrokEngineBrokerTurnDependencies["proxy"] & {
+        port: number;
+        close(): Promise<void>;
+    }>;
+    startMcp: () => Promise<GrokEngineBrokerTurnDependencies["mcp"] & {
+        close(): Promise<void>;
+    }>;
+    prepareAttestation: typeof prepareGrokWorkerAttestation;
+    needsTaskClockReconciliation: typeof needsBrokerTaskClockReconciliation;
+    createIsolationGuard: typeof createGrokWorkerIsolationGuard;
+    writeTaskClock: typeof writeBrokerTaskClock;
+    workerIdentityEmpty: typeof grokWorkerIdentityEmpty;
+    runNative: typeof runNativeBrokerTurn;
+}>;
+export declare function startGrokEngineBroker(options: Readonly<{
+    grokCommand: string;
+    nativeClient: string;
+    credentialHome: string;
+    turnStore: string;
+    registrations: readonly GrokEngineBrokerRegistration[];
+    inferenceLedgerPath?: string;
+    maxRunRequests?: number;
+    runRequestStore?: string;
+}>, dependencies?: GrokEngineBrokerDependencies): Promise<{
+    turn: (agentId: string, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal | undefined, limits?: Readonly<Partial<Readonly<{
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    }>>> | undefined, processClock?: string | undefined, slot?: number | undefined) => Promise<GrokEngineBrokerTurnResult>;
+    resetSlot(slot: number): Promise<void>;
+    requestInferenceGrant(request: GrokInferenceGrantRequest): Readonly<{
+        grantId: string;
+        token: string;
+        purpose: import("./inferenceUsageLedger.js").GrokInferencePurpose;
+        policy: import("./grokBrokerModelPolicy.js").GrokBrokerModelPolicy;
+        expiresAt: number;
+        limits: import("./engineBrokerTurnAccounting.js").EngineBrokerTurnLimits;
+    }>;
+    releaseInferenceGrant(grantId: string): boolean;
+    close(): Promise<void>;
+    readiness: () => {
+        providerProxyPort: number;
+        mcpFacadePort: number;
+        registrations: number;
+        credentialStale: boolean;
+        realmLease: boolean;
+        workerIsolation: boolean;
+    };
+}>;
+/** @internal One slot identity carries one turn until cleanup settles, including clock publication. */
+export type GrokBrokerActiveTurns = Map<number, {
+    controller: AbortController;
+    done: Promise<void>;
+}>;
+type TurnArguments = [wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, limits?: EngineBrokerTurnLimitOverrides, processClock?: string];
+/** The production dispatch boundary, isolated from credential/network setup for lifecycle tests. */
+export declare function createGrokEngineBrokerTurnDispatch(registrations: ReadonlyMap<number, GrokEngineBrokerRegistration>, active: GrokBrokerActiveTurns, isClosed: () => boolean, run: (registration: GrokEngineBrokerRegistration, ...args: TurnArguments) => Promise<GrokEngineBrokerTurnResult>, resetting?: ReadonlySet<number>): (agentId: string, ...input: [...TurnArguments, slot?: number]) => Promise<GrokEngineBrokerTurnResult>;
+//# sourceMappingURL=grokEngineBroker.d.ts.map

package/dist/runtime/grokEngineBroker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokEngineBroker.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBroker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kCAAkC,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAItF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAEL,KAAK,gCAAgC,EAAE,KAAK,0BAA0B,EACvE,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAA4B,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAA0D,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC/H,OAAO,EAAgE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAExI,OAAO,EAAE,uBAAuB,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,mFAAmF;AACnF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,YAAY,EAAE,OAAO,2BAA2B,CAAC;IACjD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,oCAAoC,EAC3F,YAAY,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;IAC7D,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,KAAK,OAAO,CACvE,gCAAgC,CAAC,OAAO,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;IACxF,QAAQ,EAAE,MAAM,OAAO,CAAC,gCAAgC,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9F,kBAAkB,EAAE,OAAO,4BAA4B,CAAC;IACxD,4BAA4B,EAAE,OAAO,kCAAkC,CAAC;IACxE,oBAAoB,EAAE,OAAO,8BAA8B,CAAC;IAC5D,cAAc,EAAE,OAAO,oBAAoB,CAAC;IAC5C,mBAAmB,EAAE,OAAO,uBAAuB,CAAC;IACpD,SAAS,EAAE,OAAO,mBAAmB,CAAC;CACvC,CAAC,CAAC;AAeH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IACrF,aAAa,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACzI,CAAC,EACF,YAAY,GAAE,4BAAiD;oBA0IxC,MAAM;;;;uFAAgD,OAAO,CAAC,0BAA0B,CAAC;oBAzDxF,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;mCAkBb,yBAAyB;;;;;;;;mCAKzB,MAAM,GAAG,OAAO;aAIhC,OAAO,CAAC,IAAI,CAAC;;;;;;;;;GAiB/B;AAED,uGAAuG;AACvG,MAAM,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AACtG,KAAK,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,8BAA8B,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;AAEjK,oGAAoG;AACpG,wBAAgB,kCAAkC,CAChD,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAC/F,QAAQ,EAAE,MAAM,OAAO,EACvB,GAAG,EAAE,CAAC,YAAY,EAAE,4BAA4B,EAAE,GAAG,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,0BAA0B,CAAC,EAChH,SAAS,GAAE,WAAW,CAAC,MAAM,CAAa,IAE5B,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,KAAG,OAAO,CAAC,0BAA0B,CAAC,CAiBjH"}

package/dist/runtime/grokEngineBroker.js

@@ -0,0 +1,202 @@
+import path from "node:path";
+import { rm } from "node:fs/promises";
+import { assertBrokerTaskClockIsolation, brokerTaskClockFileFor } from "./grokBrokerSlot.js";
+import { needsBrokerTaskClockReconciliation, writeBrokerTaskClock } from "./grokBrokerTaskClock.js";
+import { DurableGrokBrokerCredentialAuthority } from "./grokBrokerCredentialAuthority.js";
+import { runNativeBrokerTurn } from "./engineBrokerNativeClient.js";
+import { ENGINE_BROKER_TASK_CLOCK_RESET_FAILED } from "./engineBrokerProtocol.js";
+import { EngineBrokerTurnRegistry } from "./engineBrokerTurnRegistry.js";
+import { GrokBrokerRunBudget } from "./grokBrokerRunBudget.js";
+import { startGrokBrokerProxy } from "./grokBrokerProxy.js";
+import { startEngineBrokerMcpFacade } from "./engineBrokerMcpFacade.js";
+import { acquireGrokBrokerRealmLease } from "./grokBrokerRealmLease.js";
+import { grokBrokerWorkerConfigPins } from "./grokBrokerWorkerConfig.js";
+import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+import { EngineBrokerTurnFailure, runGrokEngineBrokerTurn } from "./grokEngineBrokerTurn.js";
+import { createGrokWorkerIsolationGuard, grokBrokerAttestationInput, prepareGrokWorkerAttestation } from "./grokWorkerAttestation.js";
+import { awaitGrokWorkerIdentityEmpty, GROK_WORKER_REAP_WAIT_MS, grokWorkerIdentityEmpty } from "./grokEngineBrokerTurnEnd.js";
+import { createLedgeredGrokInferenceGrants, GrokInferenceGrantRefused } from "./grokInferenceGrants.js";
+export { EngineBrokerTurnFailure } from "./grokEngineBrokerTurn.js";
+export { finishBrokerTurnWithUsage } from "./grokEngineBrokerMetering.js";
+const brokerDependencies = {
+    acquireLease: acquireGrokBrokerRealmLease,
+    createAuthority: (command, home) => new DurableGrokBrokerCredentialAuthority(command, home),
+    startProxy: startGrokBrokerProxy,
+    startMcp: startEngineBrokerMcpFacade,
+    prepareAttestation: prepareGrokWorkerAttestation,
+    needsTaskClockReconciliation: needsBrokerTaskClockReconciliation,
+    createIsolationGuard: createGrokWorkerIsolationGuard,
+    writeTaskClock: writeBrokerTaskClock,
+    workerIdentityEmpty: (uid) => grokWorkerIdentityEmpty(uid, undefined, true),
+    runNative: runNativeBrokerTurn
+};
+export async function startGrokEngineBroker(options, dependencies = brokerDependencies) {
+    const registrations = new Map(options.registrations.map((entry) => [
+        entry.slot, { ...entry, model: parseGrokBrokerModelPolicy(entry.model) }
+    ]));
+    if (registrations.size !== options.registrations.length || new Set(options.registrations.map((entry) => entry.workerUid)).size !== options.registrations.length)
+        throw new Error("engine broker registration conflict");
+    const attestationFor = (registration) => grokBrokerAttestationInput(registration, [...registrations.values()], grokBrokerWorkerConfigPins(registration.model, registration.slot));
+    const grants = options.inferenceLedgerPath === undefined
+        ? undefined : createLedgeredGrokInferenceGrants(options.inferenceLedgerPath);
+    const lease = await dependencies.acquireLease(options.credentialHome);
+    const authority = dependencies.createAuthority(options.grokCommand, options.credentialHome);
+    let proxy;
+    let mcp;
+    let runBudget;
+    const clockedSlots = new Set();
+    try {
+        // Reconcile before accepting traffic. A prior broker may have died after
+        // publishing an offset; its finally never ran. The realm lease excludes peers.
+        for (const registration of registrations.values()) {
+            const attestation = attestationFor(registration);
+            if (!await dependencies.needsTaskClockReconciliation(registration.profilePath, attestation.configSha256, brokerTaskClockFileFor(registration.slot)))
+                continue;
+            const snapshot = await dependencies.prepareAttestation(attestation);
+            assertBrokerTaskClockIsolation(snapshot.configVariant, registration.slot, [...registrations.keys()], snapshot.denyPaths);
+            const reaped = await awaitGrokWorkerIdentityEmpty(registration.workerUid, GROK_WORKER_REAP_WAIT_MS, dependencies.workerIdentityEmpty);
+            if (!reaped)
+                throw new Error("Grok broker task clock worker did not terminate");
+            await dependencies.writeTaskClock(undefined, brokerTaskClockFileFor(registration.slot));
+            clockedSlots.add(registration.slot);
+        }
+        await authority.initialize();
+        runBudget = options.maxRunRequests === undefined ? undefined :
+            await GrokBrokerRunBudget.open(options.maxRunRequests, path.join(options.runRequestStore ?? options.turnStore, "run-requests.json"));
+        proxy = await dependencies.startProxy(authority, undefined, undefined, undefined, grants, runBudget);
+        mcp = await dependencies.startMcp();
+    }
+    catch (error) {
+        grants?.close();
+        await Promise.allSettled([mcp?.close(), proxy?.close(), runBudget?.close()]);
+        await Promise.allSettled([lease.close()]);
+        throw error;
+    }
+    const slotStore = (slot) => path.join(options.turnStore, `slot-${slot}`);
+    const turnStores = new Map([...registrations.keys()].map((slot) => [slot, new EngineBrokerTurnRegistry(slotStore(slot))]));
+    const active = new Map();
+    let closed = false;
+    const clockFailed = new Set();
+    const resetting = new Set();
+    const resets = new Map();
+    const facade = mcp;
+    const provider = proxy;
+    const depsFor = (registration) => ({
+        turns: turnStores.get(registration.slot), proxy: provider, mcp: facade, credentialStale: () => authority.isStale(),
+        clockedSlot: clockedSlots.has(registration.slot),
+        writeTaskClock: (value) => dependencies.writeTaskClock(value, brokerTaskClockFileFor(registration.slot)),
+        workerIdentityEmpty: dependencies.workerIdentityEmpty,
+        taskClockFailed: () => { clockFailed.add(registration.slot); },
+        prepareIsolation: async (registration) => {
+            const attestation = attestationFor(registration);
+            const snapshot = await dependencies.prepareAttestation(attestation);
+            assertBrokerTaskClockIsolation(snapshot.configVariant, registration.slot, [...registrations.keys()], snapshot.denyPaths);
+            if (snapshot.configVariant === "clocked")
+                clockedSlots.add(registration.slot);
+            return {
+                guard: dependencies.createIsolationGuard(attestation, snapshot),
+                configVariant: snapshot.configVariant
+            };
+        },
+        runNative: (input, signal) => dependencies.runNative(options.nativeClient, input, signal)
+    });
+    return {
+        turn: createGrokEngineBrokerTurnDispatch(registrations, active, () => closed, async (registration, ...args) => {
+            if (clockFailed.has(registration.slot))
+                throw new EngineBrokerTurnFailure("unavailable", undefined, { outcome: "failed", usage: null, model: registration.model.model, requests: 0, limitReason: "none" }, undefined, undefined, undefined, ENGINE_BROKER_TASK_CLOCK_RESET_FAILED);
+            return runGrokEngineBrokerTurn(depsFor(registration), registration, ...args);
+        }, resetting),
+        async resetSlot(slot) {
+            const registration = registrations.get(slot);
+            if (closed || registration === undefined)
+                throw new Error("engine broker unavailable");
+            if (active.has(slot) || resetting.has(slot))
+                throw new Error("engine broker slot busy");
+            resetting.add(slot);
+            const reset = (async () => {
+                try {
+                    const empty = await awaitGrokWorkerIdentityEmpty(registration.workerUid, GROK_WORKER_REAP_WAIT_MS, dependencies.workerIdentityEmpty);
+                    if (!empty)
+                        throw new Error("engine broker slot busy");
+                    if (clockedSlots.has(slot))
+                        await dependencies.writeTaskClock(undefined, brokerTaskClockFileFor(slot));
+                    await rm(slotStore(slot), { recursive: true, force: true });
+                    turnStores.set(slot, new EngineBrokerTurnRegistry(slotStore(slot)));
+                    clockFailed.delete(slot);
+                }
+                catch (error) {
+                    clockFailed.add(slot);
+                    throw error;
+                }
+            })();
+            resets.set(slot, reset);
+            try {
+                await reset;
+            }
+            finally {
+                resetting.delete(slot);
+                resets.delete(slot);
+            }
+        },
+        requestInferenceGrant(request) {
+            if (closed || grants === undefined)
+                throw new GrokInferenceGrantRefused("unavailable");
+            if (authority.isStale())
+                throw new GrokInferenceGrantRefused("auth_stale");
+            return grants.issue(request);
+        },
+        releaseInferenceGrant(grantId) {
+            if (grants === undefined)
+                throw new GrokInferenceGrantRefused("unavailable");
+            return grants.release(grantId);
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            grants?.close();
+            const running = [...active.values()];
+            for (const entry of running)
+                entry.controller.abort();
+            await Promise.allSettled([...running.map((entry) => entry.done), ...resets.values()]);
+            const results = await Promise.allSettled([facade.close(), provider.close(), runBudget?.close()]);
+            results.push(...await Promise.allSettled([lease.close()]));
+            const failures = results.flatMap((entry) => entry.status === "rejected" ? [entry.reason] : []);
+            if (failures.length)
+                throw new AggregateError(failures, "engine broker shutdown failed");
+        },
+        readiness: () => ({
+            providerProxyPort: provider.port, mcpFacadePort: 43_124, registrations: registrations.size,
+            credentialStale: authority.isStale(), realmLease: true, workerIsolation: clockFailed.size === 0
+        })
+    };
+}
+/** The production dispatch boundary, isolated from credential/network setup for lifecycle tests. */
+export function createGrokEngineBrokerTurnDispatch(registrations, active, isClosed, run, resetting = new Set()) {
+    return async (agentId, ...input) => {
+        const [wakeId, prompt, mcpEndpoint, signal_, limits, processClock, requestedSlot] = input;
+        const matches = [...registrations.values()].filter((entry) => entry.agentId === agentId);
+        const registration = requestedSlot === undefined ? (matches.length === 1 ? matches[0] : undefined) : registrations.get(requestedSlot);
+        const args = [wakeId, prompt, mcpEndpoint, signal_, limits, processClock];
+        if (isClosed() || registration === undefined || registration.agentId !== agentId)
+            throw new Error("engine broker unavailable");
+        const slot = registration.slot;
+        if (active.has(slot) || resetting.has(slot))
+            throw new Error("engine broker slot already active");
+        const signal = args[3], controller = new AbortController();
+        const onAbort = () => controller.abort();
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            controller.abort();
+        args[3] = controller.signal;
+        const done = Promise.resolve().then(() => run(registration, ...args));
+        active.set(slot, { controller, done: done.then(() => undefined, () => undefined) });
+        try {
+            return await done;
+        }
+        finally {
+            signal?.removeEventListener("abort", onAbort);
+            active.delete(slot);
+        }
+    };
+}

package/dist/runtime/grokEngineBrokerLedger.d.ts

@@ -0,0 +1,52 @@
+import { type GrokTurnRequest } from "./turnRequestLedger.js";
+import { type TurnUsageFailureReason } from "./turnUsageLedger.js";
+import type { EngineBrokerTerminalResponse } from "./engineBrokerProtocol.js";
+/**
+ * The exact ledger bytes a terminal broker turn owes, sealed into its turn
+ * record *before* they are appended.
+ *
+ * The record is published first and the ledger appended second, so a crash in
+ * between used to leave a sealed turn whose spend never reached the ledger —
+ * and a replay never metered. Now a replay re-checks: if the ledger holds no
+ * row for this `turn`, it appends these same bytes (same `at`, same numbers).
+ * That is completing the original metering, not re-metering: a replay after a
+ * normal append finds the row and writes nothing, and readers dedupe on `turn`
+ * should two replays race.
+ */
+export type BrokerTurnLedgerLines = Readonly<{
+    usage: string | null;
+    requests: string;
+    seal?: string;
+}>;
+/** A v1 record, or a replay with no sealed bytes at all: nothing to append, including no seal. */
+export declare const EMPTY_BROKER_TURN_LEDGER: BrokerTurnLedgerLines;
+export type BrokerTurnLedgerDetail = Readonly<{
+    agentId: string;
+    wakeId: string;
+    notionalUsd: number;
+    complete: boolean;
+    reason?: TurnUsageFailureReason;
+    requests: readonly GrokTurnRequest[];
+    session?: string;
+    estimatedRequests: number;
+}>;
+export declare function renderBrokerTurnLedger(terminal: EngineBrokerTerminalResponse, detail: BrokerTurnLedgerDetail): BrokerTurnLedgerLines;
+/**
+ * Strict check of stored ledger bytes: exactly the turn's own rows,
+ * newline-terminated, bounded.
+ *
+ * `seal` is optional so a record sealed before this stream existed still
+ * replays; its absence means the turn owes no seal row, never that one was
+ * lost.
+ */
+export declare function parseBrokerTurnLedgerLines(value: unknown, turnId: string): BrokerTurnLedgerLines;
+export type BrokerTurnLedgerPaths = Readonly<{
+    usageLedgerPath: string;
+    requestLedgerPath: string;
+    sealLedgerPath: string;
+}>;
+/** Appends sealed lines on the first metering: no presence scan is needed, nothing was appended before the record existed. */
+export declare function appendBrokerTurnLedger(lines: BrokerTurnLedgerLines, paths: BrokerTurnLedgerPaths): Promise<void>;
+/** On replay: append each stream's sealed lines only when that stream (current file or its `.1`) holds no row for this turn. Never rejects. */
+export declare function ensureBrokerTurnLedgered(lines: BrokerTurnLedgerLines, turnId: string, paths: BrokerTurnLedgerPaths): Promise<void>;
+//# sourceMappingURL=grokEngineBrokerLedger.d.ts.map

package/dist/runtime/grokEngineBrokerLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokEngineBrokerLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBrokerLedger.ts"],"names":[],"mappings":"AAGA,OAAO,EAA8E,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1I,OAAO,EAAkD,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACxG,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,EAAE,qBAAoE,CAAC;AAE5G,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/O,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,4BAA4B,EAAE,MAAM,EAAE,sBAAsB,GAAG,qBAAqB,CAmBpI;AAKD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAqBhG;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE7H,8HAA8H;AAC9H,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtH;AAED,+IAA+I;AAC/I,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMxI"}

package/dist/runtime/grokEngineBrokerLedger.js

@@ -0,0 +1,114 @@
+import { readFile } from "node:fs/promises";
+import { renderBrokerTurnSealLine, TURN_SEAL_LEDGER_VERSION, TURN_SEAL_MAX_LINE_BYTES } from "./engineBrokerSealLedger.js";
+import { recordLedgerLines, renderGrokTurnRequestLines, TURN_REQUEST_LEDGER_VERSION } from "./turnRequestLedger.js";
+import { renderTurnUsageLine, TURN_USAGE_LEDGER_VERSION } from "./turnUsageLedger.js";
+/** A v1 record, or a replay with no sealed bytes at all: nothing to append, including no seal. */
+export const EMPTY_BROKER_TURN_LEDGER = Object.freeze({ usage: null, requests: "" });
+export function renderBrokerTurnLedger(terminal, detail) {
+    const at = new Date().toISOString();
+    // The seal row is rendered for *every* terminal turn, including one whose
+    // usage is null. That is the whole point: a turn cancelled before any usage
+    // could be attributed is exactly the turn whose outstanding MCP call and
+    // redacted last words have no other route to the host.
+    const seal = renderBrokerTurnSealLine(terminal, { agent: detail.agentId, wake: detail.wakeId, at });
+    if (terminal.usage === null)
+        return { usage: null, requests: "", seal };
+    const { usage } = terminal;
+    return {
+        seal,
+        usage: renderTurnUsageLine({
+            agent: detail.agentId, wake: detail.wakeId, engine: "grok", at,
+            usage: { input: usage.input, output: usage.output, cacheRead: usage.cacheRead, cacheWrite: usage.cacheWrite, total: usage.total, calls: terminal.requests, notionalUsd: detail.notionalUsd, complete: detail.complete },
+            outcome: terminal.kind === "completed" ? { status: "completed" } : { status: "failed", reason: detail.reason ?? "unknown" },
+            turn: terminal.turnId, limitReason: terminal.limitReason, model: terminal.model, estimatedRequests: detail.estimatedRequests
+        }),
+        requests: renderGrokTurnRequestLines({ agent: detail.agentId, wake: detail.wakeId, turn: terminal.turnId, model: terminal.model, requests: detail.requests, requestCount: terminal.requests, at, ...(detail.session === undefined ? {} : { session: detail.session }) })
+    };
+}
+const MAX_USAGE_LINE_BYTES = 4_096, MAX_REQUEST_LINES_BYTES = 262_144;
+const rows = (text) => text.split("\n").filter((line) => line.length > 0).map((line) => { const value = JSON.parse(line); if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new Error(); return value; });
+/**
+ * Strict check of stored ledger bytes: exactly the turn's own rows,
+ * newline-terminated, bounded.
+ *
+ * `seal` is optional so a record sealed before this stream existed still
+ * replays; its absence means the turn owes no seal row, never that one was
+ * lost.
+ */
+export function parseBrokerTurnLedgerLines(value, turnId) {
+    const invalid = () => new Error("broker turn registry unavailable");
+    if (value === null || typeof value !== "object" || Array.isArray(value) || !Object.hasOwn(value, "usage") || !Object.hasOwn(value, "requests"))
+        throw invalid();
+    const sealed = Object.hasOwn(value, "seal");
+    if (Object.keys(value).length !== (sealed ? 3 : 2))
+        throw invalid();
+    const { usage, requests, seal } = value;
+    try {
+        if (usage !== null) {
+            if (typeof usage !== "string" || !usage.endsWith("\n") || Buffer.byteLength(usage) > MAX_USAGE_LINE_BYTES)
+                throw invalid();
+            const parsed = rows(usage);
+            if (parsed.length !== 1 || parsed[0].v !== TURN_USAGE_LEDGER_VERSION || parsed[0].turn !== turnId)
+                throw invalid();
+        }
+        if (typeof requests !== "string" || (requests.length > 0 && (usage === null || !requests.endsWith("\n"))) || Buffer.byteLength(requests) > MAX_REQUEST_LINES_BYTES)
+            throw invalid();
+        if (rows(requests).some((row) => row.v !== TURN_REQUEST_LEDGER_VERSION || row.turn !== turnId))
+            throw invalid();
+        if (sealed) {
+            if (typeof seal !== "string" || !seal.endsWith("\n") || Buffer.byteLength(seal) > TURN_SEAL_MAX_LINE_BYTES)
+                throw invalid();
+            const parsed = rows(seal);
+            if (parsed.length !== 1 || parsed[0].v !== TURN_SEAL_LEDGER_VERSION || parsed[0].turn !== turnId)
+                throw invalid();
+        }
+    }
+    catch {
+        throw invalid();
+    }
+    return { usage: usage, requests, ...(sealed ? { seal: seal } : {}) };
+}
+/** Appends sealed lines on the first metering: no presence scan is needed, nothing was appended before the record existed. */
+export async function appendBrokerTurnLedger(lines, paths) {
+    if (lines.usage !== null)
+        await recordLedgerLines(paths.usageLedgerPath, lines.usage);
+    await recordLedgerLines(paths.requestLedgerPath, lines.requests);
+    // Last, and never conditional on usage: a turn with no attributable spend is
+    // precisely the one whose seal row is its only account of itself.
+    if (lines.seal !== undefined)
+        await recordLedgerLines(paths.sealLedgerPath, lines.seal);
+}
+/** On replay: append each stream's sealed lines only when that stream (current file or its `.1`) holds no row for this turn. Never rejects. */
+export async function ensureBrokerTurnLedgered(lines, turnId, paths) {
+    try {
+        if (lines.usage !== null && !await ledgerHasTurn(paths.usageLedgerPath, turnId))
+            await recordLedgerLines(paths.usageLedgerPath, lines.usage);
+        if (lines.requests.length > 0 && !await ledgerHasTurn(paths.requestLedgerPath, turnId))
+            await recordLedgerLines(paths.requestLedgerPath, lines.requests);
+        if (lines.seal !== undefined && !await ledgerHasTurn(paths.sealLedgerPath, turnId))
+            await recordLedgerLines(paths.sealLedgerPath, lines.seal);
+    }
+    catch { /* advisory: a replay never fails on its ledger */ }
+}
+async function ledgerHasTurn(file, turnId) {
+    for (const candidate of [`${file}.1`, file]) {
+        let text;
+        try {
+            text = await readFile(candidate, "utf8");
+        }
+        catch {
+            continue;
+        }
+        for (const line of text.split("\n")) {
+            if (!line.includes(turnId))
+                continue;
+            try {
+                if (JSON.parse(line).turn === turnId)
+                    return true;
+            }
+            catch { /* a torn line is not this turn's row */ }
+        }
+    }
+    return false;
+}

package/dist/runtime/grokEngineBrokerMetering.d.ts

@@ -0,0 +1,51 @@
+import type { EngineBrokerRequest, EngineBrokerTerminalResponse } from "./engineBrokerProtocol.js";
+import type { EngineBrokerTurnRegistry } from "./engineBrokerTurnRegistry.js";
+import type { GrokTurnRequest } from "./turnRequestLedger.js";
+import type { TurnUsageFailureReason } from "./turnUsageLedger.js";
+export type BrokerTurnMetering = Readonly<{
+    usageLedgerPath: string;
+    requestLedgerPath: string;
+    /** Where the sealed response's operator-visible projection is appended (`engineBrokerSealLedger.ts`). */
+    sealLedgerPath: string;
+    agentId: string;
+    wakeId: string;
+}>;
+export type BrokerTurnMeteringDetail = Readonly<{
+    notionalUsd: number;
+    complete: boolean;
+    reason?: TurnUsageFailureReason;
+    requests: readonly GrokTurnRequest[];
+    session?: string;
+    estimatedRequests: number;
+}>;
+/**
+ * Seal a terminal turn, then meter it. The broker is the single writer.
+ *
+ * Order is load-bearing. The ledger bytes are rendered first and sealed into
+ * the durable terminal record together with its accounting
+ * (`grokEngineBrokerLedger.ts`); only after `turns.finish` published that
+ * record are the same bytes appended. A replayed turn returns before the
+ * broker's `try` block and never meters again — it only completes an append a
+ * crash interrupted (`ensureBrokerTurnLedgered`), and every row carries the
+ * turn id as `turn`, so a reader that sees one twice counts it once.
+ *
+ * Remaining window, documented rather than closed: a crash before the record's
+ * rename (while the turn is still `active`, including mid-turn) makes the next
+ * boot seal that turn `failed` with `usage: null`, so its spend is unmetered.
+ * Closing it needs the running proxy usage checkpointed into the active record
+ * on every request (an fsync'd rewrite per model request); not done here.
+ *
+ * Both terminal kinds meter: a failed turn spent real tokens, so its partial
+ * usage is written with `outcome: failed` and its closed `limitReason`. A turn
+ * with no usage at all (`usage: null`) writes no *usage* row — a zero row is
+ * byte-identical to a measured zero — but it still writes its seal row, which
+ * is a record of what the turn did rather than of what it spent.
+ *
+ * Appends never reject, so an append failure cannot escape into the caller's
+ * `catch` and rewrite a completed turn as failed; the caller also refuses to
+ * re-seal a turn this helper already sealed.
+ */
+export declare function finishBrokerTurnWithUsage(turns: EngineBrokerTurnRegistry, request: Extract<EngineBrokerRequest, {
+    kind: "start_turn";
+}>, terminal: EngineBrokerTerminalResponse, metering: BrokerTurnMetering, detail: BrokerTurnMeteringDetail, onSealed?: () => void): Promise<void>;
+//# sourceMappingURL=grokEngineBrokerMetering.d.ts.map

package/dist/runtime/grokEngineBrokerMetering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokEngineBrokerMetering.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBrokerMetering.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yGAAyG;IACzG,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhN;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ,GAAE,MAAM,IAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7S"}

package/dist/runtime/grokEngineBrokerMetering.js

@@ -0,0 +1,34 @@
+import { appendBrokerTurnLedger, renderBrokerTurnLedger } from "./grokEngineBrokerLedger.js";
+/**
+ * Seal a terminal turn, then meter it. The broker is the single writer.
+ *
+ * Order is load-bearing. The ledger bytes are rendered first and sealed into
+ * the durable terminal record together with its accounting
+ * (`grokEngineBrokerLedger.ts`); only after `turns.finish` published that
+ * record are the same bytes appended. A replayed turn returns before the
+ * broker's `try` block and never meters again — it only completes an append a
+ * crash interrupted (`ensureBrokerTurnLedgered`), and every row carries the
+ * turn id as `turn`, so a reader that sees one twice counts it once.
+ *
+ * Remaining window, documented rather than closed: a crash before the record's
+ * rename (while the turn is still `active`, including mid-turn) makes the next
+ * boot seal that turn `failed` with `usage: null`, so its spend is unmetered.
+ * Closing it needs the running proxy usage checkpointed into the active record
+ * on every request (an fsync'd rewrite per model request); not done here.
+ *
+ * Both terminal kinds meter: a failed turn spent real tokens, so its partial
+ * usage is written with `outcome: failed` and its closed `limitReason`. A turn
+ * with no usage at all (`usage: null`) writes no *usage* row — a zero row is
+ * byte-identical to a measured zero — but it still writes its seal row, which
+ * is a record of what the turn did rather than of what it spent.
+ *
+ * Appends never reject, so an append failure cannot escape into the caller's
+ * `catch` and rewrite a completed turn as failed; the caller also refuses to
+ * re-seal a turn this helper already sealed.
+ */
+export async function finishBrokerTurnWithUsage(turns, request, terminal, metering, detail, onSealed = () => undefined) {
+    const lines = renderBrokerTurnLedger(terminal, { ...detail, agentId: metering.agentId, wakeId: metering.wakeId });
+    await turns.finish(request, terminal, lines);
+    onSealed();
+    await appendBrokerTurnLedger(lines, metering);
+}

package/dist/runtime/grokEngineBrokerTurn.d.ts

@@ -0,0 +1,82 @@
+import type { GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+import { writeBrokerTaskClock, type BrokerShellClock, type BrokerClockObservation } from "./grokBrokerTaskClock.js";
+import { type GrokBrokerProviderClockObservation } from "./grokBrokerProviderClock.js";
+import { type EngineBrokerCleanupObservation, type EngineBrokerFailureCode } from "./engineBrokerProtocol.js";
+import type { EngineBrokerMcpCallObservation } from "./engineBrokerMcpCallLog.js";
+import { type EngineBrokerTurnAccounting, type EngineBrokerTurnLimitOverrides } from "./engineBrokerTurnAccounting.js";
+import { type NativeBrokerDiagnostic, type NativeBrokerTurn, type NativeBrokerTurnResult } from "./engineBrokerNativeClient.js";
+import type { EngineBrokerTurnRegistry } from "./engineBrokerTurnRegistry.js";
+import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
+import type { GrokBrokerProxyTurn } from "./grokBrokerProxy.js";
+import { type GrokBrokerTurnEndTiming, type GrokWorkerProcess } from "./grokEngineBrokerTurnEnd.js";
+import type { EngineBrokerMcpActivity } from "./engineBrokerMcpCallLog.js";
+export type GrokEngineBrokerTurnResult = Readonly<{
+    text: string;
+    workerPid: number;
+    workerUid: number;
+    workerStartTime: string;
+}> & EngineBrokerTurnAccounting & BrokerClockObservation & EngineBrokerCleanupObservation;
+export declare class EngineBrokerTurnFailure extends Error {
+    readonly code: Exclude<EngineBrokerFailureCode, "turn_conflict">;
+    readonly diagnostic?: NativeBrokerDiagnostic | undefined;
+    readonly accounting?: EngineBrokerTurnAccounting | undefined;
+    readonly mcpCalls?: EngineBrokerMcpCallObservation | undefined;
+    readonly shellClock?: BrokerShellClock | undefined;
+    readonly providerClock?: GrokBrokerProviderClockObservation | undefined;
+    readonly cleanupDiagnostic?: EngineBrokerCleanupObservation["cleanupDiagnostic"];
+    constructor(code: Exclude<EngineBrokerFailureCode, "turn_conflict">, diagnostic?: NativeBrokerDiagnostic | undefined, accounting?: EngineBrokerTurnAccounting | undefined, mcpCalls?: EngineBrokerMcpCallObservation | undefined, shellClock?: BrokerShellClock | undefined, providerClock?: GrokBrokerProviderClockObservation | undefined, cleanupDiagnostic?: EngineBrokerCleanupObservation["cleanupDiagnostic"]);
+}
+/** Everything one broker turn touches, injected so the accounting and limit paths run under test without a native launcher. */
+export type GrokEngineBrokerTurnDependencies = Readonly<{
+    turns: EngineBrokerTurnRegistry;
+    proxy: Readonly<{
+        capabilities: Readonly<{
+            issue(agentId: string, turnId: string, ttlMs?: number): string;
+            revoke(turnId: string): void;
+        }>;
+        registerIsolationGuard(turnId: string, guard: () => Promise<void>): void;
+        revokeIsolationGuard(turnId: string): void;
+        registerTurn(turnId: string, turn: GrokBrokerProxyTurn): void;
+        revokeTurn(turnId: string): void;
+    }>;
+    mcp: Readonly<{
+        register(agentId: string, turnId: string, endpoint: string, ttlMs?: number): string;
+        revoke(turnId: string): void;
+        observe?(turnId: string): EngineBrokerMcpCallObservation | undefined;
+        activity?(turnId: string): EngineBrokerMcpActivity | undefined;
+    }>;
+    credentialStale(): boolean;
+    prepareIsolation(registration: EngineBrokerServiceRegistration): Promise<Readonly<{
+        guard: () => Promise<void>;
+        configVariant: GrokWorkerConfigVariant;
+    }>>;
+    writeTaskClock?: typeof writeBrokerTaskClock;
+    /** Startup attestation also owns cleanup when per-turn attestation fails. */
+    clockedSlot?: boolean;
+    /** A failed cleanup fences production dispatch until the broker restarts. */
+    taskClockFailed?(): void;
+    runNative(input: NativeBrokerTurn, signal: AbortSignal): Promise<Readonly<NativeBrokerTurnResult>>;
+    /** The worker the launcher started for this identity (`/proc` by default); only read when the broker ends a turn itself. */
+    observeWorker?(workerUid: number): Promise<GrokWorkerProcess | undefined>;
+    /** Overrides the turn-end grace and idle bounds (tests). */
+    turnEnd?: GrokBrokerTurnEndTiming;
+    /** Whether no live process holds the worker identity (`/proc` by default); polled, bounded, before an aborted turn is sealed. */
+    workerIdentityEmpty?(workerUid: number): Promise<boolean>;
+    workerReapWaitMs?: number;
+}>;
+/**
+ * One brokered Grok turn under its declared limits.
+ *
+ * The limits are the registration's, lowered (never raised) by the wake. The
+ * proxy meter refuses model requests past `maxRequests`, past the elapsed
+ * deadline, or once the upstream-reported running total reached `maxTokens`,
+ * and a tripped limit aborts the worker through the same cancel/kill path a
+ * client cancellation uses. A wall-clock timer trips `timeout` for a worker
+ * that is mid-request.
+ *
+ * Every terminal path — completed, failed, limit, cancelled — is sealed and
+ * metered through {@link finishBrokerTurnWithUsage}; a replayed turn returns its
+ * sealed accounting before any of this runs and never meters again.
+ */
+export declare function runGrokEngineBrokerTurn(deps: GrokEngineBrokerTurnDependencies, registration: EngineBrokerServiceRegistration, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, overrides?: EngineBrokerTurnLimitOverrides, processClock?: string): Promise<GrokEngineBrokerTurnResult>;
+//# sourceMappingURL=grokEngineBrokerTurn.d.ts.map