@noopolis/daimon 0.2.0 → 0.2.1

package/dist/runtime/grokBrokerProviderClock.js

@@ -0,0 +1,133 @@
+import { parseBrokerProcessClock } from "./grokBrokerTaskClock.js";
+import { parseGrokBrokerProxyJson } from "./grokBrokerProxyJson.js";
+export class GrokBrokerProviderClockRefusal extends Error {
+    reason;
+    constructor(reason) {
+        super(`grok broker proxy refused: ${reason}`);
+        this.reason = reason;
+    }
+}
+const DATE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/u;
+const DATE_LINE = /^Today's date: ([0-9]{4}-[0-9]{2}-[0-9]{2})$/u;
+const DATE_LIKE = /today['’]?s\s+date\b/iu;
+const MAX_TASK_MS = 253_402_300_799_999;
+/** One processClock, owned by one turn; never reads the broker's ambient TZ. */
+export class GrokBrokerProviderClock {
+    now;
+    offsetMs;
+    observation = {
+        requests: 0, linesRewritten: 0, requestsWithoutDateLine: 0, linesIgnored: 0,
+        injectedDate: null, taskDate: null
+    };
+    constructor(processClock, now = () => Date.now()) {
+        this.now = now;
+        this.offsetMs = Math.round(Number(parseBrokerProcessClock(processClock)) * 1000);
+    }
+    rewrite(body) {
+        this.observation = { ...this.observation, requests: this.observation.requests + 1 };
+        let parsed;
+        try {
+            parsed = parseGrokBrokerProxyJson(body);
+        }
+        catch {
+            throw new GrokBrokerProviderClockRefusal("request_body_rejected");
+        }
+        const taskMs = this.now() + this.offsetMs;
+        if (!Number.isSafeInteger(taskMs) || taskMs < 0 || taskMs > MAX_TASK_MS) {
+            throw new GrokBrokerProviderClockRefusal("task_clock_date_range");
+        }
+        // The native launcher pins TZ=UTC. Compute once per request, including
+        // history resends; a long turn may cross midnight between requests.
+        const taskDate = new Date(taskMs).toISOString().slice(0, 10);
+        let lines = 0;
+        let ignored = 0;
+        let injectedDate = null;
+        const countIgnored = (text) => text.split(/\r\n|\r|\n/u).filter((line) => DATE_LIKE.test(line)).length;
+        const rewriteText = (text, injected) => {
+            const block = injected ? /<user_info>([\s\S]*?)<\/user_info>/u.exec(text) : null;
+            if (block === null) {
+                ignored += countIgnored(text);
+                return text;
+            }
+            const before = text.slice(0, block.index), after = text.slice(block.index + block[0].length);
+            ignored += countIgnored(before) + countIgnored(after);
+            const rewritten = block[1].split(/(\r\n|\r|\n)/u).map((line) => {
+                if (!DATE_LIKE.test(line))
+                    return line;
+                const match = DATE_LINE.exec(line);
+                if (match === null)
+                    throw new GrokBrokerProviderClockRefusal("task_clock_date_format");
+                lines++;
+                injectedDate = match[1];
+                return `Today's date: ${taskDate}`;
+            }).join("");
+            return `${before}<user_info>${rewritten}</user_info>${after}`;
+        };
+        if (Array.isArray(parsed.value.messages)) {
+            let firstUser = true;
+            for (const message of parsed.value.messages) {
+                if (!isRecord(message))
+                    continue;
+                const injected = message.role === "user" && firstUser;
+                if (message.role === "user")
+                    firstUser = false;
+                if (typeof message.content === "string") {
+                    message.content = rewriteText(message.content, injected);
+                }
+                else if (Array.isArray(message.content)) {
+                    const parts = message.content.filter((part) => isRecord(part) && part.type === "text" && typeof part.text === "string");
+                    // A block or date can straddle text parts. Replacements have exactly
+                    // the same width, so slicing restores every original part boundary.
+                    const rewritten = rewriteText(parts.map((part) => part.text).join(""), injected);
+                    let start = 0;
+                    for (const part of parts) {
+                        const end = start + part.text.length;
+                        part.text = rewritten.slice(start, end);
+                        start = end;
+                    }
+                }
+            }
+        }
+        // Commit only after the entire body passes: a refused request rewrites no
+        // lines upstream, even when an earlier line had the recognized format.
+        this.observation = {
+            requests: this.observation.requests,
+            linesRewritten: this.observation.linesRewritten + lines,
+            requestsWithoutDateLine: this.observation.requestsWithoutDateLine + (lines === 0 ? 1 : 0),
+            linesIgnored: (this.observation.linesIgnored ?? 0) + ignored,
+            injectedDate: lines === 0 ? this.observation.injectedDate : injectedDate,
+            taskDate: lines === 0 ? this.observation.taskDate : taskDate
+        };
+        return lines === 0 ? parsed.body : Buffer.from(JSON.stringify(parsed.value));
+    }
+    snapshot() {
+        return { ...this.observation };
+    }
+}
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Closed, dates-only observation on the v3 terminal frame and durable seal. */
+export function parseGrokBrokerProviderClockObservation(value) {
+    if (!isRecord(value))
+        throw new TypeError("invalid broker frame");
+    const fields = ["requests", "linesRewritten", "requestsWithoutDateLine", "injectedDate", "taskDate"];
+    if (Object.keys(value).some((key) => !fields.includes(key) && key !== "linesIgnored") ||
+        fields.some((key) => !Object.hasOwn(value, key))) {
+        throw new TypeError("invalid broker frame");
+    }
+    for (const key of [...fields.slice(0, 3), ...(Object.hasOwn(value, "linesIgnored") ? ["linesIgnored"] : [])]) {
+        if (!Number.isSafeInteger(value[key]) || value[key] < 0) {
+            throw new TypeError("invalid broker frame");
+        }
+    }
+    const result = value;
+    if (result.requestsWithoutDateLine > result.requests ||
+        (result.linesRewritten > 0 && result.requestsWithoutDateLine === result.requests)) {
+        throw new TypeError("invalid broker frame");
+    }
+    for (const date of [result.injectedDate, result.taskDate]) {
+        if (result.linesRewritten === 0 ? date !== null : typeof date !== "string" || !DATE.test(date)) {
+            throw new TypeError("invalid broker frame");
+        }
+    }
+    return { ...result };
+}

package/dist/runtime/grokBrokerProxy.d.ts

@@ -1,12 +1,16 @@
+import { type GrokBrokerRunBudget } from "./grokBrokerRunBudget.js";
+import { type IncomingMessage, type ServerResponse } from "node:http";
 import { EngineBrokerCapabilities } from "./engineBrokerCapabilities.js";
 import { type GrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
 import { authorizeGrokBrokerProxyRequest } from "./grokBrokerProxyRequest.js";
 import { type GrokBrokerTurnMeter } from "./grokBrokerTurnMeter.js";
 import type { GrokInferenceGrants } from "./grokInferenceGrants.js";
+import { type GrokBrokerProviderClock } from "./grokBrokerProviderClock.js";
 /** One running turn as the proxy sees it: its declared model/effort and its spend gate. */
 export type GrokBrokerProxyTurn = Readonly<{
     policy: GrokBrokerModelPolicy;
     meter: GrokBrokerTurnMeter;
+    clock?: GrokBrokerProviderClock;
 }>;
 export type GrokBrokerCredentialAuthority = Readonly<{
     accessToken(forceRefresh: boolean): Promise<string>;
@@ -30,15 +34,25 @@ export type GrokBrokerUpstream = (request: ReturnType<typeof authorizeGrokBroker
  * `grokInferenceProxy.ts`; every other bearer is looked up only among turn
  * capabilities. Without `grants` a prefixed bearer is simply refused.
  */
-export declare function startGrokBrokerProxy(authority: GrokBrokerCredentialAuthority, upstream?: GrokBrokerUpstream, policy?: GrokBrokerModelPolicy, listenPort?: number, grants?: GrokInferenceGrants): Promise<Readonly<{
+export declare function startGrokBrokerProxy(authority: GrokBrokerCredentialAuthority, upstream?: GrokBrokerUpstream, policy?: GrokBrokerModelPolicy, listenPort?: number, grants?: GrokInferenceGrants, runBudget?: GrokBrokerRunBudget): Promise<{
     port: number;
+    close: () => Promise<void>;
     capabilities: EngineBrokerCapabilities;
     registerIsolationGuard(turnId: string, guard: () => Promise<void>): void;
     revokeIsolationGuard(turnId: string): void;
     registerTurn(turnId: string, turn: GrokBrokerProxyTurn): void;
     revokeTurn(turnId: string): void;
-    close(): Promise<void>;
-}>>;
+    serve: (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+}>;
+/** @internal The production request handler, usable without opening a socket. */
+export declare function createGrokBrokerProxyHandler(authority: GrokBrokerCredentialAuthority, upstream?: GrokBrokerUpstream, policy?: GrokBrokerModelPolicy, grants?: GrokInferenceGrants, runBudget?: GrokBrokerRunBudget): {
+    capabilities: EngineBrokerCapabilities;
+    registerIsolationGuard(turnId: string, guard: () => Promise<void>): void;
+    revokeIsolationGuard(turnId: string): void;
+    registerTurn(turnId: string, turn: GrokBrokerProxyTurn): void;
+    revokeTurn(turnId: string): void;
+    serve: (request: IncomingMessage, response: ServerResponse) => Promise<void>;
+};
 /**
  * A refusal the caller must not retry.
  *

package/dist/runtime/grokBrokerProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerProxy.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProxy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACtI,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,OAAO,EAAsD,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGxH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAC;AAE1G,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IAAE,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,qBAAqB,CAAC,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AACjQ,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3N;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,6BAA6B,EAAE,QAAQ,GAAE,kBAAoC,EAAE,MAAM,GAAE,qBAAwD,EAAE,UAAU,SAAS,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,wBAAwB,CAAC;IAAC,sBAAsB,CAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,MAAI,OAAO,CAAC,IAAI,CAAC,GAAE,IAAI,CAAC;IAAC,oBAAoB,CAAC,MAAM,EAAC,MAAM,GAAE,IAAI,CAAC;IAAC,YAAY,CAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,mBAAmB,GAAE,IAAI,CAAC;IAAC,UAAU,CAAC,MAAM,EAAC,MAAM,GAAE,IAAI,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC,CAMtiB;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CACpC"}
+{"version":3,"file":"grokBrokerProxy.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAIpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACtI,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,OAAO,EAA2E,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG7I,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAkC,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5G,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IAAE,WAAW,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,qBAAqB,CAAC,CAAC,mBAAmB,EAAC,MAAM,GAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,mBAAmB,CAAC,EAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,CAAC,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AACjQ,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC,CAAC;AAE3N;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,6BAA6B,EAAE,QAAQ,GAAE,kBAAoC,EACxF,MAAM,GAAE,qBAAwD,EAAE,UAAU,SAAS,EACrF,MAAM,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,mBAAmB;;;;mCAoC5B,MAAM,SAAS,MAAM,OAAO,CAAC,IAAI,CAAC;iCACpC,MAAM;yBACd,MAAM,QAAQ,mBAAmB;uBAMnC,MAAM;qBACR,eAAe,YAAY,cAAc;GA5B7D;AAED,iFAAiF;AACjF,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,6BAA6B,EAAE,QAAQ,GAAE,kBAAoC,EACxF,MAAM,GAAE,qBAAwD,EAAE,MAAM,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,mBAAmB;;mCAc9F,MAAM,SAAS,MAAM,OAAO,CAAC,IAAI,CAAC;iCACpC,MAAM;yBACd,MAAM,QAAQ,mBAAmB;uBAMnC,MAAM;qBACR,eAAe,YAAY,cAAc;EAI7D;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CACpC"}

package/dist/runtime/grokBrokerProxy.js

@@ -1,3 +1,4 @@
+import { GrokBrokerRunLimit } from "./grokBrokerRunBudget.js";
 import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { redactCredentialText } from "../core/credentialRedaction.js";
@@ -7,9 +8,10 @@ import { ENGINE_BROKER_AUTH_STALE } from "./engineBrokerProtocol.js";
 import { DEFAULT_GROK_BROKER_MODEL_POLICY, parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
 import { authorizeGrokBrokerProxyRequest } from "./grokBrokerProxyRequest.js";
 import { GROK_SESSION_TITLE_SINK_KEY } from "./grokBrokerWorkerConfig.js";
-import { parseGrokResponseToolNames, parseGrokUpstreamUsage } from "./grokBrokerTurnMeter.js";
+import { parseGrokFinalReply, parseGrokResponseToolNames, parseGrokUpstreamUsage } from "./grokBrokerTurnMeter.js";
 import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
 import { serveGrokInferenceGrant } from "./grokInferenceProxy.js";
+import { GrokBrokerProviderClockRefusal } from "./grokBrokerProviderClock.js";
 /**
  * `policy` is the fallback declared model/effort (closed list); a registered
  * turn's own policy wins. A request whose turn has no registered meter is
@@ -21,15 +23,48 @@ import { serveGrokInferenceGrant } from "./grokInferenceProxy.js";
  * `grokInferenceProxy.ts`; every other bearer is looked up only among turn
  * capabilities. Without `grants` a prefixed bearer is simply refused.
  */
-export async function startGrokBrokerProxy(authority, upstream = defaultUpstream, policy = DEFAULT_GROK_BROKER_MODEL_POLICY, listenPort = 43_123, grants) {
+export async function startGrokBrokerProxy(authority, upstream = defaultUpstream, policy = DEFAULT_GROK_BROKER_MODEL_POLICY, listenPort = 43_123, grants, runBudget) {
+    const handler = createGrokBrokerProxyHandler(authority, upstream, policy, grants, runBudget);
+    const server = createServer((request, response) => { void handler.serve(request, response); });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(listenPort, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+    });
+    const address = server.address();
+    return {
+        ...handler, port: address.port,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => error === undefined ? resolve() : reject(error));
+            // A worker's idle pooled socket otherwise leaves close() without a bound.
+            server.closeAllConnections();
+        })
+    };
+}
+/** @internal The production request handler, usable without opening a socket. */
+export function createGrokBrokerProxyHandler(authority, upstream = defaultUpstream, policy = DEFAULT_GROK_BROKER_MODEL_POLICY, grants, runBudget) {
+    const admittedUpstream = async (request, signal) => {
+        signal?.throwIfAborted();
+        await runBudget?.reserve();
+        signal?.throwIfAborted();
+        return upstream(request, signal);
+    };
     const declared = parseGrokBrokerModelPolicy(policy);
     const capabilities = new EngineBrokerCapabilities();
     const guards = new Map();
     const turns = new Map();
-    const server = createServer((request, response) => { void serve(request, response, authority, upstream, capabilities, guards, turns, declared, grants); });
-    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(listenPort, "127.0.0.1", () => { server.off("error", reject); resolve(); }); });
-    const address = server.address();
-    return { port: address.port, capabilities, registerIsolationGuard(turnId, guard) { guards.set(turnId, guard); }, revokeIsolationGuard(turnId) { guards.delete(turnId); }, registerTurn(turnId, turn) { turns.set(turnId, { policy: parseGrokBrokerModelPolicy(turn.policy), meter: turn.meter }); }, revokeTurn(turnId) { turns.delete(turnId); }, close: () => new Promise((resolve, reject) => { server.close((error) => error === undefined ? resolve() : reject(error)); /* `close` waits for every open connection, and a worker keeps its client pool's socket to this proxy open with nothing here accounting for it — so that wait has no bound. Ending them is this listener's to do, exactly as the MCP facade does. */ /* `close` waits for every open connection, and a worker keeps its client pool's socket to this proxy open with nothing here accounting for it — so that wait has no bound. Ending them is this listener's to do, exactly as the MCP facade does. */ server.closeAllConnections(); }) };
+    return {
+        capabilities,
+        registerIsolationGuard(turnId, guard) { guards.set(turnId, guard); },
+        revokeIsolationGuard(turnId) { guards.delete(turnId); },
+        registerTurn(turnId, turn) {
+            turns.set(turnId, {
+                policy: parseGrokBrokerModelPolicy(turn.policy), meter: turn.meter,
+                ...(turn.clock === undefined ? {} : { clock: turn.clock })
+            });
+        },
+        revokeTurn(turnId) { turns.delete(turnId); },
+        serve: (request, response) => serve(request, response, authority, admittedUpstream, capabilities, guards, turns, declared, grants)
+    };
 }
 /**
  * A refusal the caller must not retry.
@@ -55,7 +90,7 @@ async function serve(request, response, authority, upstream, capabilities, guard
     // child and launcher diagnostics are. Nothing reads them but {@link brokerFaultCause}.
     const secrets = [];
     try {
-        const body = await readBody(request);
+        let body = await readBody(request);
         const headers = Object.fromEntries(Object.entries(request.headers).map(([key, value]) => [key, Array.isArray(value) ? value[0] : value]));
         titleSink = headers.authorization === `Bearer ${GROK_SESSION_TITLE_SINK_KEY}`;
         const match = headers.authorization?.match(/^Bearer ([A-Za-z0-9_-]{40,})$/u);
@@ -78,6 +113,17 @@ async function serve(request, response, authority, upstream, capabilities, guard
         catch (error) {
             throw new GrokBrokerProxyRefusal("worker_isolation_unverified");
         }
+        // Neutralize engine context before the existing body gate or bearer read.
+        // The clock belongs to this turn, never to the slot's installed variant.
+        try {
+            if (turn.clock !== undefined)
+                body = Buffer.from(turn.clock.rewrite(body));
+        }
+        catch (error) {
+            if (error instanceof GrokBrokerProviderClockRefusal)
+                throw new GrokBrokerProxyRefusal(error.reason);
+            throw error;
+        }
         // A fenced realm is not a transient fault: the credential is gone until an
         // operator re-logs in, and 503 made Grok blind-retry it (observed: fifteen
         // retries over five minutes, $0 spent, nothing learned). Named, 400, and
@@ -102,7 +148,7 @@ async function serve(request, response, authority, upstream, capabilities, guard
             response.end('{"error":"turn request in flight"}');
             return;
         }
-        settle = (usage, toolCalls) => { turn.meter.settle(admission.index, usage, body.byteLength, toolCalls); settle = undefined; };
+        settle = (usage, toolCalls, finalReply) => { turn.meter.settle(admission.index, usage, body.byteLength, toolCalls, finalReply); settle = undefined; };
         let result = await upstream(prepared, admission.signal);
         if (result.status === 401) {
             token = authority.refreshAfterRejection ? await authority.refreshAfterRejection(rejectedDigest) : await authority.accessToken(true);
@@ -118,12 +164,21 @@ async function serve(request, response, authority, upstream, capabilities, guard
         // is already buffered here for its usage block, so what the model tried to
         // call is in hand. A decoder fault records no attempt rather than a false
         // empty one, and never disturbs the turn.
-        settle?.(usageOrEstimate(result.body, result.headers["content-type"]), toolCallsOrNothing(result.body, result.headers["content-type"]));
+        // A successful answer that called nothing and stopped is the turn's final
+        // reply: the broker ends a worker that finished but did not exit on it
+        // (`grokEngineBrokerTurnEnd.ts`), and reports it when the launcher refused
+        // the worker's stdout. Observation only, exactly like the tool names.
+        settle?.(usageOrEstimate(result.body, result.headers["content-type"]), toolCallsOrNothing(result.body, result.headers["content-type"]), result.status === 200 ? finalReplyOrNothing(result.body, result.headers["content-type"]) : undefined);
         response.writeHead(result.status, { "content-type": result.headers["content-type"] ?? "application/json", "cache-control": "no-store" });
         response.end(result.body);
     }
     catch (error) {
         settle?.(undefined);
+        if (error instanceof GrokBrokerRunLimit) {
+            response.writeHead(429, { "content-type": "application/json", "cache-control": "no-store" });
+            response.end('{"error":"run_request_limit"}');
+            return;
+        }
         // Name the refusal on the broker's own stderr (reason code only, never a body
         // or a token) so a failing turn is diagnosable without a stub harness —
         // except for the two requests every healthy turn makes anyway.
@@ -243,6 +298,15 @@ const toolCallsOrNothing = (body, contentType) => {
         return undefined;
     }
 };
+/** Instrumentation must never fail a turn: a throwing decoder reports no final reply. */
+const finalReplyOrNothing = (body, contentType) => {
+    try {
+        return parseGrokFinalReply(body, contentType);
+    }
+    catch {
+        return undefined;
+    }
+};
 /** The body gate, refused non-retryably: a rejected body is a policy miss, never a transient fault. */
 function authorizeRequestOrRefuse(...args) {
     try {

package/dist/runtime/grokBrokerProxyJson.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Preserve ordinary JSON bytes, including whitespace and escaping. Ambiguous
+ * duplicate members still normalize to the validated values, as the spend gate
+ * requires: an upstream parser must never select a different model or tool set.
+ */
+export declare function parseGrokBrokerProxyJson(body: Uint8Array): {
+    value: Record<string, unknown>;
+    body: Uint8Array;
+};
+//# sourceMappingURL=grokBrokerProxyJson.d.ts.map

package/dist/runtime/grokBrokerProxyJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerProxyJson.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProxyJson.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,UAAU,GAAG;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,UAAU,CAAC;CAClB,CAuBA"}

package/dist/runtime/grokBrokerProxyJson.js

@@ -0,0 +1,31 @@
+/**
+ * Preserve ordinary JSON bytes, including whitespace and escaping. Ambiguous
+ * duplicate members still normalize to the validated values, as the spend gate
+ * requires: an upstream parser must never select a different model or tool set.
+ */
+export function parseGrokBrokerProxyJson(body) {
+    const source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(body);
+    let properties = 0;
+    const value = JSON.parse(source, (key, entry) => {
+        if (key === "__proto__")
+            throw new Error("broker proxy request rejected");
+        if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+            properties += Object.keys(entry).length;
+        }
+        return entry;
+    });
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("broker proxy request rejected");
+    }
+    // JSON.parse established the grammar. Match whole string tokens (including
+    // escaped quotes), so a colon inside message content cannot count as a key.
+    let sourceProperties = 0;
+    for (const token of source.matchAll(/"(?:[^"\\]|\\[\s\S])*"\s*(:)?/gu)) {
+        if (token[1] !== undefined)
+            sourceProperties++;
+    }
+    return {
+        value: value,
+        body: sourceProperties === properties ? body : Buffer.from(JSON.stringify(value))
+    };
+}

package/dist/runtime/grokBrokerProxyRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokBrokerProxyRequest.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProxyRequest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGtI,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC9L,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,qDAAqD,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAE9K;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,qBAAwD,GAAG,yBAAyB,CAsBhO;AASD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAStD"}
+{"version":3,"file":"grokBrokerProxyRequest.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerProxyRequest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAgE,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGtI,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC9L,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,qDAAqD,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAE9K;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,qBAAwD,GAAG,yBAAyB,CAmChO;AASD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAStD"}

package/dist/runtime/grokBrokerProxyRequest.js

@@ -34,8 +34,11 @@ export function authorizeGrokBrokerProxyRequest(input, capabilities, bearer, pol
     // `__proto__` is refused at any depth: JSON.parse makes it an ordinary own
     // member, but an upstream JavaScript parser may treat it as a prototype.
     try {
-        parsed = JSON.parse(Buffer.from(input.body).toString("utf8"), (key, value) => { if (key === "__proto__")
-            throw new Error(); return value; });
+        parsed = JSON.parse(Buffer.from(input.body).toString("utf8"), (key, value) => {
+            if (key === "__proto__")
+                throw new Error("broker proxy request rejected");
+            return value;
+        });
     }
     catch {
         throw new Error("broker proxy request rejected");
@@ -48,10 +51,18 @@ export function authorizeGrokBrokerProxyRequest(input, capabilities, bearer, pol
         throw new Error("broker proxy request rejected");
     if (Object.keys(parsed).some((key) => !LEAN_BODY_MEMBERS.has(key)) || !validStreamOptions(parsed.stream_options))
         throw new Error("broker proxy request rejected");
-    // Forward what was validated, never the worker's bytes: JSON.parse keeps the
-    // last of duplicate keys, and an upstream that keeps the first would
-    // otherwise see a different `tools`/`model`/`reasoning_effort` than the gate.
-    return { url: "https://cli-chat-proxy.grok.com/v1/chat/completions", headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json", "x-xai-token-auth": "xai-grok-cli", "x-grok-model-override": declared.model, "x-grok-client-version": clientVersion, "x-grok-client-identifier": "grok-shell" }, body: Buffer.from(JSON.stringify(parsed)) };
+    // Keep origin/main's production handling: UTF-8 replacement decoding, then
+    // serialize the validated object (including last-member-wins duplicates).
+    // Only a clocked turn takes the stricter date rewrite before this gate.
+    return {
+        url: "https://cli-chat-proxy.grok.com/v1/chat/completions",
+        headers: {
+            authorization: `Bearer ${bearer}`, "content-type": "application/json",
+            "x-xai-token-auth": "xai-grok-cli", "x-grok-model-override": declared.model,
+            "x-grok-client-version": clientVersion, "x-grok-client-identifier": "grok-shell"
+        },
+        body: Buffer.from(JSON.stringify(parsed))
+    };
 }
 /** Top-level members of a Grok 1.0.34 lean worker chat-completions body (live stub capture). */
 const LEAN_BODY_MEMBERS = new Set(["messages", "model", "reasoning_effort", "stream", "stream_options", "tools"]);

package/dist/runtime/grokBrokerRealmLease.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnRealTime as spawn } from "./taskClockProcess.js";
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 import path from "node:path";

package/dist/runtime/grokBrokerRefresh.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnRealTime as spawn } from "./taskClockProcess.js";
 import { readChild } from "../pi/cliChildOutput.js";
 import { terminateChild, trackCliChild } from "../pi/cliProcess.js";
 export async function refreshGrokBrokerCredential(command, grokHome, timeoutMs = 15_000) {

package/dist/runtime/grokBrokerRunBudget.d.ts

@@ -0,0 +1,20 @@
+export declare class GrokBrokerRunLimit extends Error {
+    constructor();
+}
+/** One broker realm lease owns this journal. Reserve durably BEFORE forwarding;
+ * failed calls and credential retries consume capacity, never refund it.
+ * Slot recycle must never remove this run-level file.
+ */
+export declare class GrokBrokerRunBudget {
+    readonly maximum: number;
+    private readonly file;
+    private used;
+    private tail;
+    private failed;
+    private closed;
+    private constructor();
+    static open(maximum: number, file: string): Promise<GrokBrokerRunBudget>;
+    reserve(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=grokBrokerRunBudget.d.ts.map

package/dist/runtime/grokBrokerRunBudget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerRunBudget.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerRunBudget.ts"],"names":[],"mappings":"AAIA,qBAAa,kBAAmB,SAAQ,KAAK;;CAE5C;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAIV,QAAQ,CAAC,OAAO,EAAE,MAAM;IAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,IAAI;IAHzF,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO;WAEM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAc9E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBlB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/runtime/grokBrokerRunBudget.js

@@ -0,0 +1,85 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+export class GrokBrokerRunLimit extends Error {
+    constructor() { super("run_request_limit"); }
+}
+/** One broker realm lease owns this journal. Reserve durably BEFORE forwarding;
+ * failed calls and credential retries consume capacity, never refund it.
+ * Slot recycle must never remove this run-level file.
+ */
+export class GrokBrokerRunBudget {
+    maximum;
+    file;
+    used;
+    tail = Promise.resolve();
+    failed = false;
+    closed = false;
+    constructor(maximum, file, used) {
+        this.maximum = maximum;
+        this.file = file;
+        this.used = used;
+    }
+    static async open(maximum, file) {
+        if (!Number.isSafeInteger(maximum) || maximum < 1)
+            throw new TypeError("invalid run request cap");
+        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        let used = 0;
+        try {
+            const state = JSON.parse(await readFile(file, "utf8"));
+            if (state.schema !== "daimon.run-requests.v1" || state.maximum !== maximum ||
+                !Number.isSafeInteger(state.used) || state.used < 0 || state.used > maximum ||
+                Object.keys(state).length !== 3)
+                throw new Error("invalid run request checkpoint");
+            used = state.used;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        return new GrokBrokerRunBudget(maximum, file, used);
+    }
+    reserve() {
+        if (this.closed)
+            return Promise.reject(new Error("run request budget closed"));
+        const reservation = this.tail.then(async () => {
+            if (this.failed)
+                throw new Error("run request checkpoint unavailable");
+            if (this.used >= this.maximum)
+                throw new GrokBrokerRunLimit();
+            this.used += 1;
+            const temporary = `${this.file}.${randomUUID()}.tmp`;
+            try {
+                const handle = await open(temporary, "wx", 0o600);
+                try {
+                    await handle.writeFile(JSON.stringify({ schema: "daimon.run-requests.v1", maximum: this.maximum, used: this.used }));
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+                await rename(temporary, this.file);
+                const directory = await open(path.dirname(this.file), "r");
+                try {
+                    await directory.sync();
+                }
+                finally {
+                    await directory.close();
+                }
+            }
+            catch (error) {
+                this.failed = true;
+                throw error;
+            }
+            finally {
+                await rm(temporary, { force: true });
+            }
+        });
+        this.tail = reservation.catch(() => undefined);
+        return reservation;
+    }
+    async close() {
+        this.closed = true;
+        await this.tail;
+    }
+}

package/dist/runtime/grokBrokerSlot.d.ts

@@ -0,0 +1,6 @@
+import { type GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+/** Canonical path in both broker and worker views; never a caller-selected file. */
+export declare function brokerTaskClockFileFor(slot: number): string;
+/** The pinned strict base exposes /run; its deny mounts must hide every peer clock. */
+export declare function assertBrokerTaskClockIsolation(variant: GrokWorkerConfigVariant, slot: number, slots: readonly number[], denyPaths: readonly string[]): void;
+//# sourceMappingURL=grokBrokerSlot.d.ts.map

package/dist/runtime/grokBrokerSlot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerSlot.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerSlot.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE3G,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,uFAAuF;AACvF,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GACrG,IAAI,CAUN"}

package/dist/runtime/grokBrokerSlot.js

@@ -0,0 +1,21 @@
+import { GROK_BROKER_TASK_CLOCK } from "../contracts/grokBrokerTaskClock.js";
+/** Canonical path in both broker and worker views; never a caller-selected file. */
+export function brokerTaskClockFileFor(slot) {
+    if (!Number.isSafeInteger(slot) || slot < 0)
+        throw new TypeError("invalid broker slot");
+    return `${GROK_BROKER_TASK_CLOCK.rootDirectoryPath}/slot-${slot}/faketime`;
+}
+/** The pinned strict base exposes /run; its deny mounts must hide every peer clock. */
+export function assertBrokerTaskClockIsolation(variant, slot, slots, denyPaths) {
+    if (variant !== "clocked")
+        return;
+    const own = brokerTaskClockFileFor(slot);
+    const covers = (denied, file) => file === denied || file.startsWith(`${denied}/`);
+    if (denyPaths.some((denied) => covers(denied, own)))
+        throw new Error("own broker task clock is denied");
+    for (const peer of slots) {
+        if (peer !== slot && !denyPaths.some((denied) => covers(denied, brokerTaskClockFileFor(peer).slice(0, -"/faketime".length)))) {
+            throw new Error("sibling broker task clock is not denied");
+        }
+    }
+}

package/dist/runtime/grokBrokerTaskClock.d.ts

@@ -0,0 +1,32 @@
+import { type Stats } from "node:fs";
+import { type GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+import type { GrokBrokerProviderClockObservation } from "./grokBrokerProviderClock.js";
+import { type GrokWorkerConfigPins } from "./grokWorkerHomeAttestation.js";
+/** Internal filesystem seam; tests wrap real handles to observe both fsyncs. */
+export type BrokerTaskClockFs = Pick<typeof import("node:fs/promises"), "lstat" | "open" | "rename" | "unlink">;
+export type BrokerShellClock = "task" | "real" | "gap";
+export type BrokerShellClockObservation = Readonly<{
+    shellClock?: BrokerShellClock;
+}>;
+export type BrokerClockObservation = BrokerShellClockObservation & Readonly<{
+    providerClock?: GrokBrokerProviderClockObservation;
+}>;
+export declare function brokerClockObservation(shellClock?: BrokerShellClock, providerClock?: GrokBrokerProviderClockObservation): BrokerClockObservation;
+/** Relative seconds only: never a date, speed, loader path or arbitrary environment. */
+export declare function parseBrokerProcessClock(value: unknown): string;
+/** Daimon remains the offset owner; the broker uses its pinned library, not ambient preload. */
+export declare function brokerProcessClock(): string | undefined;
+/** Discovery only; selected slots still require full attestation before reconciliation. */
+export declare function needsBrokerTaskClockReconciliation(profilePath: string, pins: GrokWorkerConfigPins, file?: string): Promise<boolean>;
+/** Pure provisioning seam: only the broker can replace entries; every worker can read. */
+export declare function assertBrokerTaskClockDirectory(entry: Pick<Stats, "uid" | "mode" | "isDirectory">, brokerUid?: number): void;
+/**
+ * Root provisions a non-symlink broker-owned directory. Rename publishes a
+ * complete value before launch; binding the DIRECTORY (not the old file inode)
+ * into the worker view keeps subsequent turns visible. No native ABI changes.
+ * Paths/uid below are internal test seams, never control or service inputs.
+ */
+export declare function writeBrokerTaskClock(value: string | undefined, file?: string, brokerUid?: number, fs?: BrokerTaskClockFs): Promise<void>;
+/** Unknown config is never called clocked: this runs only after byte attestation. */
+export declare function prepareBrokerTaskClock(variant: GrokWorkerConfigVariant, value: string | undefined, write?: typeof writeBrokerTaskClock): Promise<BrokerShellClock>;
+//# sourceMappingURL=grokBrokerTaskClock.d.ts.map

package/dist/runtime/grokBrokerTaskClock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerTaskClock.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerTaskClock.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAIhD,OAAO,EAA0B,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAA+B,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAExG,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAGhH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AACvD,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAAE,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,2BAA2B,GAAG,QAAQ,CAAC;IAC1E,aAAa,CAAC,EAAE,kCAAkC,CAAC;CACpD,CAAC,CAAC;AAEH,wBAAgB,sBAAsB,CACpC,UAAU,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,EAAE,kCAAkC,GAChF,sBAAsB,CAKxB;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG9D;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED,2FAA2F;AAC3F,wBAAsB,kCAAkC,CACtD,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAC/C,IAAI,GAAE,MAAkC,GACvC,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED,0FAA0F;AAC1F,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,GAAE,MAAwC,GAAG,IAAI,CAI5J;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,IAAI,GAAE,MAAkC,EACxC,SAAS,GAAE,MAAwC,EACnD,EAAE,GAAE,iBAA2B,GAC9B,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED,qFAAqF;AACrF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,GAAE,OAAO,oBAA2C,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9L"}