@noopolis/daimon 0.2.0 → 0.2.2

package/dist/runtime/grokBrokerWorkerConfig.js

@@ -1,5 +1,8 @@
+import { brokerTaskClockFileFor } from "./grokBrokerSlot.js";
 import { createHash } from "node:crypto";
 import path from "node:path";
+import { GROK_BROKER_TASK_CLOCK } from "../contracts/grokBrokerTaskClock.js";
+import { shellEnvironmentPolicyEntries } from "../contracts/shellEnvironmentPolicy.js";
 import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
 import { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS } from "../contracts/grokWorkerContract.js";
 import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
@@ -95,8 +98,16 @@ export const renderGrokLeanBaseConfig = () => [
  * default *and* its closed enum, so it reaches the request body and nothing
  * else can be selected; the proxy then re-verifies it on every body.
  */
-export function renderGrokBrokerWorkerConfig(policy = {}) {
-    return renderGrokBrokerWorkerConfigWith(parseGrokBrokerModelPolicy(policy), PRODUCTION_ENDPOINTS);
+export function renderGrokBrokerWorkerConfig(policy = {}, variant = "unclocked", slot = 0) {
+    if (variant !== "unclocked" && variant !== "clocked")
+        throw new TypeError("invalid Grok worker config variant");
+    const base = renderGrokBrokerWorkerConfigWith(parseGrokBrokerModelPolicy(policy), PRODUCTION_ENDPOINTS);
+    return variant === "unclocked" ? base : `${base}\n[shell_environment_policy]\n${shellEnvironmentPolicyEntries({
+        LD_PRELOAD: GROK_BROKER_TASK_CLOCK.preloadPath,
+        FAKETIME_TIMESTAMP_FILE: brokerTaskClockFileFor(slot),
+        FAKETIME_DONT_FAKE_MONOTONIC: "1",
+        LC_ALL: "C"
+    }).join("\n")}\n`;
 }
 /** Explicit-endpoint variant for the local live probe; production bytes come only from the function above. */
 export function renderGrokBrokerWorkerConfigWith(policy, endpoints) {
@@ -116,7 +127,15 @@ export function renderGrokBrokerWorkerConfigWith(policy, endpoints) {
         "[mcp_servers.daimon]", `url = "${mcpUrl}"`, 'bearer_token_env_var = "DAIMON_MCP_CAPABILITY"', ""
     ].join("\n");
 }
-export const grokBrokerWorkerConfigSha256 = (policy = {}) => createHash("sha256").update(renderGrokBrokerWorkerConfig(policy)).digest("hex");
+export const grokBrokerWorkerConfigSha256 = (policy = {}, variant = "unclocked", slot = 0) => createHash("sha256").update(renderGrokBrokerWorkerConfig(policy, variant, slot)).digest("hex");
+/** Validate the slot-zero template pin before deriving bytes for another canonical slot path. */
+export function grokBrokerWorkerConfigPins(policy, slot = 0) {
+    const base = GROK_ENGINE_BROKER.worker.clockedConfigSha256[policy.model][policy.reasoningEffort];
+    if (grokBrokerWorkerConfigSha256(policy, "clocked", 0) !== base)
+        throw new Error("Grok clocked config template drifted from manifest");
+    return { unclocked: GROK_ENGINE_BROKER.worker.configSha256[policy.model][policy.reasoningEffort],
+        clocked: grokBrokerWorkerConfigSha256(policy, "clocked", slot) };
+}
 /**
  * TypeScript mirror of the argv compiled into `native/engineBrokerLauncherCore.inc`.
  * `native/launcherArgv.test.ts` parses the C source and fails on any divergence.

package/dist/runtime/grokEngineBroker.d.ts

@@ -1,6 +1,13 @@
+import { needsBrokerTaskClockReconciliation, writeBrokerTaskClock } from "./grokBrokerTaskClock.js";
+import { DurableGrokBrokerCredentialAuthority } from "./grokBrokerCredentialAuthority.js";
+import { runNativeBrokerTurn } from "./engineBrokerNativeClient.js";
 import type { EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 import type { EngineBrokerTurnLimitOverrides } from "./engineBrokerTurnAccounting.js";
-import { type GrokEngineBrokerTurnResult } from "./grokEngineBrokerTurn.js";
+import { startGrokBrokerProxy } from "./grokBrokerProxy.js";
+import { acquireGrokBrokerRealmLease } from "./grokBrokerRealmLease.js";
+import { type GrokEngineBrokerTurnDependencies, type GrokEngineBrokerTurnResult } from "./grokEngineBrokerTurn.js";
+import { createGrokWorkerIsolationGuard, prepareGrokWorkerAttestation } from "./grokWorkerAttestation.js";
+import { grokWorkerIdentityEmpty } from "./grokEngineBrokerTurnEnd.js";
 import { type GrokInferenceGrantRequest } from "./grokInferenceGrants.js";
 export { EngineBrokerTurnFailure, type GrokEngineBrokerTurnResult } from "./grokEngineBrokerTurn.js";
 export { finishBrokerTurnWithUsage } from "./grokEngineBrokerMetering.js";
@@ -17,6 +24,24 @@ export type GrokEngineBroker = Awaited<ReturnType<typeof startGrokEngineBroker>>
  * proxy; their rows go only to that ledger. A stale realm refuses a grant as
  * `auth_stale`, exactly as it fails subject turns.
  */
+/** Internal seams exercise the production startup and per-turn admission paths. */
+export type GrokEngineBrokerDependencies = Readonly<{
+    acquireLease: typeof acquireGrokBrokerRealmLease;
+    createAuthority: (command: string, home: string) => Pick<DurableGrokBrokerCredentialAuthority, "initialize" | "accessToken" | "markRejected" | "isStale">;
+    startProxy: (...args: Parameters<typeof startGrokBrokerProxy>) => Promise<GrokEngineBrokerTurnDependencies["proxy"] & {
+        port: number;
+        close(): Promise<void>;
+    }>;
+    startMcp: () => Promise<GrokEngineBrokerTurnDependencies["mcp"] & {
+        close(): Promise<void>;
+    }>;
+    prepareAttestation: typeof prepareGrokWorkerAttestation;
+    needsTaskClockReconciliation: typeof needsBrokerTaskClockReconciliation;
+    createIsolationGuard: typeof createGrokWorkerIsolationGuard;
+    writeTaskClock: typeof writeBrokerTaskClock;
+    workerIdentityEmpty: typeof grokWorkerIdentityEmpty;
+    runNative: typeof runNativeBrokerTurn;
+}>;
 export declare function startGrokEngineBroker(options: Readonly<{
     grokCommand: string;
     nativeClient: string;
@@ -24,8 +49,15 @@ export declare function startGrokEngineBroker(options: Readonly<{
     turnStore: string;
     registrations: readonly GrokEngineBrokerRegistration[];
     inferenceLedgerPath?: string;
-}>): Promise<{
-    turn(agentId: string, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, limits?: EngineBrokerTurnLimitOverrides): Promise<GrokEngineBrokerTurnResult>;
+    maxRunRequests?: number;
+    runRequestStore?: string;
+}>, dependencies?: GrokEngineBrokerDependencies): Promise<{
+    turn: (agentId: string, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal | undefined, limits?: Readonly<Partial<Readonly<{
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    }>>> | undefined, processClock?: string | undefined, slot?: number | undefined) => Promise<GrokEngineBrokerTurnResult>;
+    resetSlot(slot: number): Promise<void>;
     requestInferenceGrant(request: GrokInferenceGrantRequest): Readonly<{
         grantId: string;
         token: string;
@@ -45,4 +77,12 @@ export declare function startGrokEngineBroker(options: Readonly<{
         workerIsolation: boolean;
     };
 }>;
+/** @internal One slot identity carries one turn until cleanup settles, including clock publication. */
+export type GrokBrokerActiveTurns = Map<number, {
+    controller: AbortController;
+    done: Promise<void>;
+}>;
+type TurnArguments = [wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, limits?: EngineBrokerTurnLimitOverrides, processClock?: string];
+/** The production dispatch boundary, isolated from credential/network setup for lifecycle tests. */
+export declare function createGrokEngineBrokerTurnDispatch(registrations: ReadonlyMap<number, GrokEngineBrokerRegistration>, active: GrokBrokerActiveTurns, isClosed: () => boolean, run: (registration: GrokEngineBrokerRegistration, ...args: TurnArguments) => Promise<GrokEngineBrokerTurnResult>, resetting?: ReadonlySet<number>): (agentId: string, ...input: [...TurnArguments, slot?: number]) => Promise<GrokEngineBrokerTurnResult>;
 //# sourceMappingURL=grokEngineBroker.d.ts.map

package/dist/runtime/grokEngineBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokEngineBroker.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBroker.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOtF,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAErG,OAAO,EAAgE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAExI,OAAO,EAAE,uBAAuB,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;kBAYrN,MAAM,UAAU,MAAM,UAAU,MAAM,eAAe,MAAM,WAAW,WAAW,WAAW,8BAA8B,GAAG,OAAO,CAAC,0BAA0B,CAAC;mCAOrJ,yBAAyB;;;;;;;;mCAKzB,MAAM,GAAG,OAAO;aAIhC,OAAO,CAAC,IAAI,CAAC;;;;;;;;;GAG/B"}
+{"version":3,"file":"grokEngineBroker.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBroker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kCAAkC,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,oCAAoC,EAAE,MAAM,oCAAoC,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAItF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EAEL,KAAK,gCAAgC,EAAE,KAAK,0BAA0B,EACvE,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAA4B,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAA0D,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC/H,OAAO,EAAgE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAExI,OAAO,EAAE,uBAAuB,EAAE,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,mFAAmF;AACnF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAClD,YAAY,EAAE,OAAO,2BAA2B,CAAC;IACjD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,oCAAoC,EAC3F,YAAY,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;IAC7D,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,KAAK,OAAO,CACvE,gCAAgC,CAAC,OAAO,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;IACxF,QAAQ,EAAE,MAAM,OAAO,CAAC,gCAAgC,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9F,kBAAkB,EAAE,OAAO,4BAA4B,CAAC;IACxD,4BAA4B,EAAE,OAAO,kCAAkC,CAAC;IACxE,oBAAoB,EAAE,OAAO,8BAA8B,CAAC;IAC5D,cAAc,EAAE,OAAO,oBAAoB,CAAC;IAC5C,mBAAmB,EAAE,OAAO,uBAAuB,CAAC;IACpD,SAAS,EAAE,OAAO,mBAAmB,CAAC;CACvC,CAAC,CAAC;AAeH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,QAAQ,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IACrF,aAAa,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACzI,CAAC,EACF,YAAY,GAAE,4BAAiD;oBA0IxC,MAAM;;;;uFAAgD,OAAO,CAAC,0BAA0B,CAAC;oBAzDxF,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;mCAkBb,yBAAyB;;;;;;;;mCAKzB,MAAM,GAAG,OAAO;aAIhC,OAAO,CAAC,IAAI,CAAC;;;;;;;;;GAiB/B;AAED,uGAAuG;AACvG,MAAM,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AACtG,KAAK,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,8BAA8B,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;AAEjK,oGAAoG;AACpG,wBAAgB,kCAAkC,CAChD,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAC/F,QAAQ,EAAE,MAAM,OAAO,EACvB,GAAG,EAAE,CAAC,YAAY,EAAE,4BAA4B,EAAE,GAAG,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,0BAA0B,CAAC,EAChH,SAAS,GAAE,WAAW,CAAC,MAAM,CAAa,IAE5B,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,KAAG,OAAO,CAAC,0BAA0B,CAAC,CAiBjH"}

package/dist/runtime/grokEngineBroker.js

@@ -1,96 +1,141 @@
+import path from "node:path";
+import { rm } from "node:fs/promises";
+import { assertBrokerTaskClockIsolation, brokerTaskClockFileFor } from "./grokBrokerSlot.js";
+import { needsBrokerTaskClockReconciliation, writeBrokerTaskClock } from "./grokBrokerTaskClock.js";
 import { DurableGrokBrokerCredentialAuthority } from "./grokBrokerCredentialAuthority.js";
 import { runNativeBrokerTurn } from "./engineBrokerNativeClient.js";
+import { ENGINE_BROKER_TASK_CLOCK_RESET_FAILED } from "./engineBrokerProtocol.js";
 import { EngineBrokerTurnRegistry } from "./engineBrokerTurnRegistry.js";
+import { GrokBrokerRunBudget } from "./grokBrokerRunBudget.js";
 import { startGrokBrokerProxy } from "./grokBrokerProxy.js";
 import { startEngineBrokerMcpFacade } from "./engineBrokerMcpFacade.js";
 import { acquireGrokBrokerRealmLease } from "./grokBrokerRealmLease.js";
-import { grokBrokerWorkerConfigSha256 } from "./grokBrokerWorkerConfig.js";
+import { grokBrokerWorkerConfigPins } from "./grokBrokerWorkerConfig.js";
 import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
-import { runGrokEngineBrokerTurn } from "./grokEngineBrokerTurn.js";
+import { EngineBrokerTurnFailure, runGrokEngineBrokerTurn } from "./grokEngineBrokerTurn.js";
 import { createGrokWorkerIsolationGuard, grokBrokerAttestationInput, prepareGrokWorkerAttestation } from "./grokWorkerAttestation.js";
+import { awaitGrokWorkerIdentityEmpty, GROK_WORKER_REAP_WAIT_MS, grokWorkerIdentityEmpty } from "./grokEngineBrokerTurnEnd.js";
 import { createLedgeredGrokInferenceGrants, GrokInferenceGrantRefused } from "./grokInferenceGrants.js";
 export { EngineBrokerTurnFailure } from "./grokEngineBrokerTurn.js";
 export { finishBrokerTurnWithUsage } from "./grokEngineBrokerMetering.js";
-/**
- * The Grok engine broker: one credential realm, one provider proxy, one MCP
- * facade, and the root-provisioned registrations. Each registration declares
- * its own model/effort (whose worker config bytes are attested), usage ledger,
- * and turn limits (`engineBrokerServiceConfig.ts`).
- *
- * With an `inferenceLedgerPath` the broker also issues evaluator inference
- * grants (`grokInferenceGrants.ts`) over the same credential authority and
- * proxy; their rows go only to that ledger. A stale realm refuses a grant as
- * `auth_stale`, exactly as it fails subject turns.
- */
-export async function startGrokEngineBroker(options) {
-    const registrations = new Map(options.registrations.map((entry) => [entry.agentId, { ...entry, model: parseGrokBrokerModelPolicy(entry.model) }]));
-    if (registrations.size !== options.registrations.length)
+const brokerDependencies = {
+    acquireLease: acquireGrokBrokerRealmLease,
+    createAuthority: (command, home) => new DurableGrokBrokerCredentialAuthority(command, home),
+    startProxy: startGrokBrokerProxy,
+    startMcp: startEngineBrokerMcpFacade,
+    prepareAttestation: prepareGrokWorkerAttestation,
+    needsTaskClockReconciliation: needsBrokerTaskClockReconciliation,
+    createIsolationGuard: createGrokWorkerIsolationGuard,
+    writeTaskClock: writeBrokerTaskClock,
+    workerIdentityEmpty: (uid) => grokWorkerIdentityEmpty(uid, undefined, true),
+    runNative: runNativeBrokerTurn
+};
+export async function startGrokEngineBroker(options, dependencies = brokerDependencies) {
+    const registrations = new Map(options.registrations.map((entry) => [
+        entry.slot, { ...entry, model: parseGrokBrokerModelPolicy(entry.model) }
+    ]));
+    if (registrations.size !== options.registrations.length || new Set(options.registrations.map((entry) => entry.workerUid)).size !== options.registrations.length)
         throw new Error("engine broker registration conflict");
-    const attestationFor = (registration) => grokBrokerAttestationInput(registration, [...registrations.values()], grokBrokerWorkerConfigSha256(registration.model));
-    const inferenceLedgerPath = options.inferenceLedgerPath;
-    const grants = inferenceLedgerPath === undefined ? undefined : createLedgeredGrokInferenceGrants(inferenceLedgerPath);
-    const lease = await acquireGrokBrokerRealmLease(options.credentialHome);
-    const authority = new DurableGrokBrokerCredentialAuthority(options.grokCommand, options.credentialHome);
-    try {
-        await authority.initialize();
-    }
-    catch (error) {
-        await lease.close();
-        throw error;
-    }
+    const attestationFor = (registration) => grokBrokerAttestationInput(registration, [...registrations.values()], grokBrokerWorkerConfigPins(registration.model, registration.slot));
+    const grants = options.inferenceLedgerPath === undefined
+        ? undefined : createLedgeredGrokInferenceGrants(options.inferenceLedgerPath);
+    const lease = await dependencies.acquireLease(options.credentialHome);
+    const authority = dependencies.createAuthority(options.grokCommand, options.credentialHome);
     let proxy;
-    try {
-        proxy = await startGrokBrokerProxy(authority, undefined, undefined, undefined, grants);
-    }
-    catch (error) {
-        await lease.close();
-        throw error;
-    }
     let mcp;
+    let runBudget;
+    const clockedSlots = new Set();
     try {
-        mcp = await startEngineBrokerMcpFacade();
-        for (const registration of registrations.values())
-            await prepareGrokWorkerAttestation(attestationFor(registration));
+        // Reconcile before accepting traffic. A prior broker may have died after
+        // publishing an offset; its finally never ran. The realm lease excludes peers.
+        for (const registration of registrations.values()) {
+            const attestation = attestationFor(registration);
+            if (!await dependencies.needsTaskClockReconciliation(registration.profilePath, attestation.configSha256, brokerTaskClockFileFor(registration.slot)))
+                continue;
+            const snapshot = await dependencies.prepareAttestation(attestation);
+            assertBrokerTaskClockIsolation(snapshot.configVariant, registration.slot, [...registrations.keys()], snapshot.denyPaths);
+            const reaped = await awaitGrokWorkerIdentityEmpty(registration.workerUid, GROK_WORKER_REAP_WAIT_MS, dependencies.workerIdentityEmpty);
+            if (!reaped)
+                throw new Error("Grok broker task clock worker did not terminate");
+            await dependencies.writeTaskClock(undefined, brokerTaskClockFileFor(registration.slot));
+            clockedSlots.add(registration.slot);
+        }
+        await authority.initialize();
+        runBudget = options.maxRunRequests === undefined ? undefined :
+            await GrokBrokerRunBudget.open(options.maxRunRequests, path.join(options.runRequestStore ?? options.turnStore, "run-requests.json"));
+        proxy = await dependencies.startProxy(authority, undefined, undefined, undefined, grants, runBudget);
+        mcp = await dependencies.startMcp();
     }
     catch (error) {
-        if (mcp)
-            await mcp.close().catch(() => undefined);
-        await proxy.close();
-        await lease.close();
+        grants?.close();
+        await Promise.allSettled([mcp?.close(), proxy?.close(), runBudget?.close()]);
+        await Promise.allSettled([lease.close()]);
         throw error;
     }
-    if (!mcp)
-        throw new Error("engine broker unavailable");
-    const turns = new EngineBrokerTurnRegistry(options.turnStore);
+    const slotStore = (slot) => path.join(options.turnStore, `slot-${slot}`);
+    const turnStores = new Map([...registrations.keys()].map((slot) => [slot, new EngineBrokerTurnRegistry(slotStore(slot))]));
     const active = new Map();
     let closed = false;
+    const clockFailed = new Set();
+    const resetting = new Set();
+    const resets = new Map();
     const facade = mcp;
-    const deps = {
-        turns, proxy, mcp: facade, credentialStale: () => authority.isStale(),
-        prepareIsolation: async (registration) => { const attestation = attestationFor(registration); return createGrokWorkerIsolationGuard(attestation, await prepareGrokWorkerAttestation(attestation)); },
-        runNative: (input, signal) => runNativeBrokerTurn(options.nativeClient, input, signal)
-    };
+    const provider = proxy;
+    const depsFor = (registration) => ({
+        turns: turnStores.get(registration.slot), proxy: provider, mcp: facade, credentialStale: () => authority.isStale(),
+        clockedSlot: clockedSlots.has(registration.slot),
+        writeTaskClock: (value) => dependencies.writeTaskClock(value, brokerTaskClockFileFor(registration.slot)),
+        workerIdentityEmpty: dependencies.workerIdentityEmpty,
+        taskClockFailed: () => { clockFailed.add(registration.slot); },
+        prepareIsolation: async (registration) => {
+            const attestation = attestationFor(registration);
+            const snapshot = await dependencies.prepareAttestation(attestation);
+            assertBrokerTaskClockIsolation(snapshot.configVariant, registration.slot, [...registrations.keys()], snapshot.denyPaths);
+            if (snapshot.configVariant === "clocked")
+                clockedSlots.add(registration.slot);
+            return {
+                guard: dependencies.createIsolationGuard(attestation, snapshot),
+                configVariant: snapshot.configVariant
+            };
+        },
+        runNative: (input, signal) => dependencies.runNative(options.nativeClient, input, signal)
+    });
     return {
-        async turn(agentId, wakeId, prompt, mcpEndpoint, signal, limits) {
-            if (closed)
+        turn: createGrokEngineBrokerTurnDispatch(registrations, active, () => closed, async (registration, ...args) => {
+            if (clockFailed.has(registration.slot))
+                throw new EngineBrokerTurnFailure("unavailable", undefined, { outcome: "failed", usage: null, model: registration.model.model, requests: 0, limitReason: "none" }, undefined, undefined, undefined, ENGINE_BROKER_TASK_CLOCK_RESET_FAILED);
+            return runGrokEngineBrokerTurn(depsFor(registration), registration, ...args);
+        }, resetting),
+        async resetSlot(slot) {
+            const registration = registrations.get(slot);
+            if (closed || registration === undefined)
                 throw new Error("engine broker unavailable");
-            const registration = registrations.get(agentId);
-            if (registration === undefined)
-                throw new Error("engine broker unavailable");
-            const controller = new AbortController();
-            const onAbort = () => controller.abort();
-            signal?.addEventListener("abort", onAbort, { once: true });
-            if (signal?.aborted)
-                controller.abort();
-            const key = `${agentId}\0${wakeId}`;
-            const done = runGrokEngineBrokerTurn(deps, registration, wakeId, prompt, mcpEndpoint, controller.signal, limits);
-            active.set(key, { controller, done: done.then(() => undefined, () => undefined) });
+            if (active.has(slot) || resetting.has(slot))
+                throw new Error("engine broker slot busy");
+            resetting.add(slot);
+            const reset = (async () => {
+                try {
+                    const empty = await awaitGrokWorkerIdentityEmpty(registration.workerUid, GROK_WORKER_REAP_WAIT_MS, dependencies.workerIdentityEmpty);
+                    if (!empty)
+                        throw new Error("engine broker slot busy");
+                    if (clockedSlots.has(slot))
+                        await dependencies.writeTaskClock(undefined, brokerTaskClockFileFor(slot));
+                    await rm(slotStore(slot), { recursive: true, force: true });
+                    turnStores.set(slot, new EngineBrokerTurnRegistry(slotStore(slot)));
+                    clockFailed.delete(slot);
+                }
+                catch (error) {
+                    clockFailed.add(slot);
+                    throw error;
+                }
+            })();
+            resets.set(slot, reset);
             try {
-                return await done;
+                await reset;
             }
             finally {
-                signal?.removeEventListener("abort", onAbort);
-                active.delete(key);
+                resetting.delete(slot);
+                resets.delete(slot);
             }
         },
         requestInferenceGrant(request) {
@@ -105,10 +150,53 @@ export async function startGrokEngineBroker(options) {
                 throw new GrokInferenceGrantRefused("unavailable");
             return grants.release(grantId);
         },
-        async close() { if (closed)
-            return; closed = true; grants?.close(); const running = [...active.values()]; for (const entry of running)
-            entry.controller.abort(); await Promise.allSettled(running.map((entry) => entry.done)); const results = await Promise.allSettled([facade.close(), proxy.close(), lease.close()]); const failures = results.flatMap((entry) => entry.status === "rejected" ? [entry.reason] : []); if (failures.length)
-            throw new AggregateError(failures, "engine broker shutdown failed"); },
-        readiness: () => ({ providerProxyPort: proxy.port, mcpFacadePort: 43_124, registrations: registrations.size, credentialStale: authority.isStale(), realmLease: true, workerIsolation: true })
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            grants?.close();
+            const running = [...active.values()];
+            for (const entry of running)
+                entry.controller.abort();
+            await Promise.allSettled([...running.map((entry) => entry.done), ...resets.values()]);
+            const results = await Promise.allSettled([facade.close(), provider.close(), runBudget?.close()]);
+            results.push(...await Promise.allSettled([lease.close()]));
+            const failures = results.flatMap((entry) => entry.status === "rejected" ? [entry.reason] : []);
+            if (failures.length)
+                throw new AggregateError(failures, "engine broker shutdown failed");
+        },
+        readiness: () => ({
+            providerProxyPort: provider.port, mcpFacadePort: 43_124, registrations: registrations.size,
+            credentialStale: authority.isStale(), realmLease: true, workerIsolation: clockFailed.size === 0
+        })
+    };
+}
+/** The production dispatch boundary, isolated from credential/network setup for lifecycle tests. */
+export function createGrokEngineBrokerTurnDispatch(registrations, active, isClosed, run, resetting = new Set()) {
+    return async (agentId, ...input) => {
+        const [wakeId, prompt, mcpEndpoint, signal_, limits, processClock, requestedSlot] = input;
+        const matches = [...registrations.values()].filter((entry) => entry.agentId === agentId);
+        const registration = requestedSlot === undefined ? (matches.length === 1 ? matches[0] : undefined) : registrations.get(requestedSlot);
+        const args = [wakeId, prompt, mcpEndpoint, signal_, limits, processClock];
+        if (isClosed() || registration === undefined || registration.agentId !== agentId)
+            throw new Error("engine broker unavailable");
+        const slot = registration.slot;
+        if (active.has(slot) || resetting.has(slot))
+            throw new Error("engine broker slot already active");
+        const signal = args[3], controller = new AbortController();
+        const onAbort = () => controller.abort();
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            controller.abort();
+        args[3] = controller.signal;
+        const done = Promise.resolve().then(() => run(registration, ...args));
+        active.set(slot, { controller, done: done.then(() => undefined, () => undefined) });
+        try {
+            return await done;
+        }
+        finally {
+            signal?.removeEventListener("abort", onAbort);
+            active.delete(slot);
+        }
     };
 }

package/dist/runtime/grokEngineBrokerTurn.d.ts

@@ -1,29 +1,37 @@
-import { type EngineBrokerFailureCode } from "./engineBrokerProtocol.js";
+import type { GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+import { writeBrokerTaskClock, type BrokerShellClock, type BrokerClockObservation } from "./grokBrokerTaskClock.js";
+import { type GrokBrokerProviderClockObservation } from "./grokBrokerProviderClock.js";
+import { type EngineBrokerCleanupObservation, type EngineBrokerFailureCode } from "./engineBrokerProtocol.js";
 import type { EngineBrokerMcpCallObservation } from "./engineBrokerMcpCallLog.js";
 import { type EngineBrokerTurnAccounting, type EngineBrokerTurnLimitOverrides } from "./engineBrokerTurnAccounting.js";
 import { type NativeBrokerDiagnostic, type NativeBrokerTurn, type NativeBrokerTurnResult } from "./engineBrokerNativeClient.js";
 import type { EngineBrokerTurnRegistry } from "./engineBrokerTurnRegistry.js";
 import { type EngineBrokerServiceRegistration } from "./engineBrokerServiceConfig.js";
 import type { GrokBrokerProxyTurn } from "./grokBrokerProxy.js";
+import { type GrokBrokerTurnEndTiming, type GrokWorkerProcess } from "./grokEngineBrokerTurnEnd.js";
+import type { EngineBrokerMcpActivity } from "./engineBrokerMcpCallLog.js";
 export type GrokEngineBrokerTurnResult = Readonly<{
     text: string;
     workerPid: number;
     workerUid: number;
     workerStartTime: string;
-}> & EngineBrokerTurnAccounting;
+}> & EngineBrokerTurnAccounting & BrokerClockObservation & EngineBrokerCleanupObservation;
 export declare class EngineBrokerTurnFailure extends Error {
-    readonly code: Exclude<EngineBrokerFailureCode, "turn_conflict" | "unavailable">;
+    readonly code: Exclude<EngineBrokerFailureCode, "turn_conflict">;
     readonly diagnostic?: NativeBrokerDiagnostic | undefined;
     readonly accounting?: EngineBrokerTurnAccounting | undefined;
     readonly mcpCalls?: EngineBrokerMcpCallObservation | undefined;
-    constructor(code: Exclude<EngineBrokerFailureCode, "turn_conflict" | "unavailable">, diagnostic?: NativeBrokerDiagnostic | undefined, accounting?: EngineBrokerTurnAccounting | undefined, mcpCalls?: EngineBrokerMcpCallObservation | undefined);
+    readonly shellClock?: BrokerShellClock | undefined;
+    readonly providerClock?: GrokBrokerProviderClockObservation | undefined;
+    readonly cleanupDiagnostic?: EngineBrokerCleanupObservation["cleanupDiagnostic"];
+    constructor(code: Exclude<EngineBrokerFailureCode, "turn_conflict">, diagnostic?: NativeBrokerDiagnostic | undefined, accounting?: EngineBrokerTurnAccounting | undefined, mcpCalls?: EngineBrokerMcpCallObservation | undefined, shellClock?: BrokerShellClock | undefined, providerClock?: GrokBrokerProviderClockObservation | undefined, cleanupDiagnostic?: EngineBrokerCleanupObservation["cleanupDiagnostic"]);
 }
 /** Everything one broker turn touches, injected so the accounting and limit paths run under test without a native launcher. */
 export type GrokEngineBrokerTurnDependencies = Readonly<{
     turns: EngineBrokerTurnRegistry;
     proxy: Readonly<{
         capabilities: Readonly<{
-            issue(agentId: string, turnId: string): string;
+            issue(agentId: string, turnId: string, ttlMs?: number): string;
             revoke(turnId: string): void;
         }>;
         registerIsolationGuard(turnId: string, guard: () => Promise<void>): void;
@@ -32,13 +40,29 @@ export type GrokEngineBrokerTurnDependencies = Readonly<{
         revokeTurn(turnId: string): void;
     }>;
     mcp: Readonly<{
-        register(agentId: string, turnId: string, endpoint: string): string;
+        register(agentId: string, turnId: string, endpoint: string, ttlMs?: number): string;
         revoke(turnId: string): void;
         observe?(turnId: string): EngineBrokerMcpCallObservation | undefined;
+        activity?(turnId: string): EngineBrokerMcpActivity | undefined;
     }>;
     credentialStale(): boolean;
-    prepareIsolation(registration: EngineBrokerServiceRegistration): Promise<() => Promise<void>>;
+    prepareIsolation(registration: EngineBrokerServiceRegistration): Promise<Readonly<{
+        guard: () => Promise<void>;
+        configVariant: GrokWorkerConfigVariant;
+    }>>;
+    writeTaskClock?: typeof writeBrokerTaskClock;
+    /** Startup attestation also owns cleanup when per-turn attestation fails. */
+    clockedSlot?: boolean;
+    /** A failed cleanup fences production dispatch until the broker restarts. */
+    taskClockFailed?(): void;
     runNative(input: NativeBrokerTurn, signal: AbortSignal): Promise<Readonly<NativeBrokerTurnResult>>;
+    /** The worker the launcher started for this identity (`/proc` by default); only read when the broker ends a turn itself. */
+    observeWorker?(workerUid: number): Promise<GrokWorkerProcess | undefined>;
+    /** Overrides the turn-end grace and idle bounds (tests). */
+    turnEnd?: GrokBrokerTurnEndTiming;
+    /** Whether no live process holds the worker identity (`/proc` by default); polled, bounded, before an aborted turn is sealed. */
+    workerIdentityEmpty?(workerUid: number): Promise<boolean>;
+    workerReapWaitMs?: number;
 }>;
 /**
  * One brokered Grok turn under its declared limits.
@@ -54,5 +78,5 @@ export type GrokEngineBrokerTurnDependencies = Readonly<{
  * metered through {@link finishBrokerTurnWithUsage}; a replayed turn returns its
  * sealed accounting before any of this runs and never meters again.
  */
-export declare function runGrokEngineBrokerTurn(deps: GrokEngineBrokerTurnDependencies, registration: EngineBrokerServiceRegistration, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, overrides?: EngineBrokerTurnLimitOverrides): Promise<GrokEngineBrokerTurnResult>;
+export declare function runGrokEngineBrokerTurn(deps: GrokEngineBrokerTurnDependencies, registration: EngineBrokerServiceRegistration, wakeId: string, prompt: string, mcpEndpoint: string, signal?: AbortSignal, overrides?: EngineBrokerTurnLimitOverrides, processClock?: string): Promise<GrokEngineBrokerTurnResult>;
 //# sourceMappingURL=grokEngineBrokerTurn.d.ts.map

package/dist/runtime/grokEngineBrokerTurn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grokEngineBrokerTurn.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBrokerTurn.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyB,KAAK,uBAAuB,EAAqC,MAAM,2BAA2B,CAAC;AACnI,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAqD,KAAK,0BAA0B,EAAE,KAAK,8BAA8B,EAA8B,MAAM,iCAAiC,CAAC;AACtM,OAAO,EAA2B,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACzJ,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAmE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAGvJ,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAIhE,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,0BAA0B,CAAC;AAChK,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,uBAAuB,EAAE,eAAe,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B;gBAA3N,IAAI,EAAE,OAAO,CAAC,uBAAuB,EAAE,eAAe,GAAG,aAAa,CAAC,EAAW,UAAU,CAAC,EAAE,sBAAsB,YAAA,EAAW,UAAU,CAAC,EAAE,0BAA0B,YAAA,EAAW,QAAQ,CAAC,EAAE,8BAA8B,YAAA;CACjP;AAED,+HAA+H;AAC/H,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,KAAK,EAAE,wBAAwB,CAAC;IAChC,KAAK,EAAE,QAAQ,CAAC;QAAE,YAAY,EAAE,QAAQ,CAAC;YAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACrV,GAAG,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,8BAA8B,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC3L,eAAe,IAAI,OAAO,CAAC;IAC3B,gBAAgB,CAAC,YAAY,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;CACpG,CAAC,CAAC;AAKH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,gCAAgC,EAAE,YAAY,EAAE,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA2D/R"}
+{"version":3,"file":"grokEngineBrokerTurn.d.ts","sourceRoot":"","sources":["../../src/runtime/grokEngineBrokerTurn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAEL,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,KAAK,sBAAsB,EACzE,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAA2B,KAAK,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAMhH,OAAO,EAEL,KAAK,8BAA8B,EAAE,KAAK,uBAAuB,EAClE,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAqD,KAAK,0BAA0B,EAAE,KAAK,8BAA8B,EAA8B,MAAM,iCAAiC,CAAC;AACtM,OAAO,EAA2B,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACzJ,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,EAAmE,KAAK,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAGvJ,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAgK,KAAK,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAClQ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;CAC7E,CAAC,GAAG,0BAA0B,GAAG,sBAAsB,GAAG,8BAA8B,CAAC;AAC1F,qBAAa,uBAAwB,SAAQ,KAAK;IAE9C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,uBAAuB,EAAE,eAAe,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,kCAAkC;IAC3D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,mBAAmB,CAAC;gBANvE,IAAI,EAAE,OAAO,CAAC,uBAAuB,EAAE,eAAe,CAAC,EACvD,UAAU,CAAC,EAAE,sBAAsB,YAAA,EACnC,UAAU,CAAC,EAAE,0BAA0B,YAAA,EACvC,QAAQ,CAAC,EAAE,8BAA8B,YAAA,EACzC,UAAU,CAAC,EAAE,gBAAgB,YAAA,EAC7B,aAAa,CAAC,EAAE,kCAAkC,YAAA,EAClD,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,mBAAmB,CAAC;CAEnF;AAED,+HAA+H;AAC/H,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,KAAK,EAAE,wBAAwB,CAAC;IAChC,KAAK,EAAE,QAAQ,CAAC;QAAE,YAAY,EAAE,QAAQ,CAAC;YAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAAC,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACrW,GAAG,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,8BAA8B,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC3Q,eAAe,IAAI,OAAO,CAAC;IAC3B,gBAAgB,CAAC,YAAY,EAAE,+BAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,aAAa,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC,CAAC;IAC3J,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAC;IAC7C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,eAAe,CAAC,IAAI,IAAI,CAAC;IACzB,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACnG,4HAA4H;IAC5H,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAC1E,4DAA4D;IAC5D,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,iIAAiI;IACjI,mBAAmB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC,CAAC;AAKH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,gCAAgC,EAAE,YAAY,EAAE,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,8BAA8B,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAyKtT"}