agl 40.5.0 → 40.6.0

package/dist_ts/functions.inferencecli.js

@@ -3,12 +3,12 @@ import { commitinfo } from './00_commitinfo_data.js';
 import { ensureControllerDataRoot, preflightAGLHomeMigration } from './functions.controllerdataroot.js';
 import { resolveAGLHomePaths } from './classes.aglhome.js';
 import { resolveProductionAuthoritySocketPaths } from './classes.authorityclient.js';
-import { inferenceHarnessLaunch } from './functions.inferencelaunch.js';
+import { confinedDockerLaunch, inferenceHarnessLaunch } from './functions.inferencelaunch.js';
 import { AglProxyControlClient, AglProxyUnavailableError } from './classes.proxycontrolclient.js';
-import { AglProxyLeaseHolder } from './classes.proxyleaseholder.js';
+import { AglProxyConfinedHolder, AglProxyLeaseHolder } from './classes.proxyleaseholder.js';
 import { AglProxyDaemon } from './classes.proxydaemon.js';
 import { AglProxyService, resolveAglExecutable } from './classes.proxyservice.js';
-import { aglProxyUnitName } from './functions.proxycontract.js';
+import { aglProxyConfinedMountPoint, aglProxyUnitName } from './functions.proxycontract.js';
 import { inferenceCliHelp, parseInferenceCliArguments } from './functions.inferencecliarguments.js';
 import { runProxyCredentialCommand } from './functions.proxycredentialcli.js';
 import { currentProxyCredentialHelper, writeProxyCredentialHelper } from './functions.proxycredentialhelper.js';
@@ -52,6 +52,14 @@ export const formatProxyStatus = (unitArg, statusArg) => {
             + `${client.generation}${client.delivery === 'file' ? ' (kept in a file)' : ''}, ${client.pending} in flight, `
             + `last used ${client.lastUsedAt ?? 'never'}`);
     }
+    if (statusArg.confinedSocketPath !== undefined) {
+        lines.push(`Confined listener: ${statusArg.confinedSocketPath ?? 'none'}`);
+        for (const run of statusArg.confinedRuns ?? []) {
+            lines.push(`Confined run ${run.id}: issued ${run.createdAt}`
+                + `${run.held ? '' : ', waiting for its launcher to take it back after a proxy restart'}`
+                + ` (end it with \`agl proxy confined end ${run.id}\`)`);
+        }
+    }
     if (!statusArg.accounts) {
         // The proxy runs the older AGL it was started from until it restarts, as after an upgrade it was not restarted by.
         lines.push(`Accounts: not reported, as the proxy runs AGL ${statusArg.version} and this command AGL ${commitinfo.version}. `
@@ -115,7 +123,7 @@ const serve = (portArg) => withSignals(async (signalArg) => {
     // files go with the next upgrade, while harnesses still ask this proxy until it restarts.
     const credentialHelper = await currentProxyCredentialHelper(paths.root, () => resolveAglExecutable(process.env, plugins.os.homedir()));
     const daemon = new AglProxyDaemon({ socketPath: paths.proxySocket, dataDirectory: plugins.path.join(paths.proxy, 'nosqldb'),
-        credentialDirectory: paths.proxyCredentials,
+        credentialDirectory: paths.proxyCredentials, confinedSocketPath: paths.proxyConfinedSocket,
         authorityPaths: resolveProductionAuthoritySocketPaths(), port: portArg });
     const stopping = () => { void daemon.stop().catch(() => undefined); };
     signalArg.addEventListener('abort', stopping, { once: true });
@@ -192,6 +200,51 @@ const run = (optionsArg) => withSignals(async (signalArg) => {
     if (lost)
         throw new Error(`${lost.message} Run \`agl proxy run ${optionsArg.harness}\` again to continue.`);
 });
+/**
+ * Runs a confined run's container (see `confinedDockerLaunch`) on a credential of its own, which ends when the container
+ * exits. A proxy that restarts meanwhile hands the credential back; one the proxy no longer hands back, or the operator
+ * ended, stops the container (`docker run` passes the signal on to it), and the run ends with the reason.
+ */
+const confinedRun = (optionsArg) => withSignals(async (signalArg) => {
+    await preflightAGLHomeMigration();
+    const paths = resolveAGLHomePaths();
+    const run = await AglProxyConfinedHolder.take({ socketPath: paths.proxySocket }, AbortSignal.any([signalArg, AbortSignal.timeout(90_000)]));
+    let lost;
+    try {
+        const launch = confinedDockerLaunch({ args: optionsArg.args, socketPath: run.confinedSocketPath, baseUrl: run.baseUrl,
+            token: run.token, environment: process.env });
+        process.stderr.write(`AGL proxy confined run ${run.id}: ${plugins.path.dirname(run.confinedSocketPath)} is mounted read-only `
+            + `at ${aglProxyConfinedMountPoint}; end it at once with \`agl proxy confined end ${run.id}\`.\n`);
+        signalArg.throwIfAborted();
+        const child = plugins.childProcess.spawn(launch.command, launch.args, { env: launch.environment, stdio: 'inherit', shell: false });
+        let killTimer;
+        const terminate = () => {
+            child.kill('SIGTERM');
+            killTimer ??= setTimeout(() => child.kill('SIGKILL'), 10_000);
+            killTimer.unref();
+        };
+        signalArg.addEventListener('abort', terminate, { once: true });
+        void run.lost.then((errorArg) => { lost = errorArg; terminate(); });
+        try {
+            if (signalArg.aborted)
+                terminate();
+            process.exitCode = await new Promise((resolve, reject) => {
+                child.once('error', reject);
+                child.once('exit', (codeArg) => resolve(codeArg ?? 1));
+            });
+        }
+        finally {
+            signalArg.removeEventListener('abort', terminate);
+            if (killTimer)
+                clearTimeout(killTimer);
+        }
+    }
+    finally {
+        run.close();
+    }
+    if (lost)
+        throw new Error(`${lost.message} The container was stopped; start the run again to continue.`);
+});
 const unitState = async (serviceArg) => {
     try {
         const state = await serviceArg.inspect();
@@ -216,8 +269,17 @@ export const runInferenceCli = async (argvArg) => {
         await run(options);
         return;
     }
+    if (options.command === 'confined' && options.confinedAction === 'run') {
+        await confinedRun(options);
+        return;
+    }
     const paths = resolveAGLHomePaths();
     const client = new AglProxyControlClient(paths.proxySocket);
+    if (options.command === 'confined') {
+        await client.endConfined(options.confinedId, AbortSignal.timeout(10_000));
+        process.stdout.write(`Ended confined run ${options.confinedId}: the proxy refuses its credential from now on.\n`);
+        return;
+    }
     if (options.command === 'credential') {
         await runProxyCredentialCommand(options, (textArg) => process.stdout.write(textArg));
         return;
@@ -261,4 +323,4 @@ export const runInferenceCli = async (argvArg) => {
     }
     process.stdout.write(`${aglProxyUnitName}: ${await unitState(service)}\n`);
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWNsaS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VjbGkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQ3JELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSx5QkFBeUIsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBQ3hHLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQzNELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ3JGLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBRXhFLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSx3QkFBd0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ2xHLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3BFLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUMxRCxPQUFPLEVBQUUsZUFBZSxFQUFFLG9CQUFvQixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDbEYsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDaEUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLDBCQUEwQixFQUErQixNQUFNLHNDQUFzQyxDQUFDO0FBQ2pJLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBQzlFLE9BQU8sRUFBRSw0QkFBNEIsRUFBRSwwQkFBMEIsRUFBRSxNQUFNLHNDQUFzQyxDQUFDO0FBZWhILG9IQUFvSDtBQUNwSCxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQXVCLEVBQVUsRUFBRSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVU7SUFDbkYsQ0FBQyxDQUFDLEdBQUcsUUFBUSxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO0FBRXZFLHVHQUF1RztBQUN2RyxNQUFNLGFBQWEsR0FBRyxDQUFDLFVBQWlFLEVBQVUsRUFBRTtJQUNsRyxJQUFJLFVBQVUsQ0FBQyxTQUFTLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xELElBQUksVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRO1FBQUUsT0FBTyxZQUFZLFVBQVUsQ0FBQyxRQUFRLHlCQUF5QixDQUFDO0lBQ3ZHLE9BQU8sR0FBRyxVQUFVLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsc0JBQXNCLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFO1VBQzlGLGVBQWUsU0FBUyxDQUFDLFVBQVUsQ0FBQyxjQUFjLElBQUksSUFBSSxDQUFDLEVBQUU7VUFDN0QsR0FBRyxVQUFVLENBQUMsYUFBYSxLQUFLLElBQUksSUFBSSxVQUFVLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsNEJBQTRCO1lBQzdHLENBQUMsQ0FBQyxVQUFVLFVBQVUsQ0FBQyxhQUFhLEVBQUUsR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUM7QUFDcEgsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxXQUFXLEdBQUcsQ0FBQyxVQUFpRSxFQUFVLEVBQUUsQ0FDaEcsVUFBVSxDQUFDLGlCQUFpQixLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxVQUFVLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLFVBQVU7SUFDN0csQ0FBQyxDQUFDLEdBQUcsVUFBVSxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxVQUFVLFVBQVUsQ0FBQyxpQkFBaUIsR0FBRztVQUNqRyxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLENBQUMsNkJBQTZCLEVBQUU7VUFDdEcsR0FBRyxVQUFVLENBQUMsYUFBYSxLQUFLLElBQUksSUFBSSxVQUFVLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRTtZQUNuRixDQUFDLENBQUMsZUFBZSxVQUFVLENBQUMsYUFBYSxFQUFFLEdBQUc7VUFDOUMsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtVQUMvQyxHQUFHLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsd0NBQXdDLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO0FBRTVGLE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsT0FBZSxFQUFFLFNBQTJDLEVBQVUsRUFBRTtJQUN4RyxNQUFNLEtBQUssR0FBRyxDQUFDLFFBQVEsZ0JBQWdCLEtBQUssT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN2RCxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDZixLQUFLLENBQUMsSUFBSSxDQUFDLGtHQUFrRyxDQUFDLENBQUM7UUFDL0csT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQztJQUNqQyxDQUFDO0lBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxjQUFjLFNBQVMsQ0FBQyxPQUFPLFNBQVMsU0FBUyxDQUFDLEdBQUcsa0JBQWtCLFNBQVMsQ0FBQyxPQUFPLFVBQVUsU0FBUyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDcEksS0FBSyxDQUFDLElBQUksQ0FBQyxzQkFBc0IsU0FBUyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDeEQsS0FBSyxDQUFDLElBQUksQ0FBQyxjQUFjLFNBQVMsQ0FBQyxRQUFRLGFBQWEsU0FBUyxDQUFDLE1BQU0sQ0FBQyxVQUFVLGdCQUFnQjtVQUMvRixHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQUMsU0FBUyxnQkFBZ0IsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLHFCQUFxQixTQUFTLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNoSCxLQUFLLE1BQU0sTUFBTSxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN2QyxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsTUFBTSxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsUUFBUSxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLG1DQUFtQztjQUMxSCxHQUFHLE1BQU0sQ0FBQyxVQUFVLEdBQUcsTUFBTSxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxFQUFFLEtBQUssTUFBTSxDQUFDLE9BQU8sY0FBYztjQUM3RyxhQUFhLE1BQU0sQ0FBQyxVQUFVLElBQUksT0FBTyxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixtSEFBbUg7UUFDbkgsS0FBSyxDQUFDLElBQUksQ0FBQyxpREFBaUQsU0FBUyxDQUFDLE9BQU8seUJBQXlCLFVBQVUsQ0FBQyxPQUFPLElBQUk7Y0FDeEgsa0dBQWtHLENBQUMsQ0FBQztRQUN4RyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDO0lBQ2pDLENBQUM7SUFDRCxLQUFLLE1BQU0sT0FBTyxJQUFJLFNBQVMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN6QyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsT0FBTyxDQUFDLEtBQUssS0FBSyxPQUFPLENBQUMsVUFBVSxLQUFLLFNBQVM7WUFDdEUsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsV0FBVyxVQUFVLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtjQUM1SCxHQUFHLE9BQU8sQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssT0FBTyxDQUFDLElBQUksRUFBRSxNQUFNLE9BQU8sQ0FBQyxTQUFTLEVBQUU7Y0FDNUUsR0FBRyxPQUFPLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLE9BQU8sQ0FBQyxPQUFPLEVBQUUsSUFBSTtZQUNyRSx1RkFBdUY7Y0FDckYsR0FBRyxPQUFPLENBQUMsVUFBVSxLQUFLLFNBQVM7Z0JBQ25DLENBQUMsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLDZCQUE2QixFQUFFO2dCQUNwRyxDQUFDLENBQUMsYUFBYSxPQUFPLENBQUMsZUFBZSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxlQUFlLEdBQUcsRUFBRTtzQkFDekYsR0FBRyxPQUFPLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLElBQUksRUFBRTtjQUMzRixHQUFHLE9BQU8sQ0FBQyxRQUFRLFlBQVk7Y0FDL0IsR0FBRyxhQUFhLENBQUMsT0FBTyxDQUFDLEtBQUssV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFvQixFQUFVLEVBQUUsQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQzVFLENBQUMsQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLEVBQUUsS0FBSyxLQUFLLENBQUMsRUFBRSxLQUFLLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDbkcsSUFBSSxTQUFTLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDNUIsS0FBSyxDQUFDLElBQUksQ0FBQyw0QkFBNEIsWUFBWSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUk7Y0FDdEYsV0FBVyxZQUFZLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDL0IsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUNoSCxLQUFLLE1BQU0sU0FBUyxJQUFJLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ25ELEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxTQUFTLENBQUMsRUFBRSxZQUFZLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRztrQkFDckUsSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUs7a0JBQ2xFLEdBQUcsU0FBUyxDQUFDLGFBQWEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxZQUFZLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUU7a0JBQzNGLEdBQUcsWUFBWSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFO2tCQUM3RCxHQUFHLFNBQVMsQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFdBQVcsU0FBUyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNwRixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDaEMsS0FBSyxDQUFDLElBQUksQ0FBQyx1QkFBdUIsU0FBUyxDQUFDLGlCQUFpQixDQUFDLFVBQVUsa0NBQWtDO2NBQ3RHLEdBQUcsU0FBUyxDQUFDLGlCQUFpQixDQUFDLE1BQU0sU0FBUyxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsS0FBSyxFQUFLLFlBQW9ELEVBQWMsRUFBRTtJQUNoRyxNQUFNLEtBQUssR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO0lBQ3BDLE1BQU0sUUFBUSxHQUFHLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQy9CLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2hDLElBQUksQ0FBQztRQUFDLE9BQU8sTUFBTSxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQUMsQ0FBQztZQUN4QyxDQUFDO1FBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUFDLENBQUM7QUFDaEYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxPQUFlLEVBQWlCLEVBQUUsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxFQUFFO0lBQ2hGLE1BQU0sd0JBQXdCLEVBQUUsQ0FBQztJQUNqQyxNQUFNLEtBQUssR0FBRyxtQkFBbUIsRUFBRSxDQUFDO0lBQ3BDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDcEQsa0hBQWtIO0lBQ2xILDBGQUEwRjtJQUMxRixNQUFNLGdCQUFnQixHQUFHLE1BQU0sNEJBQTRCLENBQUMsS0FBSyxDQUFDLElBQUksRUFDcEUsR0FBRyxFQUFFLENBQUMsb0JBQW9CLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNqRSxNQUFNLE1BQU0sR0FBRyxJQUFJLGNBQWMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsV0FBVyxFQUFFLGFBQWEsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQztRQUN6SCxtQkFBbUIsRUFBRSxLQUFLLENBQUMsZ0JBQWdCO1FBQzNDLGNBQWMsRUFBRSxxQ0FBcUMsRUFBRSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sUUFBUSxHQUFHLEdBQUcsRUFBRSxHQUFHLEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlELElBQUksQ0FBQztRQUNILElBQUksT0FBZSxDQUFDO1FBQ3BCLElBQUksQ0FBQztZQUFDLE9BQU8sR0FBRyxNQUFNLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUFDLENBQUM7UUFDdkMsT0FBTyxRQUFRLEVBQUUsQ0FBQztZQUNoQixrREFBa0Q7WUFDbEQsSUFBSSxTQUFTLENBQUMsT0FBTztnQkFBRSxPQUFPO1lBQzlCLE1BQU0sUUFBUSxDQUFDO1FBQ2pCLENBQUM7UUFDRCx5SEFBeUg7UUFDekgsTUFBTSwwQkFBMEIsQ0FBQyxLQUFLLENBQUMscUJBQXFCLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUNoRixPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxvQ0FBb0MsT0FBTyxJQUFJLENBQUMsQ0FBQztRQUN0RSxNQUFNLElBQUksT0FBTyxDQUFPLENBQUMsT0FBTyxFQUFFLEVBQUU7WUFDbEMsSUFBSSxTQUFTLENBQUMsT0FBTztnQkFBRSxPQUFPLEVBQUUsQ0FBQzs7Z0JBQU0sU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlHLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztZQUFTLENBQUM7UUFDVCxTQUFTLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3RCLENBQUM7QUFDSCxDQUFDLENBQUMsQ0FBQztBQUVIOzs7R0FHRztBQUNILE1BQU0sR0FBRyxHQUFHLENBQUMsVUFBa0MsRUFBaUIsRUFBRSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLEVBQUU7SUFDakcsTUFBTSx5QkFBeUIsRUFBRSxDQUFDO0lBQ2xDLE1BQU0sS0FBSyxHQUFHLG1CQUFtQixFQUFFLENBQUM7SUFDcEMsK0VBQStFO0lBQy9FLE1BQU0sS0FBSyxHQUFHLE1BQU0sbUJBQW1CLENBQUMsSUFBSSxDQUFDLEVBQUUsVUFBVSxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxPQUFRLEVBQUUsRUFDcEksV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdELElBQUksSUFBdUIsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxFQUFFLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sV0FBVyxDQUFDLHdCQUF3QixDQUFDO1FBQzVDLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFRLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLO1lBQzlHLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSSxFQUFFLFdBQVc7WUFDdkYscUJBQXFCLEVBQUUsS0FBSyxDQUFDLGVBQWUsRUFBRSxDQUFDLENBQUM7UUFDbEQsU0FBUyxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsV0FBVyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDeEksSUFBSSxTQUFvRCxDQUFDO1FBQ3pELE1BQU0sU0FBUyxHQUFHLEdBQUcsRUFBRTtZQUNyQixLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3RCLFNBQVMsS0FBSyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM5RCxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDcEIsQ0FBQyxDQUFDO1FBQ0YsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUMvRCxpSEFBaUg7UUFDakgsS0FBSyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLFFBQVEsQ0FBQyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdEUsSUFBSSxDQUFDO1lBQ0gsSUFBSSxTQUFTLENBQUMsT0FBTztnQkFBRSxTQUFTLEVBQUUsQ0FBQztZQUNuQyxPQUFPLENBQUMsUUFBUSxHQUFHLE1BQU0sSUFBSSxPQUFPLENBQVMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7Z0JBQy9ELEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUM1QixLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3pELENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsU0FBUyxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNsRCxJQUFJLFNBQVM7Z0JBQUUsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3pDLENBQUM7SUFDSCxDQUFDO1lBQVMsQ0FBQztRQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUFDLENBQUM7SUFDNUIsSUFBSSxJQUFJO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLElBQUksQ0FBQyxPQUFPLHdCQUF3QixVQUFVLENBQUMsT0FBTyx1QkFBdUIsQ0FBQyxDQUFDO0FBQzlHLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLFVBQTJCLEVBQW1CLEVBQUU7SUFDdkUsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDekMsT0FBTyxHQUFHLEtBQUssQ0FBQyxXQUFXLElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsYUFBYSxJQUFJLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQztJQUM5RixDQUFDO0lBQUMsT0FBTyxRQUFRLEVBQUUsQ0FBQztRQUNsQixPQUFPLFlBQVksUUFBUSxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEdBQUcsQ0FBQztJQUNoRyxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFBRSxPQUEwQixFQUFpQixFQUFFO0lBQ2pGLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxNQUFNLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDL0YsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUFDLE9BQU87SUFDakQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLDBCQUEwQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3BELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUFDLE1BQU0seUJBQXlCLEVBQUUsQ0FBQztRQUFDLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUFDLE9BQU87SUFBQyxDQUFDO0lBQzFHLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUFDLE1BQU0sR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQUMsT0FBTztJQUFDLENBQUM7SUFDOUQsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLEVBQUUsQ0FBQztJQUNwQyxNQUFNLE1BQU0sR0FBRyxJQUFJLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM1RCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDckMsTUFBTSx5QkFBeUIsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDckYsT0FBTztJQUNULENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLGVBQWUsQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM1RCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDakMsTUFBTSxJQUFJLEdBQUcsTUFBTSxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEMsSUFBSSxNQUF3QyxDQUFDO1FBQzdDLElBQUksQ0FBQztZQUFDLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUNsRSxPQUFPLFFBQVEsRUFBRSxDQUFDO1lBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxZQUFZLHdCQUF3QixDQUFDO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQUMsQ0FBQztRQUN6RixJQUFJLE9BQU8sQ0FBQyxJQUFJO1lBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLElBQUksSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQzs7WUFDN0gsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUNsQyxPQUFPO0lBQ1QsQ0FBQztJQUNELFFBQVEsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzlCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDZixNQUFNLFNBQVMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMxQyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsV0FBVyxLQUFLLGdCQUFnQixTQUFTLFNBQVMsQ0FBQyxVQUFVLGVBQWU7a0JBQ2xJLFVBQVUsT0FBTyxDQUFDLElBQUksNEZBQTRGLENBQUMsQ0FBQztZQUN4SCxPQUFPO1FBQ1QsQ0FBQztRQUNELEtBQUssUUFBUTtZQUFFLE1BQU0sT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQUMsTUFBTTtRQUM3QyxLQUFLLE9BQU87WUFBRSxNQUFNLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUFDLE1BQU07UUFDM0MsS0FBSyxNQUFNO1lBQUUsTUFBTSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7WUFBQyxNQUFNO1FBQ3pDLFNBQVMsTUFBTTtJQUNqQixDQUFDO0lBQ0QsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxnQkFBZ0IsS0FBSyxNQUFNLFNBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDN0UsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWNsaS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VjbGkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQ3JELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSx5QkFBeUIsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBQ3hHLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQzNELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ3JGLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0IsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBRTlGLE9BQU8sRUFBRSxxQkFBcUIsRUFBRSx3QkFBd0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ2xHLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxtQkFBbUIsRUFBK0IsTUFBTSwrQkFBK0IsQ0FBQztBQUN6SCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGVBQWUsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQ2xGLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzVGLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSwwQkFBMEIsRUFBK0IsTUFBTSxzQ0FBc0MsQ0FBQztBQUNqSSxPQUFPLEVBQUUseUJBQXlCLEVBQUUsTUFBTSxtQ0FBbUMsQ0FBQztBQUM5RSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxzQ0FBc0MsQ0FBQztBQWdCaEgsb0hBQW9IO0FBQ3BILE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBdUIsRUFBVSxFQUFFLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVTtJQUNuRixDQUFDLENBQUMsR0FBRyxRQUFRLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7QUFFdkUsdUdBQXVHO0FBQ3ZHLE1BQU0sYUFBYSxHQUFHLENBQUMsVUFBaUUsRUFBVSxFQUFFO0lBQ2xHLElBQUksVUFBVSxDQUFDLFNBQVMsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDbEQsSUFBSSxVQUFVLENBQUMsU0FBUyxLQUFLLFFBQVE7UUFBRSxPQUFPLFlBQVksVUFBVSxDQUFDLFFBQVEseUJBQXlCLENBQUM7SUFDdkcsT0FBTyxHQUFHLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLENBQUMsQ0FBQyxzQkFBc0IsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7VUFDOUYsZUFBZSxTQUFTLENBQUMsVUFBVSxDQUFDLGNBQWMsSUFBSSxJQUFJLENBQUMsRUFBRTtVQUM3RCxHQUFHLFVBQVUsQ0FBQyxhQUFhLEtBQUssSUFBSSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyw0QkFBNEI7WUFDN0csQ0FBQyxDQUFDLFVBQVUsVUFBVSxDQUFDLGFBQWEsRUFBRSxHQUFHLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztBQUNwSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLFdBQVcsR0FBRyxDQUFDLFVBQWlFLEVBQVUsRUFBRSxDQUNoRyxVQUFVLENBQUMsaUJBQWlCLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxVQUFVLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sVUFBVTtJQUM3RyxDQUFDLENBQUMsR0FBRyxVQUFVLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLFVBQVUsVUFBVSxDQUFDLGlCQUFpQixHQUFHO1VBQ2pHLElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLENBQUMsQ0FBQyw2QkFBNkIsRUFBRTtVQUN0RyxHQUFHLFVBQVUsQ0FBQyxhQUFhLEtBQUssSUFBSSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFO1lBQ25GLENBQUMsQ0FBQyxlQUFlLFVBQVUsQ0FBQyxhQUFhLEVBQUUsR0FBRztVQUM5QyxHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFO1VBQy9DLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUM7QUFFNUYsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxPQUFlLEVBQUUsU0FBMkMsRUFBVSxFQUFFO0lBQ3hHLE1BQU0sS0FBSyxHQUFHLENBQUMsUUFBUSxnQkFBZ0IsS0FBSyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZELElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNmLEtBQUssQ0FBQyxJQUFJLENBQUMsa0dBQWtHLENBQUMsQ0FBQztRQUMvRyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDO0lBQ2pDLENBQUM7SUFDRCxLQUFLLENBQUMsSUFBSSxDQUFDLGNBQWMsU0FBUyxDQUFDLE9BQU8sU0FBUyxTQUFTLENBQUMsR0FBRyxrQkFBa0IsU0FBUyxDQUFDLE9BQU8sVUFBVSxTQUFTLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNwSSxLQUFLLENBQUMsSUFBSSxDQUFDLHNCQUFzQixTQUFTLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN4RCxLQUFLLENBQUMsSUFBSSxDQUFDLGNBQWMsU0FBUyxDQUFDLFFBQVEsYUFBYSxTQUFTLENBQUMsTUFBTSxDQUFDLFVBQVUsZ0JBQWdCO1VBQy9GLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxTQUFTLGdCQUFnQixTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUsscUJBQXFCLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ2hILEtBQUssTUFBTSxNQUFNLElBQUksU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3ZDLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxNQUFNLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxRQUFRLEtBQUssV0FBVyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsbUNBQW1DO2NBQzFILEdBQUcsTUFBTSxDQUFDLFVBQVUsR0FBRyxNQUFNLENBQUMsUUFBUSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxNQUFNLENBQUMsT0FBTyxjQUFjO2NBQzdHLGFBQWEsTUFBTSxDQUFDLFVBQVUsSUFBSSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvQyxLQUFLLENBQUMsSUFBSSxDQUFDLHNCQUFzQixTQUFTLENBQUMsa0JBQWtCLElBQUksTUFBTSxFQUFFLENBQUMsQ0FBQztRQUMzRSxLQUFLLE1BQU0sR0FBRyxJQUFJLFNBQVMsQ0FBQyxZQUFZLElBQUksRUFBRSxFQUFFLENBQUM7WUFDL0MsS0FBSyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxDQUFDLEVBQUUsWUFBWSxHQUFHLENBQUMsU0FBUyxFQUFFO2tCQUN4RCxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsa0VBQWtFLEVBQUU7a0JBQ3ZGLDBDQUEwQyxHQUFHLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM3RCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDeEIsbUhBQW1IO1FBQ25ILEtBQUssQ0FBQyxJQUFJLENBQUMsaURBQWlELFNBQVMsQ0FBQyxPQUFPLHlCQUF5QixVQUFVLENBQUMsT0FBTyxJQUFJO2NBQ3hILGtHQUFrRyxDQUFDLENBQUM7UUFDeEcsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQztJQUNqQyxDQUFDO0lBQ0QsS0FBSyxNQUFNLE9BQU8sSUFBSSxTQUFTLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDekMsS0FBSyxDQUFDLElBQUksQ0FBQyxXQUFXLE9BQU8sQ0FBQyxLQUFLLEtBQUssT0FBTyxDQUFDLFVBQVUsS0FBSyxTQUFTO1lBQ3RFLENBQUMsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsVUFBVSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUU7Y0FDNUgsR0FBRyxPQUFPLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLE9BQU8sQ0FBQyxJQUFJLEVBQUUsTUFBTSxPQUFPLENBQUMsU0FBUyxFQUFFO2NBQzVFLEdBQUcsT0FBTyxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxPQUFPLENBQUMsT0FBTyxFQUFFLElBQUk7WUFDckUsdUZBQXVGO2NBQ3JGLEdBQUcsT0FBTyxDQUFDLFVBQVUsS0FBSyxTQUFTO2dCQUNuQyxDQUFDLENBQUMsR0FBRyxPQUFPLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsRUFBRTtnQkFDcEcsQ0FBQyxDQUFDLGFBQWEsT0FBTyxDQUFDLGVBQWUsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLENBQUMsZUFBZSxHQUFHLEVBQUU7c0JBQ3pGLEdBQUcsT0FBTyxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsWUFBWSxJQUFJLEVBQUU7Y0FDM0YsR0FBRyxPQUFPLENBQUMsUUFBUSxZQUFZO2NBQy9CLEdBQUcsYUFBYSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFdBQVcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBb0IsRUFBVSxFQUFFLENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTTtRQUM1RSxDQUFDLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEtBQUssS0FBSyxDQUFDLEVBQUUsS0FBSyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ25HLElBQUksU0FBUyxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsNEJBQTRCLFlBQVksQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJO2NBQ3RGLFdBQVcsWUFBWSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBQy9CLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsbUNBQW1DLENBQUMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDLENBQUM7UUFDaEgsS0FBSyxNQUFNLFNBQVMsSUFBSSxTQUFTLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUNuRCxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssU0FBUyxDQUFDLEVBQUUsWUFBWSxTQUFTLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUc7a0JBQ3JFLElBQUksU0FBUyxDQUFDLFFBQVEsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLO2tCQUNsRSxHQUFHLFNBQVMsQ0FBQyxhQUFhLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsWUFBWSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFO2tCQUMzRixHQUFHLFlBQVksQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRTtrQkFDN0QsR0FBRyxTQUFTLENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLFNBQVMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ2hDLEtBQUssQ0FBQyxJQUFJLENBQUMsdUJBQXVCLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLGtDQUFrQztjQUN0RyxHQUFHLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLFNBQVMsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDO0FBQ2pDLENBQUMsQ0FBQztBQUVGLE1BQU0sV0FBVyxHQUFHLEtBQUssRUFBSyxZQUFvRCxFQUFjLEVBQUU7SUFDaEcsTUFBTSxLQUFLLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztJQUNwQyxNQUFNLFFBQVEsR0FBRyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUMsQ0FBQztJQUNoRixPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMvQixPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNoQyxJQUFJLENBQUM7UUFBQyxPQUFPLE1BQU0sWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUFDLENBQUM7WUFDeEMsQ0FBQztRQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFBQyxDQUFDO0FBQ2hGLENBQUMsQ0FBQztBQUVGLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBZSxFQUFpQixFQUFFLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtJQUNoRixNQUFNLHdCQUF3QixFQUFFLENBQUM7SUFDakMsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLEVBQUUsQ0FBQztJQUNwQyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUMvRSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3BELGtIQUFrSDtJQUNsSCwwRkFBMEY7SUFDMUYsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLDRCQUE0QixDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQ3BFLEdBQUcsRUFBRSxDQUFDLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDakUsTUFBTSxNQUFNLEdBQUcsSUFBSSxjQUFjLENBQUMsRUFBRSxVQUFVLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxTQUFTLENBQUM7UUFDekgsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxtQkFBbUI7UUFDMUYsY0FBYyxFQUFFLHFDQUFxQyxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDNUUsTUFBTSxRQUFRLEdBQUcsR0FBRyxFQUFFLEdBQUcsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RFLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDOUQsSUFBSSxDQUFDO1FBQ0gsSUFBSSxPQUFlLENBQUM7UUFDcEIsSUFBSSxDQUFDO1lBQUMsT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQUMsQ0FBQztRQUN2QyxPQUFPLFFBQVEsRUFBRSxDQUFDO1lBQ2hCLGtEQUFrRDtZQUNsRCxJQUFJLFNBQVMsQ0FBQyxPQUFPO2dCQUFFLE9BQU87WUFDOUIsTUFBTSxRQUFRLENBQUM7UUFDakIsQ0FBQztRQUNELHlIQUF5SDtRQUN6SCxNQUFNLDBCQUEwQixDQUFDLEtBQUssQ0FBQyxxQkFBcUIsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ2hGLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLG9DQUFvQyxPQUFPLElBQUksQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRTtZQUNsQyxJQUFJLFNBQVMsQ0FBQyxPQUFPO2dCQUFFLE9BQU8sRUFBRSxDQUFDOztnQkFBTSxTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDOUcsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO1lBQVMsQ0FBQztRQUNULFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDakQsTUFBTSxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdEIsQ0FBQztBQUNILENBQUMsQ0FBQyxDQUFDO0FBRUg7OztHQUdHO0FBQ0gsTUFBTSxHQUFHLEdBQUcsQ0FBQyxVQUFrQyxFQUFpQixFQUFFLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtJQUNqRyxNQUFNLHlCQUF5QixFQUFFLENBQUM7SUFDbEMsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLEVBQUUsQ0FBQztJQUNwQywrRUFBK0U7SUFDL0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsRUFBRSxVQUFVLEVBQUUsS0FBSyxDQUFDLFdBQVcsRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLE9BQVEsRUFBRSxFQUNwSSxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDN0QsSUFBSSxJQUF1QixDQUFDO0lBQzVCLElBQUksQ0FBQztRQUNILE1BQU0sV0FBVyxHQUFHLEVBQUUsR0FBRyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdkMsT0FBTyxXQUFXLENBQUMsd0JBQXdCLENBQUM7UUFDNUMsTUFBTSxNQUFNLEdBQUcsc0JBQXNCLENBQUMsRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQVEsRUFBRSxPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUs7WUFDOUcsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJLEVBQUUsV0FBVztZQUN2RixxQkFBcUIsRUFBRSxLQUFLLENBQUMsZUFBZSxFQUFFLENBQUMsQ0FBQztRQUNsRCxTQUFTLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDM0IsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLE9BQVEsRUFBRSxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxXQUFXLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUN4SSxJQUFJLFNBQW9ELENBQUM7UUFDekQsTUFBTSxTQUFTLEdBQUcsR0FBRyxFQUFFO1lBQ3JCLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDdEIsU0FBUyxLQUFLLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzlELFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNwQixDQUFDLENBQUM7UUFDRixTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELGlIQUFpSDtRQUNqSCxLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsUUFBUSxDQUFDLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RSxJQUFJLENBQUM7WUFDSCxJQUFJLFNBQVMsQ0FBQyxPQUFPO2dCQUFFLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE9BQU8sQ0FBQyxRQUFRLEdBQUcsTUFBTSxJQUFJLE9BQU8sQ0FBUyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtnQkFDL0QsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQzVCLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDekQsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO2dCQUFTLENBQUM7WUFDVCxTQUFTLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1lBQ2xELElBQUksU0FBUztnQkFBRSxZQUFZLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekMsQ0FBQztJQUNILENBQUM7WUFBUyxDQUFDO1FBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQUMsQ0FBQztJQUM1QixJQUFJLElBQUk7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLE9BQU8sd0JBQXdCLFVBQVUsQ0FBQyxPQUFPLHVCQUF1QixDQUFDLENBQUM7QUFDOUcsQ0FBQyxDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxXQUFXLEdBQUcsQ0FBQyxVQUFrQyxFQUFpQixFQUFFLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtJQUN6RyxNQUFNLHlCQUF5QixFQUFFLENBQUM7SUFDbEMsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLEVBQUUsQ0FBQztJQUNwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLHNCQUFzQixDQUFDLElBQUksQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzVJLElBQUksSUFBd0MsQ0FBQztJQUM3QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxHQUFHLENBQUMsa0JBQWtCLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPO1lBQ25ILEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNoRCxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQywwQkFBMEIsR0FBRyxDQUFDLEVBQUUsS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsd0JBQXdCO2NBQzFILE1BQU0sMEJBQTBCLGtEQUFrRCxHQUFHLENBQUMsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNyRyxTQUFTLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDM0IsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxXQUFXLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNuSSxJQUFJLFNBQW9ELENBQUM7UUFDekQsTUFBTSxTQUFTLEdBQUcsR0FBRyxFQUFFO1lBQ3JCLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDdEIsU0FBUyxLQUFLLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzlELFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNwQixDQUFDLENBQUM7UUFDRixTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9ELEtBQUssR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxRQUFRLENBQUMsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLElBQUksQ0FBQztZQUNILElBQUksU0FBUyxDQUFDLE9BQU87Z0JBQUUsU0FBUyxFQUFFLENBQUM7WUFDbkMsT0FBTyxDQUFDLFFBQVEsR0FBRyxNQUFNLElBQUksT0FBTyxDQUFTLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO2dCQUMvRCxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDNUIsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN6RCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7Z0JBQVMsQ0FBQztZQUNULFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDbEQsSUFBSSxTQUFTO2dCQUFFLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN6QyxDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFBQyxHQUFHLENBQUMsS0FBSyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQzFCLElBQUksSUFBSTtRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxJQUFJLENBQUMsT0FBTyw4REFBOEQsQ0FBQyxDQUFDO0FBQzNHLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLFVBQTJCLEVBQW1CLEVBQUU7SUFDdkUsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDekMsT0FBTyxHQUFHLEtBQUssQ0FBQyxXQUFXLElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsYUFBYSxJQUFJLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQztJQUM5RixDQUFDO0lBQUMsT0FBTyxRQUFRLEVBQUUsQ0FBQztRQUNsQixPQUFPLFlBQVksUUFBUSxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEdBQUcsQ0FBQztJQUNoRyxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFBRSxPQUEwQixFQUFpQixFQUFFO0lBQ2pGLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxNQUFNLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDL0YsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUFDLE9BQU87SUFDakQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLDBCQUEwQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3BELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUFDLE1BQU0seUJBQXlCLEVBQUUsQ0FBQztRQUFDLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUFDLE9BQU87SUFBQyxDQUFDO0lBQzFHLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUFDLE1BQU0sR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQUMsT0FBTztJQUFDLENBQUM7SUFDOUQsSUFBSSxPQUFPLENBQUMsT0FBTyxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQUMsTUFBTSxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7UUFBQyxPQUFPO0lBQUMsQ0FBQztJQUMvRyxNQUFNLEtBQUssR0FBRyxtQkFBbUIsRUFBRSxDQUFDO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLElBQUkscUJBQXFCLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzVELElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUNuQyxNQUFNLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFVBQVcsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDM0UsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsc0JBQXNCLE9BQU8sQ0FBQyxVQUFVLG1EQUFtRCxDQUFDLENBQUM7UUFDbEgsT0FBTztJQUNULENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDckMsTUFBTSx5QkFBeUIsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDckYsT0FBTztJQUNULENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLGVBQWUsQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM1RCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDakMsTUFBTSxJQUFJLEdBQUcsTUFBTSxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEMsSUFBSSxNQUF3QyxDQUFDO1FBQzdDLElBQUksQ0FBQztZQUFDLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUNsRSxPQUFPLFFBQVEsRUFBRSxDQUFDO1lBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxZQUFZLHdCQUF3QixDQUFDO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQUMsQ0FBQztRQUN6RixJQUFJLE9BQU8sQ0FBQyxJQUFJO1lBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLElBQUksSUFBSSxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQzs7WUFDN0gsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUNsQyxPQUFPO0lBQ1QsQ0FBQztJQUNELFFBQVEsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzlCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDZixNQUFNLFNBQVMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMxQyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsV0FBVyxLQUFLLGdCQUFnQixTQUFTLFNBQVMsQ0FBQyxVQUFVLGVBQWU7a0JBQ2xJLFVBQVUsT0FBTyxDQUFDLElBQUksNEZBQTRGLENBQUMsQ0FBQztZQUN4SCxPQUFPO1FBQ1QsQ0FBQztRQUNELEtBQUssUUFBUTtZQUFFLE1BQU0sT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQUMsTUFBTTtRQUM3QyxLQUFLLE9BQU87WUFBRSxNQUFNLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUFDLE1BQU07UUFDM0MsS0FBSyxNQUFNO1lBQUUsTUFBTSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7WUFBQyxNQUFNO1FBQ3pDLFNBQVMsTUFBTTtJQUNqQixDQUFDO0lBQ0QsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxnQkFBZ0IsS0FBSyxNQUFNLFNBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDN0UsQ0FBQyxDQUFDIn0=

package/dist_ts/functions.inferencecliarguments.d.ts

@@ -1,14 +1,18 @@
 import type { IInferenceRoutingPolicy } from './classes.inferencerouter.js';
 import type { TInferenceHarness } from './functions.inferencelaunch.js';
 import { type TInferenceProvider, type TProxyCredentialDelivery } from './functions.proxycontract.js';
-export declare const inferenceCliHelp = "Usage:\n  agl proxy service install [--port 4100] | enable | start | stop | status\n  agl proxy serve [--port 4100]\n  agl proxy status [--json]\n  agl proxy credential <client> [--provider openai|anthropic] [--delivery file|none] [--write <path>] [--rotate] | --version\n  agl proxy run codex|claude|opencode [--provider openai|anthropic] [--account <id>] [--plan <name>] [--model <id>] -- [harness arguments]\n\nThe proxy runs as the agl-proxy.service user unit (serve runs it in a terminal instead).\nEvery client (codex, claude, opencode, or a name of your own) has one credential, sealed by the proxy.\ncredential <client> alone prints it: that is the command a harness runs for its credential, not one to type.\n--write puts it in a private file instead; --delivery file has the proxy keep it in its own private file for the\nclient, rewritten on every rotation (none ends that); --rotate replaces it. These print what they did, never the credential.\ncredential --version prints the AGL release a credential command runs, without asking the proxy.\nEach client is served from one pool: ChatGPT accounts (openai) or Claude accounts (anthropic). The claude\nclient starts on Claude accounts, every other client on ChatGPT accounts; --provider moves a client.\nRun gives one child a private credential that ends when the child exits; run claude uses Claude accounts\nunless --provider openai asks for ChatGPT models behind Claude Code.\nRepeat --account or --plan to restrict automatic routing. Only accounts the account service holds are eligible.\nChatGPT pools: /openai/v1/responses, /anthropic/v1/messages (translated), and each prefix's /models.\nClaude pools: /anthropic/v1/messages, /anthropic/v1/messages/count_tokens and /anthropic/v1/models, sent on as Claude Code sent them.\nSessions stay on one account until current quota or a provider 429 requires another; recovered accounts do not pull sessions back.\nA session on an account that --account leaves out moves to one of the named accounts.\nUse x-agl-session-id for custom clients; native session headers and prompt_cache_key are recognized.\nSwitches use full history with a cold cache. Provider-only references require a full-history retry; opaque account state never crosses accounts.\n";
-export type TInferenceCommand = 'serve' | 'run' | 'credential' | 'status' | 'service';
+export declare const inferenceCliHelp = "Usage:\n  agl proxy service install [--port 4100] | enable | start | stop | status\n  agl proxy serve [--port 4100]\n  agl proxy status [--json]\n  agl proxy credential <client> [--provider openai|anthropic] [--delivery file|none] [--write <path>] [--rotate] | --version\n  agl proxy run codex|claude|opencode [--provider openai|anthropic] [--account <id>] [--plan <name>] [--model <id>] -- [harness arguments]\n  agl proxy confined run -- docker run [docker options] <image> [command]\n  agl proxy confined end <run id>\n\nThe proxy runs as the agl-proxy.service user unit (serve runs it in a terminal instead).\nEvery client (codex, claude, opencode, or a name of your own) has one credential, sealed by the proxy.\ncredential <client> alone prints it: that is the command a harness runs for its credential, not one to type.\n--write puts it in a private file instead; --delivery file has the proxy keep it in its own private file for the\nclient, rewritten on every rotation (none ends that); --rotate replaces it. These print what they did, never the credential.\ncredential --version prints the AGL release a credential command runs, without asking the proxy.\nEach client is served from one pool: ChatGPT accounts (openai) or Claude accounts (anthropic). The claude\nclient starts on Claude accounts, every other client on ChatGPT accounts; --provider moves a client.\nRun gives one child a private credential that ends when the child exits; run claude uses Claude accounts\nunless --provider openai asks for ChatGPT models behind Claude Code.\nconfined run starts Claude Code's container on a credential of its own, accepted only on the proxy's confined\nlistener: a Unix socket whose directory the run mounts read-only at /run/agl-proxy, served the Claude pool's\nthree Claude Code endpoints alone. It adds the mount and Claude Code's settings (ANTHROPIC_UNIX_SOCKET, ANTHROPIC_BASE_URL,\nANTHROPIC_AUTH_TOKEN) right after docker run, prints the run's id on standard error, and ends the credential when the\ncontainer exits. The socket is the proxy user's (0600): run the container as that uid (--user), or as root under\nrootless Docker. Root of a rootful daemon connects as well while it keeps CAP_DAC_OVERRIDE (--cap-drop ALL takes it).\nconfined end ends a run's credential at once, and its launcher stops the container; agl proxy status lists the runs.\nRepeat --account or --plan to restrict automatic routing. Only accounts the account service holds are eligible.\nChatGPT pools: /openai/v1/responses, /anthropic/v1/messages (translated), and each prefix's /models.\nClaude pools: /anthropic/v1/messages, /anthropic/v1/messages/count_tokens and /anthropic/v1/models, sent on as Claude Code sent them.\nSessions stay on one account until current quota or a provider 429 requires another; recovered accounts do not pull sessions back.\nA session on an account that --account leaves out moves to one of the named accounts.\nUse x-agl-session-id for custom clients; native session headers and prompt_cache_key are recognized.\nSwitches use full history with a cold cache. Provider-only references require a full-history retry; opaque account state never crosses accounts.\n";
+export type TInferenceCommand = 'serve' | 'run' | 'credential' | 'status' | 'service' | 'confined';
 export type TInferenceServiceAction = 'install' | 'enable' | 'start' | 'stop' | 'status';
+export type TInferenceConfinedAction = 'run' | 'end';
 export interface IInferenceCliArguments {
     command: TInferenceCommand;
     harness?: TInferenceHarness;
     client?: string;
     serviceAction?: TInferenceServiceAction;
+    confinedAction?: TInferenceConfinedAction;
+    /** `confined end`: the run to end. */
+    confinedId?: string;
     port: number;
     policy: IInferenceRoutingPolicy;
     /** `--provider`, when given. */

package/dist_ts/functions.inferencecliarguments.js

@@ -1,5 +1,5 @@
 import * as path from 'node:path';
-import { aglProxyDefaultPort, aglProxyUnitName, defaultProxyClientProvider, inferencePlanPattern, inferenceProviders, proxyClientNamePattern, proxyCredentialDeliveries, } from './functions.proxycontract.js';
+import { aglProxyConfinedIdPattern, aglProxyConfinedMountPoint, aglProxyDefaultPort, aglProxyUnitName, defaultProxyClientProvider, inferencePlanPattern, inferenceProviders, proxyClientNamePattern, proxyCredentialDeliveries, } from './functions.proxycontract.js';
 /*
  * The `agl proxy` command line's grammar. Node's own modules and plain values only: the fast `agl proxy credential`
  * entry parses its arguments here without loading the rest of AGL.
@@ -10,6 +10,8 @@ export const inferenceCliHelp = `Usage:
   agl proxy status [--json]
   agl proxy credential <client> [--provider openai|anthropic] [--delivery file|none] [--write <path>] [--rotate] | --version
   agl proxy run codex|claude|opencode [--provider openai|anthropic] [--account <id>] [--plan <name>] [--model <id>] -- [harness arguments]
+  agl proxy confined run -- docker run [docker options] <image> [command]
+  agl proxy confined end <run id>
 
 The proxy runs as the ${aglProxyUnitName} user unit (serve runs it in a terminal instead).
 Every client (codex, claude, opencode, or a name of your own) has one credential, sealed by the proxy.
@@ -21,6 +23,13 @@ Each client is served from one pool: ChatGPT accounts (openai) or Claude account
 client starts on Claude accounts, every other client on ChatGPT accounts; --provider moves a client.
 Run gives one child a private credential that ends when the child exits; run claude uses Claude accounts
 unless --provider openai asks for ChatGPT models behind Claude Code.
+confined run starts Claude Code's container on a credential of its own, accepted only on the proxy's confined
+listener: a Unix socket whose directory the run mounts read-only at ${aglProxyConfinedMountPoint}, served the Claude pool's
+three Claude Code endpoints alone. It adds the mount and Claude Code's settings (ANTHROPIC_UNIX_SOCKET, ANTHROPIC_BASE_URL,
+ANTHROPIC_AUTH_TOKEN) right after docker run, prints the run's id on standard error, and ends the credential when the
+container exits. The socket is the proxy user's (0600): run the container as that uid (--user), or as root under
+rootless Docker. Root of a rootful daemon connects as well while it keeps CAP_DAC_OVERRIDE (--cap-drop ALL takes it).
+confined end ends a run's credential at once, and its launcher stops the container; agl proxy status lists the runs.
 Repeat --account or --plan to restrict automatic routing. Only accounts the account service holds are eligible.
 ChatGPT pools: /openai/v1/responses, /anthropic/v1/messages (translated), and each prefix's /models.
 Claude pools: /anthropic/v1/messages, /anthropic/v1/messages/count_tokens and /anthropic/v1/models, sent on as Claude Code sent them.
@@ -35,6 +44,7 @@ const commandOptions = {
     credential: ['--provider', '--delivery', '--write', '--rotate'],
     status: ['--json'],
     service: ['--port'],
+    confined: [],
 };
 const flags = new Set(['--rotate', '--json']);
 export const parseInferenceCliArguments = (argvArg) => {
@@ -66,6 +76,23 @@ export const parseInferenceCliArguments = (argvArg) => {
             throw new Error(inferenceCliHelp);
         result.serviceAction = action;
     }
+    else if (command === 'confined') {
+        const action = argv.shift();
+        if (action === 'end') {
+            const id = argv.shift();
+            if (id === undefined || !aglProxyConfinedIdPattern.test(id) || argv.length) {
+                throw new Error('Name the confined run to end by its id: 12 hex characters, as `agl proxy status` lists it.');
+            }
+            result.confinedAction = 'end';
+            result.confinedId = id;
+            return result;
+        }
+        if (action !== 'run' || argv.shift() !== '--' || !argv.length)
+            throw new Error(inferenceCliHelp);
+        result.confinedAction = 'run';
+        result.args = argv;
+        return result;
+    }
     const accounts = [];
     const plans = [];
     while (argv.length) {
@@ -137,4 +164,4 @@ export const parseInferenceCliArguments = (argvArg) => {
     }
     return result;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWNsaWFyZ3VtZW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VjbGlhcmd1bWVudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFHbEMsT0FBTyxFQUNMLG1CQUFtQixFQUNuQixnQkFBZ0IsRUFDaEIsMEJBQTBCLEVBQzFCLG9CQUFvQixFQUNwQixrQkFBa0IsRUFDbEIsc0JBQXNCLEVBQ3RCLHlCQUF5QixHQUcxQixNQUFNLDhCQUE4QixDQUFDO0FBRXRDOzs7R0FHRztBQUVILE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHO3NDQUNNLG1CQUFtQjs0QkFDN0IsbUJBQW1COzs7Ozt3QkFLdkIsZ0JBQWdCOzs7Ozs7Ozs7Ozs7Ozs7OztDQWlCdkMsQ0FBQztBQXdCRixNQUFNLGNBQWMsR0FBaUQ7SUFDbkUsS0FBSyxFQUFFLENBQUMsUUFBUSxDQUFDO0lBQ2pCLEdBQUcsRUFBRSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLFNBQVMsQ0FBQztJQUNyRCxVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUM7SUFDL0QsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDO0lBQ2xCLE9BQU8sRUFBRSxDQUFDLFFBQVEsQ0FBQztDQUNwQixDQUFDO0FBQ0YsTUFBTSxLQUFLLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUU5QyxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLE9BQTBCLEVBQTBCLEVBQUU7SUFDL0YsTUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxDQUFDO0lBQzFCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQW1DLENBQUM7SUFDOUQsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLE9BQU8sQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUMzRixNQUFNLE1BQU0sR0FBMkIsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxLQUFLO1FBQ2pJLElBQUksRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUNiLElBQUksT0FBTyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3RCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM3QixJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ2hHLE1BQU0sQ0FBQyxPQUFPLEdBQUcsT0FBNEIsQ0FBQztJQUNoRCxDQUFDO1NBQU0sSUFBSSxPQUFPLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDcEMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDdEIsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM1QixJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUMzSSxNQUFNLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN6QixDQUFDO1NBQU0sSUFBSSxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDakMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzVCLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUNoSCxNQUFNLENBQUMsYUFBYSxHQUFHLE1BQWlDLENBQUM7SUFDM0QsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUM5QixNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsT0FBTyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssRUFBRyxDQUFDO1FBQzNCLElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxFQUFFLENBQUM7WUFBQyxNQUFNLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztZQUFDLE1BQU07UUFBQyxDQUFDO1FBQ3RFLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNsSSxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNwQixJQUFJLElBQUksS0FBSyxVQUFVO2dCQUFFLE1BQU0sQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDOztnQkFBTSxNQUFNLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztZQUN2RSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMzQixJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNwRixJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxLQUFLO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztZQUM5SCxNQUFNLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUM5QixDQUFDO2FBQU0sSUFBSSxJQUFJLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1lBQ2pHLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLENBQUMsQ0FBQztZQUMzRixLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3BCLENBQUM7YUFBTSxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztZQUNqQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLEtBQTJCLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ3JILE1BQU0sQ0FBQyxRQUFRLEdBQUcsS0FBMkIsQ0FBQztRQUNoRCxDQUFDO2FBQU0sSUFBSSxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7WUFDakMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxLQUFpQyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUMzSCxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQWlDLENBQUM7UUFDdEQsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7WUFDaEYsTUFBTSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLEdBQUc7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLEVBQUU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDdEgsSUFBSSxRQUFRLENBQUMsTUFBTTtRQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE1BQU07UUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM1RCxJQUFJLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUN0QixJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLEtBQUssQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQ25HLENBQUM7UUFDRCxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxJQUFJLDBCQUEwQixDQUFDLE1BQU0sQ0FBQyxPQUFRLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWNsaWFyZ3VtZW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VjbGlhcmd1bWVudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFHbEMsT0FBTyxFQUNMLHlCQUF5QixFQUN6QiwwQkFBMEIsRUFDMUIsbUJBQW1CLEVBQ25CLGdCQUFnQixFQUNoQiwwQkFBMEIsRUFDMUIsb0JBQW9CLEVBQ3BCLGtCQUFrQixFQUNsQixzQkFBc0IsRUFDdEIseUJBQXlCLEdBRzFCLE1BQU0sOEJBQThCLENBQUM7QUFFdEM7OztHQUdHO0FBRUgsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUc7c0NBQ00sbUJBQW1COzRCQUM3QixtQkFBbUI7Ozs7Ozs7d0JBT3ZCLGdCQUFnQjs7Ozs7Ozs7Ozs7c0VBVzhCLDBCQUEwQjs7Ozs7Ozs7Ozs7OztDQWEvRixDQUFDO0FBNEJGLE1BQU0sY0FBYyxHQUFpRDtJQUNuRSxLQUFLLEVBQUUsQ0FBQyxRQUFRLENBQUM7SUFDakIsR0FBRyxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDO0lBQ3JELFVBQVUsRUFBRSxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQztJQUMvRCxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUM7SUFDbEIsT0FBTyxFQUFFLENBQUMsUUFBUSxDQUFDO0lBQ25CLFFBQVEsRUFBRSxFQUFFO0NBQ2IsQ0FBQztBQUNGLE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFOUMsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxPQUEwQixFQUEwQixFQUFFO0lBQy9GLE1BQU0sSUFBSSxHQUFHLENBQUMsR0FBRyxPQUFPLENBQUMsQ0FBQztJQUMxQixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFtQyxDQUFDO0lBQzlELElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDM0YsTUFBTSxNQUFNLEdBQTJCLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSztRQUNqSSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQUM7SUFDYixJQUFJLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUN0QixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDN0IsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUNoRyxNQUFNLENBQUMsT0FBTyxHQUFHLE9BQTRCLENBQUM7SUFDaEQsQ0FBQztTQUFNLElBQUksT0FBTyxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3BDLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ2pELE1BQU0sQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ3RCLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDNUIsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDM0ksTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7SUFDekIsQ0FBQztTQUFNLElBQUksT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM1QixJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUM7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDaEgsTUFBTSxDQUFDLGFBQWEsR0FBRyxNQUFpQyxDQUFDO0lBQzNELENBQUM7U0FBTSxJQUFJLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUNsQyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDNUIsSUFBSSxNQUFNLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDckIsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3hCLElBQUksRUFBRSxLQUFLLFNBQVMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzNFLE1BQU0sSUFBSSxLQUFLLENBQUMsNEZBQTRGLENBQUMsQ0FBQztZQUNoSCxDQUFDO1lBQ0QsTUFBTSxDQUFDLGNBQWMsR0FBRyxLQUFLLENBQUM7WUFDOUIsTUFBTSxDQUFDLFVBQVUsR0FBRyxFQUFFLENBQUM7WUFDdkIsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztRQUNELElBQUksTUFBTSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDakcsTUFBTSxDQUFDLGNBQWMsR0FBRyxLQUFLLENBQUM7UUFDOUIsTUFBTSxDQUFDLElBQUksR0FBRyxJQUFJLENBQUM7UUFDbkIsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUM5QixNQUFNLEtBQUssR0FBYSxFQUFFLENBQUM7SUFDM0IsT0FBTyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssRUFBRyxDQUFDO1FBQzNCLElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxFQUFFLENBQUM7WUFBQyxNQUFNLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztZQUFDLE1BQU07UUFBQyxDQUFDO1FBQ3RFLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNsSSxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNwQixJQUFJLElBQUksS0FBSyxVQUFVO2dCQUFFLE1BQU0sQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDOztnQkFBTSxNQUFNLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztZQUN2RSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMzQixJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNwRixJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN0QixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxLQUFLO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztZQUM5SCxNQUFNLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUM5QixDQUFDO2FBQU0sSUFBSSxJQUFJLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1lBQ2pHLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLENBQUMsQ0FBQztZQUMzRixLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3BCLENBQUM7YUFBTSxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztZQUNqQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLEtBQTJCLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ3JILE1BQU0sQ0FBQyxRQUFRLEdBQUcsS0FBMkIsQ0FBQztRQUNoRCxDQUFDO2FBQU0sSUFBSSxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7WUFDakMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxLQUFpQyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUMzSCxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQWlDLENBQUM7UUFDdEQsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7WUFDaEYsTUFBTSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLEdBQUc7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLEVBQUU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDdEgsSUFBSSxRQUFRLENBQUMsTUFBTTtRQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE1BQU07UUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM1RCxJQUFJLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUN0QixJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLEtBQUssQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQ25HLENBQUM7UUFDRCxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxJQUFJLDBCQUEwQixDQUFDLE1BQU0sQ0FBQyxPQUFRLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=

package/dist_ts/functions.inferencelaunch.d.ts

@@ -31,3 +31,27 @@ export declare const inferenceHarnessLaunch: (optionsArg: IInferenceLaunchOption
     args: string[];
     environment: NodeJS.ProcessEnv;
 };
+/**
+ * A confined run's `docker run`: the given command, with the confined listener's directory mounted read-only at
+ * `aglProxyConfinedMountPoint` and Claude Code's settings for it added right after `run`, before the launcher's own
+ * options and image. Claude Code inside reaches the proxy through the socket alone (`ANTHROPIC_UNIX_SOCKET`, which
+ * Claude Code sends its API requests through as plain HTTP to `ANTHROPIC_BASE_URL`'s path), on the run's credential
+ * (`ANTHROPIC_AUTH_TOKEN`), reads the pool's models from the proxy and sends nothing beyond its model requests. The
+ * container gets each variable by name from the docker command's environment, so the credential never appears on a
+ * command line; that environment drops every variable that would give Claude Code another login or route, so `-e NAME`
+ * of one of them passes nothing. The mount is the socket's own directory, which holds nothing else and survives a proxy
+ * restart, unlike a mount of the socket file. Only `docker run` and `docker container run` are taken.
+ */
+export declare const confinedDockerLaunch: (optionsArg: {
+    args: readonly string[];
+    /** The confined listener's socket on the host. */
+    socketPath: string;
+    /** The origin Claude Code names; see `IAglProxyConfinedGrant.baseUrl`. */
+    baseUrl: string;
+    token: string;
+    environment: NodeJS.ProcessEnv;
+}) => {
+    command: string;
+    args: string[];
+    environment: NodeJS.ProcessEnv;
+};

package/dist_ts/functions.inferencelaunch.js

@@ -1,4 +1,6 @@
-import { aglProxyProviderId, claudeProxyEnvironment, claudeRoutingVariables, codexProxyProvider, openCodeProxyProvider, proxyHarnessModels } from './functions.proxyharnessconfig.js';
+import * as path from 'node:path';
+import { aglProxyConfinedMountPoint } from './functions.proxycontract.js';
+import { aglProxyProviderId, claudeProxyEnvironment, claudeProxyReservedVariables, claudeRoutingVariables, codexProxyProvider, openCodeProxyProvider, proxyHarnessModels } from './functions.proxyharnessconfig.js';
 /**
  * Claude Code on a Claude pool: its own configuration and home, with only its endpoint and credential pointed at
  * the proxy, which sends its requests on to the account unchanged. The proxy's credential replaces any claude.ai
@@ -118,4 +120,42 @@ export const inferenceHarnessLaunch = (optionsArg) => {
         return { environment, args: ['run', ...selection, ...args.slice(1)] };
     return { environment, args: args[0] !== undefined && openCodeCommands.has(args[0]) ? args : [...selection, ...args] };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWxhdW5jaC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VsYXVuY2gudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLHNCQUFzQixFQUFFLHNCQUFzQixFQUFFLGtCQUFrQixFQUFFLHFCQUFxQixFQUNwSCxrQkFBa0IsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBY2hFOzs7OztHQUtHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFVBQTRFLEVBQXNELEVBQUU7SUFDOUosTUFBTSxXQUFXLEdBQUcsRUFBRSxHQUFHLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUNsRCxLQUFLLE1BQU0sSUFBSSxJQUFJLHNCQUFzQjtRQUFFLE9BQU8sV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3BFLElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDekgsTUFBTSxJQUFJLEtBQUssQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUMsR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsR0FBRyxXQUFXO1lBQ2hFLEdBQUcsc0JBQXNCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQztZQUM3QyxvQkFBb0IsRUFBRSxVQUFVLENBQUMsS0FBSztZQUN0QyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxlQUFlLEVBQUUsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1NBQ3JGLEVBQUUsQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUtuQyxFQUEyRCxFQUFFO0lBQzVELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRixJQUFJLENBQUMsS0FBSztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUN4RixPQUFPO1FBQ0wsV0FBVyxFQUFFO1lBQ1gsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGVBQWU7WUFDM0Msa0JBQWtCLEVBQUUsUUFBUSxDQUFDLE9BQU87WUFDcEMsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLEtBQUs7WUFDcEMsZUFBZSxFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzlCLDRCQUE0QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzNDLDhCQUE4QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzdDLDZCQUE2QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzVDLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLDhCQUE4QixFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztZQUM3RyxzQ0FBc0MsRUFBRSxHQUFHO1lBQzNDLHdDQUF3QyxFQUFFLEdBQUc7WUFDN0MsOEJBQThCLEVBQUUsR0FBRztTQUNwQztRQUNELElBQUksRUFBRSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUNsQyxXQUFXLEVBQUU7b0JBQ1gsT0FBTyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO3dCQUMxQyxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU87d0JBQ3ZCLEtBQUssRUFBRSxRQUFRLENBQUMsV0FBVzt3QkFDM0IsR0FBRyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO3FCQUN2RSxDQUFDLENBQUM7b0JBQ0gscUJBQXFCLEVBQUUsSUFBSTtpQkFDNUI7YUFDRixDQUFDLENBQUM7S0FDSixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsc0hBQXNIO0FBQ3RILE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxZQUFZLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFNBQVM7SUFDdEgsV0FBVyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUUxSCxrSEFBa0g7QUFDbEgsTUFBTSxZQUFZLEdBQUcsQ0FBQyxTQUFpQixFQUFFLFFBQWlDLEVBQTJCLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUN4SCxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ3JILENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxHQUFHLFNBQVMsSUFBSSxHQUFHLEVBQUUsRUFBRSxLQUFnQyxDQUFDLENBQUM7SUFDdkYsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLFNBQVMsSUFBSSxHQUFHLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUV6QyxtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxVQUFtQyxFQUFzRCxFQUFFO0lBQ2hJLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUM7SUFDbkMsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3JDLElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO1FBQ3BJLE9BQU8sa0JBQWtCLENBQUMsRUFBRSxHQUFHLFVBQVUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDO0lBQzlCLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUM3RixDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN6RCxJQUFJLENBQUMsS0FBSztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNoRixNQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2xDLE1BQU0sV0FBVyxHQUFHLEVBQUUsR0FBRyxVQUFVLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbEQsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFrQixFQUFFLEVBQUU7UUFDckMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxHQUFHLEtBQUssSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzVGLE1BQU0sSUFBSSxLQUFLLENBQUMsNEdBQTRHLENBQUMsQ0FBQztRQUNoSSxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBQ0YsSUFBSSxVQUFVLENBQUMsT0FBTyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ25DLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDN0YsV0FBVyxDQUFDLHdCQUF3QixHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7UUFDeEQsc0dBQXNHO1FBQ3RHLHNDQUFzQztRQUN0QyxNQUFNLGFBQWEsR0FBNEI7WUFDN0MsY0FBYyxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsT0FBTztZQUN4RCxHQUFHLFlBQVksQ0FBQyxtQkFBbUIsa0JBQWtCLEVBQUUsRUFBRSxrQkFBa0IsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDdkcsSUFBSSxFQUFFLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1NBQ3hFLENBQUM7UUFDRixPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxHQUFHLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7SUFDakosQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNwQyxPQUFPLENBQUMsQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDbEUsS0FBSyxNQUFNLElBQUksSUFBSSxzQkFBc0I7WUFBRSxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwRSxNQUFNLE1BQU0sR0FBRyxtQkFBbUIsQ0FBQyxFQUFFLE9BQU8sRUFBRSxHQUFHLFVBQVUsQ0FBQyxPQUFPLFlBQVksRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdEcsZUFBZSxFQUFFLFVBQVUsQ0FBQyxxQkFBcUI7WUFDakQsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxLQUFLLEVBQUUsU0FBUyxFQUFFLEtBQUssS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzlILE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFBRSxHQUFHLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JHLENBQUM7SUFDRCxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDdkMsSUFBSSxXQUFXLENBQUMsdUJBQXVCO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ2hJLFdBQVcsQ0FBQyx3QkFBd0IsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO0lBQ3hELFdBQVcsQ0FBQyx1QkFBdUIsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ25ELE9BQU8sRUFBRSxpQ0FBaUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxrQkFBa0IsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFO1FBQzNGLFFBQVEsRUFBRSxFQUFFLENBQUMsa0JBQWtCLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxnQ0FBZ0M7Z0JBQzdILE1BQU0sRUFBRSxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLEVBQUU7S0FDMUMsQ0FBQyxDQUFDO0lBQ0gscUhBQXFIO0lBQ3JILGlDQUFpQztJQUNqQyxNQUFNLFNBQVMsR0FBRyxDQUFDLFNBQVMsRUFBRSxHQUFHLGtCQUFrQixJQUFJLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUs7UUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLFNBQVMsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzdGLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLElBQUksZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxTQUFTLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3hILENBQUMsQ0FBQyJ9
+/**
+ * A confined run's `docker run`: the given command, with the confined listener's directory mounted read-only at
+ * `aglProxyConfinedMountPoint` and Claude Code's settings for it added right after `run`, before the launcher's own
+ * options and image. Claude Code inside reaches the proxy through the socket alone (`ANTHROPIC_UNIX_SOCKET`, which
+ * Claude Code sends its API requests through as plain HTTP to `ANTHROPIC_BASE_URL`'s path), on the run's credential
+ * (`ANTHROPIC_AUTH_TOKEN`), reads the pool's models from the proxy and sends nothing beyond its model requests. The
+ * container gets each variable by name from the docker command's environment, so the credential never appears on a
+ * command line; that environment drops every variable that would give Claude Code another login or route, so `-e NAME`
+ * of one of them passes nothing. The mount is the socket's own directory, which holds nothing else and survives a proxy
+ * restart, unlike a mount of the socket file. Only `docker run` and `docker container run` are taken.
+ */
+export const confinedDockerLaunch = (optionsArg) => {
+    const [command, ...args] = optionsArg.args;
+    const runAt = args[0] === 'run' ? 1 : args[0] === 'container' && args[1] === 'run' ? 2 : 0;
+    if (command === undefined || path.basename(command) !== 'docker' || runAt === 0) {
+        throw new Error('A confined run starts its container with `docker run` (or `docker container run`) and its arguments.');
+    }
+    const directory = path.dirname(optionsArg.socketPath);
+    // `--mount` separates its fields with commas and reads quotes; a directory naming either cannot be passed safely.
+    if (/[,"'\n]/u.test(directory))
+        throw new Error(`The confined listener's directory ${directory} cannot be mounted: it holds a comma, quote or line break.`);
+    const variables = {
+        ...claudeProxyEnvironment(optionsArg.baseUrl),
+        ANTHROPIC_UNIX_SOCKET: `${aglProxyConfinedMountPoint}/${path.basename(optionsArg.socketPath)}`,
+        ANTHROPIC_AUTH_TOKEN: optionsArg.token,
+    };
+    const environment = { ...optionsArg.environment };
+    for (const name of claudeProxyReservedVariables)
+        delete environment[name];
+    return {
+        command,
+        args: [...args.slice(0, runAt),
+            '--mount', `type=bind,source=${directory},target=${aglProxyConfinedMountPoint},readonly`,
+            ...Object.keys(variables).flatMap((nameArg) => ['--env', nameArg]),
+            ...args.slice(runAt)],
+        environment: { ...environment, ...variables },
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLmluZmVyZW5jZWxhdW5jaC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy5pbmZlcmVuY2VsYXVuY2gudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFHbEMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDMUUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLHNCQUFzQixFQUFFLGtCQUFrQixFQUMzSCxxQkFBcUIsRUFBRSxrQkFBa0IsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBY3ZGOzs7OztHQUtHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFVBQTRFLEVBQXNELEVBQUU7SUFDOUosTUFBTSxXQUFXLEdBQUcsRUFBRSxHQUFHLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUNsRCxLQUFLLE1BQU0sSUFBSSxJQUFJLHNCQUFzQjtRQUFFLE9BQU8sV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3BFLElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDekgsTUFBTSxJQUFJLEtBQUssQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUMsR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsR0FBRyxXQUFXO1lBQ2hFLEdBQUcsc0JBQXNCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQztZQUM3QyxvQkFBb0IsRUFBRSxVQUFVLENBQUMsS0FBSztZQUN0QyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxlQUFlLEVBQUUsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1NBQ3JGLEVBQUUsQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUtuQyxFQUEyRCxFQUFFO0lBQzVELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRixJQUFJLENBQUMsS0FBSztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUN4RixPQUFPO1FBQ0wsV0FBVyxFQUFFO1lBQ1gsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLGVBQWU7WUFDM0Msa0JBQWtCLEVBQUUsUUFBUSxDQUFDLE9BQU87WUFDcEMsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLEtBQUs7WUFDcEMsZUFBZSxFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzlCLDRCQUE0QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzNDLDhCQUE4QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzdDLDZCQUE2QixFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQzVDLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLDhCQUE4QixFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztZQUM3RyxzQ0FBc0MsRUFBRSxHQUFHO1lBQzNDLHdDQUF3QyxFQUFFLEdBQUc7WUFDN0MsOEJBQThCLEVBQUUsR0FBRztTQUNwQztRQUNELElBQUksRUFBRSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUNsQyxXQUFXLEVBQUU7b0JBQ1gsT0FBTyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO3dCQUMxQyxLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU87d0JBQ3ZCLEtBQUssRUFBRSxRQUFRLENBQUMsV0FBVzt3QkFDM0IsR0FBRyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO3FCQUN2RSxDQUFDLENBQUM7b0JBQ0gscUJBQXFCLEVBQUUsSUFBSTtpQkFDNUI7YUFDRixDQUFDLENBQUM7S0FDSixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsc0hBQXNIO0FBQ3RILE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxZQUFZLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFNBQVM7SUFDdEgsV0FBVyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUUxSCxrSEFBa0g7QUFDbEgsTUFBTSxZQUFZLEdBQUcsQ0FBQyxTQUFpQixFQUFFLFFBQWlDLEVBQTJCLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUN4SCxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ3JILENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxHQUFHLFNBQVMsSUFBSSxHQUFHLEVBQUUsRUFBRSxLQUFnQyxDQUFDLENBQUM7SUFDdkYsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLFNBQVMsSUFBSSxHQUFHLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUV6QyxtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxVQUFtQyxFQUFzRCxFQUFFO0lBQ2hJLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUM7SUFDbkMsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3JDLElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO1FBQ3BJLE9BQU8sa0JBQWtCLENBQUMsRUFBRSxHQUFHLFVBQVUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDO0lBQzlCLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUM3RixDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN6RCxJQUFJLENBQUMsS0FBSztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNoRixNQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2xDLE1BQU0sV0FBVyxHQUFHLEVBQUUsR0FBRyxVQUFVLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbEQsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFrQixFQUFFLEVBQUU7UUFDckMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxHQUFHLEtBQUssSUFBSSxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzVGLE1BQU0sSUFBSSxLQUFLLENBQUMsNEdBQTRHLENBQUMsQ0FBQztRQUNoSSxDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBQ0YsSUFBSSxVQUFVLENBQUMsT0FBTyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ25DLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDN0YsV0FBVyxDQUFDLHdCQUF3QixHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7UUFDeEQsc0dBQXNHO1FBQ3RHLHNDQUFzQztRQUN0QyxNQUFNLGFBQWEsR0FBNEI7WUFDN0MsY0FBYyxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsT0FBTztZQUN4RCxHQUFHLFlBQVksQ0FBQyxtQkFBbUIsa0JBQWtCLEVBQUUsRUFBRSxrQkFBa0IsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDdkcsSUFBSSxFQUFFLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1NBQ3hFLENBQUM7UUFDRixPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxHQUFHLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7SUFDakosQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNwQyxPQUFPLENBQUMsQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDbEUsS0FBSyxNQUFNLElBQUksSUFBSSxzQkFBc0I7WUFBRSxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwRSxNQUFNLE1BQU0sR0FBRyxtQkFBbUIsQ0FBQyxFQUFFLE9BQU8sRUFBRSxHQUFHLFVBQVUsQ0FBQyxPQUFPLFlBQVksRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdEcsZUFBZSxFQUFFLFVBQVUsQ0FBQyxxQkFBcUI7WUFDakQsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxLQUFLLEVBQUUsU0FBUyxFQUFFLEtBQUssS0FBSyxLQUFLLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzlILE9BQU8sRUFBRSxXQUFXLEVBQUUsRUFBRSxHQUFHLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0lBQ3JHLENBQUM7SUFDRCxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDdkMsSUFBSSxXQUFXLENBQUMsdUJBQXVCO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ2hJLFdBQVcsQ0FBQyx3QkFBd0IsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO0lBQ3hELFdBQVcsQ0FBQyx1QkFBdUIsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ25ELE9BQU8sRUFBRSxpQ0FBaUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxrQkFBa0IsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFO1FBQzNGLFFBQVEsRUFBRSxFQUFFLENBQUMsa0JBQWtCLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxnQ0FBZ0M7Z0JBQzdILE1BQU0sRUFBRSxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLEVBQUU7S0FDMUMsQ0FBQyxDQUFDO0lBQ0gscUhBQXFIO0lBQ3JILGlDQUFpQztJQUNqQyxNQUFNLFNBQVMsR0FBRyxDQUFDLFNBQVMsRUFBRSxHQUFHLGtCQUFrQixJQUFJLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUs7UUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLFNBQVMsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzdGLE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLElBQUksZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxTQUFTLEVBQUUsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3hILENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFVBUXBDLEVBQXVFLEVBQUU7SUFDeEUsTUFBTSxDQUFDLE9BQU8sRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUM7SUFDM0MsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNGLElBQUksT0FBTyxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxzR0FBc0csQ0FBQyxDQUFDO0lBQzFILENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN0RCxrSEFBa0g7SUFDbEgsSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLFNBQVMsNERBQTRELENBQUMsQ0FBQztJQUM1SixNQUFNLFNBQVMsR0FBMkI7UUFDeEMsR0FBRyxzQkFBc0IsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDO1FBQzdDLHFCQUFxQixFQUFFLEdBQUcsMEJBQTBCLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEVBQUU7UUFDOUYsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLEtBQUs7S0FDdkMsQ0FBQztJQUNGLE1BQU0sV0FBVyxHQUFHLEVBQUUsR0FBRyxVQUFVLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDbEQsS0FBSyxNQUFNLElBQUksSUFBSSw0QkFBNEI7UUFBRSxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMxRSxPQUFPO1FBQ0wsT0FBTztRQUNQLElBQUksRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDO1lBQzVCLFNBQVMsRUFBRSxvQkFBb0IsU0FBUyxXQUFXLDBCQUEwQixXQUFXO1lBQ3hGLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ2xFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QixXQUFXLEVBQUUsRUFBRSxHQUFHLFdBQVcsRUFBRSxHQUFHLFNBQVMsRUFBRTtLQUM5QyxDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=

package/dist_ts/functions.proxycontract.d.ts

@@ -27,3 +27,14 @@ export type TProxyCredentialDelivery = 'none' | 'file';
 export declare const proxyCredentialDeliveries: readonly TProxyCredentialDelivery[];
 export declare const aglProxyUnitName = "agl-proxy.service";
 export declare const aglProxyDefaultPort = 4100;
+/**
+ * Confined runs (`agl proxy confined run`): Claude Code in a container that reaches the proxy only through the confined
+ * listener, a Unix socket alone in its directory, which the run mounts read-only at `aglProxyConfinedMountPoint`. Their
+ * sessions are those of the client `aglProxyConfinedClient`, and Claude Code names `aglProxyConfinedOrigin` as its
+ * endpoint's origin, whose host the socket makes irrelevant.
+ */
+export declare const aglProxyConfinedClient = "confined";
+export declare const aglProxyConfinedOrigin = "http://localhost";
+export declare const aglProxyConfinedMountPoint = "/run/agl-proxy";
+/** A confined run's id: the first 12 hex characters of its credential's SHA-256 digest. */
+export declare const aglProxyConfinedIdPattern: RegExp;

package/dist_ts/functions.proxycontract.js

@@ -14,4 +14,15 @@ export const defaultProxyClientProvider = (nameArg) => nameArg === 'claude' ? 'a
 export const proxyCredentialDeliveries = ['none', 'file'];
 export const aglProxyUnitName = 'agl-proxy.service';
 export const aglProxyDefaultPort = 4100;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnByb3h5Y29udHJhY3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9mdW5jdGlvbnMucHJveHljb250cmFjdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFJSCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBa0MsQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFPekYsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQW9DLENBQUMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxDQUFDO0FBRWpHLDhHQUE4RztBQUM5RyxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRywwQkFBMEIsQ0FBQztBQUUvRCw4RkFBOEY7QUFDOUYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsd0JBQXdCLENBQUM7QUFDL0QsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBVSxDQUFDO0FBQzVFLHVJQUF1STtBQUN2SSxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLE9BQWUsRUFBc0IsRUFBRSxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO0FBUWpJLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUF3QyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztBQUUvRixNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxtQkFBbUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLENBQUMifQ==
+/**
+ * Confined runs (`agl proxy confined run`): Claude Code in a container that reaches the proxy only through the confined
+ * listener, a Unix socket alone in its directory, which the run mounts read-only at `aglProxyConfinedMountPoint`. Their
+ * sessions are those of the client `aglProxyConfinedClient`, and Claude Code names `aglProxyConfinedOrigin` as its
+ * endpoint's origin, whose host the socket makes irrelevant.
+ */
+export const aglProxyConfinedClient = 'confined';
+export const aglProxyConfinedOrigin = 'http://localhost';
+export const aglProxyConfinedMountPoint = '/run/agl-proxy';
+/** A confined run's id: the first 12 hex characters of its credential's SHA-256 digest. */
+export const aglProxyConfinedIdPattern = /^[a-f0-9]{12}$/;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnByb3h5Y29udHJhY3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9mdW5jdGlvbnMucHJveHljb250cmFjdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFJSCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBa0MsQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFPekYsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQW9DLENBQUMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxDQUFDO0FBRWpHLDhHQUE4RztBQUM5RyxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRywwQkFBMEIsQ0FBQztBQUUvRCw4RkFBOEY7QUFDOUYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsd0JBQXdCLENBQUM7QUFDL0QsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBVSxDQUFDO0FBQzVFLHVJQUF1STtBQUN2SSxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLE9BQWUsRUFBc0IsRUFBRSxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO0FBUWpJLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUF3QyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztBQUUvRixNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxtQkFBbUIsQ0FBQztBQUNwRCxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLENBQUM7QUFFeEM7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxVQUFVLENBQUM7QUFDakQsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsa0JBQWtCLENBQUM7QUFDekQsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsZ0JBQWdCLENBQUM7QUFDM0QsMkZBQTJGO0FBQzNGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLGdCQUFnQixDQUFDIn0=

package/dist_ts/functions.proxysocket.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Claims the pathname of one of the proxy's Unix sockets: its directory is made private (0700, this user's, not a link),
+ * and a socket a killed proxy left there is removed, but only while it is an unchanged, owned socket nobody answers on.
+ * `nameArg` names the socket in the refusals; `busyArg` is the refusal for a socket another process answers on.
+ */
+export declare const claimProxySocketPath: (socketPathArg: string, nameArg: string, busyArg: string) => Promise<void>;

package/dist_ts/functions.proxysocket.js

@@ -0,0 +1,46 @@
+import * as plugins from './plugins.js';
+/**
+ * Claims the pathname of one of the proxy's Unix sockets: its directory is made private (0700, this user's, not a link),
+ * and a socket a killed proxy left there is removed, but only while it is an unchanged, owned socket nobody answers on.
+ * `nameArg` names the socket in the refusals; `busyArg` is the refusal for a socket another process answers on.
+ */
+export const claimProxySocketPath = async (socketPathArg, nameArg, busyArg) => {
+    const directory = plugins.path.dirname(socketPathArg);
+    await plugins.fs.promises.mkdir(directory, { recursive: true, mode: 0o700 });
+    const stat = await plugins.fs.promises.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()) {
+        throw new Error(`The ${nameArg} directory is not private.`);
+    }
+    await plugins.fs.promises.chmod(directory, 0o700);
+    let before;
+    try {
+        before = await plugins.fs.promises.lstat(socketPathArg);
+    }
+    catch (errorArg) {
+        if (errorArg.code === 'ENOENT')
+            return;
+        throw errorArg;
+    }
+    if (!before.isSocket() || before.uid !== process.getuid?.())
+        throw new Error(`The ${nameArg} path is unsafe.`);
+    const refused = await new Promise((resolve, reject) => {
+        const probe = plugins.net.createConnection(socketPathArg);
+        probe.setTimeout(1_000, () => { probe.destroy(); reject(new Error(`The ${nameArg} probe timed out.`)); });
+        probe.once('connect', () => { probe.destroy(); resolve(false); });
+        probe.once('error', (errorArg) => {
+            probe.destroy();
+            if (errorArg.code === 'ECONNREFUSED')
+                resolve(true);
+            else
+                reject(errorArg);
+        });
+    });
+    if (!refused)
+        throw new Error(busyArg);
+    const after = await plugins.fs.promises.lstat(socketPathArg);
+    if (!after.isSocket() || after.dev !== before.dev || after.ino !== before.ino) {
+        throw new Error(`The ${nameArg} path changed during startup.`);
+    }
+    await plugins.fs.promises.unlink(socketPathArg);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLnByb3h5c29ja2V0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZnVuY3Rpb25zLnByb3h5c29ja2V0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBRXhDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxLQUFLLEVBQUUsYUFBcUIsRUFBRSxPQUFlLEVBQUUsT0FBZSxFQUFpQixFQUFFO0lBQ25ILE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3RELE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDN0UsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDeEQsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQ3BGLE1BQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNsRCxJQUFJLE1BQXdCLENBQUM7SUFDN0IsSUFBSSxDQUFDO1FBQUMsTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUNoRSxPQUFPLFFBQVEsRUFBRSxDQUFDO1FBQ2hCLElBQUssUUFBa0MsQ0FBQyxJQUFJLEtBQUssUUFBUTtZQUFFLE9BQU87UUFDbEUsTUFBTSxRQUFRLENBQUM7SUFDakIsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksTUFBTSxDQUFDLEdBQUcsS0FBSyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sT0FBTyxrQkFBa0IsQ0FBQyxDQUFDO0lBQy9HLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxPQUFPLENBQVUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7UUFDN0QsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMxRCxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxPQUFPLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzFHLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUU7WUFDL0IsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2hCLElBQUssUUFBa0MsQ0FBQyxJQUFJLEtBQUssY0FBYztnQkFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7O2dCQUMxRSxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDLENBQUMsQ0FBQztJQUNILElBQUksQ0FBQyxPQUFPO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUM3RCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssTUFBTSxDQUFDLEdBQUcsSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUM5RSxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sT0FBTywrQkFBK0IsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQztBQUNsRCxDQUFDLENBQUMifQ==

package/dist_ts/functions.workerprocessproof.d.ts

@@ -29,6 +29,12 @@ export declare const fleetWorkerPath: (pathArg?: string) => string;
 /** The Claude Code executable a fleet worker runs, resolved as the fleet resolves it: a native process's exe is the realpath. */
 export declare const resolveClaudeWorkerExecutable: () => Promise<string>;
 export declare const resolveWorkerBridgeCommand: (serverArg: IConfigurationMcpStdioServer) => Promise<IWorkerBridgeCommand>;
+/**
+ * The bridge process `bridgePidArg`, proved to hold the caller's end of the direct loopback connection and to run the
+ * approved command, whatever its parent. The command is the one recorded when the launch was prepared: an upgrade
+ * installs AGL under another path, and a command whose files are gone is refused as such.
+ */
+export declare const readWorkerBridge: (connectionArg: IWorkerCallerConnection | undefined, bridgePidArg: number, commandArg: IWorkerBridgeCommand) => Promise<IWorkerProcessSnapshot>;
 export declare const verifyWorkerBridge: (connectionArg: IWorkerCallerConnection | undefined, bridgePidArg: number, commandArg: IWorkerBridgeCommand, parentArg: IWorkerProcessSnapshot) => Promise<IWorkerProcessSnapshot>;
 export declare const verifyClaudeWorkerProcess: (processArg: IFleetClaudeProcess, executableArg: string) => Promise<IWorkerProcessSnapshot>;
 export declare const readWorkerUnixSocketOwner: (socketPathArg: string) => Promise<IWorkerProcessSnapshot>;