agl 40.5.1 → 40.6.0

package/dist_ts/functions.workerprocessproof.js

@@ -112,16 +112,40 @@ const processOwnsLoopbackConnection = async (connectionArg, pidArg) => {
     const matches = table.split('\n').slice(1).map(line => line.trim().split(/\s+/u)).filter(fields => (fields[1] === endpoint(connectionArg.remotePort) && fields[2] === endpoint(connectionArg.localPort) && fields[3] === '01'));
     return matches.length === 1 && await processOwnsInode(pidArg, matches[0][9]);
 };
-export const verifyWorkerBridge = async (connectionArg, bridgePidArg, commandArg, parentArg) => {
+/**
+ * The bridge process `bridgePidArg`, proved to hold the caller's end of the direct loopback connection and to run the
+ * approved command, whatever its parent. The command is the one recorded when the launch was prepared: an upgrade
+ * installs AGL under another path, and a command whose files are gone is refused as such.
+ */
+export const readWorkerBridge = async (connectionArg, bridgePidArg, commandArg) => {
+    for (const file of [commandArg.executable, commandArg.entry]) {
+        let resolved;
+        try {
+            resolved = await plugins.fs.promises.realpath(file);
+        }
+        catch (errorArg) {
+            if (isWorkerCallerProofRefusal(errorArg))
+                throw new WorkerCallerProofError('The approved bridge command no longer exists.');
+            throw errorArg;
+        }
+        if (resolved !== file)
+            throw new WorkerCallerProofError('The approved bridge command no longer exists.');
+    }
     if (!await processOwnsLoopbackConnection(connectionArg, bridgePidArg)) {
         throw new WorkerCallerProofError('Worker transport ownership could not be proved.');
     }
     const bridge = await readWorkerProcessSnapshot(bridgePidArg);
     const entry = await plugins.fs.promises.realpath(bridge.arguments[1] ?? '');
-    if (bridge.parentPid !== parentArg.pid || bridge.executable !== commandArg.executable
-        || entry !== commandArg.entry || !plugins.util.isDeepStrictEqual(bridge.arguments.slice(2), commandArg.arguments)) {
+    if (bridge.executable !== commandArg.executable || entry !== commandArg.entry
+        || !plugins.util.isDeepStrictEqual(bridge.arguments.slice(2), commandArg.arguments)) {
         throw new WorkerCallerProofError('Worker bridge does not match the approved launch.');
     }
+    return bridge;
+};
+export const verifyWorkerBridge = async (connectionArg, bridgePidArg, commandArg, parentArg) => {
+    const bridge = await readWorkerBridge(connectionArg, bridgePidArg, commandArg);
+    if (bridge.parentPid !== parentArg.pid)
+        throw new WorkerCallerProofError('Worker bridge does not match the approved launch.');
     if (!workerSnapshotsEqual(parentArg, await readWorkerProcessSnapshot(parentArg.pid))
         || !workerSnapshotsEqual(bridge, await readWorkerProcessSnapshot(bridge.pid))) {
         throw new WorkerCallerProofError('Worker transport or process incarnation could not be proved.');
@@ -189,4 +213,4 @@ export const proveConnectionProcessAncestry = async (connectionArg, pidArg, maxi
     }
     return chain;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLndvcmtlcnByb2Nlc3Nwcm9vZi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy53b3JrZXJwcm9jZXNzcHJvb2YudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFFekYsTUFBTSxPQUFPLHNCQUF1QixTQUFRLEtBQUs7Q0FBRztBQUVwRCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFFBQWlCLEVBQVcsRUFBRSxDQUFDLENBQ3hFLFFBQVEsWUFBWSxzQkFBc0I7T0FDdkMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFFLFFBQThDLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUMzSCxDQUFDO0FBd0JGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQW1DLEVBQUU7SUFDakcsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxTQUFTLE1BQU0sRUFBRSxDQUFDO0lBQy9CLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDNUUsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRixJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLElBQUksVUFBVSxDQUFDLENBQUM7SUFDOUUsSUFBSSxlQUFlLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxlQUFlLENBQUMsTUFBTSxHQUFHLEdBQUcsR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUN4RSxNQUFNLElBQUksc0JBQXNCLENBQUMsMkNBQTJDLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxJQUFJLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM1RSxNQUFNLElBQUksR0FBRyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEQsSUFBSSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDOUYsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDeEUsVUFBVSxFQUFFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUM7UUFDN0QsU0FBUyxFQUFFLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQzlFLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBK0IsRUFBRSxRQUFnQyxFQUFXLEVBQUUsQ0FBQyxDQUNsSCxPQUFPLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FDbEQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxVQUFrQixFQUFtQixFQUFFO0lBQ25GLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUNuRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO2FBQ3JFLEdBQUcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLEtBQUssTUFBTSxTQUFTLElBQUksVUFBVSxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3ZFLE9BQU8sTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDbEIsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUUsUUFBa0MsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQ2hILENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGLDZIQUE2SDtBQUM3SCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFVLEVBQUU7SUFDMUUsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3hILE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxHQUFHLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQ2xHLENBQUMsQ0FBQztBQUVGLGlJQUFpSTtBQUNqSSxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxLQUFLLElBQXFCLEVBQUUsQ0FBQyxDQUN4RSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLHdDQUF3QyxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQzFJLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQUUsU0FBdUMsRUFBaUMsRUFBRTtJQUN6SCxNQUFNLE9BQU8sR0FBRyxNQUFNLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNqRSxJQUFJLEtBQWEsQ0FBQztJQUNsQixJQUFJLGFBQXVCLENBQUM7SUFDNUIsSUFBSSxVQUFrQixDQUFDO0lBQ3ZCLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDN0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ2xHLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuRSxNQUFNLE9BQU8sR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDLENBQUM7UUFDcEUsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUN0SCxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUQsYUFBYSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUM7UUFDL0IsVUFBVSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDckQsQ0FBQztTQUFNLENBQUM7UUFDTixVQUFVLEdBQUcsT0FBTyxDQUFDO1FBQ3JCLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ25HLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM5RCxhQUFhLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN4SSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSyxVQUFVO1dBQ3ZHLGFBQWEsQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ3BHLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLEdBQUcsYUFBYSxDQUFDLEVBQUUsQ0FBQztBQUM5RCxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQUUsUUFBZ0IsRUFBb0IsRUFBRTtJQUNwRixNQUFNLElBQUksR0FBRyxTQUFTLE1BQU0sS0FBSyxDQUFDO0lBQ2xDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RELElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxLQUFLO1FBQUUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDcEgsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCxJQUFJLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLEtBQUssV0FBVyxRQUFRLEdBQUc7Z0JBQUUsT0FBTyxJQUFJLENBQUM7UUFDcEcsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDbEIsSUFBSyxRQUFrQyxDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQzVFLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixtSUFBbUk7QUFDbkksTUFBTSw2QkFBNkIsR0FBRyxLQUFLLEVBQUUsYUFBa0QsRUFBRSxNQUFjLEVBQW9CLEVBQUU7SUFDbkksSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxJQUFJLGFBQWEsQ0FBQyxTQUFTLElBQUksYUFBYSxDQUFDLFVBQVUsS0FBSyxXQUFXO1dBQ3BGLGFBQWEsQ0FBQyxTQUFTLEtBQUssV0FBVztRQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzNJLE1BQU0sUUFBUSxHQUFHLENBQUMsT0FBZSxFQUFFLEVBQUUsQ0FBQyxZQUFZLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ3hHLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMxRSxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FDakcsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FDMUgsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxLQUFLLEVBQ3JDLGFBQWtELEVBQ2xELFlBQW9CLEVBQ3BCLFVBQWdDLEVBQ2hDLFNBQWlDLEVBQ0EsRUFBRTtJQUNuQyxJQUFJLENBQUMsTUFBTSw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUN0RSxNQUFNLElBQUksc0JBQXNCLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSx5QkFBeUIsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3RCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzVFLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsR0FBRyxJQUFJLE1BQU0sQ0FBQyxVQUFVLEtBQUssVUFBVSxDQUFDLFVBQVU7V0FDaEYsS0FBSyxLQUFLLFVBQVUsQ0FBQyxLQUFLLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3BILE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFDRCxJQUFJLENBQUMsb0JBQW9CLENBQUMsU0FBUyxFQUFFLE1BQU0seUJBQXlCLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1dBQy9FLENBQUMsb0JBQW9CLENBQUMsTUFBTSxFQUFFLE1BQU0seUJBQXlCLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixNQUFNLElBQUksc0JBQXNCLENBQUMsOERBQThELENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsS0FBSyxFQUM1QyxVQUErQixFQUMvQixhQUFxQixFQUNZLEVBQUU7SUFDbkMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFBRSxNQUFNLElBQUksc0JBQXNCLENBQUMsb0NBQW9DLENBQUMsQ0FBQztJQUN2SSxNQUFNLFFBQVEsR0FBRyxNQUFNLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxDQUFDLFVBQVUsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLGFBQWEsRUFBRSxDQUFDO1FBQzNGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQUUsYUFBcUIsRUFBbUMsRUFBRTtJQUN4RyxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMzRSxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1NBQzNFLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxhQUFhLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQzdFLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDaEgsTUFBTSxVQUFVLEdBQUcsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUNwRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsS0FBSztRQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ2hILE1BQU0sTUFBTSxHQUE2QixFQUFFLENBQUM7SUFDNUMsS0FBSyxNQUFNLElBQUksSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUM5QixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDekIsSUFBSSxNQUFNLGdCQUFnQixDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLHlCQUF5QixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDakcsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDbEIsSUFBSSxDQUFDLDBCQUEwQixDQUFDLFFBQVEsQ0FBQztnQkFBRSxNQUFNLFFBQVEsQ0FBQztRQUM1RCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVHLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNuQixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQ2pELGFBQWtELEVBQ2xELE1BQWMsRUFDZCxlQUFlLEdBQUcsRUFBRSxFQUNlLEVBQUU7SUFDckMsSUFBSSxDQUFDLE1BQU0sNkJBQTZCLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDaEUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUE2QixFQUFFLENBQUM7SUFDM0MsSUFBSSxHQUFHLEdBQUcsTUFBTSxDQUFDO0lBQ2pCLE9BQU8sR0FBRyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ2pELElBQUksUUFBZ0MsQ0FBQztRQUNyQyxJQUFJLENBQUM7WUFBQyxRQUFRLEdBQUcsTUFBTSx5QkFBeUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUFDLENBQUM7UUFBQyxPQUFPLFFBQVEsRUFBRSxDQUFDO1lBQ3pFLHdHQUF3RztZQUN4RyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksMEJBQTBCLENBQUMsUUFBUSxDQUFDO2dCQUFFLE1BQU07WUFDaEUsTUFBTSxRQUFRLENBQUM7UUFDakIsQ0FBQztRQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckIsR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUM7SUFDM0IsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZnVuY3Rpb25zLndvcmtlcnByb2Nlc3Nwcm9vZi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2Z1bmN0aW9ucy53b3JrZXJwcm9jZXNzcHJvb2YudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFFekYsTUFBTSxPQUFPLHNCQUF1QixTQUFRLEtBQUs7Q0FBRztBQUVwRCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFFBQWlCLEVBQVcsRUFBRSxDQUFDLENBQ3hFLFFBQVEsWUFBWSxzQkFBc0I7T0FDdkMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFFLFFBQThDLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUMzSCxDQUFDO0FBd0JGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQW1DLEVBQUU7SUFDakcsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxTQUFTLE1BQU0sRUFBRSxDQUFDO0lBQy9CLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDNUUsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRixJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzVFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLElBQUksVUFBVSxDQUFDLENBQUM7SUFDOUUsSUFBSSxlQUFlLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxlQUFlLENBQUMsTUFBTSxHQUFHLEdBQUcsR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUN4RSxNQUFNLElBQUksc0JBQXNCLENBQUMsMkNBQTJDLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxJQUFJLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM1RSxNQUFNLElBQUksR0FBRyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEQsSUFBSSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDOUYsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDeEUsVUFBVSxFQUFFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUM7UUFDN0QsU0FBUyxFQUFFLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQzlFLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBK0IsRUFBRSxRQUFnQyxFQUFXLEVBQUUsQ0FBQyxDQUNsSCxPQUFPLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FDbEQsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxVQUFrQixFQUFtQixFQUFFO0lBQ25GLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUNuRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO2FBQ3JFLEdBQUcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLEtBQUssTUFBTSxTQUFTLElBQUksVUFBVSxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3ZFLE9BQU8sTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDbEIsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUUsUUFBa0MsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQ2hILENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGLDZIQUE2SDtBQUM3SCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFVLEVBQUU7SUFDMUUsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3hILE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxHQUFHLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQ2xHLENBQUMsQ0FBQztBQUVGLGlJQUFpSTtBQUNqSSxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxLQUFLLElBQXFCLEVBQUUsQ0FBQyxDQUN4RSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLHdDQUF3QyxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsT0FBTyxDQUFDLEdBQUcsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQzFJLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQUUsU0FBdUMsRUFBaUMsRUFBRTtJQUN6SCxNQUFNLE9BQU8sR0FBRyxNQUFNLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNqRSxJQUFJLEtBQWEsQ0FBQztJQUNsQixJQUFJLGFBQXVCLENBQUM7SUFDNUIsSUFBSSxVQUFrQixDQUFDO0lBQ3ZCLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDN0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQ2xHLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuRSxNQUFNLE9BQU8sR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDLENBQUM7UUFDcEUsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUN0SCxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUQsYUFBYSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUM7UUFDL0IsVUFBVSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDckQsQ0FBQztTQUFNLENBQUM7UUFDTixVQUFVLEdBQUcsT0FBTyxDQUFDO1FBQ3JCLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ25HLE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM5RCxhQUFhLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN4SSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSyxVQUFVO1dBQ3ZHLGFBQWEsQ0FBQyxDQUFDLENBQUMsS0FBSyxLQUFLO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ3BHLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDLEdBQUcsYUFBYSxDQUFDLEVBQUUsQ0FBQztBQUM5RCxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQUUsUUFBZ0IsRUFBb0IsRUFBRTtJQUNwRixNQUFNLElBQUksR0FBRyxTQUFTLE1BQU0sS0FBSyxDQUFDO0lBQ2xDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RELElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxLQUFLO1FBQUUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDcEgsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCxJQUFJLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLEtBQUssV0FBVyxRQUFRLEdBQUc7Z0JBQUUsT0FBTyxJQUFJLENBQUM7UUFDcEcsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDbEIsSUFBSyxRQUFrQyxDQUFDLElBQUksS0FBSyxRQUFRO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQzVFLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixtSUFBbUk7QUFDbkksTUFBTSw2QkFBNkIsR0FBRyxLQUFLLEVBQUUsYUFBa0QsRUFBRSxNQUFjLEVBQW9CLEVBQUU7SUFDbkksSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxJQUFJLGFBQWEsQ0FBQyxTQUFTLElBQUksYUFBYSxDQUFDLFVBQVUsS0FBSyxXQUFXO1dBQ3BGLGFBQWEsQ0FBQyxTQUFTLEtBQUssV0FBVztRQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzNJLE1BQU0sUUFBUSxHQUFHLENBQUMsT0FBZSxFQUFFLEVBQUUsQ0FBQyxZQUFZLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ3hHLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMxRSxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FDakcsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FDMUgsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUNuQyxhQUFrRCxFQUNsRCxZQUFvQixFQUNwQixVQUFnQyxFQUNDLEVBQUU7SUFDbkMsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0QsSUFBSSxRQUFnQixDQUFDO1FBQ3JCLElBQUksQ0FBQztZQUFDLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUFDLENBQUM7UUFBQyxPQUFPLFFBQVEsRUFBRSxDQUFDO1lBQzdFLElBQUksMEJBQTBCLENBQUMsUUFBUSxDQUFDO2dCQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1lBQzVILE1BQU0sUUFBUSxDQUFDO1FBQ2pCLENBQUM7UUFDRCxJQUFJLFFBQVEsS0FBSyxJQUFJO1lBQUUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDM0csQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLHlCQUF5QixDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQzdELE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUUsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxVQUFVLElBQUksS0FBSyxLQUFLLFVBQVUsQ0FBQyxLQUFLO1dBQ3hFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLElBQUksc0JBQXNCLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsS0FBSyxFQUNyQyxhQUFrRCxFQUNsRCxZQUFvQixFQUNwQixVQUFnQyxFQUNoQyxTQUFpQyxFQUNBLEVBQUU7SUFDbkMsTUFBTSxNQUFNLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxhQUFhLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQy9FLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsR0FBRztRQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQzlILElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7V0FDL0UsQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQzVDLFVBQStCLEVBQy9CLGFBQXFCLEVBQ1ksRUFBRTtJQUNuQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztRQUFFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3ZJLE1BQU0sUUFBUSxHQUFHLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pFLElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxVQUFVLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDM0YsTUFBTSxJQUFJLHNCQUFzQixDQUFDLDhEQUE4RCxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFBRSxhQUFxQixFQUFtQyxFQUFFO0lBQ3hHLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzNFLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7U0FDM0UsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLGFBQWEsSUFBSSxNQUFNLENBQUMsQ0FBQyxDQUFDLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDN0UsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksc0JBQXNCLENBQUMsc0RBQXNELENBQUMsQ0FBQztJQUNoSCxNQUFNLFVBQVUsR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3BHLElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxLQUFLO1FBQUUsTUFBTSxJQUFJLHNCQUFzQixDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDaEgsTUFBTSxNQUFNLEdBQTZCLEVBQUUsQ0FBQztJQUM1QyxLQUFLLE1BQU0sSUFBSSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQzlCLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN6QixJQUFJLE1BQU0sZ0JBQWdCLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNqRyxDQUFDO1FBQUMsT0FBTyxRQUFRLEVBQUUsQ0FBQztZQUNsQixJQUFJLENBQUMsMEJBQTBCLENBQUMsUUFBUSxDQUFDO2dCQUFFLE1BQU0sUUFBUSxDQUFDO1FBQzVELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLHlCQUF5QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUcsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDMUYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ25CLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsYUFBa0QsRUFDbEQsTUFBYyxFQUNkLGVBQWUsR0FBRyxFQUFFLEVBQ2UsRUFBRTtJQUNyQyxJQUFJLENBQUMsTUFBTSw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNoRSxNQUFNLElBQUksc0JBQXNCLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQTZCLEVBQUUsQ0FBQztJQUMzQyxJQUFJLEdBQUcsR0FBRyxNQUFNLENBQUM7SUFDakIsT0FBTyxHQUFHLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsZUFBZSxFQUFFLENBQUM7UUFDakQsSUFBSSxRQUFnQyxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUFDLFFBQVEsR0FBRyxNQUFNLHlCQUF5QixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE9BQU8sUUFBUSxFQUFFLENBQUM7WUFDekUsd0dBQXdHO1lBQ3hHLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSwwQkFBMEIsQ0FBQyxRQUFRLENBQUM7Z0JBQUUsTUFBTTtZQUNoRSxNQUFNLFFBQVEsQ0FBQztRQUNqQixDQUFDO1FBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyQixHQUFHLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztJQUMzQixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUMifQ==

package/dist_ts_interfaces/workercallers.d.ts

@@ -4,6 +4,8 @@ export declare const workerCallerLaunchGenerationEnvironmentVariable = "AGL_MCP_
 export interface IFleetWorkerCallerLaunchBase {
     launchId: string;
     projectId: string;
+    /** The fleet worker the launch identifies, `${projectId}:${name}`: a worker holds one current launch. */
+    workerId: string;
 }
 /**
  * The Codex app-server connection that created the worker's thread: a controller connection profile, or the fleet's
@@ -28,12 +30,18 @@ export interface IFleetClaudeProcess {
     pid: number;
     startTicks: string;
 }
-export type TFleetWorkerCallerBinding = IFleetWorkerCallerLaunchBase & {
+export type TFleetWorkerCallerBinding = Omit<IFleetWorkerCallerLaunchBase, 'workerId'> & {
     nativeSessionId: string;
     expectedBindingRevision: number;
-} & ({
+} & (
+/**
+ * A Claude launch binds to its background job and to the job's current process; a job whose process already exited
+ * binds without one, and the next process of the same job proves itself when its bridge enrolls.
+ */
+{
     harnessId: 'claude';
-    claudeProcess: IFleetClaudeProcess;
+    claudeJobId: string;
+    claudeProcess?: IFleetClaudeProcess;
 } | {
     harnessId: 'codex';
 });
@@ -58,11 +66,42 @@ export interface IFleetWorkerCallerHooks {
         ticketSessionId: string;
     }>;
     getWorkerCallerStatus(launchId: string): IWorkerCallerReadiness;
-    revokeWorkerCaller(request: {
+    /**
+     * Revokes one launch, or the current launch of a worker, also one the controller kept from before a restart. Every
+     * reason but `generation_change` revokes it for good: its kept binding is deleted with it.
+     */
+    revokeWorkerCaller(request: ({
         launchId: string;
+    } | {
+        workerId: string;
+    }) & {
         reason: 'failure' | 'stop' | 'replacement' | 'generation_change' | 'cancelled';
     }): Promise<void>;
 }
+/** The background job a Claude worker's launch is bound to, as the controller asks the fleet about it. */
+export interface IWorkerClaudeJobRequest {
+    workerId: string;
+    projectId: string;
+    nativeSessionId: string;
+    jobId: string;
+}
+/**
+ * What a fresh Claude inventory shows of that job: `running` in one process, `settled` without a process, `ended` for
+ * this worker (the worker is gone or archived, continues in another session, or the session continues as another job),
+ * or `unproven` when the registry or the inventory could not be read or did not list the session once.
+ */
+export type TWorkerClaudeJobObservation = {
+    state: 'running';
+    process: IFleetClaudeProcess;
+} | {
+    state: 'settled';
+} | {
+    state: 'ended';
+    reason: string;
+} | {
+    state: 'unproven';
+    reason: string;
+};
 export interface IWorkerCallerSubject {
     kind: 'worker_launch';
     launchId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agl",
-  "version": "40.5.1",
+  "version": "40.6.0",
   "controllerUpgradeManagementVersion": 2,
   "private": false,
   "description": "Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions",

package/readme.md

@@ -328,6 +328,8 @@ agl proxy run codex --model <catalog-model> -- exec 'Explain this repository'
 agl proxy run claude --                       # Claude Code on Claude accounts
 agl proxy run claude --provider openai --model <catalog-model> --
 agl proxy run opencode --model <catalog-model> -- run 'Explain this repository'
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> claude -p   # Claude Code in a container
+agl proxy confined end <run id>
 ```
 
 Every client -- `codex`, `claude`, `opencode`, or a name of your own -- has one credential. The proxy keeps it
@@ -434,7 +436,8 @@ pool and keeps its credential. `agl proxy run claude` uses Claude accounts unles
 ChatGPT models behind Claude Code; `run codex` and `run opencode` use ChatGPT accounts.
 
 The listener binds only `127.0.0.1` and requires the exact host and port, no browser Origin, and
-`Authorization: Bearer <credential>` (or `x-api-key`).
+`Authorization: Bearer <credential>` (or `x-api-key`). Claude Code in a container reaches the proxy through a second
+listener, a Unix socket that serves confined runs alone (see [Confined containers](#confined-containers)).
 
 - A ChatGPT pool serves `/openai/v1/responses` and `/openai/v1/models` (the pooled Codex catalog in Codex's
   own shape when Codex names its `client_version`), and `/anthropic/v1/messages` and `/anthropic/v1/models`
@@ -701,6 +704,65 @@ proxy's binding with it, and the sessions it served move at their next request.
 pool, 16 requests in flight per session, 256 per client credential, 512 in all, 32 MiB per request and 8 MiB
 per inspected response event (or non-streaming JSON response).
 
+#### Confined containers
+
+`agl proxy confined run` runs Claude Code in a Docker container that reaches AGL through one route only: the proxy's
+confined listener, a Unix socket alone in a directory of its own (`agl-proxy-confined/proxy.sock` beside the proxy's
+control socket; `agl proxy status` names it). The listener serves the Claude pool's three endpoints Claude Code uses --
+`GET /anthropic/v1/models`, `POST /anthropic/v1/messages` and `POST /anthropic/v1/messages/count_tokens` -- exactly as
+the loopback listener serves a Claude client, and refuses every other path, method and pool with 404 before anything is
+read or routed; nothing else of AGL is reachable through it. It accepts confined runs' credentials alone: a request
+without a credential, with one the proxy does not know, or with a credential of the loopback listener (any client's or
+lease's) is refused with 401, and a confined run's credential is refused on the loopback listener alike.
+
+```sh
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> \
+  claude -p --model claude-opus-5-5 --output-format json < prompt.txt
+agl proxy status                  # names the confined listener and lists the runs by id
+agl proxy confined end <run id>   # ends a run's credential at once
+```
+
+Before the container starts, the command asks the proxy for the run's credential: one for this run alone, a lease of
+the Claude pool (the Claude accounts first, then the Anthropic API keys) whose sessions are those of the client
+`confined`, so its requests are placed, moved and counted (token usage under `confined`) like any other Claude
+client's. Right after `docker run` it adds the listener's directory as a read-only mount at `/run/agl-proxy` and what
+Claude Code inside needs to reach it, each variable passed by name so the credential appears on no command line:
+
+- `ANTHROPIC_UNIX_SOCKET=/run/agl-proxy/proxy.sock`: Claude Code sends its API requests through the socket, as plain
+  HTTP, so no relay runs in the container (Claude Code's own setting, which `claude ssh` uses; verified with Claude Code
+  2.1.288, the release of AGL's Agent SDK);
+- `ANTHROPIC_BASE_URL=http://localhost/anthropic`: the path Claude Code puts on its requests; the host is not used;
+- `ANTHROPIC_AUTH_TOKEN`: the run's credential;
+- `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` and `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, as `agl proxy run
+  claude` sets them.
+
+It prints the run's id on standard error (`AGL proxy confined run <id>: …`), passes its standard input and output
+through, and exits with the container's status. The container never receives an account token, the control socket or
+any other part of the AGL home: the mount holds the socket alone, and the variables that would give Claude Code another
+login or route (`CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_API_KEY`, …) are removed from the environment `docker` runs with,
+so a `-e NAME` of one of them passes nothing. What the launcher names itself after `docker run` is its own: it must not
+set the variables above. The command takes `docker run` and `docker container run` only, with the image and its
+command after the options.
+
+The socket and its directory are the proxy user's alone (0600 and 0700), so the container's processes connect as that
+user: `--user` with its uid and gid under a Docker daemon that runs as root, or the container's own root under rootless
+Docker, which maps it to that user; another uid, or a container whose user namespace maps it elsewhere, cannot connect.
+Root in a container of a rootful daemon connects as well while it keeps Docker's default capabilities, since
+`CAP_DAC_OVERRIDE` passes the socket's mode (with `--cap-drop ALL` it is refused): the mode keeps the host's other users
+out, and only the containers a run started have the mount at all. The directory, not the socket file, is mounted, so a
+proxy restart, which replaces the socket, does not cut the container off.
+
+The credential lives as long as the command. When the container exits the command ends it, and the proxy refuses it
+from then on and forgets it. Like a lease it survives a restart of the proxy, which keeps only its SHA-256 digest and
+serves it again at once while the command takes it back. `agl proxy confined end <run id>` ends it at once: requests in
+flight end, the next one is refused, and the command stops the container (`docker run` passes its SIGTERM on) and exits
+with the reason; it does the same when the proxy does not hand the credential back after a restart.
+
+Downgrade: an earlier proxy refuses to start while its store keeps a confined run's credential, which its check of the
+kept leases does not know. Let every confined run end before downgrading; if an earlier proxy's start already failed,
+start this release once with no confined run going and wait out the 60-second reclaim window, which ends the kept
+credential, then downgrade.
+
 ## Native Codex Harness
 
 Choose **New → Chat session** and pick the Codex harness to use Codex inside AGL. Native threads support text and reasoning streaming, tool activity, the Codex model and reasoning-effort catalog, command and file approvals, ordinary user-input questions, interruption, history pagination, rename, archive, and deletion. AGL Ask/Yolo controls apply to the exact pending native approval request; approvals never outlive its server request.
@@ -1737,11 +1799,12 @@ superseded origins refuse preparation.
 - Revoke on failure, stop, replacement, cancellation or controller-generation change.
   Revocation fences new admissions immediately, removes credentials, and waits for already
   admitted ticket requests. Native-ID uniqueness and binding revision checks fence races.
-  Controller restart invalidates every old handle; existing native workers remain
-  unidentified until fleet performs an authorized controlled resume/relaunch with a fresh
-  overlay. Hooks do not automatically terminate or adopt outside sessions. Revoked launch IDs
-  stay recorded so they are never prepared again; the oldest give way once 65,536 launches
-  are recorded.
+  Controller restart invalidates every credential. A Claude launch's binding to its job
+  outlives it (below); a Codex launch does not, and its worker is bound again at its next
+  steer. Every reason but a controller-generation change revokes a launch for good and
+  deletes its kept binding. Hooks do not automatically terminate or adopt outside sessions.
+  Revoked launch IDs stay recorded so they are never prepared again; the oldest give way
+  once 65,536 launches are recorded.
 
 Fleet workers use these hooks themselves, so a worker's MCP ticket writes are admitted as
 that worker, not as the driver or anonymously:
@@ -1753,16 +1816,40 @@ that worker, not as the driver or anonymously:
   the worker id), passed as `--mcp-config <file> -- <prompt>`. Claude Code saves that path and reads it
   again at every wake, so the fleet rewrites it before each one; the launch ID and
   generation reach only the `agl` MCP server's environment, never the Claude process's.
-  Once the agents listing shows the job's process, the fleet binds the launch to it. A start,
-  wake or relaunch that fails at any step revokes its launch. Stop revokes the launch and archive removes the overlay. A start fails closed before Claude
-  runs when the Configuration master has no `agl` MCP server.
+  Once the agents listing shows the job's process, the fleet binds the launch to the job and
+  that process; a job that already settled after a quick turn is bound without a process. A
+  start, wake or relaunch that fails at any step revokes its launch. Stop revokes the launch
+  and archive also removes the overlay. A start fails closed before Claude runs when the
+  Configuration master has no `agl` MCP server.
 - Fleet Codex workers prepare the launch on the fleet's own connection before
   `thread/start` and bind it before the first `turn/start`. Before steering a thread whose
   launch is unbound, from an earlier connection or from before a controller restart, the
   fleet loads the thread and binds a fresh launch; a refusal fails the steer undispatched.
-- Launches live in memory. After a controller restart a Claude worker stays unidentified
-  until its next fleet start, steer or resume, and a Codex worker is bound again at its next
-  steer.
+- A Claude launch belongs to its background job, not to one process. Claude Code retires an
+  idle job's process and starts a new one for the same job when someone writes to it in
+  Claude Code; that process reads the same overlay. The controller keeps each Claude
+  launch's binding in its store (`agl_worker_caller_bindings`, one record per worker:
+  digests of the launch ID and generation, the job and session IDs, the binding revision, the
+  proved process's PID, start and snapshot digest, and the approved bridge command; never a
+  credential). When a bridge enrolls under another process than the bound one, or after a
+  controller restart, the fleet reads a fresh Claude inventory (one read at a time) and the
+  launch is bound to the bridge's process only when the inventory lists the worker's session,
+  once, as the same background job in exactly that process, the process runs the approved
+  Claude Code executable, and the bridge is its direct child running the recorded command
+  over its own connection. A launch a restarted controller restores is proved the same way
+  before its first write, also when its process still runs. Every other process stays
+  unverified, and a refused bridge is not proved again at every call: for the life of that
+  process image, or for five seconds when the job showed no process yet, the inventory could
+  not be read, or the inventory still named another process for the job (Claude Code may just
+  have replaced it).
+  When the inventory shows the worker's session as another job, or the fleet no longer binds
+  the worker to it (archived, moved to another session), the launch is revoked for good.
+  An upgrade moves every bridge in place onto the new build (`process.execve`: the same PID and
+  start, a new image from the new install's path), and the image it became is proved afresh:
+  its command is the one recorded with the launch or the one the restarted controller resolves
+  itself from its configured `agl` MCP entry, never one the bridge names, and a new command is
+  kept with the binding's next revision. Each reason an enrollment stays unverified is written once to the controller log,
+  naming the worker and its session, never the launch ID or a credential.
 
 The bridge exchanges credentials only through the private controller endpoint after Linux
 direct-loopback socket-inode ownership, approved executable/argv and current native
@@ -2860,6 +2947,8 @@ Backend isolation is mandatory. Proxy mode binds the controller to all interface
 - Permission auto-accept is an explicit server policy, never an assumption based on an open browser.
 - Questions are never auto-answered.
 - Unknown, malformed, concurrent, or unverifiable lifecycle state fails closed.
+- The inference proxy's confined listener is a Unix socket of the proxy's user alone; it accepts only confined runs'
+  credentials and serves them only the Claude pool's three Claude Code endpoints.
 
 The global **auto-accept permissions (yolo)** setting replies once to pending permissions across registered projects and writes those replies to the audit log. Each conversation also has a run-local Ask/Yolo switch. For an active managed OpenCode root, that switch covers its currently active direct children under the same exact family authority. For an active managed Flex root, it covers admitted descendants through their exact active parent-run authority chain; a relationship alone grants nothing. Terminal children are never auto-accepted. Disabling either policy seals new automatic replies and drains already admitted replies before returning. Neither mode creates persistent broad provider grants.
 
@@ -2910,7 +2999,7 @@ A run that fails keeps its evidence before its root goes: when a test of the fil
 The suite guards, end to end: opening every harness's conversation across page reloads without a harness child being replaced, recovering the Flex child after `SIGKILL` within 15 seconds, rejoining the shared Codex daemon on its own after that daemon restarts (the conversation opens and answers again within one rejoin backoff step, without **Reconnect**), starting the controller again (as the same and as the next build) with a browser resource attached to a Codex, Flex and OpenCode chat, listing a project's resources right after a browser is attached to each new chat and after a restart, the Flex model list carrying the account's current catalog, a Flex conversation answering, and opening and answering again after a restart, in a project whose id begins with `-` or `_` (the file creates projects until one does), and an `agl mcp` bridge answering tool calls from the same process after the controller moves to the next build. It is the test step of `gitzone release` (`release.preflight` in `.smartconfig.json`) and takes about eight minutes.
 
 
-Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
+Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. `e2e.proxyconfined` also runs a Docker container (a daemon this user may use and the `ubuntu:24.04` image already on the host, which the case never pulls) and skips with the missing prerequisite named without them. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
 
 ```sh
 AGL_E2E_PACKAGE_ROOT=/path/to/agl-32.15.1 pnpm exec tsrepo test test/e2e/e2e.conversations.node.ts --verbose --timeout 900

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: 'agl',
-  version: '40.5.1',
+  version: '40.6.0',
   description: 'Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions'
 }

package/ts/classes.aglhome.ts

@@ -64,6 +64,11 @@ export interface IAGLHomePaths {
   proxy: string;
   /** The running proxy's private control socket. */
   proxySocket: string;
+  /**
+   * The proxy's confined listener: a Unix socket alone in a private directory of its own, which a confined run mounts
+   * into its container, so the container sees nothing else of AGL. Only confined credentials are accepted on it.
+   */
+  proxyConfinedSocket: string;
   /** The credentials the proxy keeps in files, one per client with delivery `file` (OpenCode's `{file:...}`). */
   proxyCredentials: string;
   /** The credential command a harness routed through the proxy runs; the proxy writes it whenever it starts. */
@@ -211,6 +216,7 @@ export const resolveAGLHomePaths = (
     claudeOnChatGpt: path.join(root, 'claude-gateway'),
     proxy: path.join(root, 'proxy'),
     proxySocket: path.join(sockets, 'agl-proxy.sock'),
+    proxyConfinedSocket: path.join(sockets, 'agl-proxy-confined', 'proxy.sock'),
     proxyCredentials: path.join(root, 'proxy', 'credentials'),
     proxyCredentialHelper: path.join(root, 'proxy', 'credential-helper'),
     migration: path.join(root, 'migration'),

package/ts/classes.authstore.ts

@@ -3,6 +3,7 @@ import { DriverModel } from './driver/classes.driverstore.js';
 import { DirectReportModel } from './driver/classes.directreportstore.js';
 import { SessionFeedAcknowledgementModel } from './classes.sessionfeedacknowledgements.js';
 import { HarnessReleaseModel } from './classes.harnessreleases.js';
+import { WorkerCallerBindingModel } from './classes.workercallerbindings.js';
 import { FleetTicketEffectModel } from './fleet/classes.ticketeffects.js';
 import { ControllerCodexOriginMigrationModel } from '../ts_migration/v29_codexorigins.js';
 import { ControllerCodexConnectionStore } from './classes.codexconnectionstore.js';
@@ -781,6 +782,7 @@ const setAuthStoreModelManager = (
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, SessionFeedAcknowledgementModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, FleetTicketEffectModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, HarnessReleaseModel);
+  plugins.nosqldb.setDefaultManagerForDoc(managerArg, WorkerCallerBindingModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketBoardModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketCommentModel);
@@ -1054,6 +1056,8 @@ export class SmartDataAuthStore implements IAuthStore, IAuthStoreSessionIdentity
       await FleetTicketEffectModel.exact.prepare();
       await HarnessReleaseModel.init();
       await HarnessReleaseModel.exact.prepare();
+      await WorkerCallerBindingModel.init();
+      await WorkerCallerBindingModel.exact.prepare();
       await TicketModel.init();
       await TicketBoardModel.init();
       await TicketCommentModel.init();

package/ts/classes.controller.ts

@@ -5,6 +5,7 @@ import { FleetDispatchError } from './fleet/interfaces.workers.js';
 import type { TFleetWorkerAction, TFleetWorkerRequest } from '../ts_interfaces/fleetworkers.js';
 import { ControllerBrowserOperationAuthority } from './classes.browseroperationauthority.js';
 import { ControllerWorkerCallers, type IWorkerCodexCallerOrigin } from './classes.workercallers.js';
+import { WorkerCallerBindingStore } from './classes.workercallerbindings.js';
 import { FleetWorkerLaunches } from './fleet/classes.workerlaunches.js';
 import { workerCallerEnrollmentToolName } from './classes.mcpworkercaller.js';
 import { readWorkerProcessSnapshot, readWorkerUnixSocketOwner, workerSnapshotsEqual, isWorkerCallerProofRefusal, type IWorkerCallerConnection } from './functions.workerprocessproof.js';
@@ -10555,7 +10556,12 @@ export class OpenCodeController {
         readMaster: async () => {
           const resource = await configurationAuthority.getResource();
           return (await configurationAuthority.getMaster({ resourceId: resource.resourceId })).master;
-        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch) });
+        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch),
+        // Claude launches keep their bindings, so a fleet worker's bridge proves itself again after this restart and
+        // after Claude Code continued its job in another process; the fleet reads the job's inventory for that proof.
+        bindings: new WorkerCallerBindingStore(),
+        observeClaudeJob: async (request) => this.fleetWorkers
+          ? await this.fleetWorkers.observeCallerJob(request) : { state: 'unproven', reason: 'the fleet is not running yet' } });
       this.workerCallers = workerCallers;
       const mcpControllerHost = new ControllerMcpHost({
         controllerPort: runtimeConfig.controllerPort,
@@ -12955,6 +12961,9 @@ export class OpenCodeController {
       }
     };
 
+    // Fleet jobs prepare, bind and revoke worker launches through the caller hooks: admit none and let the running
+    // ones settle before the hooks go, so a stop or archive meets the fleet's own refusal, never missing hooks.
+    await stopPart(async () => { await this.fleetWorkers?.closeAdmission(); });
     await stopPart(async () => {
       await this.workerCallers?.close();
       this.workerCallers = undefined;