@push.rocks/smartdaemon 2.11.0 → 2.13.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdaemon',
-    version: '2.11.0',
+    version: '2.13.0',
     description: 'Start scripts as long running daemons and manage them.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHdEQUF3RDtDQUN0RSxDQUFBIn0=

package/dist_ts/classes.systemdservicedefinition.d.ts

@@ -1,5 +1,6 @@
-import { type TSystemdServiceStartup, type ISystemdServiceDependencies, type ISystemdServiceInstallTargets } from './systemd.definition.js';
-export type { ISystemdServiceStartup, ISystemdServiceNotifyStartup, TSystemdServiceStartup, ISystemdServiceDependencies, ISystemdServiceInstallTargets } from './systemd.definition.js';
+import { type TSystemdServiceStartup, type ISystemdServiceDependencies, type ISystemdServiceInstallTargets, type ISystemdServiceCredential, type TSystemdCapability, type TSystemdAddressFamily } from './systemd.definition.js';
+export type { ISystemdServiceStartup, ISystemdServiceNotifyStartup, TSystemdServiceStartup, ISystemdServiceDependencies, ISystemdServiceInstallTargets, ISystemdServiceCredential, TSystemdCapability, TSystemdAddressFamily } from './systemd.definition.js';
+export { systemdCapabilities, systemdAddressFamilies } from './systemd.definition.js';
 interface ISystemdServiceDefinitionBaseOptions {
     unitName: string;
     description: string;
@@ -29,6 +30,53 @@ interface ISystemdServiceDefinitionBaseOptions {
      * 64 variables and 8192 UTF-8 bytes of `NAME=value` in total. They are taken literally: `%` is escaped, and `Environment=` never expands `$`.
      */
     environment?: Readonly<Record<string, string>>;
+    /**
+     * System scope only. Runs the service as a transient user and group allocated at start
+     * (`DynamicUser=`), named by `user` and `group`, which then must not be `root` and have at most
+     * 31 characters. Systemd enforces `ProtectSystem=strict`, `PrivateTmp=`, `NoNewPrivileges=` and
+     * `RestrictSUIDSGID=` for such a service, so a definition that weakens any of them is refused.
+     */
+    dynamicUser?: boolean;
+    /** System scope only. Credentials read in plaintext, one `LoadCredential=` line each, ordered by name. */
+    loadCredentials?: readonly ISystemdServiceCredential[];
+    /** System scope only. Credentials sealed with `systemd-creds encrypt`, one `LoadCredentialEncrypted=` line each, ordered by name. */
+    loadCredentialsEncrypted?: readonly ISystemdServiceCredential[];
+    /** System scope only (`NoNewPrivileges=`). */
+    noNewPrivileges?: boolean;
+    /** System scope only (`ProtectSystem=`): `true` mounts `/usr` and the boot loader read-only, `'full'` also `/etc`, `'strict'` the whole file system but the API file systems. */
+    protectSystem?: boolean | 'full' | 'strict';
+    /** System scope only (`ProtectHome=`). */
+    protectHome?: boolean | 'read-only' | 'tmpfs';
+    /** System scope only (`PrivateTmp=`). */
+    privateTmp?: boolean;
+    /** System scope only (`PrivateDevices=`). */
+    privateDevices?: boolean;
+    /** System scope only (`ProtectKernelTunables=`). */
+    protectKernelTunables?: boolean;
+    /** System scope only (`ProtectKernelModules=`). */
+    protectKernelModules?: boolean;
+    /** System scope only (`ProtectKernelLogs=`). */
+    protectKernelLogs?: boolean;
+    /** System scope only (`ProtectControlGroups=`). */
+    protectControlGroups?: boolean;
+    /** System scope only (`ProtectClock=`). */
+    protectClock?: boolean;
+    /** System scope only (`ProtectHostname=`). */
+    protectHostname?: boolean;
+    /** System scope only (`RestrictNamespaces=`): `true` forbids creating every kind of namespace. */
+    restrictNamespaces?: boolean;
+    /** System scope only (`RestrictRealtime=`). */
+    restrictRealtime?: boolean;
+    /** System scope only (`RestrictSUIDSGID=`). */
+    restrictSUIDSGID?: boolean;
+    /** System scope only (`LockPersonality=`). */
+    lockPersonality?: boolean;
+    /** System scope only. The only capabilities the service's processes can ever hold (`CapabilityBoundingSet=`); empty drops all. */
+    capabilityBoundingSet?: readonly TSystemdCapability[];
+    /** System scope only. Capabilities a non-root service's processes receive (`AmbientCapabilities=`); within `capabilityBoundingSet` when both are given. */
+    ambientCapabilities?: readonly TSystemdCapability[];
+    /** System scope only. The only socket families the service may create (`RestrictAddressFamilies=`); at least one, and `AF_UNIX` for a notify service. */
+    restrictAddressFamilies?: readonly TSystemdAddressFamily[];
 }
 export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOptions & ({
     scope?: 'system';
@@ -39,8 +87,14 @@ export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOpti
     user?: never;
     group?: never;
 });
+/**
+ * The option a refusal names: a key of the definition, or `'options'` for the definition object
+ * itself (not a plain object, an unknown or accessor key, or a unit over 16384 bytes).
+ */
+export type TSystemdServiceDefinitionOption = keyof ISystemdServiceDefinitionOptions | 'options';
 export declare class SystemdServiceDefinitionError extends Error {
-    constructor();
+    readonly option: TSystemdServiceDefinitionOption;
+    constructor(option: TSystemdServiceDefinitionOption);
 }
 /** Literal direct-execution definition; never introduces a shell or environment expansion. */
 export declare class SystemdServiceDefinition {

package/dist_ts/classes.systemdservicedefinition.js

@@ -1,27 +1,50 @@
 import * as plugins from './smartdaemon.plugins.js';
-import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations } from './systemd.definition.js';
+import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations, systemdAddressFamilies, systemdCapabilities } from './systemd.definition.js';
+export { systemdCapabilities, systemdAddressFamilies } from './systemd.definition.js';
 export class SystemdServiceDefinitionError extends Error {
-    constructor() {
-        super('Invalid direct systemd service definition.');
+    constructor(option) {
+        super(`Invalid direct systemd service definition: ${option}.`);
         this.name = 'SystemdServiceDefinitionError';
+        this.option = option;
     }
 }
+/** Sandboxing switches in their rendering order, each with its directive. */
+const sandboxSwitches = [
+    ['privateTmp', 'PrivateTmp'],
+    ['privateDevices', 'PrivateDevices'],
+    ['protectKernelTunables', 'ProtectKernelTunables'],
+    ['protectKernelModules', 'ProtectKernelModules'],
+    ['protectKernelLogs', 'ProtectKernelLogs'],
+    ['protectControlGroups', 'ProtectControlGroups'],
+    ['protectClock', 'ProtectClock'],
+    ['protectHostname', 'ProtectHostname'],
+    ['restrictNamespaces', 'RestrictNamespaces'],
+    ['restrictRealtime', 'RestrictRealtime'],
+    ['restrictSUIDSGID', 'RestrictSUIDSGID'],
+    ['lockPersonality', 'LockPersonality'],
+];
+/** Options a user manager's service cannot carry: they need the system manager's privileges. */
+const systemOnlyOptions = ['dynamicUser', 'loadCredentials', 'loadCredentialsEncrypted', 'noNewPrivileges',
+    'protectSystem', 'protectHome', ...sandboxSwitches.map(([option]) => option), 'capabilityBoundingSet',
+    'ambientCapabilities', 'restrictAddressFamilies'];
 /** Literal direct-execution definition; never introduces a shell or environment expansion. */
 export class SystemdServiceDefinition {
     constructor(options) {
-        const requireValue = (value) => {
+        const fail = (option) => {
+            throw new SystemdServiceDefinitionError(option);
+        };
+        const requireValue = (value, option) => {
             if (!value)
-                throw new SystemdServiceDefinitionError();
+                fail(option);
         };
         requireValue(options && !plugins.util.types.isProxy(options) &&
-            Object.getPrototypeOf(options) === Object.prototype);
+            Object.getPrototypeOf(options) === Object.prototype, 'options');
         const scopeDescriptor = Object.getOwnPropertyDescriptor(options, 'scope');
         requireValue(scopeDescriptor === undefined ||
-            scopeDescriptor.enumerable && 'value' in scopeDescriptor);
+            scopeDescriptor.enumerable && 'value' in scopeDescriptor, 'scope');
         const scopeValue = scopeDescriptor?.value ?? 'system';
-        if (scopeValue !== 'system' && scopeValue !== 'user') {
-            throw new SystemdServiceDefinitionError();
-        }
+        if (scopeValue !== 'system' && scopeValue !== 'user')
+            fail('scope');
         const scope = scopeValue;
         // Systemd ignores an assignment whose text is not clean UTF-8, leaving the unit unloadable.
         const text = (value, maximum = 4096) => typeof value === 'string' && value.length <= maximum && isCleanText(value);
@@ -38,55 +61,64 @@ export class SystemdServiceDefinition {
             'timeoutStopSeconds',
             ...(scope === 'system' ? ['user', 'group'] : []),
         ];
-        const optionalKeys = ['scope', 'startup', 'dependencies', 'install', 'restartSeconds', 'delegate',
-            'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment'];
-        requireValue(Reflect.ownKeys(options).every(key => typeof key === 'string' && [...keys, ...optionalKeys].includes(key)
-            && Object.getOwnPropertyDescriptor(options, key)?.enumerable && 'value' in Object.getOwnPropertyDescriptor(options, key)) && keys.every((key) => {
+        const optionalKeys = ['scope', 'startup', 'dependencies', 'install',
+            'restartSeconds', 'delegate', 'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment',
+            ...systemOnlyOptions];
+        // Every own key is a known option held by an enumerable data property, so no accessor or trap runs.
+        for (const key of Reflect.ownKeys(options)) {
+            requireValue(typeof key === 'string' && [...keys, ...optionalKeys, 'user', 'group'].includes(key), 'options');
+            const option = key;
             const descriptor = Object.getOwnPropertyDescriptor(options, key);
-            return descriptor && 'value' in descriptor;
-        }));
+            requireValue(keys.includes(option) || optionalKeys.includes(option), option);
+            requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+        }
+        for (const key of keys)
+            requireValue(Object.getOwnPropertyDescriptor(options, key), key);
         requireValue(typeof options.unitName === 'string' &&
-            /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName));
+            /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName), 'unitName');
         requireValue(text(options.description, 1024) && options.description.length > 0 &&
-            options.description.trim() === options.description && !options.description.includes('\\'));
+            options.description.trim() === options.description && !options.description.includes('\\'), 'description');
         requireValue(absolute(options.executable) && options.executable !== '/' &&
-            !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
-            absolute(options.workingDirectory) &&
+            !/[\\"']/.test(options.executable) && !options.executable.endsWith('/'), 'executable');
+        requireValue(absolute(options.workingDirectory) &&
             options.workingDirectory.trim() === options.workingDirectory &&
-            !options.workingDirectory.includes('\\'));
+            !options.workingDirectory.includes('\\'), 'workingDirectory');
         requireValue(Array.isArray(options.args) && !plugins.util.types.isProxy(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
             options.args.length <= 128 &&
             Reflect.ownKeys(options.args).length === options.args.length + 1 &&
             Array.from({ length: options.args.length }, (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)))
-                .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)));
+                .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)), 'args');
         if (scope === 'system') {
-            requireValue([options.user, options.group].every((value) => typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)));
+            for (const key of ['user', 'group']) {
+                requireValue(typeof options[key] === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(options[key]), key);
+            }
         }
-        requireValue(['no', 'on-failure', 'always'].includes(options.restart) &&
-            ['mixed', 'control-group', 'process'].includes(options.killMode) &&
-            Number.isSafeInteger(options.timeoutStopSeconds) &&
-            options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600);
+        requireValue(['no', 'on-failure', 'always'].includes(options.restart), 'restart');
+        requireValue(['mixed', 'control-group', 'process'].includes(options.killMode), 'killMode');
+        requireValue(Number.isSafeInteger(options.timeoutStopSeconds) &&
+            options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600, 'timeoutStopSeconds');
         const integer = (value, minimum, maximum) => Number.isSafeInteger(value) && value >= minimum && value <= maximum;
         const limit = (value) => value === 'infinity' || integer(value, 1, Number.MAX_SAFE_INTEGER);
+        const yesNo = (value) => value ? 'yes' : 'no';
         // Each optional directive is absent unless supplied, so existing definitions keep their bytes.
         const service = [];
         if (options.restartSeconds !== undefined) {
-            requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no');
+            requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no', 'restartSeconds');
         }
         if (options.delegate !== undefined) {
-            requireValue(typeof options.delegate === 'boolean');
-            service.push(`Delegate=${options.delegate ? 'yes' : 'no'}`);
+            requireValue(typeof options.delegate === 'boolean', 'delegate');
+            service.push(`Delegate=${yesNo(options.delegate)}`);
         }
         if (options.limitNoFile !== undefined) {
-            requireValue(limit(options.limitNoFile));
+            requireValue(limit(options.limitNoFile), 'limitNoFile');
             service.push(`LimitNOFILE=${options.limitNoFile}`);
         }
         if (options.tasksMax !== undefined) {
-            requireValue(limit(options.tasksMax));
+            requireValue(limit(options.tasksMax), 'tasksMax');
             service.push(`TasksMax=${options.tasksMax}`);
         }
         if (options.oomScoreAdjust !== undefined) {
-            requireValue(integer(options.oomScoreAdjust, -1000, 1000));
+            requireValue(integer(options.oomScoreAdjust, -1000, 1000), 'oomScoreAdjust');
             service.push(`OOMScoreAdjust=${options.oomScoreAdjust}`);
         }
         // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
@@ -94,26 +126,130 @@ export class SystemdServiceDefinition {
             .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
             .replaceAll('$', () => command ? '$$' : '$') +
             '"';
+        const plainObject = (value, option) => requireValue(value !== null && typeof value === 'object' && !plugins.util.types.isProxy(value) &&
+            Object.getPrototypeOf(value) === Object.prototype, option);
         if (options.environment !== undefined) {
             // Read each variable once through its own data descriptor, so no accessor or trap runs.
             const variables = options.environment;
-            requireValue(variables !== null && typeof variables === 'object' &&
-                !plugins.util.types.isProxy(variables) && Object.getPrototypeOf(variables) === Object.prototype);
+            plainObject(variables, 'environment');
             const names = Reflect.ownKeys(variables);
-            requireValue(names.length <= environmentVariableLimit);
+            requireValue(names.length <= environmentVariableLimit, 'environment');
             const assignments = new Map();
             for (const name of names) {
                 const descriptor = Object.getOwnPropertyDescriptor(variables, name);
                 requireValue(typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name) &&
-                    descriptor?.enumerable && 'value' in descriptor && text(descriptor.value));
+                    descriptor?.enumerable && 'value' in descriptor && text(descriptor.value), 'environment');
                 assignments.set(name, `${name}=${descriptor.value}`);
             }
-            requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit);
+            requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit, 'environment');
             // Environment= unquotes and unescapes each word and expands `%` specifiers, never `$`.
             service.push(...[...assignments.keys()].sort()
                 .map((name) => `Environment=${quote(assignments.get(name))}`));
         }
-        const relations = renderServiceRelations(options, options.unitName, options.restart, scope, () => { throw new SystemdServiceDefinitionError(); });
+        // Every system-only option is refused by name in a user manager's service.
+        for (const option of systemOnlyOptions) {
+            requireValue(scope === 'system' || options[option] === undefined, option);
+        }
+        /** Reads a plain array once through its data descriptors: distinct items, sorted. */
+        const list = (value, option, maximum, item, identity) => {
+            requireValue(Array.isArray(value) && !plugins.util.types.isProxy(value) &&
+                Object.getPrototypeOf(value) === Array.prototype && value.length <= maximum &&
+                Reflect.ownKeys(value).length === value.length + 1, option);
+            const result = Array.from({ length: value.length }, (_, index) => {
+                const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+                return item(descriptor.value);
+            });
+            const identities = result.map(identity);
+            requireValue(new Set(identities).size === identities.length, option);
+            return result.sort((left, right) => identity(left) < identity(right) ? -1 : 1);
+        };
+        // Credential names and sources hold no `%`, quote, backslash, whitespace or `:`, so systemd's
+        // `NAME[:SOURCE]` parser and its specifier expansion read them exactly as written.
+        const credentialName = (value) => typeof value === 'string' && /^[A-Za-z0-9_@-][A-Za-z0-9_.@-]{0,254}$/.test(value);
+        const credentials = (value, option) => list(value, option, 64, (entry) => {
+            plainObject(entry, option);
+            const entryKeys = Reflect.ownKeys(entry);
+            requireValue(entryKeys.includes('name') && entryKeys.every((key) => (key === 'name' || key === 'source') &&
+                Object.getOwnPropertyDescriptor(entry, key)?.enumerable &&
+                'value' in Object.getOwnPropertyDescriptor(entry, key)), option);
+            const { name, source } = entry;
+            requireValue(credentialName(name), option);
+            if (entryKeys.includes('source')) {
+                requireValue(source !== name && (credentialName(source) || absolute(source) && !source.endsWith('/') &&
+                    /^[A-Za-z0-9_.@/+-]+$/.test(source)), option);
+            }
+            return entryKeys.includes('source') ? { name: name, source: source } : { name: name };
+        }, (entry) => entry.name);
+        const plainCredentials = options.loadCredentials === undefined ? [] : credentials(options.loadCredentials, 'loadCredentials');
+        const encryptedCredentials = options.loadCredentialsEncrypted === undefined
+            ? [] : credentials(options.loadCredentialsEncrypted, 'loadCredentialsEncrypted');
+        // Systemd keeps both kinds in one table by name, so a name loads from exactly one of them.
+        requireValue(encryptedCredentials.every((entry) => !plainCredentials.some(({ name }) => name === entry.name)), 'loadCredentialsEncrypted');
+        const credential = ({ name, source }) => source === undefined ? name : `${name}:${source}`;
+        service.push(...plainCredentials.map((entry) => `LoadCredential=${credential(entry)}`));
+        service.push(...encryptedCredentials.map((entry) => `LoadCredentialEncrypted=${credential(entry)}`));
+        const dynamicUser = options.dynamicUser;
+        if (dynamicUser !== undefined) {
+            requireValue(typeof dynamicUser === 'boolean', 'dynamicUser');
+            // A static account of the same name would be used instead, so the name must not be root's,
+            // and systemd allocates only names that fit utmp.
+            requireValue(!dynamicUser || [options.user, options.group].every((name) => name !== 'root' && typeof name === 'string' && name.length <= 31), 'dynamicUser');
+        }
+        // Settings systemd forces on for a dynamic user, so the unit never states a weaker one.
+        const forced = (option, weakened) => requireValue(!(dynamicUser === true && weakened), option);
+        if (options.noNewPrivileges !== undefined) {
+            requireValue(typeof options.noNewPrivileges === 'boolean', 'noNewPrivileges');
+            forced('noNewPrivileges', !options.noNewPrivileges);
+            service.push(`NoNewPrivileges=${yesNo(options.noNewPrivileges)}`);
+        }
+        if (options.protectSystem !== undefined) {
+            requireValue([true, false, 'full', 'strict'].includes(options.protectSystem), 'protectSystem');
+            forced('protectSystem', options.protectSystem !== 'strict');
+            service.push(`ProtectSystem=${typeof options.protectSystem === 'boolean'
+                ? yesNo(options.protectSystem) : options.protectSystem}`);
+        }
+        if (options.protectHome !== undefined) {
+            requireValue([true, false, 'read-only', 'tmpfs'].includes(options.protectHome), 'protectHome');
+            forced('protectHome', options.protectHome === false);
+            service.push(`ProtectHome=${typeof options.protectHome === 'boolean'
+                ? yesNo(options.protectHome) : options.protectHome}`);
+        }
+        for (const [option, directive] of sandboxSwitches) {
+            const value = options[option];
+            if (value === undefined)
+                continue;
+            requireValue(typeof value === 'boolean', option);
+            forced(option, (option === 'privateTmp' || option === 'restrictSUIDSGID') && !value);
+            service.push(`${directive}=${yesNo(value)}`);
+        }
+        const capabilities = (value, option) => list(value, option, systemdCapabilities.length, (entry) => {
+            requireValue(systemdCapabilities.includes(entry), option);
+            return entry;
+        }, (entry) => entry);
+        const bounding = options.capabilityBoundingSet === undefined
+            ? undefined : capabilities(options.capabilityBoundingSet, 'capabilityBoundingSet');
+        const ambient = options.ambientCapabilities === undefined
+            ? undefined : capabilities(options.ambientCapabilities, 'ambientCapabilities');
+        // An ambient capability outside the bounding set would fail every start of the service.
+        requireValue(!bounding || !ambient || ambient.every((entry) => bounding.includes(entry)), 'ambientCapabilities');
+        // An empty CapabilityBoundingSet= empties the bounding set; an empty AmbientCapabilities= grants none.
+        if (bounding)
+            service.push(`CapabilityBoundingSet=${bounding.join(' ')}`);
+        if (ambient)
+            service.push(`AmbientCapabilities=${ambient.join(' ')}`);
+        const families = options.restrictAddressFamilies === undefined ? undefined
+            : list(options.restrictAddressFamilies, 'restrictAddressFamilies', systemdAddressFamilies.length, (entry) => {
+                requireValue(systemdAddressFamilies.includes(entry), 'restrictAddressFamilies');
+                return entry;
+            }, (entry) => entry);
+        // An empty RestrictAddressFamilies= would lift the restriction instead of denying every family.
+        requireValue(!families || families.length > 0, 'restrictAddressFamilies');
+        if (families)
+            service.push(`RestrictAddressFamilies=${families.join(' ')}`);
+        const relations = renderServiceRelations(options, options.unitName, options.restart, scope, fail);
+        // A notify service sends READY=1 over an AF_UNIX socket it creates itself.
+        requireValue(!families || !relations.service.includes('Type=notify') || families.includes('AF_UNIX'), 'restrictAddressFamilies');
         this.unitName = options.unitName;
         this.scope = scope;
         this.content = [
@@ -124,6 +260,7 @@ export class SystemdServiceDefinition {
             '[Service]',
             ...relations.service,
             ...(scope === 'system' ? [`User=${options.user}`, `Group=${options.group}`] : []),
+            ...(dynamicUser !== undefined ? [`DynamicUser=${yesNo(dynamicUser)}`] : []),
             `ExecStart=${[quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')}`,
             // WorkingDirectory is a raw path value, not an ExecStart word list.
             `WorkingDirectory=${options.workingDirectory.replaceAll('%', '%%')}`,
@@ -144,9 +281,9 @@ export class SystemdServiceDefinition {
             ...relations.install,
             '',
         ].join('\n');
-        requireValue(Buffer.byteLength(this.content) <= 16384);
+        requireValue(Buffer.byteLength(this.content) <= 16384, 'options');
         this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
         Object.freeze(this);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kc2VydmljZWRlZmluaXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWRzZXJ2aWNlZGVmaW5pdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSx3QkFBd0IsRUFBRSxXQUFXLEVBQUUsc0JBQXNCLEVBQ3BCLE1BQU0seUJBQXlCLENBQUM7QUF3Q3hHLE1BQU0sT0FBTyw2QkFBOEIsU0FBUSxLQUFLO0lBQ3REO1FBQ0UsS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFFRCw4RkFBOEY7QUFDOUYsTUFBTSxPQUFPLHdCQUF3QjtJQU1uQyxZQUFZLE9BQXlDO1FBQ25ELE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFRLEVBQUU7WUFDNUMsSUFBSSxDQUFDLEtBQUs7Z0JBQUUsTUFBTSxJQUFJLDZCQUE2QixFQUFFLENBQUM7UUFDeEQsQ0FBQyxDQUFDO1FBQ0YsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7WUFDMUQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkQsTUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsZUFBZSxLQUFLLFNBQVM7WUFDeEMsZUFBZSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksZUFBZSxDQUFDLENBQUM7UUFDNUQsTUFBTSxVQUFVLEdBQVksZUFBZSxFQUFFLEtBQUssSUFBSSxRQUFRLENBQUM7UUFDL0QsSUFBSSxVQUFVLEtBQUssUUFBUSxJQUFJLFVBQVUsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNyRCxNQUFNLElBQUksNkJBQTZCLEVBQUUsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLDRGQUE0RjtRQUM1RixNQUFNLElBQUksR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFPLEdBQUcsSUFBSSxFQUFtQixFQUFFLENBQy9ELE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLE9BQU8sSUFBSSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDN0UsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUNsQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1lBQzdDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQztRQUMxQyxNQUFNLElBQUksR0FBRztZQUNYLFVBQVU7WUFDVixhQUFhO1lBQ2IsWUFBWTtZQUNaLE1BQU07WUFDTixrQkFBa0I7WUFDbEIsU0FBUztZQUNULFVBQVU7WUFDVixvQkFBb0I7WUFDcEIsR0FBRyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDakQsQ0FBQztRQUNGLE1BQU0sWUFBWSxHQUFHLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixFQUFFLFVBQVU7WUFDL0YsYUFBYSxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUM5RCxZQUFZLENBQ1YsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxHQUFHLElBQUksRUFBRSxHQUFHLFlBQVksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDbEcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsRUFBRSxVQUFVLElBQUksT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFFLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUU7WUFDakosTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQztZQUNqRSxPQUFPLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxDQUFDO1FBQzdDLENBQUMsQ0FBQyxDQUNMLENBQUM7UUFDRixZQUFZLENBQ1YsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7WUFDbEMsNkNBQTZDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FDdkUsQ0FBQztRQUNGLFlBQVksQ0FDVixJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQy9ELE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLEtBQUssT0FBTyxDQUFDLFdBQVcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUM1RixDQUFDO1FBQ0YsWUFBWSxDQUNWLFFBQVEsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxHQUFHO1lBQ3hELENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7WUFDdkUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQztZQUNsQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEtBQUssT0FBTyxDQUFDLGdCQUFnQjtZQUM1RCxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQzNDLENBQUM7UUFDRixZQUFZLENBQ1YsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTO1lBQ2pJLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUc7WUFDMUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDaEUsS0FBSyxDQUFDLElBQUksQ0FDUixFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUMvQixDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUMzRTtpQkFDRSxLQUFLLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDMUYsQ0FBQztRQUNGLElBQUksS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3ZCLFlBQVksQ0FDVixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQzVDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxnQ0FBZ0MsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQzFFLENBQ0YsQ0FBQztRQUNKLENBQUM7UUFDRCxZQUFZLENBQ1YsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1lBQ3RELENBQUMsT0FBTyxFQUFFLGVBQWUsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztZQUNoRSxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztZQUNoRCxPQUFPLENBQUMsa0JBQWtCLElBQUksQ0FBQyxJQUFJLE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSxHQUFHLENBQ3ZFLENBQUM7UUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFlLEVBQUUsT0FBZSxFQUFtQixFQUFFLENBQ3BGLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUssS0FBZ0IsSUFBSSxPQUFPLElBQUssS0FBZ0IsSUFBSSxPQUFPLENBQUM7UUFDOUYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUUsQ0FDN0QsS0FBSyxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsRUFBRSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUNyRSwrRkFBK0Y7UUFDL0YsTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO1FBQzdCLElBQUksT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN6QyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuQyxZQUFZLENBQUMsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxDQUFDO1lBQ3BELE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0QyxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO1lBQ3pDLE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLE9BQU8sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDM0QsT0FBTyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELGlGQUFpRjtRQUNqRixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWEsRUFBRSxPQUFPLEdBQUcsS0FBSyxFQUFFLEVBQUUsQ0FDL0MsR0FBRyxHQUFHLEtBQUs7YUFDUixVQUFVLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUM7YUFDckUsVUFBVSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQzlDLEdBQUcsQ0FBQztRQUNOLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0Qyx3RkFBd0Y7WUFDeEYsTUFBTSxTQUFTLEdBQVksT0FBTyxDQUFDLFdBQVcsQ0FBQztZQUMvQyxZQUFZLENBQUMsU0FBUyxLQUFLLElBQUksSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRO2dCQUM5RCxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLFNBQVMsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRyxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQW1CLENBQUMsQ0FBQztZQUNuRCxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO1lBQzlDLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3BFLFlBQVksQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksZ0NBQWdDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztvQkFDbEYsVUFBVSxFQUFFLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztnQkFDN0UsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFjLEVBQUUsR0FBRyxJQUFjLElBQUksVUFBVyxDQUFDLEtBQWUsRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxDQUFDO1lBQzVGLHVGQUF1RjtZQUN2RixPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRTtpQkFDM0MsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxlQUFlLEtBQUssQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDcEUsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sSUFBSSw2QkFBNkIsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEosSUFBSSxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO1FBQ25CLElBQUksQ0FBQyxPQUFPLEdBQUc7WUFDYixRQUFRO1lBQ1IsZUFBZSxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEVBQUU7WUFDMUQsR0FBRyxTQUFTLENBQUMsSUFBSTtZQUNqQixFQUFFO1lBQ0YsV0FBVztZQUNYLEdBQUcsU0FBUyxDQUFDLE9BQU87WUFDcEIsR0FBRyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQUUsU0FBUyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pGLGFBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQzFGLEVBQUU7WUFDRixvRUFBb0U7WUFDcEUsb0JBQW9CLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQ3BFLFdBQVcsT0FBTyxDQUFDLE9BQU8sRUFBRTtZQUM1QixHQUFHLENBQUMsT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsY0FBYyxPQUFPLENBQUMsY0FBYyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzFGLFlBQVksT0FBTyxDQUFDLFFBQVEsRUFBRTtZQUM5QixvQkFBb0I7WUFDcEIseUJBQXlCO1lBQ3pCLGlCQUFpQjtZQUNqQixlQUFlO1lBQ2Ysa0JBQWtCLE9BQU8sQ0FBQyxrQkFBa0IsR0FBRztZQUMvQyxHQUFHLE9BQU87WUFDVixvQkFBb0I7WUFDcEIsd0JBQXdCO1lBQ3hCLHVCQUF1QjtZQUN2QixFQUFFO1lBQ0YsV0FBVztZQUNYLEdBQUcsU0FBUyxDQUFDLE9BQU87WUFDcEIsRUFBRTtTQUNILENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2IsWUFBWSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckYsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kc2VydmljZWRlZmluaXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWRzZXJ2aWNlZGVmaW5pdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSx3QkFBd0IsRUFBRSxXQUFXLEVBQUUsc0JBQXNCLEVBQUUsc0JBQXNCLEVBQ2xILG1CQUFtQixFQUNrRSxNQUFNLHlCQUF5QixDQUFDO0FBSXZILE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBMkZ0RixNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUd0RCxZQUFZLE1BQXVDO1FBQ2pELEtBQUssQ0FBQyw4Q0FBOEMsTUFBTSxHQUFHLENBQUMsQ0FBQztRQUMvRCxJQUFJLENBQUMsSUFBSSxHQUFHLCtCQUErQixDQUFDO1FBQzVDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRjtBQUVELDZFQUE2RTtBQUM3RSxNQUFNLGVBQWUsR0FBRztJQUN0QixDQUFDLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDNUIsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQztJQUNwQyxDQUFDLHVCQUF1QixFQUFFLHVCQUF1QixDQUFDO0lBQ2xELENBQUMsc0JBQXNCLEVBQUUsc0JBQXNCLENBQUM7SUFDaEQsQ0FBQyxtQkFBbUIsRUFBRSxtQkFBbUIsQ0FBQztJQUMxQyxDQUFDLHNCQUFzQixFQUFFLHNCQUFzQixDQUFDO0lBQ2hELENBQUMsY0FBYyxFQUFFLGNBQWMsQ0FBQztJQUNoQyxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixDQUFDO0lBQ3RDLENBQUMsb0JBQW9CLEVBQUUsb0JBQW9CLENBQUM7SUFDNUMsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBQztJQUN4QyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDO0lBQ3hDLENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLENBQUM7Q0FDOUIsQ0FBQztBQUVYLGdHQUFnRztBQUNoRyxNQUFNLGlCQUFpQixHQUFHLENBQUMsYUFBYSxFQUFFLGlCQUFpQixFQUFFLDBCQUEwQixFQUFFLGlCQUFpQjtJQUN4RyxlQUFlLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLHVCQUF1QjtJQUNyRyxxQkFBcUIsRUFBRSx5QkFBeUIsQ0FBVSxDQUFDO0FBRTdELDhGQUE4RjtBQUM5RixNQUFNLE9BQU8sd0JBQXdCO0lBTW5DLFlBQVksT0FBeUM7UUFDbkQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxNQUF1QyxFQUFTLEVBQUU7WUFDOUQsTUFBTSxJQUFJLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2xELENBQUMsQ0FBQztRQUNGLE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFFLE1BQXVDLEVBQVEsRUFBRTtZQUNyRixJQUFJLENBQUMsS0FBSztnQkFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDO1FBQ0YsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7WUFDMUQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUUsWUFBWSxDQUFDLGVBQWUsS0FBSyxTQUFTO1lBQ3hDLGVBQWUsQ0FBQyxVQUFVLElBQUksT0FBTyxJQUFJLGVBQWUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNyRSxNQUFNLFVBQVUsR0FBWSxlQUFlLEVBQUUsS0FBSyxJQUFJLFFBQVEsQ0FBQztRQUMvRCxJQUFJLFVBQVUsS0FBSyxRQUFRLElBQUksVUFBVSxLQUFLLE1BQU07WUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDcEUsTUFBTSxLQUFLLEdBQUcsVUFBK0IsQ0FBQztRQUM5Qyw0RkFBNEY7UUFDNUYsTUFBTSxJQUFJLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBTyxHQUFHLElBQUksRUFBbUIsRUFBRSxDQUMvRCxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPLElBQUksV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzdFLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQ25ELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFDN0MsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssS0FBSyxDQUFDO1FBQzFDLE1BQU0sSUFBSSxHQUFzQztZQUM5QyxVQUFVO1lBQ1YsYUFBYTtZQUNiLFlBQVk7WUFDWixNQUFNO1lBQ04sa0JBQWtCO1lBQ2xCLFNBQVM7WUFDVCxVQUFVO1lBQ1Ysb0JBQW9CO1lBQ3BCLEdBQUcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzFELENBQUM7UUFDRixNQUFNLFlBQVksR0FBc0MsQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxTQUFTO1lBQ3BHLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixFQUFFLGFBQWE7WUFDeEYsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3hCLG9HQUFvRztRQUNwRyxLQUFLLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxZQUFZLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFZLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUN2SCxNQUFNLE1BQU0sR0FBRyxHQUFzQyxDQUFDO1lBQ3RELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDakUsWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM3RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUk7WUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN6RixZQUFZLENBQ1YsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7WUFDbEMsNkNBQTZDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFDdEUsVUFBVSxDQUNYLENBQUM7UUFDRixZQUFZLENBQ1YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUMvRCxPQUFPLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxLQUFLLE9BQU8sQ0FBQyxXQUFXLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFDM0YsYUFBYSxDQUNkLENBQUM7UUFDRixZQUFZLENBQ1YsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLEdBQUc7WUFDeEQsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUN6RSxZQUFZLENBQ2IsQ0FBQztRQUNGLFlBQVksQ0FDVixRQUFRLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDO1lBQ2hDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsS0FBSyxPQUFPLENBQUMsZ0JBQWdCO1lBQzVELENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFDMUMsa0JBQWtCLENBQ25CLENBQUM7UUFDRixZQUFZLENBQ1YsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTO1lBQ2pJLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUc7WUFDMUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDaEUsS0FBSyxDQUFDLElBQUksQ0FDUixFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUMvQixDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUMzRTtpQkFDRSxLQUFLLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFDekYsTUFBTSxDQUNQLENBQUM7UUFDRixJQUFJLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN2QixLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBVSxFQUFFLENBQUM7Z0JBQzdDLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxRQUFRLElBQUksZ0NBQWdDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQzdHLENBQUM7UUFDSCxDQUFDO1FBQ0QsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2xGLFlBQVksQ0FBQyxDQUFDLE9BQU8sRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMzRixZQUFZLENBQ1YsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUM7WUFDOUMsT0FBTyxDQUFDLGtCQUFrQixJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsa0JBQWtCLElBQUksR0FBRyxFQUN0RSxvQkFBb0IsQ0FDckIsQ0FBQztRQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxPQUFlLEVBQW1CLEVBQUUsQ0FDcEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSyxLQUFnQixJQUFJLE9BQU8sSUFBSyxLQUFnQixJQUFJLE9BQU8sQ0FBQztRQUM5RixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWMsRUFBZ0MsRUFBRSxDQUM3RCxLQUFLLEtBQUssVUFBVSxJQUFJLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sS0FBSyxHQUFHLENBQUMsS0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3ZELCtGQUErRjtRQUMvRixNQUFNLE9BQU8sR0FBYSxFQUFFLENBQUM7UUFDN0IsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUN0RyxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ2hFLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1lBQ3hELE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ2xELE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUMvQyxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzdFLE9BQU8sQ0FBQyxJQUFJLENBQUMsa0JBQWtCLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxpRkFBaUY7UUFDakYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFhLEVBQUUsT0FBTyxHQUFHLEtBQUssRUFBRSxFQUFFLENBQy9DLEdBQUcsR0FBRyxLQUFLO2FBQ1IsVUFBVSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDO2FBQ3JFLFVBQVUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUM5QyxHQUFHLENBQUM7UUFDTixNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBRSxNQUF1QyxFQUFFLEVBQUUsQ0FDOUUsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUM1RixNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDL0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLHdGQUF3RjtZQUN4RixNQUFNLFNBQVMsR0FBWSxPQUFPLENBQUMsV0FBVyxDQUFDO1lBQy9DLFdBQVcsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDdEMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFtQixDQUFDLENBQUM7WUFDbkQsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksd0JBQXdCLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDdEUsTUFBTSxXQUFXLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7WUFDOUMsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztnQkFDekIsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFDcEUsWUFBWSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxnQ0FBZ0MsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO29CQUNsRixVQUFVLEVBQUUsVUFBVSxJQUFJLE9BQU8sSUFBSSxVQUFVLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztnQkFDNUYsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFjLEVBQUUsR0FBRyxJQUFjLElBQUksVUFBVyxDQUFDLEtBQWUsRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxvQkFBb0IsRUFBRSxhQUFhLENBQUMsQ0FBQztZQUMzRyx1RkFBdUY7WUFDdkYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxXQUFXLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUU7aUJBQzNDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsZUFBZSxLQUFLLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCwyRUFBMkU7UUFDM0UsS0FBSyxNQUFNLE1BQU0sSUFBSSxpQkFBaUIsRUFBRSxDQUFDO1lBQ3ZDLFlBQVksQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELHFGQUFxRjtRQUNyRixNQUFNLElBQUksR0FBRyxDQUFJLEtBQWMsRUFBRSxNQUF1QyxFQUFFLE9BQWUsRUFDdkYsSUFBMkIsRUFBRSxRQUE4QixFQUFPLEVBQUU7WUFDcEUsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO2dCQUNyRSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPO2dCQUMzRSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM5RCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxFQUFHLEtBQW1CLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUU7Z0JBQzlFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQ3pFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE9BQU8sSUFBSSxVQUFVLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLE9BQU8sSUFBSSxDQUFDLFVBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNqQyxDQUFDLENBQUMsQ0FBQztZQUNILE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDeEMsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3JFLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqRixDQUFDLENBQUM7UUFDRiw4RkFBOEY7UUFDOUYsbUZBQW1GO1FBQ25GLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQ3pELE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQUUsTUFBc0QsRUFBRSxFQUFFLENBQzdGLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBNkIsRUFBRTtZQUMzRCxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzNCLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBZSxDQUFDLENBQUM7WUFDbkQsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLEtBQUssTUFBTSxJQUFJLEdBQUcsS0FBSyxRQUFRLENBQUM7Z0JBQ3RHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLEVBQUUsVUFBVTtnQkFDdkQsT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFFLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNwRSxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLEtBQTJDLENBQUM7WUFDckUsWUFBWSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMzQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDakMsWUFBWSxDQUFDLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7b0JBQ2xHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQWMsRUFBRSxNQUFNLEVBQUUsTUFBZ0IsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFjLEVBQUUsQ0FBQztRQUN0SCxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1QixNQUFNLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxlQUFlLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsZUFBZSxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDOUgsTUFBTSxvQkFBb0IsR0FBRyxPQUFPLENBQUMsd0JBQXdCLEtBQUssU0FBUztZQUN6RSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLHdCQUF3QixFQUFFLDBCQUEwQixDQUFDLENBQUM7UUFDbkYsMkZBQTJGO1FBQzNGLFlBQVksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUMzRywwQkFBMEIsQ0FBQyxDQUFDO1FBQzlCLE1BQU0sVUFBVSxHQUFHLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUE2QixFQUFFLEVBQUUsQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ3RILE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDeEYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsMkJBQTJCLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNyRyxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3hDLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLFlBQVksQ0FBQyxPQUFPLFdBQVcsS0FBSyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDOUQsMkZBQTJGO1lBQzNGLGtEQUFrRDtZQUNsRCxZQUFZLENBQUMsQ0FBQyxXQUFXLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUN4RSxJQUFJLEtBQUssTUFBTSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQ3RGLENBQUM7UUFDRCx3RkFBd0Y7UUFDeEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUF1QyxFQUFFLFFBQWlCLEVBQUUsRUFBRSxDQUM1RSxZQUFZLENBQUMsQ0FBQyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUQsSUFBSSxPQUFPLENBQUMsZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzFDLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxlQUFlLEtBQUssU0FBUyxFQUFFLGlCQUFpQixDQUFDLENBQUM7WUFDOUUsTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQ3BELE9BQU8sQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEMsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztZQUMvRixNQUFNLENBQUMsZUFBZSxFQUFFLE9BQU8sQ0FBQyxhQUFhLEtBQUssUUFBUSxDQUFDLENBQUM7WUFDNUQsT0FBTyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsT0FBTyxPQUFPLENBQUMsYUFBYSxLQUFLLFNBQVM7Z0JBQ3RFLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDL0YsTUFBTSxDQUFDLGFBQWEsRUFBRSxPQUFPLENBQUMsV0FBVyxLQUFLLEtBQUssQ0FBQyxDQUFDO1lBQ3JELE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUztnQkFDbEUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLElBQUksZUFBZSxFQUFFLENBQUM7WUFDbEQsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzlCLElBQUksS0FBSyxLQUFLLFNBQVM7Z0JBQUUsU0FBUztZQUNsQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2pELE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxNQUFNLEtBQUssWUFBWSxJQUFJLE1BQU0sS0FBSyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLFNBQVMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxDQUFDLEtBQWMsRUFBRSxNQUF1RCxFQUFFLEVBQUUsQ0FDL0YsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDeEQsWUFBWSxDQUFFLG1CQUEwQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNsRixPQUFPLEtBQTJCLENBQUM7UUFDckMsQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMscUJBQXFCLEtBQUssU0FBUztZQUMxRCxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLHFCQUFxQixFQUFFLHVCQUF1QixDQUFDLENBQUM7UUFDckYsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7WUFDdkQsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2pGLHdGQUF3RjtRQUN4RixZQUFZLENBQUMsQ0FBQyxRQUFRLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFDakgsdUdBQXVHO1FBQ3ZHLElBQUksUUFBUTtZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMseUJBQXlCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLElBQUksT0FBTztZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyx1QkFBdUIsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDeEUsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsdUJBQXVCLEVBQUUseUJBQXlCLEVBQUUsc0JBQXNCLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7Z0JBQzFHLFlBQVksQ0FBRSxzQkFBNkMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUseUJBQXlCLENBQUMsQ0FBQztnQkFDeEcsT0FBTyxLQUE4QixDQUFDO1lBQ3hDLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsZ0dBQWdHO1FBQ2hHLFlBQVksQ0FBQyxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSx5QkFBeUIsQ0FBQyxDQUFDO1FBQzFFLElBQUksUUFBUTtZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzVFLE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xHLDJFQUEyRTtRQUMzRSxZQUFZLENBQUMsQ0FBQyxRQUFRLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUNsRyx5QkFBeUIsQ0FBQyxDQUFDO1FBQzdCLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUNqQyxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixJQUFJLENBQUMsT0FBTyxHQUFHO1lBQ2IsUUFBUTtZQUNSLGVBQWUsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQzFELEdBQUcsU0FBUyxDQUFDLElBQUk7WUFDakIsRUFBRTtZQUNGLFdBQVc7WUFDWCxHQUFHLFNBQVMsQ0FBQyxPQUFPO1lBQ3BCLEdBQUcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLFNBQVMsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNqRixHQUFHLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxlQUFlLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxhQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUMxRixFQUFFO1lBQ0Ysb0VBQW9FO1lBQ3BFLG9CQUFvQixPQUFPLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsRUFBRTtZQUNwRSxXQUFXLE9BQU8sQ0FBQyxPQUFPLEVBQUU7WUFDNUIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLGNBQWMsT0FBTyxDQUFDLGNBQWMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMxRixZQUFZLE9BQU8sQ0FBQyxRQUFRLEVBQUU7WUFDOUIsb0JBQW9CO1lBQ3BCLHlCQUF5QjtZQUN6QixpQkFBaUI7WUFDakIsZUFBZTtZQUNmLGtCQUFrQixPQUFPLENBQUMsa0JBQWtCLEdBQUc7WUFDL0MsR0FBRyxPQUFPO1lBQ1Ysb0JBQW9CO1lBQ3BCLHdCQUF3QjtZQUN4Qix1QkFBdUI7WUFDdkIsRUFBRTtZQUNGLFdBQVc7WUFDWCxHQUFHLFNBQVMsQ0FBQyxPQUFPO1lBQ3BCLEVBQUU7U0FDSCxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNiLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDbEUsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RCLENBQUM7Q0FDRiJ9

package/dist_ts/classes.systemdtransientscope.d.ts

@@ -0,0 +1,78 @@
+export interface ISystemdTransientScopeOptions {
+    /** The calling user's manager; the only manager a transient scope is started in. */
+    scope: 'user';
+    /** Absolute, normalized program path, executed directly: no shell, no PATH search. */
+    executable: string;
+    /** Literal arguments, at most 128 of at most 32768 characters each, without NUL. */
+    args: readonly string[];
+    /** Absolute, normalized directory the program starts in. */
+    workingDirectory: string;
+    /**
+     * The program's complete environment. Nothing of the calling process is inherited: the program
+     * receives exactly these variables, the manager's `XDG_RUNTIME_DIR` and systemd's
+     * `INVOCATION_ID`. Names match `[A-Za-z_][A-Za-z0-9_]*` (at most 128 characters); values are
+     * strings of at most 32768 characters without NUL; at most 256 variables. `XDG_RUNTIME_DIR`,
+     * `INVOCATION_ID` and names starting with `SYSTEMD_` or `DBUS_`, which configure systemd-run
+     * itself, are refused.
+     */
+    environment: Readonly<Record<string, string>>;
+    /** Literal unit description: clean text of 1 to 1024 characters, trimmed, without `\`. */
+    description: string;
+    /** A `.scope` unit name; defaults to a unique `smartdaemon-<32 hex digits>.scope`. */
+    unitName?: string;
+    /** User-manager socket directory. Defaults to a non-empty XDG_RUNTIME_DIR. */
+    runtimeDirectory?: string;
+    /** Absolute executable path supplied by trusted owning code. Defaults to `/usr/bin/systemd-run`. */
+    systemdRunPath?: string;
+    /** Absolute executable path supplied by trusted owning code. Defaults to `/usr/bin/systemctl`. */
+    systemctlPath?: string;
+    /** Bounds the manager probe and the program's direct process, each. Defaults to 120 seconds. */
+    commandTimeoutMs?: number;
+}
+export interface ISystemdTransientScopeResult {
+    /** The scope unit. It stays active while any process the program started runs in it. */
+    readonly unitName: string;
+    /** Exit status of the program's direct process; null when a signal ended it. */
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    /** UTF-8 decoded output of the program and every process that shared its stdout. */
+    readonly stdout: string;
+    /** As `stdout`, without the line systemd-run prints on starting the scope. */
+    readonly stderr: string;
+}
+export type TSystemdTransientScopeErrorCode = 
+/** The options are malformed, or the runtime directory is not a private directory of the caller. */
+'invalid_options'
+/** The process is not running on Linux. */
+ | 'unsupported_platform'
+/** No runtime directory is set or it does not exist, or the manager does not answer systemctl. */
+ | 'user_manager_unavailable'
+/** systemd-run exited without reporting the scope running; the program has not run. */
+ | 'scope_start_failed'
+/** The manager probe or the program did not finish, and close its output, in time. */
+ | 'timed_out'
+/** The program's stdout or stderr exceeded 1 MiB. */
+ | 'output_limit';
+export declare class SystemdTransientScopeError extends Error {
+    readonly code: TSystemdTransientScopeErrorCode;
+    /** The scope the call used; null when the options were refused. */
+    readonly unitName: string | null;
+    /** The probe's or systemd-run's stderr as far as it was read; empty when none ran. */
+    readonly stderr: string;
+    constructor(code: TSystemdTransientScopeErrorCode, 
+    /** The scope the call used; null when the options were refused. */
+    unitName: string | null, 
+    /** The probe's or systemd-run's stderr as far as it was read; empty when none ran. */
+    stderr: string, options?: ErrorOptions);
+}
+/**
+ * Starts a program in a new transient scope unit of the calling user's systemd manager, so it and
+ * every process it starts run outside the caller's own unit and survive that unit's stop, and
+ * waits for the program's direct process. A program that daemonizes and exits returns its result
+ * while its daemon keeps the scope active; the scope ends when its last process exits. The daemon
+ * must not keep the program's stdout or stderr open, or the call runs into its timeout.
+ *
+ * On `timed_out` and `output_limit` the direct process is killed; processes it started stay in
+ * the scope. A program that exits with a failure status is a result, not an error.
+ */
+export declare const runInTransientScope: (options: ISystemdTransientScopeOptions) => Promise<ISystemdTransientScopeResult>;