@push.rocks/smartdaemon 2.12.0 → 2.13.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdaemon',
-    version: '2.12.0',
+    version: '2.13.0',
     description: 'Start scripts as long running daemons and manage them.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHdEQUF3RDtDQUN0RSxDQUFBIn0=

package/dist_ts/classes.systemdservicedefinition.d.ts

@@ -1,5 +1,6 @@
-import { type TSystemdServiceStartup, type ISystemdServiceDependencies, type ISystemdServiceInstallTargets } from './systemd.definition.js';
-export type { ISystemdServiceStartup, ISystemdServiceNotifyStartup, TSystemdServiceStartup, ISystemdServiceDependencies, ISystemdServiceInstallTargets } from './systemd.definition.js';
+import { type TSystemdServiceStartup, type ISystemdServiceDependencies, type ISystemdServiceInstallTargets, type ISystemdServiceCredential, type TSystemdCapability, type TSystemdAddressFamily } from './systemd.definition.js';
+export type { ISystemdServiceStartup, ISystemdServiceNotifyStartup, TSystemdServiceStartup, ISystemdServiceDependencies, ISystemdServiceInstallTargets, ISystemdServiceCredential, TSystemdCapability, TSystemdAddressFamily } from './systemd.definition.js';
+export { systemdCapabilities, systemdAddressFamilies } from './systemd.definition.js';
 interface ISystemdServiceDefinitionBaseOptions {
     unitName: string;
     description: string;
@@ -29,6 +30,53 @@ interface ISystemdServiceDefinitionBaseOptions {
      * 64 variables and 8192 UTF-8 bytes of `NAME=value` in total. They are taken literally: `%` is escaped, and `Environment=` never expands `$`.
      */
     environment?: Readonly<Record<string, string>>;
+    /**
+     * System scope only. Runs the service as a transient user and group allocated at start
+     * (`DynamicUser=`), named by `user` and `group`, which then must not be `root` and have at most
+     * 31 characters. Systemd enforces `ProtectSystem=strict`, `PrivateTmp=`, `NoNewPrivileges=` and
+     * `RestrictSUIDSGID=` for such a service, so a definition that weakens any of them is refused.
+     */
+    dynamicUser?: boolean;
+    /** System scope only. Credentials read in plaintext, one `LoadCredential=` line each, ordered by name. */
+    loadCredentials?: readonly ISystemdServiceCredential[];
+    /** System scope only. Credentials sealed with `systemd-creds encrypt`, one `LoadCredentialEncrypted=` line each, ordered by name. */
+    loadCredentialsEncrypted?: readonly ISystemdServiceCredential[];
+    /** System scope only (`NoNewPrivileges=`). */
+    noNewPrivileges?: boolean;
+    /** System scope only (`ProtectSystem=`): `true` mounts `/usr` and the boot loader read-only, `'full'` also `/etc`, `'strict'` the whole file system but the API file systems. */
+    protectSystem?: boolean | 'full' | 'strict';
+    /** System scope only (`ProtectHome=`). */
+    protectHome?: boolean | 'read-only' | 'tmpfs';
+    /** System scope only (`PrivateTmp=`). */
+    privateTmp?: boolean;
+    /** System scope only (`PrivateDevices=`). */
+    privateDevices?: boolean;
+    /** System scope only (`ProtectKernelTunables=`). */
+    protectKernelTunables?: boolean;
+    /** System scope only (`ProtectKernelModules=`). */
+    protectKernelModules?: boolean;
+    /** System scope only (`ProtectKernelLogs=`). */
+    protectKernelLogs?: boolean;
+    /** System scope only (`ProtectControlGroups=`). */
+    protectControlGroups?: boolean;
+    /** System scope only (`ProtectClock=`). */
+    protectClock?: boolean;
+    /** System scope only (`ProtectHostname=`). */
+    protectHostname?: boolean;
+    /** System scope only (`RestrictNamespaces=`): `true` forbids creating every kind of namespace. */
+    restrictNamespaces?: boolean;
+    /** System scope only (`RestrictRealtime=`). */
+    restrictRealtime?: boolean;
+    /** System scope only (`RestrictSUIDSGID=`). */
+    restrictSUIDSGID?: boolean;
+    /** System scope only (`LockPersonality=`). */
+    lockPersonality?: boolean;
+    /** System scope only. The only capabilities the service's processes can ever hold (`CapabilityBoundingSet=`); empty drops all. */
+    capabilityBoundingSet?: readonly TSystemdCapability[];
+    /** System scope only. Capabilities a non-root service's processes receive (`AmbientCapabilities=`); within `capabilityBoundingSet` when both are given. */
+    ambientCapabilities?: readonly TSystemdCapability[];
+    /** System scope only. The only socket families the service may create (`RestrictAddressFamilies=`); at least one, and `AF_UNIX` for a notify service. */
+    restrictAddressFamilies?: readonly TSystemdAddressFamily[];
 }
 export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOptions & ({
     scope?: 'system';
@@ -39,8 +87,14 @@ export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOpti
     user?: never;
     group?: never;
 });
+/**
+ * The option a refusal names: a key of the definition, or `'options'` for the definition object
+ * itself (not a plain object, an unknown or accessor key, or a unit over 16384 bytes).
+ */
+export type TSystemdServiceDefinitionOption = keyof ISystemdServiceDefinitionOptions | 'options';
 export declare class SystemdServiceDefinitionError extends Error {
-    constructor();
+    readonly option: TSystemdServiceDefinitionOption;
+    constructor(option: TSystemdServiceDefinitionOption);
 }
 /** Literal direct-execution definition; never introduces a shell or environment expansion. */
 export declare class SystemdServiceDefinition {

package/dist_ts/classes.systemdservicedefinition.js

@@ -1,27 +1,50 @@
 import * as plugins from './smartdaemon.plugins.js';
-import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations } from './systemd.definition.js';
+import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations, systemdAddressFamilies, systemdCapabilities } from './systemd.definition.js';
+export { systemdCapabilities, systemdAddressFamilies } from './systemd.definition.js';
 export class SystemdServiceDefinitionError extends Error {
-    constructor() {
-        super('Invalid direct systemd service definition.');
+    constructor(option) {
+        super(`Invalid direct systemd service definition: ${option}.`);
         this.name = 'SystemdServiceDefinitionError';
+        this.option = option;
     }
 }
+/** Sandboxing switches in their rendering order, each with its directive. */
+const sandboxSwitches = [
+    ['privateTmp', 'PrivateTmp'],
+    ['privateDevices', 'PrivateDevices'],
+    ['protectKernelTunables', 'ProtectKernelTunables'],
+    ['protectKernelModules', 'ProtectKernelModules'],
+    ['protectKernelLogs', 'ProtectKernelLogs'],
+    ['protectControlGroups', 'ProtectControlGroups'],
+    ['protectClock', 'ProtectClock'],
+    ['protectHostname', 'ProtectHostname'],
+    ['restrictNamespaces', 'RestrictNamespaces'],
+    ['restrictRealtime', 'RestrictRealtime'],
+    ['restrictSUIDSGID', 'RestrictSUIDSGID'],
+    ['lockPersonality', 'LockPersonality'],
+];
+/** Options a user manager's service cannot carry: they need the system manager's privileges. */
+const systemOnlyOptions = ['dynamicUser', 'loadCredentials', 'loadCredentialsEncrypted', 'noNewPrivileges',
+    'protectSystem', 'protectHome', ...sandboxSwitches.map(([option]) => option), 'capabilityBoundingSet',
+    'ambientCapabilities', 'restrictAddressFamilies'];
 /** Literal direct-execution definition; never introduces a shell or environment expansion. */
 export class SystemdServiceDefinition {
     constructor(options) {
-        const requireValue = (value) => {
+        const fail = (option) => {
+            throw new SystemdServiceDefinitionError(option);
+        };
+        const requireValue = (value, option) => {
             if (!value)
-                throw new SystemdServiceDefinitionError();
+                fail(option);
         };
         requireValue(options && !plugins.util.types.isProxy(options) &&
-            Object.getPrototypeOf(options) === Object.prototype);
+            Object.getPrototypeOf(options) === Object.prototype, 'options');
         const scopeDescriptor = Object.getOwnPropertyDescriptor(options, 'scope');
         requireValue(scopeDescriptor === undefined ||
-            scopeDescriptor.enumerable && 'value' in scopeDescriptor);
+            scopeDescriptor.enumerable && 'value' in scopeDescriptor, 'scope');
         const scopeValue = scopeDescriptor?.value ?? 'system';
-        if (scopeValue !== 'system' && scopeValue !== 'user') {
-            throw new SystemdServiceDefinitionError();
-        }
+        if (scopeValue !== 'system' && scopeValue !== 'user')
+            fail('scope');
         const scope = scopeValue;
         // Systemd ignores an assignment whose text is not clean UTF-8, leaving the unit unloadable.
         const text = (value, maximum = 4096) => typeof value === 'string' && value.length <= maximum && isCleanText(value);
@@ -38,55 +61,64 @@ export class SystemdServiceDefinition {
             'timeoutStopSeconds',
             ...(scope === 'system' ? ['user', 'group'] : []),
         ];
-        const optionalKeys = ['scope', 'startup', 'dependencies', 'install', 'restartSeconds', 'delegate',
-            'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment'];
-        requireValue(Reflect.ownKeys(options).every(key => typeof key === 'string' && [...keys, ...optionalKeys].includes(key)
-            && Object.getOwnPropertyDescriptor(options, key)?.enumerable && 'value' in Object.getOwnPropertyDescriptor(options, key)) && keys.every((key) => {
+        const optionalKeys = ['scope', 'startup', 'dependencies', 'install',
+            'restartSeconds', 'delegate', 'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment',
+            ...systemOnlyOptions];
+        // Every own key is a known option held by an enumerable data property, so no accessor or trap runs.
+        for (const key of Reflect.ownKeys(options)) {
+            requireValue(typeof key === 'string' && [...keys, ...optionalKeys, 'user', 'group'].includes(key), 'options');
+            const option = key;
             const descriptor = Object.getOwnPropertyDescriptor(options, key);
-            return descriptor && 'value' in descriptor;
-        }));
+            requireValue(keys.includes(option) || optionalKeys.includes(option), option);
+            requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+        }
+        for (const key of keys)
+            requireValue(Object.getOwnPropertyDescriptor(options, key), key);
         requireValue(typeof options.unitName === 'string' &&
-            /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName));
+            /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName), 'unitName');
         requireValue(text(options.description, 1024) && options.description.length > 0 &&
-            options.description.trim() === options.description && !options.description.includes('\\'));
+            options.description.trim() === options.description && !options.description.includes('\\'), 'description');
         requireValue(absolute(options.executable) && options.executable !== '/' &&
-            !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
-            absolute(options.workingDirectory) &&
+            !/[\\"']/.test(options.executable) && !options.executable.endsWith('/'), 'executable');
+        requireValue(absolute(options.workingDirectory) &&
             options.workingDirectory.trim() === options.workingDirectory &&
-            !options.workingDirectory.includes('\\'));
+            !options.workingDirectory.includes('\\'), 'workingDirectory');
         requireValue(Array.isArray(options.args) && !plugins.util.types.isProxy(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
             options.args.length <= 128 &&
             Reflect.ownKeys(options.args).length === options.args.length + 1 &&
             Array.from({ length: options.args.length }, (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)))
-                .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)));
+                .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)), 'args');
         if (scope === 'system') {
-            requireValue([options.user, options.group].every((value) => typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)));
+            for (const key of ['user', 'group']) {
+                requireValue(typeof options[key] === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(options[key]), key);
+            }
         }
-        requireValue(['no', 'on-failure', 'always'].includes(options.restart) &&
-            ['mixed', 'control-group', 'process'].includes(options.killMode) &&
-            Number.isSafeInteger(options.timeoutStopSeconds) &&
-            options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600);
+        requireValue(['no', 'on-failure', 'always'].includes(options.restart), 'restart');
+        requireValue(['mixed', 'control-group', 'process'].includes(options.killMode), 'killMode');
+        requireValue(Number.isSafeInteger(options.timeoutStopSeconds) &&
+            options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600, 'timeoutStopSeconds');
         const integer = (value, minimum, maximum) => Number.isSafeInteger(value) && value >= minimum && value <= maximum;
         const limit = (value) => value === 'infinity' || integer(value, 1, Number.MAX_SAFE_INTEGER);
+        const yesNo = (value) => value ? 'yes' : 'no';
         // Each optional directive is absent unless supplied, so existing definitions keep their bytes.
         const service = [];
         if (options.restartSeconds !== undefined) {
-            requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no');
+            requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no', 'restartSeconds');
         }
         if (options.delegate !== undefined) {
-            requireValue(typeof options.delegate === 'boolean');
-            service.push(`Delegate=${options.delegate ? 'yes' : 'no'}`);
+            requireValue(typeof options.delegate === 'boolean', 'delegate');
+            service.push(`Delegate=${yesNo(options.delegate)}`);
         }
         if (options.limitNoFile !== undefined) {
-            requireValue(limit(options.limitNoFile));
+            requireValue(limit(options.limitNoFile), 'limitNoFile');
             service.push(`LimitNOFILE=${options.limitNoFile}`);
         }
         if (options.tasksMax !== undefined) {
-            requireValue(limit(options.tasksMax));
+            requireValue(limit(options.tasksMax), 'tasksMax');
             service.push(`TasksMax=${options.tasksMax}`);
         }
         if (options.oomScoreAdjust !== undefined) {
-            requireValue(integer(options.oomScoreAdjust, -1000, 1000));
+            requireValue(integer(options.oomScoreAdjust, -1000, 1000), 'oomScoreAdjust');
             service.push(`OOMScoreAdjust=${options.oomScoreAdjust}`);
         }
         // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
@@ -94,26 +126,130 @@ export class SystemdServiceDefinition {
             .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
             .replaceAll('$', () => command ? '$$' : '$') +
             '"';
+        const plainObject = (value, option) => requireValue(value !== null && typeof value === 'object' && !plugins.util.types.isProxy(value) &&
+            Object.getPrototypeOf(value) === Object.prototype, option);
         if (options.environment !== undefined) {
             // Read each variable once through its own data descriptor, so no accessor or trap runs.
             const variables = options.environment;
-            requireValue(variables !== null && typeof variables === 'object' &&
-                !plugins.util.types.isProxy(variables) && Object.getPrototypeOf(variables) === Object.prototype);
+            plainObject(variables, 'environment');
             const names = Reflect.ownKeys(variables);
-            requireValue(names.length <= environmentVariableLimit);
+            requireValue(names.length <= environmentVariableLimit, 'environment');
             const assignments = new Map();
             for (const name of names) {
                 const descriptor = Object.getOwnPropertyDescriptor(variables, name);
                 requireValue(typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name) &&
-                    descriptor?.enumerable && 'value' in descriptor && text(descriptor.value));
+                    descriptor?.enumerable && 'value' in descriptor && text(descriptor.value), 'environment');
                 assignments.set(name, `${name}=${descriptor.value}`);
             }
-            requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit);
+            requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit, 'environment');
             // Environment= unquotes and unescapes each word and expands `%` specifiers, never `$`.
             service.push(...[...assignments.keys()].sort()
                 .map((name) => `Environment=${quote(assignments.get(name))}`));
         }
-        const relations = renderServiceRelations(options, options.unitName, options.restart, scope, () => { throw new SystemdServiceDefinitionError(); });
+        // Every system-only option is refused by name in a user manager's service.
+        for (const option of systemOnlyOptions) {
+            requireValue(scope === 'system' || options[option] === undefined, option);
+        }
+        /** Reads a plain array once through its data descriptors: distinct items, sorted. */
+        const list = (value, option, maximum, item, identity) => {
+            requireValue(Array.isArray(value) && !plugins.util.types.isProxy(value) &&
+                Object.getPrototypeOf(value) === Array.prototype && value.length <= maximum &&
+                Reflect.ownKeys(value).length === value.length + 1, option);
+            const result = Array.from({ length: value.length }, (_, index) => {
+                const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+                return item(descriptor.value);
+            });
+            const identities = result.map(identity);
+            requireValue(new Set(identities).size === identities.length, option);
+            return result.sort((left, right) => identity(left) < identity(right) ? -1 : 1);
+        };
+        // Credential names and sources hold no `%`, quote, backslash, whitespace or `:`, so systemd's
+        // `NAME[:SOURCE]` parser and its specifier expansion read them exactly as written.
+        const credentialName = (value) => typeof value === 'string' && /^[A-Za-z0-9_@-][A-Za-z0-9_.@-]{0,254}$/.test(value);
+        const credentials = (value, option) => list(value, option, 64, (entry) => {
+            plainObject(entry, option);
+            const entryKeys = Reflect.ownKeys(entry);
+            requireValue(entryKeys.includes('name') && entryKeys.every((key) => (key === 'name' || key === 'source') &&
+                Object.getOwnPropertyDescriptor(entry, key)?.enumerable &&
+                'value' in Object.getOwnPropertyDescriptor(entry, key)), option);
+            const { name, source } = entry;
+            requireValue(credentialName(name), option);
+            if (entryKeys.includes('source')) {
+                requireValue(source !== name && (credentialName(source) || absolute(source) && !source.endsWith('/') &&
+                    /^[A-Za-z0-9_.@/+-]+$/.test(source)), option);
+            }
+            return entryKeys.includes('source') ? { name: name, source: source } : { name: name };
+        }, (entry) => entry.name);
+        const plainCredentials = options.loadCredentials === undefined ? [] : credentials(options.loadCredentials, 'loadCredentials');
+        const encryptedCredentials = options.loadCredentialsEncrypted === undefined
+            ? [] : credentials(options.loadCredentialsEncrypted, 'loadCredentialsEncrypted');
+        // Systemd keeps both kinds in one table by name, so a name loads from exactly one of them.
+        requireValue(encryptedCredentials.every((entry) => !plainCredentials.some(({ name }) => name === entry.name)), 'loadCredentialsEncrypted');
+        const credential = ({ name, source }) => source === undefined ? name : `${name}:${source}`;
+        service.push(...plainCredentials.map((entry) => `LoadCredential=${credential(entry)}`));
+        service.push(...encryptedCredentials.map((entry) => `LoadCredentialEncrypted=${credential(entry)}`));
+        const dynamicUser = options.dynamicUser;
+        if (dynamicUser !== undefined) {
+            requireValue(typeof dynamicUser === 'boolean', 'dynamicUser');
+            // A static account of the same name would be used instead, so the name must not be root's,
+            // and systemd allocates only names that fit utmp.
+            requireValue(!dynamicUser || [options.user, options.group].every((name) => name !== 'root' && typeof name === 'string' && name.length <= 31), 'dynamicUser');
+        }
+        // Settings systemd forces on for a dynamic user, so the unit never states a weaker one.
+        const forced = (option, weakened) => requireValue(!(dynamicUser === true && weakened), option);
+        if (options.noNewPrivileges !== undefined) {
+            requireValue(typeof options.noNewPrivileges === 'boolean', 'noNewPrivileges');
+            forced('noNewPrivileges', !options.noNewPrivileges);
+            service.push(`NoNewPrivileges=${yesNo(options.noNewPrivileges)}`);
+        }
+        if (options.protectSystem !== undefined) {
+            requireValue([true, false, 'full', 'strict'].includes(options.protectSystem), 'protectSystem');
+            forced('protectSystem', options.protectSystem !== 'strict');
+            service.push(`ProtectSystem=${typeof options.protectSystem === 'boolean'
+                ? yesNo(options.protectSystem) : options.protectSystem}`);
+        }
+        if (options.protectHome !== undefined) {
+            requireValue([true, false, 'read-only', 'tmpfs'].includes(options.protectHome), 'protectHome');
+            forced('protectHome', options.protectHome === false);
+            service.push(`ProtectHome=${typeof options.protectHome === 'boolean'
+                ? yesNo(options.protectHome) : options.protectHome}`);
+        }
+        for (const [option, directive] of sandboxSwitches) {
+            const value = options[option];
+            if (value === undefined)
+                continue;
+            requireValue(typeof value === 'boolean', option);
+            forced(option, (option === 'privateTmp' || option === 'restrictSUIDSGID') && !value);
+            service.push(`${directive}=${yesNo(value)}`);
+        }
+        const capabilities = (value, option) => list(value, option, systemdCapabilities.length, (entry) => {
+            requireValue(systemdCapabilities.includes(entry), option);
+            return entry;
+        }, (entry) => entry);
+        const bounding = options.capabilityBoundingSet === undefined
+            ? undefined : capabilities(options.capabilityBoundingSet, 'capabilityBoundingSet');
+        const ambient = options.ambientCapabilities === undefined
+            ? undefined : capabilities(options.ambientCapabilities, 'ambientCapabilities');
+        // An ambient capability outside the bounding set would fail every start of the service.
+        requireValue(!bounding || !ambient || ambient.every((entry) => bounding.includes(entry)), 'ambientCapabilities');
+        // An empty CapabilityBoundingSet= empties the bounding set; an empty AmbientCapabilities= grants none.
+        if (bounding)
+            service.push(`CapabilityBoundingSet=${bounding.join(' ')}`);
+        if (ambient)
+            service.push(`AmbientCapabilities=${ambient.join(' ')}`);
+        const families = options.restrictAddressFamilies === undefined ? undefined
+            : list(options.restrictAddressFamilies, 'restrictAddressFamilies', systemdAddressFamilies.length, (entry) => {
+                requireValue(systemdAddressFamilies.includes(entry), 'restrictAddressFamilies');
+                return entry;
+            }, (entry) => entry);
+        // An empty RestrictAddressFamilies= would lift the restriction instead of denying every family.
+        requireValue(!families || families.length > 0, 'restrictAddressFamilies');
+        if (families)
+            service.push(`RestrictAddressFamilies=${families.join(' ')}`);
+        const relations = renderServiceRelations(options, options.unitName, options.restart, scope, fail);
+        // A notify service sends READY=1 over an AF_UNIX socket it creates itself.
+        requireValue(!families || !relations.service.includes('Type=notify') || families.includes('AF_UNIX'), 'restrictAddressFamilies');
         this.unitName = options.unitName;
         this.scope = scope;
         this.content = [
@@ -124,6 +260,7 @@ export class SystemdServiceDefinition {
             '[Service]',
             ...relations.service,
             ...(scope === 'system' ? [`User=${options.user}`, `Group=${options.group}`] : []),
+            ...(dynamicUser !== undefined ? [`DynamicUser=${yesNo(dynamicUser)}`] : []),
             `ExecStart=${[quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')}`,
             // WorkingDirectory is a raw path value, not an ExecStart word list.
             `WorkingDirectory=${options.workingDirectory.replaceAll('%', '%%')}`,
@@ -144,9 +281,9 @@ export class SystemdServiceDefinition {
             ...relations.install,
             '',
         ].join('\n');
-        requireValue(Buffer.byteLength(this.content) <= 16384);
+        requireValue(Buffer.byteLength(this.content) <= 16384, 'options');
         this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
         Object.freeze(this);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kc2VydmljZWRlZmluaXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWRzZXJ2aWNlZGVmaW5pdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSx3QkFBd0IsRUFBRSxXQUFXLEVBQUUsc0JBQXNCLEVBQ3BCLE1BQU0seUJBQXlCLENBQUM7QUF3Q3hHLE1BQU0sT0FBTyw2QkFBOEIsU0FBUSxLQUFLO0lBQ3REO1FBQ0UsS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFFRCw4RkFBOEY7QUFDOUYsTUFBTSxPQUFPLHdCQUF3QjtJQU1uQyxZQUFZLE9BQXlDO1FBQ25ELE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFRLEVBQUU7WUFDNUMsSUFBSSxDQUFDLEtBQUs7Z0JBQUUsTUFBTSxJQUFJLDZCQUE2QixFQUFFLENBQUM7UUFDeEQsQ0FBQyxDQUFDO1FBQ0YsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7WUFDMUQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkQsTUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsZUFBZSxLQUFLLFNBQVM7WUFDeEMsZUFBZSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksZUFBZSxDQUFDLENBQUM7UUFDNUQsTUFBTSxVQUFVLEdBQVksZUFBZSxFQUFFLEtBQUssSUFBSSxRQUFRLENBQUM7UUFDL0QsSUFBSSxVQUFVLEtBQUssUUFBUSxJQUFJLFVBQVUsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUNyRCxNQUFNLElBQUksNkJBQTZCLEVBQUUsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLDRGQUE0RjtRQUM1RixNQUFNLElBQUksR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFPLEdBQUcsSUFBSSxFQUFtQixFQUFFLENBQy9ELE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLE9BQU8sSUFBSSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDN0UsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUNsQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1lBQzdDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQztRQUMxQyxNQUFNLElBQUksR0FBRztZQUNYLFVBQVU7WUFDVixhQUFhO1lBQ2IsWUFBWTtZQUNaLE1BQU07WUFDTixrQkFBa0I7WUFDbEIsU0FBUztZQUNULFVBQVU7WUFDVixvQkFBb0I7WUFDcEIsR0FBRyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDakQsQ0FBQztRQUNGLE1BQU0sWUFBWSxHQUFHLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixFQUFFLFVBQVU7WUFDL0YsYUFBYSxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUM5RCxZQUFZLENBQ1YsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxHQUFHLElBQUksRUFBRSxHQUFHLFlBQVksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDbEcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsRUFBRSxVQUFVLElBQUksT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFFLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUU7WUFDakosTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQztZQUNqRSxPQUFPLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxDQUFDO1FBQzdDLENBQUMsQ0FBQyxDQUNMLENBQUM7UUFDRixZQUFZLENBQ1YsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7WUFDbEMsNkNBQTZDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FDdkUsQ0FBQztRQUNGLFlBQVksQ0FDVixJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQy9ELE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLEtBQUssT0FBTyxDQUFDLFdBQVcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUM1RixDQUFDO1FBQ0YsWUFBWSxDQUNWLFFBQVEsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksT0FBTyxDQUFDLFVBQVUsS0FBSyxHQUFHO1lBQ3hELENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7WUFDdkUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQztZQUNsQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEtBQUssT0FBTyxDQUFDLGdCQUFnQjtZQUM1RCxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQzNDLENBQUM7UUFDRixZQUFZLENBQ1YsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTO1lBQ2pJLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUc7WUFDMUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDaEUsS0FBSyxDQUFDLElBQUksQ0FDUixFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUMvQixDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUMzRTtpQkFDRSxLQUFLLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDMUYsQ0FBQztRQUNGLElBQUksS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3ZCLFlBQVksQ0FDVixDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQzVDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxnQ0FBZ0MsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQzFFLENBQ0YsQ0FBQztRQUNKLENBQUM7UUFDRCxZQUFZLENBQ1YsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1lBQ3RELENBQUMsT0FBTyxFQUFFLGVBQWUsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztZQUNoRSxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztZQUNoRCxPQUFPLENBQUMsa0JBQWtCLElBQUksQ0FBQyxJQUFJLE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSxHQUFHLENBQ3ZFLENBQUM7UUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFlLEVBQUUsT0FBZSxFQUFtQixFQUFFLENBQ3BGLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUssS0FBZ0IsSUFBSSxPQUFPLElBQUssS0FBZ0IsSUFBSSxPQUFPLENBQUM7UUFDOUYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUUsQ0FDN0QsS0FBSyxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsRUFBRSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUNyRSwrRkFBK0Y7UUFDL0YsTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO1FBQzdCLElBQUksT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN6QyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuQyxZQUFZLENBQUMsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxDQUFDO1lBQ3BELE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0QyxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO1lBQ3pDLE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLE9BQU8sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDM0QsT0FBTyxDQUFDLElBQUksQ0FBQyxrQkFBa0IsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELGlGQUFpRjtRQUNqRixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWEsRUFBRSxPQUFPLEdBQUcsS0FBSyxFQUFFLEVBQUUsQ0FDL0MsR0FBRyxHQUFHLEtBQUs7YUFDUixVQUFVLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUM7YUFDckUsVUFBVSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQzlDLEdBQUcsQ0FBQztRQUNOLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0Qyx3RkFBd0Y7WUFDeEYsTUFBTSxTQUFTLEdBQVksT0FBTyxDQUFDLFdBQVcsQ0FBQztZQUMvQyxZQUFZLENBQUMsU0FBUyxLQUFLLElBQUksSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRO2dCQUM5RCxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLFNBQVMsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRyxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQW1CLENBQUMsQ0FBQztZQUNuRCxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO1lBQzlDLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3BFLFlBQVksQ0FBQyxPQUFPLElBQUksS0FBSyxRQUFRLElBQUksZ0NBQWdDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztvQkFDbEYsVUFBVSxFQUFFLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztnQkFDN0UsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFjLEVBQUUsR0FBRyxJQUFjLElBQUksVUFBVyxDQUFDLEtBQWUsRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxDQUFDO1lBQzVGLHVGQUF1RjtZQUN2RixPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRTtpQkFDM0MsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxlQUFlLEtBQUssQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDcEUsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sSUFBSSw2QkFBNkIsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEosSUFBSSxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO1FBQ25CLElBQUksQ0FBQyxPQUFPLEdBQUc7WUFDYixRQUFRO1lBQ1IsZUFBZSxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEVBQUU7WUFDMUQsR0FBRyxTQUFTLENBQUMsSUFBSTtZQUNqQixFQUFFO1lBQ0YsV0FBVztZQUNYLEdBQUcsU0FBUyxDQUFDLE9BQU87WUFDcEIsR0FBRyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQUUsU0FBUyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pGLGFBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQzFGLEVBQUU7WUFDRixvRUFBb0U7WUFDcEUsb0JBQW9CLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQ3BFLFdBQVcsT0FBTyxDQUFDLE9BQU8sRUFBRTtZQUM1QixHQUFHLENBQUMsT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsY0FBYyxPQUFPLENBQUMsY0FBYyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzFGLFlBQVksT0FBTyxDQUFDLFFBQVEsRUFBRTtZQUM5QixvQkFBb0I7WUFDcEIseUJBQXlCO1lBQ3pCLGlCQUFpQjtZQUNqQixlQUFlO1lBQ2Ysa0JBQWtCLE9BQU8sQ0FBQyxrQkFBa0IsR0FBRztZQUMvQyxHQUFHLE9BQU87WUFDVixvQkFBb0I7WUFDcEIsd0JBQXdCO1lBQ3hCLHVCQUF1QjtZQUN2QixFQUFFO1lBQ0YsV0FBVztZQUNYLEdBQUcsU0FBUyxDQUFDLE9BQU87WUFDcEIsRUFBRTtTQUNILENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2IsWUFBWSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckYsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kc2VydmljZWRlZmluaXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWRzZXJ2aWNlZGVmaW5pdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSx3QkFBd0IsRUFBRSxXQUFXLEVBQUUsc0JBQXNCLEVBQUUsc0JBQXNCLEVBQ2xILG1CQUFtQixFQUNrRSxNQUFNLHlCQUF5QixDQUFDO0FBSXZILE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBMkZ0RixNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUd0RCxZQUFZLE1BQXVDO1FBQ2pELEtBQUssQ0FBQyw4Q0FBOEMsTUFBTSxHQUFHLENBQUMsQ0FBQztRQUMvRCxJQUFJLENBQUMsSUFBSSxHQUFHLCtCQUErQixDQUFDO1FBQzVDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO0lBQ3ZCLENBQUM7Q0FDRjtBQUVELDZFQUE2RTtBQUM3RSxNQUFNLGVBQWUsR0FBRztJQUN0QixDQUFDLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDNUIsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQztJQUNwQyxDQUFDLHVCQUF1QixFQUFFLHVCQUF1QixDQUFDO0lBQ2xELENBQUMsc0JBQXNCLEVBQUUsc0JBQXNCLENBQUM7SUFDaEQsQ0FBQyxtQkFBbUIsRUFBRSxtQkFBbUIsQ0FBQztJQUMxQyxDQUFDLHNCQUFzQixFQUFFLHNCQUFzQixDQUFDO0lBQ2hELENBQUMsY0FBYyxFQUFFLGNBQWMsQ0FBQztJQUNoQyxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixDQUFDO0lBQ3RDLENBQUMsb0JBQW9CLEVBQUUsb0JBQW9CLENBQUM7SUFDNUMsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBQztJQUN4QyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDO0lBQ3hDLENBQUMsaUJBQWlCLEVBQUUsaUJBQWlCLENBQUM7Q0FDOUIsQ0FBQztBQUVYLGdHQUFnRztBQUNoRyxNQUFNLGlCQUFpQixHQUFHLENBQUMsYUFBYSxFQUFFLGlCQUFpQixFQUFFLDBCQUEwQixFQUFFLGlCQUFpQjtJQUN4RyxlQUFlLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLHVCQUF1QjtJQUNyRyxxQkFBcUIsRUFBRSx5QkFBeUIsQ0FBVSxDQUFDO0FBRTdELDhGQUE4RjtBQUM5RixNQUFNLE9BQU8sd0JBQXdCO0lBTW5DLFlBQVksT0FBeUM7UUFDbkQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxNQUF1QyxFQUFTLEVBQUU7WUFDOUQsTUFBTSxJQUFJLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2xELENBQUMsQ0FBQztRQUNGLE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFFLE1BQXVDLEVBQVEsRUFBRTtZQUNyRixJQUFJLENBQUMsS0FBSztnQkFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDM0IsQ0FBQyxDQUFDO1FBQ0YsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7WUFDMUQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUUsWUFBWSxDQUFDLGVBQWUsS0FBSyxTQUFTO1lBQ3hDLGVBQWUsQ0FBQyxVQUFVLElBQUksT0FBTyxJQUFJLGVBQWUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNyRSxNQUFNLFVBQVUsR0FBWSxlQUFlLEVBQUUsS0FBSyxJQUFJLFFBQVEsQ0FBQztRQUMvRCxJQUFJLFVBQVUsS0FBSyxRQUFRLElBQUksVUFBVSxLQUFLLE1BQU07WUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDcEUsTUFBTSxLQUFLLEdBQUcsVUFBK0IsQ0FBQztRQUM5Qyw0RkFBNEY7UUFDNUYsTUFBTSxJQUFJLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBTyxHQUFHLElBQUksRUFBbUIsRUFBRSxDQUMvRCxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPLElBQUksV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzdFLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQ25ELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFDN0MsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssS0FBSyxDQUFDO1FBQzFDLE1BQU0sSUFBSSxHQUFzQztZQUM5QyxVQUFVO1lBQ1YsYUFBYTtZQUNiLFlBQVk7WUFDWixNQUFNO1lBQ04sa0JBQWtCO1lBQ2xCLFNBQVM7WUFDVCxVQUFVO1lBQ1Ysb0JBQW9CO1lBQ3BCLEdBQUcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzFELENBQUM7UUFDRixNQUFNLFlBQVksR0FBc0MsQ0FBQyxPQUFPLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxTQUFTO1lBQ3BHLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixFQUFFLGFBQWE7WUFDeEYsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3hCLG9HQUFvRztRQUNwRyxLQUFLLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxZQUFZLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFZLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUN2SCxNQUFNLE1BQU0sR0FBRyxHQUFzQyxDQUFDO1lBQ3RELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDakUsWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM3RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUk7WUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN6RixZQUFZLENBQ1YsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7WUFDbEMsNkNBQTZDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFDdEUsVUFBVSxDQUNYLENBQUM7UUFDRixZQUFZLENBQ1YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUMvRCxPQUFPLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxLQUFLLE9BQU8sQ0FBQyxXQUFXLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFDM0YsYUFBYSxDQUNkLENBQUM7UUFDRixZQUFZLENBQ1YsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLEdBQUc7WUFDeEQsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUN6RSxZQUFZLENBQ2IsQ0FBQztRQUNGLFlBQVksQ0FDVixRQUFRLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDO1lBQ2hDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsS0FBSyxPQUFPLENBQUMsZ0JBQWdCO1lBQzVELENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFDMUMsa0JBQWtCLENBQ25CLENBQUM7UUFDRixZQUFZLENBQ1YsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTO1lBQ2pJLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUc7WUFDMUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDaEUsS0FBSyxDQUFDLElBQUksQ0FDUixFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUMvQixDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUMzRTtpQkFDRSxLQUFLLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFDekYsTUFBTSxDQUNQLENBQUM7UUFDRixJQUFJLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN2QixLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBVSxFQUFFLENBQUM7Z0JBQzdDLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxRQUFRLElBQUksZ0NBQWdDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQzdHLENBQUM7UUFDSCxDQUFDO1FBQ0QsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2xGLFlBQVksQ0FBQyxDQUFDLE9BQU8sRUFBRSxlQUFlLEVBQUUsU0FBUyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMzRixZQUFZLENBQ1YsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUM7WUFDOUMsT0FBTyxDQUFDLGtCQUFrQixJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsa0JBQWtCLElBQUksR0FBRyxFQUN0RSxvQkFBb0IsQ0FDckIsQ0FBQztRQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxPQUFlLEVBQW1CLEVBQUUsQ0FDcEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSyxLQUFnQixJQUFJLE9BQU8sSUFBSyxLQUFnQixJQUFJLE9BQU8sQ0FBQztRQUM5RixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWMsRUFBZ0MsRUFBRSxDQUM3RCxLQUFLLEtBQUssVUFBVSxJQUFJLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sS0FBSyxHQUFHLENBQUMsS0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3ZELCtGQUErRjtRQUMvRixNQUFNLE9BQU8sR0FBYSxFQUFFLENBQUM7UUFDN0IsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUN0RyxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ2hFLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1lBQ3hELE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ2xELE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUMvQyxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzdFLE9BQU8sQ0FBQyxJQUFJLENBQUMsa0JBQWtCLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxpRkFBaUY7UUFDakYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFhLEVBQUUsT0FBTyxHQUFHLEtBQUssRUFBRSxFQUFFLENBQy9DLEdBQUcsR0FBRyxLQUFLO2FBQ1IsVUFBVSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDO2FBQ3JFLFVBQVUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztZQUM5QyxHQUFHLENBQUM7UUFDTixNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBRSxNQUF1QyxFQUFFLEVBQUUsQ0FDOUUsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUM1RixNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDL0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLHdGQUF3RjtZQUN4RixNQUFNLFNBQVMsR0FBWSxPQUFPLENBQUMsV0FBVyxDQUFDO1lBQy9DLFdBQVcsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDdEMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFtQixDQUFDLENBQUM7WUFDbkQsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksd0JBQXdCLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDdEUsTUFBTSxXQUFXLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7WUFDOUMsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztnQkFDekIsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFDcEUsWUFBWSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxnQ0FBZ0MsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO29CQUNsRixVQUFVLEVBQUUsVUFBVSxJQUFJLE9BQU8sSUFBSSxVQUFVLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztnQkFDNUYsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFjLEVBQUUsR0FBRyxJQUFjLElBQUksVUFBVyxDQUFDLEtBQWUsRUFBRSxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxvQkFBb0IsRUFBRSxhQUFhLENBQUMsQ0FBQztZQUMzRyx1RkFBdUY7WUFDdkYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxXQUFXLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUU7aUJBQzNDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsZUFBZSxLQUFLLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCwyRUFBMkU7UUFDM0UsS0FBSyxNQUFNLE1BQU0sSUFBSSxpQkFBaUIsRUFBRSxDQUFDO1lBQ3ZDLFlBQVksQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELHFGQUFxRjtRQUNyRixNQUFNLElBQUksR0FBRyxDQUFJLEtBQWMsRUFBRSxNQUF1QyxFQUFFLE9BQWUsRUFDdkYsSUFBMkIsRUFBRSxRQUE4QixFQUFPLEVBQUU7WUFDcEUsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO2dCQUNyRSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPO2dCQUMzRSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM5RCxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxFQUFHLEtBQW1CLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUU7Z0JBQzlFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQ3pFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE9BQU8sSUFBSSxVQUFVLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLE9BQU8sSUFBSSxDQUFDLFVBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNqQyxDQUFDLENBQUMsQ0FBQztZQUNILE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDeEMsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3JFLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqRixDQUFDLENBQUM7UUFDRiw4RkFBOEY7UUFDOUYsbUZBQW1GO1FBQ25GLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQ3pELE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQUUsTUFBc0QsRUFBRSxFQUFFLENBQzdGLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBNkIsRUFBRTtZQUMzRCxXQUFXLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzNCLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBZSxDQUFDLENBQUM7WUFDbkQsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLEtBQUssTUFBTSxJQUFJLEdBQUcsS0FBSyxRQUFRLENBQUM7Z0JBQ3RHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLEVBQUUsVUFBVTtnQkFDdkQsT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFFLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNwRSxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLEtBQTJDLENBQUM7WUFDckUsWUFBWSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUMzQyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDakMsWUFBWSxDQUFDLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7b0JBQ2xHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQWMsRUFBRSxNQUFNLEVBQUUsTUFBZ0IsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFjLEVBQUUsQ0FBQztRQUN0SCxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1QixNQUFNLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxlQUFlLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsZUFBZSxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDOUgsTUFBTSxvQkFBb0IsR0FBRyxPQUFPLENBQUMsd0JBQXdCLEtBQUssU0FBUztZQUN6RSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLHdCQUF3QixFQUFFLDBCQUEwQixDQUFDLENBQUM7UUFDbkYsMkZBQTJGO1FBQzNGLFlBQVksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUMzRywwQkFBMEIsQ0FBQyxDQUFDO1FBQzlCLE1BQU0sVUFBVSxHQUFHLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUE2QixFQUFFLEVBQUUsQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ3RILE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDeEYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsMkJBQTJCLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNyRyxNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3hDLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlCLFlBQVksQ0FBQyxPQUFPLFdBQVcsS0FBSyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDOUQsMkZBQTJGO1lBQzNGLGtEQUFrRDtZQUNsRCxZQUFZLENBQUMsQ0FBQyxXQUFXLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUN4RSxJQUFJLEtBQUssTUFBTSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQ3RGLENBQUM7UUFDRCx3RkFBd0Y7UUFDeEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUF1QyxFQUFFLFFBQWlCLEVBQUUsRUFBRSxDQUM1RSxZQUFZLENBQUMsQ0FBQyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksUUFBUSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUQsSUFBSSxPQUFPLENBQUMsZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzFDLFlBQVksQ0FBQyxPQUFPLE9BQU8sQ0FBQyxlQUFlLEtBQUssU0FBUyxFQUFFLGlCQUFpQixDQUFDLENBQUM7WUFDOUUsTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQ3BELE9BQU8sQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEMsWUFBWSxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztZQUMvRixNQUFNLENBQUMsZUFBZSxFQUFFLE9BQU8sQ0FBQyxhQUFhLEtBQUssUUFBUSxDQUFDLENBQUM7WUFDNUQsT0FBTyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsT0FBTyxPQUFPLENBQUMsYUFBYSxLQUFLLFNBQVM7Z0JBQ3RFLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLFlBQVksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDL0YsTUFBTSxDQUFDLGFBQWEsRUFBRSxPQUFPLENBQUMsV0FBVyxLQUFLLEtBQUssQ0FBQyxDQUFDO1lBQ3JELE9BQU8sQ0FBQyxJQUFJLENBQUMsZUFBZSxPQUFPLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUztnQkFDbEUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLElBQUksZUFBZSxFQUFFLENBQUM7WUFDbEQsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzlCLElBQUksS0FBSyxLQUFLLFNBQVM7Z0JBQUUsU0FBUztZQUNsQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2pELE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxNQUFNLEtBQUssWUFBWSxJQUFJLE1BQU0sS0FBSyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDckYsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLFNBQVMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxDQUFDLEtBQWMsRUFBRSxNQUF1RCxFQUFFLEVBQUUsQ0FDL0YsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsbUJBQW1CLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDeEQsWUFBWSxDQUFFLG1CQUEwQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNsRixPQUFPLEtBQTJCLENBQUM7UUFDckMsQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMscUJBQXFCLEtBQUssU0FBUztZQUMxRCxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLHFCQUFxQixFQUFFLHVCQUF1QixDQUFDLENBQUM7UUFDckYsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLG1CQUFtQixLQUFLLFNBQVM7WUFDdkQsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2pGLHdGQUF3RjtRQUN4RixZQUFZLENBQUMsQ0FBQyxRQUFRLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFDakgsdUdBQXVHO1FBQ3ZHLElBQUksUUFBUTtZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMseUJBQXlCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLElBQUksT0FBTztZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyx1QkFBdUIsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDeEUsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsdUJBQXVCLEVBQUUseUJBQXlCLEVBQUUsc0JBQXNCLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7Z0JBQzFHLFlBQVksQ0FBRSxzQkFBNkMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUseUJBQXlCLENBQUMsQ0FBQztnQkFDeEcsT0FBTyxLQUE4QixDQUFDO1lBQ3hDLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsZ0dBQWdHO1FBQ2hHLFlBQVksQ0FBQyxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSx5QkFBeUIsQ0FBQyxDQUFDO1FBQzFFLElBQUksUUFBUTtZQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsMkJBQTJCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzVFLE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ2xHLDJFQUEyRTtRQUMzRSxZQUFZLENBQUMsQ0FBQyxRQUFRLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUNsRyx5QkFBeUIsQ0FBQyxDQUFDO1FBQzdCLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUNqQyxJQUFJLENBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNuQixJQUFJLENBQUMsT0FBTyxHQUFHO1lBQ2IsUUFBUTtZQUNSLGVBQWUsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQzFELEdBQUcsU0FBUyxDQUFDLElBQUk7WUFDakIsRUFBRTtZQUNGLFdBQVc7WUFDWCxHQUFHLFNBQVMsQ0FBQyxPQUFPO1lBQ3BCLEdBQUcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLFNBQVMsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNqRixHQUFHLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxlQUFlLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxhQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUMxRixFQUFFO1lBQ0Ysb0VBQW9FO1lBQ3BFLG9CQUFvQixPQUFPLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsRUFBRTtZQUNwRSxXQUFXLE9BQU8sQ0FBQyxPQUFPLEVBQUU7WUFDNUIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLGNBQWMsT0FBTyxDQUFDLGNBQWMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMxRixZQUFZLE9BQU8sQ0FBQyxRQUFRLEVBQUU7WUFDOUIsb0JBQW9CO1lBQ3BCLHlCQUF5QjtZQUN6QixpQkFBaUI7WUFDakIsZUFBZTtZQUNmLGtCQUFrQixPQUFPLENBQUMsa0JBQWtCLEdBQUc7WUFDL0MsR0FBRyxPQUFPO1lBQ1Ysb0JBQW9CO1lBQ3BCLHdCQUF3QjtZQUN4Qix1QkFBdUI7WUFDdkIsRUFBRTtZQUNGLFdBQVc7WUFDWCxHQUFHLFNBQVMsQ0FBQyxPQUFPO1lBQ3BCLEVBQUU7U0FDSCxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNiLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDbEUsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3RCLENBQUM7Q0FDRiJ9

package/dist_ts/systemd.definition.d.ts

@@ -27,6 +27,29 @@ export interface ISystemdServiceInstallTargets {
     wantedBy: readonly string[];
     requiredBy: readonly string[];
 }
+/**
+ * One credential a system service reads from `$CREDENTIALS_DIRECTORY/<name>` (`LoadCredential=` or
+ * `LoadCredentialEncrypted=`). The value never appears in the unit, its environment or
+ * `systemctl show`; it is readable by the service's user only.
+ */
+export interface ISystemdServiceCredential {
+    /** The credential's name inside the service: printable ASCII from `[A-Za-z0-9_.@-]`, 1–255 characters, not starting with `.`. */
+    name: string;
+    /**
+     * Where systemd reads it: an absolute normalized path (a file, a directory of files or an
+     * `AF_UNIX` socket), or a credential name that systemd searches among its own credentials and
+     * in the credstore directories (`/etc/credstore/`, `/run/credstore/`, `/usr/lib/credstore/`, and
+     * for encrypted credentials also their `.encrypted` counterparts). Omitted, systemd searches
+     * under `name` itself.
+     */
+    source?: string;
+}
+/** Linux capabilities systemd 255 knows by name, for `capabilityBoundingSet` and `ambientCapabilities`. */
+export declare const systemdCapabilities: readonly ["CAP_AUDIT_CONTROL", "CAP_AUDIT_READ", "CAP_AUDIT_WRITE", "CAP_BLOCK_SUSPEND", "CAP_BPF", "CAP_CHECKPOINT_RESTORE", "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_FOWNER", "CAP_FSETID", "CAP_IPC_LOCK", "CAP_IPC_OWNER", "CAP_KILL", "CAP_LEASE", "CAP_LINUX_IMMUTABLE", "CAP_MAC_ADMIN", "CAP_MAC_OVERRIDE", "CAP_MKNOD", "CAP_NET_ADMIN", "CAP_NET_BIND_SERVICE", "CAP_NET_BROADCAST", "CAP_NET_RAW", "CAP_PERFMON", "CAP_SETFCAP", "CAP_SETGID", "CAP_SETPCAP", "CAP_SETUID", "CAP_SYSLOG", "CAP_SYS_ADMIN", "CAP_SYS_BOOT", "CAP_SYS_CHROOT", "CAP_SYS_MODULE", "CAP_SYS_NICE", "CAP_SYS_PACCT", "CAP_SYS_PTRACE", "CAP_SYS_RAWIO", "CAP_SYS_RESOURCE", "CAP_SYS_TIME", "CAP_SYS_TTY_CONFIG", "CAP_WAKE_ALARM"];
+export type TSystemdCapability = typeof systemdCapabilities[number];
+/** Socket address families a definition may allow with `restrictAddressFamilies`. */
+export declare const systemdAddressFamilies: readonly ["AF_INET", "AF_INET6", "AF_NETLINK", "AF_PACKET", "AF_UNIX", "AF_VSOCK"];
+export type TSystemdAddressFamily = typeof systemdAddressFamilies[number];
 /**
  * Internal bounds of a definition's `environment`: variables, and UTF-8 bytes of `NAME=value` in
  * total. SystemdUnit sizes its systemctl output limit from them, so every accepted definition reads back.
@@ -46,7 +69,7 @@ export declare const renderServiceRelations: (options: {
     startup?: TSystemdServiceStartup;
     dependencies?: ISystemdServiceDependencies;
     install?: ISystemdServiceInstallTargets;
-}, unitName: string, restart: string, scope: "system" | "user", fail: () => never) => {
+}, unitName: string, restart: string, scope: "system" | "user", fail: (option: "startup" | "dependencies" | "install") => never) => {
     unit: string[];
     service: string[];
     install: string[];

package/dist_ts/systemd.definition.js

@@ -1,4 +1,17 @@
 import * as plugins from './smartdaemon.plugins.js';
+/** Linux capabilities systemd 255 knows by name, for `capabilityBoundingSet` and `ambientCapabilities`. */
+export const systemdCapabilities = [
+    'CAP_AUDIT_CONTROL', 'CAP_AUDIT_READ', 'CAP_AUDIT_WRITE', 'CAP_BLOCK_SUSPEND', 'CAP_BPF',
+    'CAP_CHECKPOINT_RESTORE', 'CAP_CHOWN', 'CAP_DAC_OVERRIDE', 'CAP_DAC_READ_SEARCH', 'CAP_FOWNER',
+    'CAP_FSETID', 'CAP_IPC_LOCK', 'CAP_IPC_OWNER', 'CAP_KILL', 'CAP_LEASE', 'CAP_LINUX_IMMUTABLE',
+    'CAP_MAC_ADMIN', 'CAP_MAC_OVERRIDE', 'CAP_MKNOD', 'CAP_NET_ADMIN', 'CAP_NET_BIND_SERVICE',
+    'CAP_NET_BROADCAST', 'CAP_NET_RAW', 'CAP_PERFMON', 'CAP_SETFCAP', 'CAP_SETGID', 'CAP_SETPCAP',
+    'CAP_SETUID', 'CAP_SYSLOG', 'CAP_SYS_ADMIN', 'CAP_SYS_BOOT', 'CAP_SYS_CHROOT', 'CAP_SYS_MODULE',
+    'CAP_SYS_NICE', 'CAP_SYS_PACCT', 'CAP_SYS_PTRACE', 'CAP_SYS_RAWIO', 'CAP_SYS_RESOURCE',
+    'CAP_SYS_TIME', 'CAP_SYS_TTY_CONFIG', 'CAP_WAKE_ALARM',
+];
+/** Socket address families a definition may allow with `restrictAddressFamilies`. */
+export const systemdAddressFamilies = ['AF_INET', 'AF_INET6', 'AF_NETLINK', 'AF_PACKET', 'AF_UNIX', 'AF_VSOCK'];
 /**
  * Internal bounds of a definition's `environment`: variables, and UTF-8 bytes of `NAME=value` in
  * total. SystemdUnit sizes its systemctl output limit from them, so every accepted definition reads back.
@@ -19,8 +32,10 @@ export const isCleanText = (value) => [...value].every((character) => {
 });
 /** Internal validated renderer; no systemd/process/filesystem effects. */
 export const renderServiceRelations = (options, unitName, restart, scope, fail) => {
+    // Every check names the option it belongs to; `option` is set before each option is read.
+    let option = 'startup';
     const requireValue = (value) => { if (!value)
-        fail(); };
+        fail(option); };
     const plain = (value) => requireValue(value !== null && typeof value === 'object'
         && !plugins.util.types.isProxy(value) && Object.getPrototypeOf(value) === Object.prototype);
     const record = (value, keys) => {
@@ -69,6 +84,7 @@ export const renderServiceRelations = (options, unitName, restart, scope, fail)
         }
     }
     if (options.dependencies !== undefined) {
+        option = 'dependencies';
         const value = options.dependencies;
         record(value, ['defaultDependencies', 'after', 'before', 'requires', 'wants', 'conflicts']);
         requireValue(typeof value.defaultDependencies === 'boolean');
@@ -79,6 +95,7 @@ export const renderServiceRelations = (options, unitName, restart, scope, fail)
             ...line('Before', before), ...line('Requires', requires), ...line('Wants', wants), ...line('Conflicts', conflicts)];
     }
     if (options.install !== undefined) {
+        option = 'install';
         const value = options.install;
         record(value, ['wantedBy', 'requiredBy']);
         const wanted = units(value.wantedBy), required = units(value.requiredBy);
@@ -87,4 +104,4 @@ export const renderServiceRelations = (options, unitName, restart, scope, fail)
     }
     return result;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3lzdGVtZC5kZWZpbml0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvc3lzdGVtZC5kZWZpbml0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sMEJBQTBCLENBQUM7QUFvQ3BEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLEVBQUUsQ0FBQztBQUMzQyxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUM7QUFFekM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUU7SUFDM0UsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUUsQ0FBQztJQUN4QyxPQUFPLEtBQUssR0FBRyxJQUFJLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssR0FBRyxNQUFNLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQztRQUN6RSxDQUFDLEtBQUssR0FBRyxNQUFNLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLE1BQU0sQ0FBQztBQUN0RSxDQUFDLENBQUMsQ0FBQztBQUVILDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLE9BSXRDLEVBQUUsUUFBZ0IsRUFBRSxPQUFlLEVBQUUsS0FBd0IsRUFBRSxJQUFpQixFQUUvRSxFQUFFO0lBQ0YsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFjLEVBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyxLQUFLO1FBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDdkUsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFjLEVBQVEsRUFBRSxDQUFDLFlBQVksQ0FBQyxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7V0FDM0YsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBdUIsRUFBUSxFQUFFO1FBQy9ELEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNiLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBZSxDQUFDLENBQUM7UUFDaEQsWUFBWSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2VBQzFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLEVBQUUsVUFBVSxJQUFJLE9BQU8sSUFBSSxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBRSxDQUFDLENBQUMsQ0FBQztJQUM1SCxDQUFDLENBQUM7SUFDRixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQXdCLEVBQVksRUFBRTtRQUNuRCxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7ZUFDbEUsTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksRUFBRTtlQUN0RSxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3pELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztRQUM1QixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ2xELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDekUsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksT0FBTyxJQUFJLFVBQVUsQ0FBQyxDQUFDO1lBQzlELE1BQU0sSUFBSSxHQUFHLFVBQVcsQ0FBQyxLQUFLLENBQUM7WUFDL0IsWUFBWSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxNQUFNLElBQUksR0FBRzttQkFDM0UsZ0hBQWdILENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7WUFDbEksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwQixDQUFDO1FBQ0QsWUFBWSxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDckQsT0FBTyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdkIsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFXLEVBQUUsS0FBd0IsRUFBWSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3BILE1BQU0sTUFBTSxHQUFHO1FBQ2IsSUFBSSxFQUFFLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsdUJBQXVCLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBYztRQUNyRSxPQUFPLEVBQUUsQ0FBQyxXQUFXLENBQUM7UUFDdEIsT0FBTyxFQUFFLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsNEJBQTRCLENBQUMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDO0tBQ3pGLENBQUM7SUFDRixJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDbEMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQztRQUM5QixLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDYiw0RkFBNEY7UUFDNUYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM1RCxNQUFNLENBQUMsS0FBSyxFQUFFLElBQUksS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLElBQUksSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFFBQVE7WUFDNUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7UUFDMUcsWUFBWSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDLElBQUksS0FBSyxDQUFDLG1CQUFtQixJQUFJLENBQUMsSUFBSSxLQUFLLENBQUMsbUJBQW1CLElBQUksR0FBRyxDQUFDLENBQUM7UUFDcEksSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzVCLFlBQVksQ0FBQyxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1lBQ25FLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxhQUFhLEVBQUUsZ0JBQWdCLEtBQUssQ0FBQyxZQUFZLEVBQUUsRUFBRSxtQkFBbUIsS0FBSyxDQUFDLG1CQUFtQixHQUFHLENBQUMsQ0FBQztRQUMxSCxDQUFDO2FBQU0sQ0FBQztZQUNOLFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssQ0FBQyxlQUFlLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQztZQUM3RyxNQUFNLENBQUMsT0FBTyxHQUFHLENBQUMsY0FBYyxFQUFFLG1CQUFtQixLQUFLLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLG1CQUFtQixLQUFLLENBQUMsbUJBQW1CLEdBQUcsQ0FBQyxDQUFDO1FBQ2hKLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUM7UUFDbkMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLHFCQUFxQixFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO1FBQzVGLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxtQkFBbUIsS0FBSyxTQUFTLENBQUMsQ0FBQztRQUM3RCxNQUFNLEtBQUssR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDL0csTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxRQUFRLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxTQUFTLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNySSxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4SSxNQUFNLENBQUMsSUFBSSxHQUFHLENBQUMsdUJBQXVCLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxHQUFHLElBQUksQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDO1lBQ3ZHLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxFQUFFLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3hILENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDbEMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQztRQUM5QixNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDMUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN6RSxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNwRyxNQUFNLENBQUMsT0FBTyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3lzdGVtZC5kZWZpbml0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvc3lzdGVtZC5kZWZpbml0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sMEJBQTBCLENBQUM7QUFzRHBELDJHQUEyRztBQUMzRyxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRztJQUNqQyxtQkFBbUIsRUFBRSxnQkFBZ0IsRUFBRSxpQkFBaUIsRUFBRSxtQkFBbUIsRUFBRSxTQUFTO0lBQ3hGLHdCQUF3QixFQUFFLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxxQkFBcUIsRUFBRSxZQUFZO0lBQzlGLFlBQVksRUFBRSxjQUFjLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUscUJBQXFCO0lBQzdGLGVBQWUsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLHNCQUFzQjtJQUN6RixtQkFBbUIsRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxZQUFZLEVBQUUsYUFBYTtJQUM3RixZQUFZLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsZ0JBQWdCO0lBQy9GLGNBQWMsRUFBRSxlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGtCQUFrQjtJQUN0RixjQUFjLEVBQUUsb0JBQW9CLEVBQUUsZ0JBQWdCO0NBQzlDLENBQUM7QUFHWCxxRkFBcUY7QUFDckYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBVSxDQUFDO0FBR3pIOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLEVBQUUsQ0FBQztBQUMzQyxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUM7QUFFekM7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUU7SUFDM0UsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUUsQ0FBQztJQUN4QyxPQUFPLEtBQUssR0FBRyxJQUFJLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssR0FBRyxNQUFNLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQztRQUN6RSxDQUFDLEtBQUssR0FBRyxNQUFNLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLE1BQU0sQ0FBQztBQUN0RSxDQUFDLENBQUMsQ0FBQztBQUVILDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLE9BSXRDLEVBQUUsUUFBZ0IsRUFBRSxPQUFlLEVBQUUsS0FBd0IsRUFDOUQsSUFBK0QsRUFFN0QsRUFBRTtJQUNGLDBGQUEwRjtJQUMxRixJQUFJLE1BQU0sR0FBMkMsU0FBUyxDQUFDO0lBQy9ELE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFRLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSztRQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM3RSxNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWMsRUFBUSxFQUFFLENBQUMsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtXQUMzRixDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM5RixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxJQUF1QixFQUFRLEVBQUU7UUFDL0QsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2IsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFlLENBQUMsQ0FBQztRQUNoRCxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDMUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsRUFBRSxVQUFVLElBQUksT0FBTyxJQUFJLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVILENBQUMsQ0FBQztJQUNGLE1BQU0sS0FBSyxHQUFHLENBQUMsS0FBd0IsRUFBWSxFQUFFO1FBQ25ELFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztlQUNsRSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFO2VBQ3RFLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDekQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDbEQsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUN6RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxPQUFPLElBQUksVUFBVSxDQUFDLENBQUM7WUFDOUQsTUFBTSxJQUFJLEdBQUcsVUFBVyxDQUFDLEtBQUssQ0FBQztZQUMvQixZQUFZLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHO21CQUMzRSxnSEFBZ0gsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztZQUNsSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3BCLENBQUM7UUFDRCxZQUFZLENBQUMsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNyRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN2QixDQUFDLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxDQUFDLEdBQVcsRUFBRSxLQUF3QixFQUFZLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDcEgsTUFBTSxNQUFNLEdBQUc7UUFDYixJQUFJLEVBQUUsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFjO1FBQ3JFLE9BQU8sRUFBRSxDQUFDLFdBQVcsQ0FBQztRQUN0QixPQUFPLEVBQUUsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDLENBQUMseUJBQXlCLENBQUM7S0FDekYsQ0FBQztJQUNGLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNsQyxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQzlCLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNiLDRGQUE0RjtRQUM1RixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzVELE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxLQUFLLFNBQVMsSUFBSSxPQUFPLElBQUksSUFBSSxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUM1RSxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsY0FBYyxFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLGlCQUFpQixFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQztRQUMxRyxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsSUFBSSxLQUFLLENBQUMsbUJBQW1CLElBQUksQ0FBQyxJQUFJLEtBQUssQ0FBQyxtQkFBbUIsSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNwSSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDNUIsWUFBWSxDQUFDLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7WUFDbkUsTUFBTSxDQUFDLE9BQU8sR0FBRyxDQUFDLGFBQWEsRUFBRSxnQkFBZ0IsS0FBSyxDQUFDLFlBQVksRUFBRSxFQUFFLG1CQUFtQixLQUFLLENBQUMsbUJBQW1CLEdBQUcsQ0FBQyxDQUFDO1FBQzFILENBQUM7YUFBTSxDQUFDO1lBQ04sWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxDQUFDLGVBQWUsS0FBSyxTQUFTLElBQUksT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDO1lBQzdHLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FBQyxjQUFjLEVBQUUsbUJBQW1CLEtBQUssQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsbUJBQW1CLEtBQUssQ0FBQyxtQkFBbUIsR0FBRyxDQUFDLENBQUM7UUFDaEosQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdkMsTUFBTSxHQUFHLGNBQWMsQ0FBQztRQUN4QixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDO1FBQ25DLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxxQkFBcUIsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUM1RixZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsbUJBQW1CLEtBQUssU0FBUyxDQUFDLENBQUM7UUFDN0QsTUFBTSxLQUFLLEdBQUcsQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQy9HLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsUUFBUSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUUsS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsU0FBUyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDckksWUFBWSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEksTUFBTSxDQUFDLElBQUksR0FBRyxDQUFDLHVCQUF1QixLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQztZQUN2RyxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsRUFBRSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUN4SCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUMsT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sR0FBRyxTQUFTLENBQUM7UUFDbkIsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQztRQUM5QixNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDMUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN6RSxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNwRyxNQUFNLENBQUMsT0FBTyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdaemon",
-  "version": "2.12.0",
+  "version": "2.13.0",
   "private": false,
   "description": "Start scripts as long running daemons and manage them.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -464,6 +464,93 @@ and `%` doubled, so systemd applies no specifier; `Environment=` never expands `
 taken literally. An empty object renders nothing. Systemd merges these variables over its own
 (`HOME`, `USER`, `INVOCATION_ID`, …), so a name such as `NOTIFY_SOCKET` overrides the manager's value.
 
+#### Credentials, a dynamic user and the sandbox
+
+A system service can receive secrets as systemd credentials instead of variables, run as a
+transient account and be confined. Each option below renders nothing when omitted, so existing
+definitions keep their exact bytes; `false` renders the directive as `no`. A user service refuses
+all of them, since a user manager cannot grant them. `DynamicUser=` follows `Group=`; the others
+follow the `environment` lines in this order:
+
+| Option | Directive | Accepted values |
+| --- | --- | --- |
+| `dynamicUser` | `DynamicUser=` | boolean; with `true`, `user` and `group` name the allocated account |
+| `loadCredentials` | one `LoadCredential=` line per credential, ordered by name | array of `{ name, source? }` |
+| `loadCredentialsEncrypted` | one `LoadCredentialEncrypted=` line per credential, ordered by name | array of `{ name, source? }` |
+| `noNewPrivileges` | `NoNewPrivileges=` | boolean |
+| `protectSystem` | `ProtectSystem=` | boolean, `'full'` or `'strict'` |
+| `protectHome` | `ProtectHome=` | boolean, `'read-only'` or `'tmpfs'` |
+| `privateTmp`, `privateDevices`, `protectKernelTunables`, `protectKernelModules`, `protectKernelLogs`, `protectControlGroups`, `protectClock`, `protectHostname`, `restrictNamespaces`, `restrictRealtime`, `restrictSUIDSGID`, `lockPersonality` | the directive of the same name, in this order | boolean |
+| `capabilityBoundingSet` | `CapabilityBoundingSet=` | distinct capabilities from `systemdCapabilities`, sorted; empty drops every capability |
+| `ambientCapabilities` | `AmbientCapabilities=` | distinct capabilities, sorted; within `capabilityBoundingSet` when both are given |
+| `restrictAddressFamilies` | `RestrictAddressFamilies=` | at least one distinct family of `AF_INET`, `AF_INET6`, `AF_NETLINK`, `AF_PACKET`, `AF_UNIX`, `AF_VSOCK`, sorted; includes `AF_UNIX` for a notify service |
+
+```typescript
+const relay = new SystemdServiceDefinition({
+  unitName: 'relay.service',
+  description: 'Cluster relay',
+  executable: '/opt/relay/current/relay',
+  args: [],
+  workingDirectory: '/opt/relay/current',
+  user: 'relay',
+  group: 'relay',
+  dynamicUser: true,
+  restart: 'always',
+  restartSeconds: 2,
+  killMode: 'mixed',
+  timeoutStopSeconds: 60,
+  dependencies: {
+    defaultDependencies: true,
+    after: ['network-online.target'],
+    before: ['node.service'],
+    requires: [],
+    wants: ['network-online.target'],
+    conflicts: [],
+  },
+  environment: { RELAY_BIND_PORT: '8443' },
+  loadCredentials: [{ name: 'RELAY_AUTHORIZATION' }],
+  noNewPrivileges: true,
+  protectSystem: 'strict',
+  protectHome: true,
+  privateTmp: true,
+  privateDevices: true,
+  capabilityBoundingSet: [],
+  restrictAddressFamilies: ['AF_INET', 'AF_INET6', 'AF_UNIX'],
+});
+// DynamicUser=yes
+// LoadCredential=RELAY_AUTHORIZATION
+// CapabilityBoundingSet=
+// RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+```
+
+A credential's value never appears in the unit, in the service's environment (so child processes
+do not inherit it) or in `systemctl show`: the service reads it from
+`$CREDENTIALS_DIRECTORY/<name>`, readable by the service's user only. `name` is 1–255 characters of
+`[A-Za-z0-9_.@-]`, not starting with `.`. `source` is either an absolute normalized path of
+`[A-Za-z0-9_.@/+-]` characters without a trailing `/` (a file, a directory of files or an `AF_UNIX`
+socket), or a credential name that systemd looks up among its own credentials and then in
+`/etc/credstore/`, `/run/credstore/` and `/usr/lib/credstore/` (for encrypted credentials also the
+`credstore.encrypted` directories). Without `source`, systemd looks up `name` itself, so
+`{ name: 'RELAY_AUTHORIZATION' }` reads `/etc/credstore/RELAY_AUTHORIZATION`; a `source` equal to
+`name` is refused, as it only spells the same lookup twice. These characters need no quoting and
+hold no `%` specifier, `:` separator or escape, so systemd reads each line exactly as written.
+Encrypted credentials are sealed with `systemd-creds encrypt` (host key or TPM2). Systemd keeps both
+kinds in one table by name, so a name appears in at most one list; at most 64 per list. The
+directory search needs systemd 250 or later; an absolute `source` works from systemd 247.
+
+`dynamicUser: true` allocates the account when the service starts. Systemd would use a static
+account of the same name instead, so `user` and `group` must not be `root`, and they have at most
+31 characters, the longest name systemd allocates. For such a service systemd enforces
+`ProtectSystem=strict`, `PrivateTmp=yes`, `NoNewPrivileges=yes`, `RestrictSUIDSGID=yes` and at least
+`ProtectHome=read-only`; a definition that states any of them weaker is refused, so the unit never
+reads as less confined than it is.
+
+Each refusal throws `SystemdServiceDefinitionError`, whose `option` names the offending option (for
+every option of a definition, not only these) and whose message is
+`Invalid direct systemd service definition: <option>.`. `option` is `'options'` for the definition
+object itself: not a plain object, an unknown or accessor key, or a unit over 16384 bytes. No
+refusal carries the offending value.
+
 Optional `dependencies` describes the complete literal runtime relationships:
 
 ```typescript

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdaemon',
-  version: '2.12.0',
+  version: '2.13.0',
   description: 'Start scripts as long running daemons and manage them.'
 }

package/ts/classes.systemdservicedefinition.ts

@@ -1,8 +1,11 @@
 import * as plugins from './smartdaemon.plugins.js';
-import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations, type TSystemdServiceStartup,
-  type ISystemdServiceDependencies, type ISystemdServiceInstallTargets } from './systemd.definition.js';
+import { environmentByteLimit, environmentVariableLimit, isCleanText, renderServiceRelations, systemdAddressFamilies,
+  systemdCapabilities, type TSystemdServiceStartup, type ISystemdServiceDependencies, type ISystemdServiceInstallTargets,
+  type ISystemdServiceCredential, type TSystemdCapability, type TSystemdAddressFamily } from './systemd.definition.js';
 export type { ISystemdServiceStartup, ISystemdServiceNotifyStartup, TSystemdServiceStartup,
-  ISystemdServiceDependencies, ISystemdServiceInstallTargets } from './systemd.definition.js';
+  ISystemdServiceDependencies, ISystemdServiceInstallTargets, ISystemdServiceCredential, TSystemdCapability,
+  TSystemdAddressFamily } from './systemd.definition.js';
+export { systemdCapabilities, systemdAddressFamilies } from './systemd.definition.js';
 
 interface ISystemdServiceDefinitionBaseOptions {
   unitName: string;
@@ -33,6 +36,53 @@ interface ISystemdServiceDefinitionBaseOptions {
    * 64 variables and 8192 UTF-8 bytes of `NAME=value` in total. They are taken literally: `%` is escaped, and `Environment=` never expands `$`.
    */
   environment?: Readonly<Record<string, string>>;
+  /**
+   * System scope only. Runs the service as a transient user and group allocated at start
+   * (`DynamicUser=`), named by `user` and `group`, which then must not be `root` and have at most
+   * 31 characters. Systemd enforces `ProtectSystem=strict`, `PrivateTmp=`, `NoNewPrivileges=` and
+   * `RestrictSUIDSGID=` for such a service, so a definition that weakens any of them is refused.
+   */
+  dynamicUser?: boolean;
+  /** System scope only. Credentials read in plaintext, one `LoadCredential=` line each, ordered by name. */
+  loadCredentials?: readonly ISystemdServiceCredential[];
+  /** System scope only. Credentials sealed with `systemd-creds encrypt`, one `LoadCredentialEncrypted=` line each, ordered by name. */
+  loadCredentialsEncrypted?: readonly ISystemdServiceCredential[];
+  /** System scope only (`NoNewPrivileges=`). */
+  noNewPrivileges?: boolean;
+  /** System scope only (`ProtectSystem=`): `true` mounts `/usr` and the boot loader read-only, `'full'` also `/etc`, `'strict'` the whole file system but the API file systems. */
+  protectSystem?: boolean | 'full' | 'strict';
+  /** System scope only (`ProtectHome=`). */
+  protectHome?: boolean | 'read-only' | 'tmpfs';
+  /** System scope only (`PrivateTmp=`). */
+  privateTmp?: boolean;
+  /** System scope only (`PrivateDevices=`). */
+  privateDevices?: boolean;
+  /** System scope only (`ProtectKernelTunables=`). */
+  protectKernelTunables?: boolean;
+  /** System scope only (`ProtectKernelModules=`). */
+  protectKernelModules?: boolean;
+  /** System scope only (`ProtectKernelLogs=`). */
+  protectKernelLogs?: boolean;
+  /** System scope only (`ProtectControlGroups=`). */
+  protectControlGroups?: boolean;
+  /** System scope only (`ProtectClock=`). */
+  protectClock?: boolean;
+  /** System scope only (`ProtectHostname=`). */
+  protectHostname?: boolean;
+  /** System scope only (`RestrictNamespaces=`): `true` forbids creating every kind of namespace. */
+  restrictNamespaces?: boolean;
+  /** System scope only (`RestrictRealtime=`). */
+  restrictRealtime?: boolean;
+  /** System scope only (`RestrictSUIDSGID=`). */
+  restrictSUIDSGID?: boolean;
+  /** System scope only (`LockPersonality=`). */
+  lockPersonality?: boolean;
+  /** System scope only. The only capabilities the service's processes can ever hold (`CapabilityBoundingSet=`); empty drops all. */
+  capabilityBoundingSet?: readonly TSystemdCapability[];
+  /** System scope only. Capabilities a non-root service's processes receive (`AmbientCapabilities=`); within `capabilityBoundingSet` when both are given. */
+  ambientCapabilities?: readonly TSystemdCapability[];
+  /** System scope only. The only socket families the service may create (`RestrictAddressFamilies=`); at least one, and `AF_UNIX` for a notify service. */
+  restrictAddressFamilies?: readonly TSystemdAddressFamily[];
 }
 
 export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOptions & (
@@ -40,13 +90,43 @@ export type ISystemdServiceDefinitionOptions = ISystemdServiceDefinitionBaseOpti
   { scope: 'user'; user?: never; group?: never }
 );
 
+/**
+ * The option a refusal names: a key of the definition, or `'options'` for the definition object
+ * itself (not a plain object, an unknown or accessor key, or a unit over 16384 bytes).
+ */
+export type TSystemdServiceDefinitionOption = keyof ISystemdServiceDefinitionOptions | 'options';
+
 export class SystemdServiceDefinitionError extends Error {
-  constructor() {
-    super('Invalid direct systemd service definition.');
+  public readonly option: TSystemdServiceDefinitionOption;
+
+  constructor(option: TSystemdServiceDefinitionOption) {
+    super(`Invalid direct systemd service definition: ${option}.`);
     this.name = 'SystemdServiceDefinitionError';
+    this.option = option;
   }
 }
 
+/** Sandboxing switches in their rendering order, each with its directive. */
+const sandboxSwitches = [
+  ['privateTmp', 'PrivateTmp'],
+  ['privateDevices', 'PrivateDevices'],
+  ['protectKernelTunables', 'ProtectKernelTunables'],
+  ['protectKernelModules', 'ProtectKernelModules'],
+  ['protectKernelLogs', 'ProtectKernelLogs'],
+  ['protectControlGroups', 'ProtectControlGroups'],
+  ['protectClock', 'ProtectClock'],
+  ['protectHostname', 'ProtectHostname'],
+  ['restrictNamespaces', 'RestrictNamespaces'],
+  ['restrictRealtime', 'RestrictRealtime'],
+  ['restrictSUIDSGID', 'RestrictSUIDSGID'],
+  ['lockPersonality', 'LockPersonality'],
+] as const;
+
+/** Options a user manager's service cannot carry: they need the system manager's privileges. */
+const systemOnlyOptions = ['dynamicUser', 'loadCredentials', 'loadCredentialsEncrypted', 'noNewPrivileges',
+  'protectSystem', 'protectHome', ...sandboxSwitches.map(([option]) => option), 'capabilityBoundingSet',
+  'ambientCapabilities', 'restrictAddressFamilies'] as const;
+
 /** Literal direct-execution definition; never introduces a shell or environment expansion. */
 export class SystemdServiceDefinition {
   public readonly unitName: string;
@@ -55,26 +135,27 @@ export class SystemdServiceDefinition {
   public readonly sha256: string;
 
   constructor(options: ISystemdServiceDefinitionOptions) {
-    const requireValue = (value: unknown): void => {
-      if (!value) throw new SystemdServiceDefinitionError();
+    const fail = (option: TSystemdServiceDefinitionOption): never => {
+      throw new SystemdServiceDefinitionError(option);
+    };
+    const requireValue = (value: unknown, option: TSystemdServiceDefinitionOption): void => {
+      if (!value) fail(option);
     };
     requireValue(options && !plugins.util.types.isProxy(options) &&
-      Object.getPrototypeOf(options) === Object.prototype);
+      Object.getPrototypeOf(options) === Object.prototype, 'options');
     const scopeDescriptor = Object.getOwnPropertyDescriptor(options, 'scope');
     requireValue(scopeDescriptor === undefined ||
-      scopeDescriptor.enumerable && 'value' in scopeDescriptor);
+      scopeDescriptor.enumerable && 'value' in scopeDescriptor, 'scope');
     const scopeValue: unknown = scopeDescriptor?.value ?? 'system';
-    if (scopeValue !== 'system' && scopeValue !== 'user') {
-      throw new SystemdServiceDefinitionError();
-    }
-    const scope = scopeValue;
+    if (scopeValue !== 'system' && scopeValue !== 'user') fail('scope');
+    const scope = scopeValue as 'system' | 'user';
     // Systemd ignores an assignment whose text is not clean UTF-8, leaving the unit unloadable.
     const text = (value: unknown, maximum = 4096): value is string =>
       typeof value === 'string' && value.length <= maximum && isCleanText(value);
-    const absolute = (value: unknown) =>
+    const absolute = (value: unknown): value is string =>
       text(value) && plugins.path.isAbsolute(value) &&
       plugins.path.normalize(value) === value;
-    const keys = [
+    const keys: TSystemdServiceDefinitionOption[] = [
       'unitName',
       'description',
       'executable',
@@ -83,31 +164,40 @@ export class SystemdServiceDefinition {
       'restart',
       'killMode',
       'timeoutStopSeconds',
-      ...(scope === 'system' ? ['user', 'group'] : []),
+      ...(scope === 'system' ? ['user', 'group'] as const : []),
     ];
-    const optionalKeys = ['scope', 'startup', 'dependencies', 'install', 'restartSeconds', 'delegate',
-      'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment'];
-    requireValue(
-      Reflect.ownKeys(options).every(key => typeof key === 'string' && [...keys, ...optionalKeys].includes(key)
-          && Object.getOwnPropertyDescriptor(options, key)?.enumerable && 'value' in Object.getOwnPropertyDescriptor(options, key)!) && keys.every((key) => {
-          const descriptor = Object.getOwnPropertyDescriptor(options, key);
-          return descriptor && 'value' in descriptor;
-        }),
-    );
+    const optionalKeys: TSystemdServiceDefinitionOption[] = ['scope', 'startup', 'dependencies', 'install',
+      'restartSeconds', 'delegate', 'limitNoFile', 'tasksMax', 'oomScoreAdjust', 'environment',
+      ...systemOnlyOptions];
+    // Every own key is a known option held by an enumerable data property, so no accessor or trap runs.
+    for (const key of Reflect.ownKeys(options)) {
+      requireValue(typeof key === 'string' && [...keys, ...optionalKeys, 'user', 'group'].includes(key as never), 'options');
+      const option = key as TSystemdServiceDefinitionOption;
+      const descriptor = Object.getOwnPropertyDescriptor(options, key);
+      requireValue(keys.includes(option) || optionalKeys.includes(option), option);
+      requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+    }
+    for (const key of keys) requireValue(Object.getOwnPropertyDescriptor(options, key), key);
     requireValue(
       typeof options.unitName === 'string' &&
         /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName),
+      'unitName',
     );
     requireValue(
       text(options.description, 1024) && options.description.length > 0 &&
         options.description.trim() === options.description && !options.description.includes('\\'),
+      'description',
     );
     requireValue(
       absolute(options.executable) && options.executable !== '/' &&
-        !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
-        absolute(options.workingDirectory) &&
+        !/[\\"']/.test(options.executable) && !options.executable.endsWith('/'),
+      'executable',
+    );
+    requireValue(
+      absolute(options.workingDirectory) &&
         options.workingDirectory.trim() === options.workingDirectory &&
         !options.workingDirectory.includes('\\'),
+      'workingDirectory',
     );
     requireValue(
       Array.isArray(options.args) && !plugins.util.types.isProxy(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
@@ -118,43 +208,44 @@ export class SystemdServiceDefinition {
           (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)),
         )
           .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)),
+      'args',
     );
     if (scope === 'system') {
-      requireValue(
-        [options.user, options.group].every((value) =>
-          typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)
-        ),
-      );
+      for (const key of ['user', 'group'] as const) {
+        requireValue(typeof options[key] === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(options[key]), key);
+      }
     }
+    requireValue(['no', 'on-failure', 'always'].includes(options.restart), 'restart');
+    requireValue(['mixed', 'control-group', 'process'].includes(options.killMode), 'killMode');
     requireValue(
-      ['no', 'on-failure', 'always'].includes(options.restart) &&
-        ['mixed', 'control-group', 'process'].includes(options.killMode) &&
-        Number.isSafeInteger(options.timeoutStopSeconds) &&
+      Number.isSafeInteger(options.timeoutStopSeconds) &&
         options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600,
+      'timeoutStopSeconds',
     );
     const integer = (value: unknown, minimum: number, maximum: number): value is number =>
       Number.isSafeInteger(value) && (value as number) >= minimum && (value as number) <= maximum;
     const limit = (value: unknown): value is number | 'infinity' =>
       value === 'infinity' || integer(value, 1, Number.MAX_SAFE_INTEGER);
+    const yesNo = (value: boolean) => value ? 'yes' : 'no';
     // Each optional directive is absent unless supplied, so existing definitions keep their bytes.
     const service: string[] = [];
     if (options.restartSeconds !== undefined) {
-      requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no');
+      requireValue(integer(options.restartSeconds, 1, 600) && options.restart !== 'no', 'restartSeconds');
     }
     if (options.delegate !== undefined) {
-      requireValue(typeof options.delegate === 'boolean');
-      service.push(`Delegate=${options.delegate ? 'yes' : 'no'}`);
+      requireValue(typeof options.delegate === 'boolean', 'delegate');
+      service.push(`Delegate=${yesNo(options.delegate)}`);
     }
     if (options.limitNoFile !== undefined) {
-      requireValue(limit(options.limitNoFile));
+      requireValue(limit(options.limitNoFile), 'limitNoFile');
       service.push(`LimitNOFILE=${options.limitNoFile}`);
     }
     if (options.tasksMax !== undefined) {
-      requireValue(limit(options.tasksMax));
+      requireValue(limit(options.tasksMax), 'tasksMax');
       service.push(`TasksMax=${options.tasksMax}`);
     }
     if (options.oomScoreAdjust !== undefined) {
-      requireValue(integer(options.oomScoreAdjust, -1000, 1000));
+      requireValue(integer(options.oomScoreAdjust, -1000, 1000), 'oomScoreAdjust');
       service.push(`OOMScoreAdjust=${options.oomScoreAdjust}`);
     }
     // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
@@ -163,26 +254,135 @@ export class SystemdServiceDefinition {
         .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
         .replaceAll('$', () => command ? '$$' : '$') +
       '"';
+    const plainObject = (value: unknown, option: TSystemdServiceDefinitionOption) =>
+      requireValue(value !== null && typeof value === 'object' && !plugins.util.types.isProxy(value) &&
+        Object.getPrototypeOf(value) === Object.prototype, option);
     if (options.environment !== undefined) {
       // Read each variable once through its own data descriptor, so no accessor or trap runs.
       const variables: unknown = options.environment;
-      requireValue(variables !== null && typeof variables === 'object' &&
-        !plugins.util.types.isProxy(variables) && Object.getPrototypeOf(variables) === Object.prototype);
+      plainObject(variables, 'environment');
       const names = Reflect.ownKeys(variables as object);
-      requireValue(names.length <= environmentVariableLimit);
+      requireValue(names.length <= environmentVariableLimit, 'environment');
       const assignments = new Map<string, string>();
       for (const name of names) {
         const descriptor = Object.getOwnPropertyDescriptor(variables, name);
         requireValue(typeof name === 'string' && /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(name) &&
-          descriptor?.enumerable && 'value' in descriptor && text(descriptor.value));
+          descriptor?.enumerable && 'value' in descriptor && text(descriptor.value), 'environment');
         assignments.set(name as string, `${name as string}=${descriptor!.value as string}`);
       }
-      requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit);
+      requireValue(Buffer.byteLength([...assignments.values()].join('')) <= environmentByteLimit, 'environment');
       // Environment= unquotes and unescapes each word and expands `%` specifiers, never `$`.
       service.push(...[...assignments.keys()].sort()
         .map((name) => `Environment=${quote(assignments.get(name)!)}`));
     }
-    const relations = renderServiceRelations(options, options.unitName, options.restart, scope, () => { throw new SystemdServiceDefinitionError(); });
+    // Every system-only option is refused by name in a user manager's service.
+    for (const option of systemOnlyOptions) {
+      requireValue(scope === 'system' || options[option] === undefined, option);
+    }
+    /** Reads a plain array once through its data descriptors: distinct items, sorted. */
+    const list = <T>(value: unknown, option: TSystemdServiceDefinitionOption, maximum: number,
+      item: (entry: unknown) => T, identity: (entry: T) => string): T[] => {
+      requireValue(Array.isArray(value) && !plugins.util.types.isProxy(value) &&
+        Object.getPrototypeOf(value) === Array.prototype && value.length <= maximum &&
+        Reflect.ownKeys(value).length === value.length + 1, option);
+      const result = Array.from({ length: (value as unknown[]).length }, (_, index) => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        requireValue(descriptor?.enumerable && 'value' in descriptor, option);
+        return item(descriptor!.value);
+      });
+      const identities = result.map(identity);
+      requireValue(new Set(identities).size === identities.length, option);
+      return result.sort((left, right) => identity(left) < identity(right) ? -1 : 1);
+    };
+    // Credential names and sources hold no `%`, quote, backslash, whitespace or `:`, so systemd's
+    // `NAME[:SOURCE]` parser and its specifier expansion read them exactly as written.
+    const credentialName = (value: unknown): value is string =>
+      typeof value === 'string' && /^[A-Za-z0-9_@-][A-Za-z0-9_.@-]{0,254}$/.test(value);
+    const credentials = (value: unknown, option: 'loadCredentials' | 'loadCredentialsEncrypted') =>
+      list(value, option, 64, (entry): ISystemdServiceCredential => {
+        plainObject(entry, option);
+        const entryKeys = Reflect.ownKeys(entry as object);
+        requireValue(entryKeys.includes('name') && entryKeys.every((key) => (key === 'name' || key === 'source') &&
+          Object.getOwnPropertyDescriptor(entry, key)?.enumerable &&
+          'value' in Object.getOwnPropertyDescriptor(entry, key)!), option);
+        const { name, source } = entry as Record<'name' | 'source', unknown>;
+        requireValue(credentialName(name), option);
+        if (entryKeys.includes('source')) {
+          requireValue(source !== name && (credentialName(source) || absolute(source) && !source.endsWith('/') &&
+            /^[A-Za-z0-9_.@/+-]+$/.test(source)), option);
+        }
+        return entryKeys.includes('source') ? { name: name as string, source: source as string } : { name: name as string };
+      }, (entry) => entry.name);
+    const plainCredentials = options.loadCredentials === undefined ? [] : credentials(options.loadCredentials, 'loadCredentials');
+    const encryptedCredentials = options.loadCredentialsEncrypted === undefined
+      ? [] : credentials(options.loadCredentialsEncrypted, 'loadCredentialsEncrypted');
+    // Systemd keeps both kinds in one table by name, so a name loads from exactly one of them.
+    requireValue(encryptedCredentials.every((entry) => !plainCredentials.some(({ name }) => name === entry.name)),
+      'loadCredentialsEncrypted');
+    const credential = ({ name, source }: ISystemdServiceCredential) => source === undefined ? name : `${name}:${source}`;
+    service.push(...plainCredentials.map((entry) => `LoadCredential=${credential(entry)}`));
+    service.push(...encryptedCredentials.map((entry) => `LoadCredentialEncrypted=${credential(entry)}`));
+    const dynamicUser = options.dynamicUser;
+    if (dynamicUser !== undefined) {
+      requireValue(typeof dynamicUser === 'boolean', 'dynamicUser');
+      // A static account of the same name would be used instead, so the name must not be root's,
+      // and systemd allocates only names that fit utmp.
+      requireValue(!dynamicUser || [options.user, options.group].every((name) =>
+        name !== 'root' && typeof name === 'string' && name.length <= 31), 'dynamicUser');
+    }
+    // Settings systemd forces on for a dynamic user, so the unit never states a weaker one.
+    const forced = (option: TSystemdServiceDefinitionOption, weakened: boolean) =>
+      requireValue(!(dynamicUser === true && weakened), option);
+    if (options.noNewPrivileges !== undefined) {
+      requireValue(typeof options.noNewPrivileges === 'boolean', 'noNewPrivileges');
+      forced('noNewPrivileges', !options.noNewPrivileges);
+      service.push(`NoNewPrivileges=${yesNo(options.noNewPrivileges)}`);
+    }
+    if (options.protectSystem !== undefined) {
+      requireValue([true, false, 'full', 'strict'].includes(options.protectSystem), 'protectSystem');
+      forced('protectSystem', options.protectSystem !== 'strict');
+      service.push(`ProtectSystem=${typeof options.protectSystem === 'boolean'
+        ? yesNo(options.protectSystem) : options.protectSystem}`);
+    }
+    if (options.protectHome !== undefined) {
+      requireValue([true, false, 'read-only', 'tmpfs'].includes(options.protectHome), 'protectHome');
+      forced('protectHome', options.protectHome === false);
+      service.push(`ProtectHome=${typeof options.protectHome === 'boolean'
+        ? yesNo(options.protectHome) : options.protectHome}`);
+    }
+    for (const [option, directive] of sandboxSwitches) {
+      const value = options[option];
+      if (value === undefined) continue;
+      requireValue(typeof value === 'boolean', option);
+      forced(option, (option === 'privateTmp' || option === 'restrictSUIDSGID') && !value);
+      service.push(`${directive}=${yesNo(value)}`);
+    }
+    const capabilities = (value: unknown, option: 'capabilityBoundingSet' | 'ambientCapabilities') =>
+      list(value, option, systemdCapabilities.length, (entry) => {
+        requireValue((systemdCapabilities as readonly unknown[]).includes(entry), option);
+        return entry as TSystemdCapability;
+      }, (entry) => entry);
+    const bounding = options.capabilityBoundingSet === undefined
+      ? undefined : capabilities(options.capabilityBoundingSet, 'capabilityBoundingSet');
+    const ambient = options.ambientCapabilities === undefined
+      ? undefined : capabilities(options.ambientCapabilities, 'ambientCapabilities');
+    // An ambient capability outside the bounding set would fail every start of the service.
+    requireValue(!bounding || !ambient || ambient.every((entry) => bounding.includes(entry)), 'ambientCapabilities');
+    // An empty CapabilityBoundingSet= empties the bounding set; an empty AmbientCapabilities= grants none.
+    if (bounding) service.push(`CapabilityBoundingSet=${bounding.join(' ')}`);
+    if (ambient) service.push(`AmbientCapabilities=${ambient.join(' ')}`);
+    const families = options.restrictAddressFamilies === undefined ? undefined
+      : list(options.restrictAddressFamilies, 'restrictAddressFamilies', systemdAddressFamilies.length, (entry) => {
+        requireValue((systemdAddressFamilies as readonly unknown[]).includes(entry), 'restrictAddressFamilies');
+        return entry as TSystemdAddressFamily;
+      }, (entry) => entry);
+    // An empty RestrictAddressFamilies= would lift the restriction instead of denying every family.
+    requireValue(!families || families.length > 0, 'restrictAddressFamilies');
+    if (families) service.push(`RestrictAddressFamilies=${families.join(' ')}`);
+    const relations = renderServiceRelations(options, options.unitName, options.restart, scope, fail);
+    // A notify service sends READY=1 over an AF_UNIX socket it creates itself.
+    requireValue(!families || !relations.service.includes('Type=notify') || families.includes('AF_UNIX'),
+      'restrictAddressFamilies');
     this.unitName = options.unitName;
     this.scope = scope;
     this.content = [
@@ -193,6 +393,7 @@ export class SystemdServiceDefinition {
       '[Service]',
       ...relations.service,
       ...(scope === 'system' ? [`User=${options.user}`, `Group=${options.group}`] : []),
+      ...(dynamicUser !== undefined ? [`DynamicUser=${yesNo(dynamicUser)}`] : []),
       `ExecStart=${
         [quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')
       }`,
@@ -215,7 +416,7 @@ export class SystemdServiceDefinition {
       ...relations.install,
       '',
     ].join('\n');
-    requireValue(Buffer.byteLength(this.content) <= 16384);
+    requireValue(Buffer.byteLength(this.content) <= 16384, 'options');
     this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
     Object.freeze(this);
   }

package/ts/systemd.definition.ts

@@ -34,6 +34,41 @@ export interface ISystemdServiceInstallTargets {
   requiredBy: readonly string[];
 }
 
+/**
+ * One credential a system service reads from `$CREDENTIALS_DIRECTORY/<name>` (`LoadCredential=` or
+ * `LoadCredentialEncrypted=`). The value never appears in the unit, its environment or
+ * `systemctl show`; it is readable by the service's user only.
+ */
+export interface ISystemdServiceCredential {
+  /** The credential's name inside the service: printable ASCII from `[A-Za-z0-9_.@-]`, 1–255 characters, not starting with `.`. */
+  name: string;
+  /**
+   * Where systemd reads it: an absolute normalized path (a file, a directory of files or an
+   * `AF_UNIX` socket), or a credential name that systemd searches among its own credentials and
+   * in the credstore directories (`/etc/credstore/`, `/run/credstore/`, `/usr/lib/credstore/`, and
+   * for encrypted credentials also their `.encrypted` counterparts). Omitted, systemd searches
+   * under `name` itself.
+   */
+  source?: string;
+}
+
+/** Linux capabilities systemd 255 knows by name, for `capabilityBoundingSet` and `ambientCapabilities`. */
+export const systemdCapabilities = [
+  'CAP_AUDIT_CONTROL', 'CAP_AUDIT_READ', 'CAP_AUDIT_WRITE', 'CAP_BLOCK_SUSPEND', 'CAP_BPF',
+  'CAP_CHECKPOINT_RESTORE', 'CAP_CHOWN', 'CAP_DAC_OVERRIDE', 'CAP_DAC_READ_SEARCH', 'CAP_FOWNER',
+  'CAP_FSETID', 'CAP_IPC_LOCK', 'CAP_IPC_OWNER', 'CAP_KILL', 'CAP_LEASE', 'CAP_LINUX_IMMUTABLE',
+  'CAP_MAC_ADMIN', 'CAP_MAC_OVERRIDE', 'CAP_MKNOD', 'CAP_NET_ADMIN', 'CAP_NET_BIND_SERVICE',
+  'CAP_NET_BROADCAST', 'CAP_NET_RAW', 'CAP_PERFMON', 'CAP_SETFCAP', 'CAP_SETGID', 'CAP_SETPCAP',
+  'CAP_SETUID', 'CAP_SYSLOG', 'CAP_SYS_ADMIN', 'CAP_SYS_BOOT', 'CAP_SYS_CHROOT', 'CAP_SYS_MODULE',
+  'CAP_SYS_NICE', 'CAP_SYS_PACCT', 'CAP_SYS_PTRACE', 'CAP_SYS_RAWIO', 'CAP_SYS_RESOURCE',
+  'CAP_SYS_TIME', 'CAP_SYS_TTY_CONFIG', 'CAP_WAKE_ALARM',
+] as const;
+export type TSystemdCapability = typeof systemdCapabilities[number];
+
+/** Socket address families a definition may allow with `restrictAddressFamilies`. */
+export const systemdAddressFamilies = ['AF_INET', 'AF_INET6', 'AF_NETLINK', 'AF_PACKET', 'AF_UNIX', 'AF_VSOCK'] as const;
+export type TSystemdAddressFamily = typeof systemdAddressFamilies[number];
+
 /**
  * Internal bounds of a definition's `environment`: variables, and UTF-8 bytes of `NAME=value` in
  * total. SystemdUnit sizes its systemctl output limit from them, so every accepted definition reads back.
@@ -59,10 +94,13 @@ export const renderServiceRelations = (options: {
   startup?: TSystemdServiceStartup;
   dependencies?: ISystemdServiceDependencies;
   install?: ISystemdServiceInstallTargets;
-}, unitName: string, restart: string, scope: 'system' | 'user', fail: () => never): {
+}, unitName: string, restart: string, scope: 'system' | 'user',
+fail: (option: 'startup' | 'dependencies' | 'install') => never): {
   unit: string[]; service: string[]; install: string[];
 } => {
-  const requireValue = (value: unknown): void => { if (!value) fail(); };
+  // Every check names the option it belongs to; `option` is set before each option is read.
+  let option: 'startup' | 'dependencies' | 'install' = 'startup';
+  const requireValue = (value: unknown): void => { if (!value) fail(option); };
   const plain = (value: unknown): void => requireValue(value !== null && typeof value === 'object'
     && !plugins.util.types.isProxy(value) && Object.getPrototypeOf(value) === Object.prototype);
   const record = (value: unknown, keys: readonly string[]): void => {
@@ -110,6 +148,7 @@ export const renderServiceRelations = (options: {
     }
   }
   if (options.dependencies !== undefined) {
+    option = 'dependencies';
     const value = options.dependencies;
     record(value, ['defaultDependencies', 'after', 'before', 'requires', 'wants', 'conflicts']);
     requireValue(typeof value.defaultDependencies === 'boolean');
@@ -120,6 +159,7 @@ export const renderServiceRelations = (options: {
       ...line('Before', before), ...line('Requires', requires), ...line('Wants', wants), ...line('Conflicts', conflicts)];
   }
   if (options.install !== undefined) {
+    option = 'install';
     const value = options.install;
     record(value, ['wantedBy', 'requiredBy']);
     const wanted = units(value.wantedBy), required = units(value.requiredBy);