@fased/fased 0.1.38 → 0.1.40

package/dist/brand.js

@@ -2,7 +2,7 @@
 const FASED_BRAND_NAME = "Fased";
 const FASED_AGENT_NAME = "Fased Agent";
 const FASED_CONTROL_NAME = "Fased Control";
-const FASED_PRODUCT_VERSION = "0.1.38";
+const FASED_PRODUCT_VERSION = "0.1.40";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 function formatFasedDisplayLine() {
 	return `${FASED_AGENT_NAME} ${FASED_DISPLAY_VERSION}`;

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.38",
-  "commit": "68d9d1e95f7fb0b92a327631dae5f0bb4221ec2f",
-  "builtAt": "2026-07-10T19:08:10.142Z"
+  "version": "0.1.40",
+  "commit": "a8403b7a8a07f287ffa8c564c20015b41c376fc5",
+  "builtAt": "2026-07-10T23:09:12.393Z"
 }

package/dist/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-d91da5fc7935c5d64a96871c12c0f9f54ab7c949c1edb6d966a4df86dbf6f149
+d43118ba792b198aa36c870735aede71aa66e9f53636ca999d50426d55459175

package/dist/cli/daemon-cli/install.js

@@ -7,6 +7,7 @@ import { randomToken } from "../../commands/onboard-helpers.js";
 import { resolveGatewayAuth } from "../../gateway/auth.js";
 import { buildGatewayInstallPlan } from "../../commands/daemon-install-helpers.js";
 import { DEFAULT_GATEWAY_DAEMON_RUNTIME, isGatewayDaemonRuntime } from "../../commands/daemon-runtime.js";
+import { installHostedSystemdService } from "../../daemon/systemd-system.js";
 import { resolveGatewayService } from "../../daemon/service.js";
 import { buildDaemonServiceSnapshot, createDaemonActionContext } from "./response.js";
 import { parsePort } from "../shared/parse-port.js";
@@ -40,6 +41,11 @@ async function runDaemonInstall(opts) {
 		return;
 	}
 	const service = resolveGatewayService();
+	const systemInstall = Boolean(opts.system || service.label === "systemd system service");
+	if (opts.system && process.platform !== "linux") {
+		fail("--system is supported on Linux VPS Hosting installs only.");
+		return;
+	}
 	let loaded = false;
 	try {
 		loaded = await service.isLoaded({ env: process.env });
@@ -113,7 +119,10 @@ async function runDaemonInstall(opts) {
 		}
 	}
 	const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
-		env: process.env,
+		env: systemInstall ? {
+			...process.env,
+			FASED_GATEWAY_MODE: "managed"
+		} : process.env,
 		port,
 		token,
 		runtime: runtimeRaw,
@@ -124,30 +133,45 @@ async function runDaemonInstall(opts) {
 				defaultRuntime.log(message);
 			}
 		},
-		config: cfg
+		config: cfg,
+		startupMode: systemInstall ? "managed-up" : undefined
 	});
 	try {
-		await service.install({
-			env: process.env,
-			stdout,
-			programArguments,
-			workingDirectory,
-			environment
-		});
+		if (systemInstall) {
+			const installed = await installHostedSystemdService({
+				programArguments,
+				workingDirectory,
+				environment
+			});
+			if (!json) {
+				defaultRuntime.log(`Installed hosted system service: ${installed.unitPath}`);
+			}
+		} else {
+			await service.install({
+				env: process.env,
+				stdout,
+				programArguments,
+				workingDirectory,
+				environment
+			});
+		}
 	} catch (err) {
 		fail(`Gateway install failed: ${String(err)}`);
 		return;
 	}
+	const installedService = systemInstall ? resolveGatewayService() : service;
 	let installed = true;
-	try {
-		installed = await service.isLoaded({ env: process.env });
-	} catch {
-		installed = true;
+	if (!systemInstall) {
+		try {
+			installed = await installedService.isLoaded({ env: process.env });
+		} catch {
+			installed = true;
+		}
 	}
 	emit({
 		ok: true,
 		result: "installed",
-		service: buildDaemonServiceSnapshot(service, installed),
+		service: buildDaemonServiceSnapshot(installedService, installed),
 		warnings: warnings.length ? warnings : undefined
 	});
 }

package/dist/cli/daemon-cli/register-service-commands.js

@@ -34,7 +34,7 @@ function addGatewayServiceCommands(parent, opts) {
 			json: Boolean(cmdOpts.json)
 		});
 	});
-	parent.command("install").description("Install the Gateway service (launchd/systemd/schtasks)").option("--port <port>", "Gateway port").option("--runtime <runtime>", "Daemon runtime (node|bun). Default: node").option("--token <token>", "Gateway token (token auth)").option("--force", "Reinstall/overwrite if already installed", false).option("--json", "Output JSON", false).action(async (cmdOpts, command) => {
+	parent.command("install").description("Install the Gateway service (launchd/systemd/schtasks)").option("--port <port>", "Gateway port").option("--runtime <runtime>", "Daemon runtime (node|bun). Default: node").option("--token <token>", "Gateway token (token auth)").option("--force", "Reinstall/overwrite if already installed", false).option("--system", "Install the root-managed VPS Hosting service", false).option("--json", "Output JSON", false).action(async (cmdOpts, command) => {
 		await runDaemonInstall(resolveInstallOptions(cmdOpts, command));
 	});
 	parent.command("uninstall").description("Uninstall the Gateway service (launchd/systemd/schtasks)").option("--json", "Output JSON", false).action(async (cmdOpts) => {

package/dist/cli/update-cli/service-target.js

@@ -0,0 +1,13 @@
+import { resolveGatewayService } from "../../daemon/service.js";
+
+//#region src/cli/update-cli/service-target.ts
+async function resolveUpdateGatewayServiceTarget() {
+	const service = resolveGatewayService();
+	return {
+		scope: service.label === "systemd system service" ? "system" : "platform",
+		service
+	};
+}
+
+//#endregion
+export { resolveUpdateGatewayServiceTarget };

package/dist/cli/update-cli/update-command.js

@@ -7,8 +7,8 @@ import { replaceCliName, resolveCliName } from "../cli-name.js";
 import { formatCliCommand } from "../command-format.js";
 import { readConfigFileSnapshot, writeConfigFile } from "../../config/io.js";
 import "../../config/config.js";
+import { loadGatewayTlsRuntime } from "../../infra/tls/gateway.js";
 import { stylePromptMessage } from "../../terminal/prompt-style.js";
-import { resolveGatewayService } from "../../daemon/service.js";
 import { runDaemonInstall } from "../daemon-cli/install.js";
 import { renderRestartDiagnostics, terminateStaleGatewayPids, waitForGatewayHealthyRestart } from "../daemon-cli/restart-health.js";
 import { runDaemonRestart } from "../daemon-cli/lifecycle.js";
@@ -19,13 +19,14 @@ import { DEFAULT_GIT_CHANNEL, DEFAULT_PACKAGE_CHANNEL, channelToNpmTag, normaliz
 import { cleanupGlobalRenameDirs, globalInstallArgs, resolveGlobalPackageRoot, resolveNodeModulesRootForPackageRoot } from "../../infra/update-global.js";
 import { checkUpdateStatus, compareSemverStrings, resolveNpmChannelTag } from "../../infra/update-check.js";
 import { readPackageName, readPackageVersion } from "../../infra/package-json.js";
-import { runGatewayUpdate } from "../../infra/update-runner.js";
+import { finalizeUpdateTransaction, rollbackUpdateTransaction, runGatewayUpdate } from "../../infra/update-runner.js";
 import { checkShellCompletionStatus, ensureCompletionCacheExists } from "../../commands/doctor-completion.js";
 import { runPostUpdateDoctorRepair } from "../../commands/doctor-update.js";
 import { doctorCommand } from "../../commands/doctor.js";
 import { DEFAULT_PACKAGE_NAME, createGlobalCommandRunner, ensureGitCheckout, normalizeTag, parseTimeoutMsOrExit, resolveGitInstallDir, resolveGlobalManager, resolveNodeRunner, resolveTargetVersion, resolveUpdateRoot, runUpdateStep, tryWriteCompletionCache } from "./shared.js";
 import { createUpdateProgress, printResult } from "./progress.js";
 import { prepareRestartScript, runRestartScript } from "./restart-helper.js";
+import { resolveUpdateGatewayServiceTarget } from "./service-target.js";
 import { suppressDeprecations } from "./suppress-deprecations.js";
 import path from "node:path";
 import { confirm, isCancel } from "@clack/prompts";
@@ -265,6 +266,17 @@ async function runPackageInstallUpdate(params) {
 			steps.push(doctorStep);
 		}
 	}
+	const expectedVersion = params.tag.trim().replace(/^v/, "");
+	if (pkgRoot && compareSemverStrings(expectedVersion, expectedVersion) === 0 && compareSemverStrings(afterVersion, expectedVersion) !== 0) {
+		steps.push({
+			name: "version verify",
+			command: `verify ${packageName}@${expectedVersion}`,
+			cwd: pkgRoot,
+			durationMs: 0,
+			exitCode: 1,
+			stderrTail: `expected ${expectedVersion}, found ${afterVersion ?? "unknown"}`
+		});
+	}
 	const failedStep = steps.find((step) => step.exitCode !== 0);
 	return {
 		status: failedStep ? "error" : "ok",
@@ -455,52 +467,68 @@ async function maybeRestartService(params) {
 					}
 				}
 			}
-			if (params.restartScriptPath) {
+			if (params.serviceTarget.scope === "system" && params.serviceLoaded) {
+				await params.serviceTarget.service.restart({
+					env: process.env,
+					stdout: process.stdout
+				});
+				restartInitiated = true;
+			} else if (params.restartScriptPath) {
 				await runRestartScript(params.restartScriptPath);
 				restartInitiated = true;
-			} else {
+			} else if (params.serviceTarget.scope === "platform") {
 				restarted = await runDaemonRestart();
+				restartInitiated = restarted;
 			}
-			if (!params.opts.json && restarted) {
-				defaultRuntime.log(theme.success("Daemon restarted successfully."));
-				defaultRuntime.log("");
-				process.env.FASED_UPDATE_IN_PROGRESS = "1";
-				try {
-					const interactiveDoctor = Boolean(process.stdin.isTTY) && !params.opts.json && params.opts.yes !== true;
-					await doctorCommand(defaultRuntime, { nonInteractive: !interactiveDoctor });
-				} catch (err) {
-					defaultRuntime.log(theme.warn(`Doctor failed: ${String(err)}`));
-				} finally {
-					delete process.env.FASED_UPDATE_IN_PROGRESS;
-				}
-			}
-			if (!params.opts.json && restartInitiated) {
-				const service = resolveGatewayService();
+			if (restartInitiated) {
 				let health = await waitForGatewayHealthyRestart({
-					service,
-					port: params.gatewayPort
+					service: params.serviceTarget.service,
+					port: params.gatewayPort,
+					rpc: params.rpc
 				});
 				if (!health.healthy && health.staleGatewayPids.length > 0) {
 					if (!params.opts.json) {
 						defaultRuntime.log(theme.warn(`Found stale gateway process(es) after restart: ${health.staleGatewayPids.join(", ")}. Cleaning up...`));
 					}
 					await terminateStaleGatewayPids(health.staleGatewayPids);
-					await runDaemonRestart();
+					await params.serviceTarget.service.restart({
+						env: process.env,
+						stdout: process.stdout
+					});
 					health = await waitForGatewayHealthyRestart({
-						service,
-						port: params.gatewayPort
+						service: params.serviceTarget.service,
+						port: params.gatewayPort,
+						rpc: params.rpc
 					});
 				}
 				if (health.healthy) {
-					defaultRuntime.log(theme.success("Daemon restart completed."));
+					if (!params.opts.json) {
+						defaultRuntime.log(theme.success("Daemon restart completed."));
+					}
 				} else {
-					defaultRuntime.log(theme.warn("Gateway did not become healthy after restart."));
-					for (const line of renderRestartDiagnostics(health)) {
-						defaultRuntime.log(theme.muted(line));
+					partial = true;
+					if (!params.opts.json) {
+						defaultRuntime.log(theme.warn("Gateway did not become healthy after restart."));
+						for (const line of renderRestartDiagnostics(health)) {
+							defaultRuntime.log(theme.muted(line));
+						}
+						defaultRuntime.log(theme.muted(`Run \`${replaceCliName(formatCliCommand("fased gateway status --deep"), CLI_NAME)}\` for details.`));
 					}
-					defaultRuntime.log(theme.muted(`Run \`${replaceCliName(formatCliCommand("fased gateway status --deep"), CLI_NAME)}\` for details.`));
 				}
-				defaultRuntime.log("");
+				if (!params.opts.json) {
+					defaultRuntime.log("");
+				}
+			}
+			if (!partial && restarted && !params.opts.json) {
+				process.env.FASED_UPDATE_IN_PROGRESS = "1";
+				try {
+					const interactiveDoctor = Boolean(process.stdin.isTTY) && params.opts.yes !== true;
+					await doctorCommand(defaultRuntime, { nonInteractive: !interactiveDoctor });
+				} catch (err) {
+					defaultRuntime.log(theme.warn(`Doctor failed: ${String(err)}`));
+				} finally {
+					delete process.env.FASED_UPDATE_IN_PROGRESS;
+				}
 			}
 		} catch (err) {
 			partial = true;
@@ -509,7 +537,10 @@ async function maybeRestartService(params) {
 				defaultRuntime.log(theme.muted(`You may need to restart the service manually: ${replaceCliName(formatCliCommand("fased gateway restart"), CLI_NAME)}`));
 			}
 		}
-		return { partial };
+		return {
+			partial,
+			healthy: !partial
+		};
 	}
 	if (!params.opts.json) {
 		defaultRuntime.log("");
@@ -519,7 +550,10 @@ async function maybeRestartService(params) {
 			defaultRuntime.log(theme.muted(`Tip: Run \`${replaceCliName(formatCliCommand("fased gateway restart"), CLI_NAME)}\` to apply updates to a running gateway.`));
 		}
 	}
-	return { partial };
+	return {
+		partial,
+		healthy: true
+	};
 }
 async function updateCommand(opts) {
 	suppressDeprecations();
@@ -678,12 +712,16 @@ async function updateCommand(opts) {
 	const startedAt = Date.now();
 	let restartScriptPath = null;
 	let refreshGatewayServiceEnv = false;
+	let serviceLoaded = false;
+	const serviceTarget = await resolveUpdateGatewayServiceTarget();
 	if (shouldRestart) {
 		try {
-			const loaded = await resolveGatewayService().isLoaded({ env: process.env });
-			if (loaded) {
-				restartScriptPath = await prepareRestartScript(process.env);
-				refreshGatewayServiceEnv = true;
+			serviceLoaded = await serviceTarget.service.isLoaded({ env: process.env });
+			if (serviceLoaded) {
+				if (serviceTarget.scope === "platform") {
+					restartScriptPath = await prepareRestartScript(process.env);
+					refreshGatewayServiceEnv = true;
+				}
 			}
 		} catch {}
 	}
@@ -727,6 +765,54 @@ async function updateCommand(opts) {
 		defaultRuntime.exit(0);
 		return;
 	}
+	const gatewayPort = resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined);
+	const gatewayConfig = configSnapshot.valid ? configSnapshot.config.gateway : undefined;
+	const tlsRuntime = await loadGatewayTlsRuntime(gatewayConfig?.tls);
+	const restartRpc = {
+		url: `${tlsRuntime.enabled ? "wss" : "ws"}://127.0.0.1:${gatewayPort}`,
+		token: gatewayConfig?.auth?.token,
+		password: gatewayConfig?.auth?.password,
+		tlsFingerprint: tlsRuntime.enabled ? tlsRuntime.fingerprintSha256 : undefined,
+		timeoutMs: 5e3
+	};
+	const restartResult = await maybeRestartService({
+		shouldRestart,
+		result,
+		opts,
+		refreshServiceEnv: refreshGatewayServiceEnv,
+		gatewayPort,
+		restartScriptPath,
+		serviceTarget,
+		serviceLoaded,
+		rpc: restartRpc
+	});
+	if (!restartResult.healthy) {
+		if (result.transaction) {
+			if (!opts.json) {
+				defaultRuntime.log(theme.warn("Gateway verification failed; restoring the previous runtime."));
+			}
+			try {
+				await rollbackUpdateTransaction(result.transaction);
+				await serviceTarget.service.restart({
+					env: process.env,
+					stdout: process.stdout
+				});
+				const rollbackHealth = await waitForGatewayHealthyRestart({
+					service: serviceTarget.service,
+					port: gatewayPort,
+					rpc: restartRpc
+				});
+				if (!rollbackHealth.healthy) {
+					defaultRuntime.error("Previous runtime was restored, but the gateway is not healthy.");
+				}
+			} catch (error) {
+				defaultRuntime.error(`Automatic runtime rollback failed: ${String(error)}`);
+			}
+		}
+		defaultRuntime.exit(1);
+		return;
+	}
+	await finalizeUpdateTransaction(result.transaction);
 	await updatePluginsAfterCoreUpdate({
 		root,
 		channel,
@@ -738,14 +824,6 @@ async function updateCommand(opts) {
 		jsonMode: Boolean(opts.json),
 		skipPrompt: Boolean(opts.yes)
 	});
-	const restartResult = await maybeRestartService({
-		shouldRestart,
-		result,
-		opts,
-		refreshServiceEnv: refreshGatewayServiceEnv,
-		gatewayPort: resolveGatewayPort(configSnapshot.valid ? configSnapshot.config : undefined),
-		restartScriptPath
-	});
 	if (!opts.json && !restartResult.partial) {
 		defaultRuntime.log(theme.muted(pickUpdateQuip()));
 	}

package/dist/commands/daemon-install-helpers.js

@@ -59,6 +59,9 @@ async function buildGatewayInstallPlan(params) {
 	});
 	const environment = { ...collectConfigServiceEnvVars(params.config) };
 	Object.assign(environment, serviceEnvironment);
+	if (startupMode === "managed-up") {
+		environment.FASED_GATEWAY_MODE = "managed";
+	}
 	const serviceNodeProgram = programArguments[0];
 	if (typeof serviceNodeProgram === "string" && serviceNodeProgram.includes(path.sep) && path.basename(serviceNodeProgram).toLowerCase().startsWith("node")) {
 		environment.FASED_NODE_BIN = serviceNodeProgram;

package/dist/daemon/service.js

@@ -1,6 +1,7 @@
 import { installLaunchAgent, isLaunchAgentLoaded, readLaunchAgentProgramArguments, readLaunchAgentRuntime, restartLaunchAgent, stopLaunchAgent, uninstallLaunchAgent } from "./launchd.js";
 import { installScheduledTask, isScheduledTaskInstalled, readScheduledTaskCommand, readScheduledTaskRuntime, restartScheduledTask, stopScheduledTask, uninstallScheduledTask } from "./schtasks.js";
 import { installSystemdService, isSystemdServiceEnabled, readSystemdServiceExecStart, readSystemdServiceRuntime, restartSystemdService, stopSystemdService, uninstallSystemdService } from "./systemd.js";
+import { resolveHostedSystemdService } from "./systemd-system.js";
 
 //#region src/daemon/service.ts
 function ignoreInstallResult(install) {
@@ -24,6 +25,10 @@ function resolveGatewayService() {
 		};
 	}
 	if (process.platform === "linux") {
+		const hostedSystemService = resolveHostedSystemdService();
+		if (hostedSystemService) {
+			return hostedSystemService;
+		}
 		return {
 			label: "systemd",
 			loadedText: "enabled",

package/dist/daemon/systemd-system.js

@@ -0,0 +1,237 @@
+import { execFileUtf8 } from "./exec-file.js";
+import { buildSystemdUnit, parseSystemdEnvAssignment, parseSystemdExecStart } from "./systemd-unit.js";
+import { parseSystemdShow } from "./systemd.js";
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+import { spawn } from "node:child_process";
+
+//#region src/daemon/systemd-system.ts
+const SERVICE_NAME = "fased-gateway";
+const INSTALL_HELPER = "/usr/local/sbin/fased-install-gateway-service";
+const SYSTEM_UNIT_CANDIDATES = [
+	`/etc/systemd/system/${SERVICE_NAME}.service`,
+	`/usr/lib/systemd/system/${SERVICE_NAME}.service`,
+	`/lib/systemd/system/${SERVICE_NAME}.service`
+];
+function findHostedSystemdUnitPath(candidates = SYSTEM_UNIT_CANDIDATES) {
+	if (process.platform !== "linux") {
+		return null;
+	}
+	return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
+async function readHostedSystemdCommand(unitPath) {
+	try {
+		const content = await fs$1.readFile(unitPath, "utf8");
+		let workingDirectory = "";
+		let execStart = "";
+		const environment = {};
+		for (const rawLine of content.split("\n")) {
+			const line = rawLine.trim();
+			if (line.startsWith("ExecStart=")) {
+				execStart = line.slice("ExecStart=".length).trim();
+			} else if (line.startsWith("WorkingDirectory=")) {
+				workingDirectory = line.slice("WorkingDirectory=".length).trim();
+			} else if (line.startsWith("Environment=")) {
+				const parsed = parseSystemdEnvAssignment(line.slice("Environment=".length).trim());
+				if (parsed) {
+					environment[parsed.key] = parsed.value;
+				}
+			}
+		}
+		if (!execStart) {
+			return null;
+		}
+		return {
+			programArguments: parseSystemdExecStart(execStart),
+			...workingDirectory ? { workingDirectory } : {},
+			...Object.keys(environment).length > 0 ? { environment } : {},
+			sourcePath: unitPath
+		};
+	} catch {
+		return null;
+	}
+}
+function resolveHostedSystemdService() {
+	const unitPath = findHostedSystemdUnitPath();
+	if (!unitPath) {
+		return null;
+	}
+	const runSystemctl = async (args) => await execFileUtf8("systemctl", args);
+	const runPrivilegedSystemctl = async (args) => await execFileUtf8("sudo", [
+		"-n",
+		"systemctl",
+		...args
+	]);
+	const control = async (action, stdout) => {
+		const args = action === "restart" ? [
+			action,
+			"--no-block",
+			`${SERVICE_NAME}.service`
+		] : [action, `${SERVICE_NAME}.service`];
+		const result = await runPrivilegedSystemctl(args);
+		if (result.code !== 0) {
+			throw new Error(result.stderr || result.stdout || `system service ${action} failed`);
+		}
+		stdout.write(`${action === "restart" ? "Restarted" : "Stopped"} system service: ${SERVICE_NAME}.service\n`);
+	};
+	return {
+		label: "systemd system service",
+		loadedText: "enabled",
+		notLoadedText: "disabled",
+		install: async ({ programArguments, workingDirectory, environment }) => {
+			await installHostedSystemdService({
+				programArguments,
+				workingDirectory,
+				environment
+			});
+		},
+		uninstall: async () => {
+			throw new Error("Hosted system service removal requires the VPS Hosting installer.");
+		},
+		stop: async ({ stdout }) => await control("stop", stdout),
+		restart: async ({ stdout }) => await control("restart", stdout),
+		isLoaded: async () => (await runSystemctl(["is-enabled", `${SERVICE_NAME}.service`])).code === 0,
+		readCommand: async () => await readHostedSystemdCommand(unitPath),
+		readRuntime: async () => {
+			const result = await runSystemctl([
+				"show",
+				`${SERVICE_NAME}.service`,
+				"--no-page",
+				"--property",
+				"ActiveState,SubState,MainPID,ExecMainStatus,ExecMainCode"
+			]);
+			if (result.code !== 0) {
+				return {
+					status: "unknown",
+					detail: result.stderr || result.stdout || undefined
+				};
+			}
+			const parsed = parseSystemdShow(result.stdout);
+			const activeState = parsed.activeState?.toLowerCase();
+			return {
+				status: activeState === "active" ? "running" : activeState ? "stopped" : "unknown",
+				state: parsed.activeState,
+				subState: parsed.subState,
+				pid: parsed.mainPid,
+				lastExitStatus: parsed.execMainStatus,
+				lastExitReason: parsed.execMainCode
+			};
+		}
+	};
+}
+function resolveRunAsUser() {
+	const user = process.env.USER?.trim() || process.env.LOGNAME?.trim() || os.userInfo().username;
+	if (!user || user === "root" || !/^[A-Za-z0-9_.@-]+$/.test(user)) {
+		throw new Error("Hosted gateway repair must run as the non-root Fased app user.");
+	}
+	return user;
+}
+function buildHostedSystemdUnit(params) {
+	const baseUnit = buildSystemdUnit({
+		description: "Fased Gateway (managed)",
+		programArguments: params.programArguments,
+		workingDirectory: params.workingDirectory,
+		environment: params.environment
+	});
+	const lines = baseUnit.split("\n");
+	const serviceIndex = lines.findIndex((line) => line.trim() === "[Service]");
+	if (serviceIndex !== -1) {
+		lines.splice(serviceIndex + 1, 0, "Type=simple", `User=${params.runAsUser}`, `Group=${params.runAsUser}`);
+	}
+	const installIndex = lines.findIndex((line) => line.trim() === "[Install]");
+	if (installIndex !== -1) {
+		lines.splice(installIndex, 0, "NoNewPrivileges=true", "PrivateTmp=true");
+	}
+	const wantedByIndex = lines.findIndex((line) => line.trim() === "WantedBy=default.target");
+	if (wantedByIndex !== -1) {
+		lines[wantedByIndex] = "WantedBy=multi-user.target";
+	}
+	return lines.join("\n");
+}
+async function runHelper(unit, runAsUser) {
+	await fs$1.access(INSTALL_HELPER);
+	await new Promise((resolve, reject) => {
+		const child = spawn("sudo", [
+			"-n",
+			INSTALL_HELPER,
+			SERVICE_NAME,
+			runAsUser
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		const timer = setTimeout(() => {
+			child.kill("SIGTERM");
+			reject(new Error("hosted gateway service helper timed out"));
+		}, 6e4);
+		child.stdout.on("data", (chunk) => {
+			stdout += String(chunk);
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += String(chunk);
+		});
+		child.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			if (code === 0) {
+				resolve();
+			} else {
+				reject(new Error((stderr || stdout || `service helper exited ${code}`).trim()));
+			}
+		});
+		child.stdin.end(unit);
+	});
+}
+async function installHostedSystemdService(params) {
+	if (process.platform !== "linux") {
+		throw new Error("Hosted system service repair is supported on Linux only.");
+	}
+	const runAsUser = resolveRunAsUser();
+	const unit = buildHostedSystemdUnit({
+		...params,
+		runAsUser
+	});
+	await spawnCommand("systemctl", [
+		"--user",
+		"disable",
+		"--now",
+		`${SERVICE_NAME}.service`
+	]).catch(() => undefined);
+	const userUnit = path.join(os.homedir(), ".config", "systemd", "user", `${SERVICE_NAME}.service`);
+	await fs$1.rm(userUnit, { force: true }).catch(() => undefined);
+	await fs$1.rm(`${userUnit}.d`, {
+		recursive: true,
+		force: true
+	}).catch(() => undefined);
+	await spawnCommand("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
+	await runHelper(unit, runAsUser);
+	return { unitPath: `/etc/systemd/system/${SERVICE_NAME}.service` };
+}
+async function spawnCommand(command, args) {
+	await new Promise((resolve, reject) => {
+		const child = spawn(command, args, { stdio: "ignore" });
+		child.on("error", reject);
+		child.on("close", (code) => {
+			if (code === 0) {
+				resolve();
+			} else {
+				reject(new Error(`${command} ${args.join(" ")} exited ${code}`));
+			}
+		});
+	});
+}
+const __testing = {
+	readHostedSystemdCommand,
+	resolveRunAsUser
+};
+
+//#endregion
+export { installHostedSystemdService, resolveHostedSystemdService };

package/dist/daemon/systemd.js

@@ -3,8 +3,8 @@ import { execFileUtf8 } from "./exec-file.js";
 import { formatLine, toPosixPath, writeFormattedLines } from "./output.js";
 import { resolveHomeDir } from "./paths.js";
 import { parseKeyValueOutput } from "./runtime-parse.js";
-import { enableSystemdUserLinger, readSystemdUserLingerStatus } from "./systemd-linger.js";
 import { buildSystemdUnit, parseSystemdEnvAssignment, parseSystemdExecStart } from "./systemd-unit.js";
+import { enableSystemdUserLinger, readSystemdUserLingerStatus } from "./systemd-linger.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 
@@ -354,4 +354,4 @@ async function uninstallLegacySystemdUnits({ env, stdout }) {
 }
 
 //#endregion
-export { installSystemdService, isSystemdServiceEnabled, isSystemdUserServiceAvailable, readSystemdServiceExecStart, readSystemdServiceRuntime, resolveSystemdUserUnitPath, restartSystemdService, stopSystemdService, uninstallLegacySystemdUnits, uninstallSystemdService };
+export { installSystemdService, isSystemdServiceEnabled, isSystemdUserServiceAvailable, parseSystemdShow, readSystemdServiceExecStart, readSystemdServiceRuntime, resolveSystemdUserUnitPath, restartSystemdService, stopSystemdService, uninstallLegacySystemdUnits, uninstallSystemdService };