@homeflare/alchemy 0.25.1 → 0.26.0

package/dist/linux/index.js

@@ -1590,6 +1590,1137 @@ var sshRunner = async (options) => {
     }
   };
 };
+// src/launchd/local-runner.ts
+import { spawn as spawn2 } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { lstat, open, readFile, rename, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+var errnoCode = (cause) => typeof cause === "object" && cause !== null && ("code" in cause) ? String(cause.code) : undefined;
+var absent2 = (cause) => errnoCode(cause) === "ENOENT" || errnoCode(cause) === "ENOTDIR";
+var run2 = (argv, timeoutMs) => new Promise((resolve, reject) => {
+  const [program, ...args] = argv;
+  if (program === undefined) {
+    reject(new Error("exec: empty argv"));
+    return;
+  }
+  const child = spawn2(program, args, {
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: timeoutMs
+  });
+  const out = [];
+  const err = [];
+  child.stdout.on("data", (chunk) => out.push(chunk));
+  child.stderr.on("data", (chunk) => err.push(chunk));
+  child.on("error", (cause) => {
+    reject(new Error(`exec ${program}: ${cause.message}`));
+  });
+  child.on("close", (exitCode, signal) => {
+    const stderr = Buffer.concat(err).toString("utf8");
+    resolve({
+      exitCode: exitCode ?? -1,
+      stderr: signal === null ? stderr : `${stderr}
+(killed by ${signal})`.trim(),
+      stdout: Buffer.concat(out).toString("utf8")
+    });
+  });
+});
+var kindOf = (stats) => {
+  if (stats.isSymbolicLink())
+    return "symlink";
+  if (stats.isFile())
+    return "file";
+  if (stats.isDirectory())
+    return "directory";
+  return "other";
+};
+var writeAtomic = async (path, bytes, options) => {
+  const temp = join(dirname(path), `.${basename(path)}.${randomBytes2(6).toString("hex")}.tmp`);
+  const handle = await open(temp, "wx", 384);
+  try {
+    try {
+      await handle.writeFile(bytes);
+      if (options.uid !== undefined || options.gid !== undefined) {
+        await handle.chown(options.uid ?? -1, options.gid ?? -1);
+      }
+      await handle.chmod(options.mode);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temp, path);
+  } catch (cause) {
+    await unlink(temp).catch(() => {
+      return;
+    });
+    throw cause;
+  }
+};
+var localRunner = (options = {}) => {
+  const timeoutMs = options.execTimeoutMs ?? 120000;
+  const platform = process.platform;
+  return {
+    effectiveUid: () => process.geteuid?.() ?? -1,
+    exec: (argv) => run2(argv, timeoutMs),
+    lookupGroup: async (nameOrId) => {
+      const result = await run2(groupQuery(platform, nameOrId), timeoutMs);
+      return result.exitCode === 0 ? parseGroup(platform, result.stdout) : undefined;
+    },
+    lookupUser: async (nameOrId) => {
+      const result = await run2(userQuery(platform, nameOrId), timeoutMs);
+      return result.exitCode === 0 ? parseUser(platform, result.stdout) : undefined;
+    },
+    privileged: false,
+    readFile: async (path) => {
+      try {
+        return new Uint8Array(await readFile(path));
+      } catch (cause) {
+        if (absent2(cause))
+          return;
+        throw cause;
+      }
+    },
+    removeFile: async (path) => {
+      try {
+        await unlink(path);
+      } catch (cause) {
+        if (!absent2(cause))
+          throw cause;
+      }
+    },
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    stat: async (path) => {
+      try {
+        const stats = await lstat(path);
+        return {
+          dev: stats.dev,
+          gid: stats.gid,
+          ino: stats.ino,
+          kind: kindOf(stats),
+          mode: stats.mode & 4095,
+          size: stats.size,
+          uid: stats.uid
+        };
+      } catch (cause) {
+        if (absent2(cause))
+          return;
+        throw cause;
+      }
+    },
+    writeFileAtomic: writeAtomic
+  };
+};
+
+// src/launchd/job-validate.ts
+var LABEL = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+var RESERVED_LABEL_PREFIXES = [
+  "org.nixos.",
+  "com.apple.",
+  "homebrew.mxcl."
+];
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var RANGES = [
+  ["minute", 0, 59],
+  ["hour", 0, 23],
+  ["day", 1, 31],
+  ["weekday", 0, 7],
+  ["month", 1, 12]
+];
+var isInt = (value, min, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(value) && value >= min && value <= max;
+var calendarProblems = (entries) => {
+  if (entries.length === 0)
+    return ["startCalendarInterval is an empty list; omit it instead"];
+  const found = [];
+  for (const [index, entry] of entries.entries()) {
+    for (const [field, min, max] of RANGES) {
+      const value = entry[field];
+      if (value !== undefined && !isInt(value, min, max)) {
+        found.push(`startCalendarInterval[${String(index)}].${field} must be ${String(min)}–${String(max)}`);
+      }
+    }
+  }
+  return found;
+};
+var absolute = (name, value) => value === undefined || value.startsWith("/") ? [] : [`${name} must be an absolute path`];
+var identityProblems3 = (label, domainText) => {
+  const found = [];
+  if (!LABEL.test(label)) {
+    found.push("label must be 1–200 of [A-Za-z0-9._-], starting with a letter or digit");
+  }
+  const reserved = RESERVED_LABEL_PREFIXES.find((prefix) => label.startsWith(prefix));
+  if (reserved !== undefined) {
+    found.push(`label ${label} is under ${reserved}, which another tool owns; declare a new label`);
+  }
+  if (parseDomain(domainText) === undefined)
+    found.push(`domain must be 'system' or 'gui/<uid>', not ${domainText}`);
+  return found;
+};
+var jobProblems = (props) => {
+  const found = identityProblems3(props.label, props.domain);
+  const domain = parseDomain(props.domain);
+  const [program] = props.programArguments;
+  if (program === undefined)
+    found.push("programArguments must name a program");
+  else if (!program.startsWith("/"))
+    found.push("programArguments[0] must be an absolute path");
+  for (const name of Object.keys(props.environment ?? {})) {
+    if (!ENV_NAME.test(name))
+      found.push(`environment name ${JSON.stringify(name)} is not a valid variable name`);
+  }
+  found.push(...jobSecretProblems(props.environment, props.programArguments, props.extraKeys));
+  if (props.startInterval !== undefined && !isInt(props.startInterval, 1)) {
+    found.push("startInterval must be a positive whole number of seconds");
+  }
+  if (props.throttleInterval !== undefined && !isInt(props.throttleInterval, 0)) {
+    found.push("throttleInterval must be a non-negative whole number of seconds");
+  }
+  const calendar = props.startCalendarInterval;
+  if (calendar !== undefined) {
+    found.push(...calendarProblems(Array.isArray(calendar) ? calendar : [calendar]));
+  }
+  const keepAlive = props.keepAlive;
+  if (typeof keepAlive === "object" && keepAlive.successfulExit === undefined && keepAlive.crashed === undefined) {
+    found.push("keepAlive {} names no condition; use true, false, or a condition");
+  }
+  found.push(...absolute("standardOutPath", props.standardOutPath));
+  found.push(...absolute("standardErrorPath", props.standardErrorPath));
+  found.push(...absolute("workingDirectory", props.workingDirectory));
+  if (domain?.kind === "gui" && (props.userName !== undefined || props.groupName !== undefined)) {
+    found.push("userName/groupName apply only to the system domain; launchd ignores them for agents");
+  }
+  for (const key of Object.keys(props.extraKeys ?? {})) {
+    if (OWNED_KEYS.includes(key))
+      found.push(`extraKeys.${key} is owned by a typed prop; use that instead`);
+  }
+  return found;
+};
+
+// src/launchd/launchctl.ts
+var LAUNCHCTL = "/bin/launchctl";
+var NOT_FOUND = 113;
+var NO_DOMAIN = 112;
+var NO_DOMAIN_TEXT = "Could not find domain";
+
+class LaunchctlError extends Error {
+  constructor(command, exitCode, stderr) {
+    super(`launchctl ${command} -> ${String(exitCode)}: ${stderr.trim().slice(0, 300)}`);
+    this.name = "LaunchctlError";
+  }
+}
+var printFields = (stdout) => {
+  const fields = new Map;
+  const closers = [];
+  for (const line of stdout.split(`
+`)) {
+    if (closers.length === 0) {
+      if (fields.size === 0 && line.endsWith(" = {"))
+        closers.push("}");
+      continue;
+    }
+    if (line === closers[closers.length - 1]) {
+      closers.pop();
+      continue;
+    }
+    const opened = /^(\t+)\S.* = \{$/.exec(line);
+    if (opened?.[1] !== undefined && opened[1].length === closers.length) {
+      closers.push(`${opened[1]}}`);
+      continue;
+    }
+    const field = closers.length === 1 ? /^\t([a-z][a-z ]*[a-z]) = (.*)$/.exec(line) : null;
+    if (field?.[1] !== undefined && field[2] !== undefined && !fields.has(field[1])) {
+      fields.set(field[1], field[2]);
+    }
+  }
+  return fields;
+};
+var leadingInt = (text) => {
+  const match = text === undefined ? null : /^(-?\d+)/.exec(text);
+  return match?.[1] === undefined ? undefined : Number(match[1]);
+};
+var parsePrint = (stdout) => {
+  const fields = printFields(stdout);
+  const state = fields.get("state");
+  const pid = leadingInt(fields.get("pid"));
+  const lastExitCode = leadingInt(fields.get("last exit code"));
+  return {
+    loaded: true,
+    ...state === undefined ? {} : { state },
+    ...pid === undefined ? {} : { pid },
+    ...lastExitCode === undefined ? {} : { lastExitCode }
+  };
+};
+var parseDisabled = (stdout) => {
+  const disabled = new Set;
+  for (const match of stdout.matchAll(/^\s*"([^"]+)" => (\w+)\s*$/gm)) {
+    if (match[1] !== undefined && (match[2] === "disabled" || match[2] === "true")) {
+      disabled.add(match[1]);
+    }
+  }
+  return disabled;
+};
+var printService = async (runner, target) => {
+  const result = await runner.exec([LAUNCHCTL, "print", target]);
+  if (result.exitCode === NOT_FOUND)
+    return { loaded: false };
+  if (result.exitCode === NO_DOMAIN && result.stderr.includes(NO_DOMAIN_TEXT)) {
+    return { domainMissing: true, loaded: false };
+  }
+  if (result.exitCode !== 0)
+    throw new LaunchctlError(`print ${target}`, result.exitCode, result.stderr);
+  return parsePrint(result.stdout);
+};
+var isDisabled = async (runner, domain, label) => {
+  const result = await runner.exec([LAUNCHCTL, "print-disabled", domain]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`print-disabled ${domain}`, result.exitCode, result.stderr);
+  }
+  return parseDisabled(result.stdout).has(label);
+};
+var bootstrap = async (runner, domain, plistPath) => {
+  const result = await runner.exec([LAUNCHCTL, "bootstrap", domain, plistPath]);
+  if (result.exitCode !== 0) {
+    throw new LaunchctlError(`bootstrap ${domain} ${plistPath}`, result.exitCode, result.stderr);
+  }
+};
+var waitUnloaded = async (runner, target, attempts = 120, intervalMs = 250) => {
+  for (let attempt = 0;attempt < attempts; attempt += 1) {
+    if (!(await printService(runner, target)).loaded)
+      return;
+    await runner.sleep(intervalMs);
+  }
+  throw new Error(`${target} is still loaded ${String(attempts * intervalMs / 1000)}s after bootout`);
+};
+var bootoutIfLoaded = async (runner, target) => {
+  if (!(await printService(runner, target)).loaded)
+    return;
+  const result = await runner.exec([LAUNCHCTL, "bootout", target]);
+  try {
+    await waitUnloaded(runner, target);
+  } catch (cause) {
+    if (result.exitCode === 0)
+      throw cause;
+    throw new LaunchctlError(`bootout ${target}`, result.exitCode, `${result.stderr.trim()} (and still loaded after waiting)`);
+  }
+};
+
+// src/launchd/sudo-allowlist.ts
+class SudoRefusedError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SudoRefusedError";
+  }
+}
+var SUDO = "/usr/bin/sudo";
+var INSTALL = "/usr/bin/install";
+var RM = "/bin/rm";
+var WRITES = new Set(["bootstrap", "bootout", "kickstart"]);
+var octalMode = (mode) => Number.isSafeInteger(mode) && mode >= 0 && mode <= 4095 ? mode.toString(8).padStart(4, "0") : undefined;
+var checkPrefixes = (prefixes) => {
+  if (prefixes.length === 0) {
+    throw new Error("sudoRunner: no prefixes. Name the directories root may write, e.g. /Library/LaunchDaemons.");
+  }
+  for (const prefix of prefixes) {
+    const found = prefix === "/" ? ['"/" would allow every path'] : pathProblems(prefix);
+    if (found.length > 0) {
+      throw new Error(`sudoRunner: prefix ${JSON.stringify(prefix)}: ${found.join("; ")}`);
+    }
+  }
+  return [...prefixes];
+};
+var prefixOf = (path, prefixes) => pathProblems(path).length > 0 ? undefined : prefixes.find((prefix) => path.startsWith(`${prefix}/`));
+var labelOk = (label) => LABEL.test(label) && !RESERVED_LABEL_PREFIXES.some((prefix) => label.startsWith(prefix));
+var systemLabel = (target) => {
+  const label = target?.startsWith("system/") === true ? target.slice("system/".length) : undefined;
+  return label !== undefined && labelOk(label) ? label : undefined;
+};
+var daemonPlist = (label, prefixes) => {
+  const path = plistPathFor(label, { kind: "system" }, undefined);
+  return prefixOf(path, prefixes) === undefined ? undefined : path;
+};
+var NO_DAEMON_PREFIX = "needs /Library/LaunchDaemons among the prefixes, where the job’s plist is written and removed";
+var launchctlProblem = (args, prefixes) => {
+  const [sub, ...rest] = args;
+  if (sub === "bootstrap") {
+    const given = rest[1] ?? "";
+    const name = given.slice(given.lastIndexOf("/") + 1);
+    const label = name.endsWith(".plist") ? name.slice(0, -".plist".length) : "";
+    const shaped = rest.length === 2 && rest[0] === "system" && labelOk(label);
+    if (!shaped)
+      return "bootstrap takes exactly `system /Library/LaunchDaemons/<label>.plist`";
+    const plist = daemonPlist(label, prefixes);
+    if (plist === undefined)
+      return `bootstrap ${NO_DAEMON_PREFIX}`;
+    return given === plist ? undefined : `bootstrap loads only ${plist}, never another path`;
+  }
+  if (sub === "bootout") {
+    const label = rest.length === 1 ? systemLabel(rest[0]) : undefined;
+    if (label === undefined)
+      return "bootout takes exactly `system/<label>`, never a bare domain";
+    return daemonPlist(label, prefixes) === undefined ? `bootout ${NO_DAEMON_PREFIX}` : undefined;
+  }
+  if (sub === "kickstart") {
+    const flags = rest.slice(0, -1);
+    const flagsOk = flags.every((flag) => flag === "-k" || flag === "-p") && new Set(flags).size === flags.length;
+    return flagsOk && systemLabel(rest[rest.length - 1]) !== undefined ? undefined : "kickstart takes only -k / -p, then `system/<label>`";
+  }
+  return `launchctl ${String(sub)} is never run as root`;
+};
+var ID = /^\d+$/;
+var idsOk = (ids) => {
+  const [flag, id, second, secondId] = ids;
+  if (ids.length === 0)
+    return true;
+  if (ids.length === 2)
+    return (flag === "-o" || flag === "-g") && ID.test(id ?? "");
+  return ids.length === 4 && flag === "-o" && ID.test(id ?? "") && second === "-g" && ID.test(secondId ?? "");
+};
+var privilegedProblem = (argv, context) => {
+  const [program, ...args] = argv;
+  const under = (path) => path !== undefined && prefixOf(path, context.prefixes) !== undefined;
+  if (program === LAUNCHCTL)
+    return launchctlProblem(args, context.prefixes);
+  if (program === INSTALL) {
+    const [safe, m, mode, ...rest] = args;
+    if (safe !== "-S" || m !== "-m" || mode === undefined || !/^[0-7]{4}$/.test(mode)) {
+      return "install takes exactly `-S -m <4 octal digits> [-o <uid>] [-g <gid>] <staged> <dest>`";
+    }
+    if (rest.length < 2 || !idsOk(rest.slice(0, -2)))
+      return "install takes only -o <uid> -g <gid>";
+    const [source, dest] = rest.slice(-2);
+    if (source === undefined || source !== context.staged) {
+      return "install copies only the file this runner staged";
+    }
+    return under(dest) ? undefined : "install destination is not under a declared prefix";
+  }
+  if (program === RM) {
+    const [force, end, path, ...extra] = args;
+    return force === "-f" && end === "--" && extra.length === 0 && under(path) ? undefined : "rm takes exactly `-f -- <path under a declared prefix>`";
+  }
+  return `${String(program)} is not on the sudo allowlist`;
+};
+var routeExec = (argv, operatorUid) => {
+  const [program, sub] = argv;
+  if (program === "sudo" || program?.endsWith("/sudo") === true) {
+    return {
+      refuse: "sudoRunner never passes a sudo argv through; it elevates only its allowlist"
+    };
+  }
+  if (program !== LAUNCHCTL || sub === undefined || !WRITES.has(sub))
+    return { as: "operator" };
+  const target = sub === "kickstart" ? argv[argv.length - 1] : argv[2];
+  if (target === "system" || target?.startsWith("system/") === true)
+    return { as: "root" };
+  const owner = /^(?:gui|user)\/(\d+)(?:\/|$)/.exec(target ?? "")?.[1];
+  if (owner === undefined || Number(owner) === operatorUid)
+    return { as: "operator" };
+  return {
+    refuse: `launchctl ${sub} ${String(target)}: that domain belongs to uid ${owner}, and sudoRunner ` + "elevates only the system domain. Deploy as that user, or as root."
+  };
+};
+
+// src/launchd/sudo-said.ts
+var PASSWORD = /^sudo: (?:a password is required|a terminal is required|sorry, you must have a tty)/m;
+var NOT_ALLOWED = /^(?:Sorry, user \S+ (?:is not allowed to execute|may not run sudo)|\S+ is not (?:in the sudoers file|allowed to run sudo on ))/m;
+var undeclared = (path, prefixes) => (cause) => {
+  const code = errnoCode(cause);
+  if (code !== "EACCES" && code !== "EPERM")
+    throw cause;
+  throw new Error(`sudoRunner ${path}: ${code} as the deploying user, and the path is under no declared prefix ` + `(${prefixes.join(", ")}). If root owns its directory, declare that directory as a prefix.`, { cause });
+};
+var sudoRefusal = (shown, result) => {
+  if (result.exitCode !== 1)
+    return;
+  if (PASSWORD.test(result.stderr)) {
+    return new SudoRefusedError(`sudo -n ${shown}: a password is required, and this runner never prompts. Run \`sudo -v\` ` + "in the deploying terminal just before the deploy, or grant exactly these commands " + "NOPASSWD (docs/launchd-sudo.md). The command did not run.");
+  }
+  if (NOT_ALLOWED.test(result.stderr)) {
+    return new SudoRefusedError(`sudo -n ${shown}: sudoers does not let the deploying user run this. The command did not run.`);
+  }
+  return;
+};
+
+// src/linux/sudo-allowlist-dir.ts
+var MKDIR = "/usr/bin/mkdir";
+var CHMOD = "/usr/bin/chmod";
+var CHOWN = "/usr/bin/chown";
+var RMDIR = "/usr/bin/rmdir";
+var parseDirMode = (text) => /^([0-7]{3}|[1-7][0-7]{3})$/.test(text) ? Number.parseInt(text, 8) : undefined;
+var DANGEROUS_MODE_BITS = 3090;
+var dirModeProblem = (mode) => {
+  if (mode === undefined)
+    return "mode";
+  return (mode & DANGEROUS_MODE_BITS) !== 0 ? "a mode with setuid/setgid or group/other write (this runner installs only 0–0o777 minus 0o022, no special bits)" : undefined;
+};
+var ROOT_OWNER = /^(\+0|:\+0|\+0:\+0)$/;
+var dirProgramProblem = (program, args, prefixes) => {
+  const under = (path2) => path2 !== undefined && prefixOf(path2, prefixes) !== undefined;
+  if (program === MKDIR) {
+    const [m, modeText, end2, path2, ...extra2] = args;
+    const mode = modeText === undefined ? undefined : parseDirMode(modeText);
+    if (m !== "-m" || mode === undefined || end2 !== "--" || extra2.length !== 0 || !under(path2)) {
+      return "mkdir takes exactly `-m <octal> -- <path under a declared prefix>`";
+    }
+    return dirModeProblem(mode);
+  }
+  if (program === CHMOD) {
+    const [modeText, end2, path2, ...extra2] = args;
+    const mode = modeText === undefined ? undefined : parseDirMode(modeText);
+    if (mode === undefined || end2 !== "--" || extra2.length !== 0 || !under(path2)) {
+      return "chmod takes exactly `<octal> -- <path under a declared prefix>`";
+    }
+    return dirModeProblem(mode);
+  }
+  if (program === CHOWN) {
+    const [owner, end2, path2, ...extra2] = args;
+    return owner !== undefined && ROOT_OWNER.test(owner) && end2 === "--" && extra2.length === 0 && under(path2) ? undefined : "chown takes exactly `+0`, `:+0` or `+0:+0` -- <path under a declared prefix>` — root " + "only, forced numeric; a directory this runner elevates never hands ownership to anyone else";
+  }
+  const [end, path, ...extra] = args;
+  return end === "--" && extra.length === 0 && under(path) ? undefined : "rmdir takes exactly `-- <path under a declared prefix>`";
+};
+
+// src/linux/sudo-allowlist-chown.ts
+var forceNumericOwner = (spec) => {
+  const [uidPart, gidPart] = spec.includes(":") ? spec.split(":") : [spec, undefined];
+  const uid = uidPart === undefined || uidPart === "" ? "" : `+${uidPart}`;
+  const gid = gidPart === undefined ? "" : `:+${gidPart}`;
+  return `${uid}${gid}`;
+};
+var SAFE_OWNER = /^(\+\d+(:\+\d+)?|:\+\d+)$/;
+var fileChownProblem = (args, temp) => {
+  const [owner, end, path, ...extra] = args;
+  if (owner !== undefined && SAFE_OWNER.test(owner) && end === "--" && extra.length === 0 && path === temp) {
+    return;
+  }
+  return "chown on the staged temp takes exactly `+<uid>`, `:+<gid>` or `+<uid>:+<gid>` -- " + "<the exact temp install just wrote>, numeric and +-forced";
+};
+var chownProblem = (args, context) => {
+  const path = args[args.length - 1];
+  if (context.temp !== undefined && path === context.temp)
+    return fileChownProblem(args, context.temp);
+  return dirProgramProblem(CHOWN, args, context.prefixes);
+};
+// src/linux/sudo-allowlist.ts
+var MV = "/usr/bin/mv";
+var RM2 = "/usr/bin/rm";
+var SYSTEMCTL_ABS = "/usr/bin/systemctl";
+var DIRECTORY_PROGRAMS = new Set([
+  "mkdir",
+  "chmod",
+  "chown",
+  "rmdir"
+]);
+var DIRECTORY_PROGRAMS_ABS = new Set([MKDIR, CHMOD, CHOWN, RMDIR]);
+var ABS_OF = {
+  chmod: CHMOD,
+  chown: CHOWN,
+  mkdir: MKDIR,
+  rmdir: RMDIR,
+  systemctl: SYSTEMCTL_ABS
+};
+var canonicalize = (argv) => {
+  const abs = ABS_OF[argv[0] ?? ""];
+  const program = abs ?? argv[0];
+  if (program === CHOWN) {
+    const [owner, ...rest] = argv.slice(1);
+    return [CHOWN, owner === undefined ? "" : forceNumericOwner(owner), ...rest];
+  }
+  return abs === undefined ? argv : [abs, ...argv.slice(1)];
+};
+var dirOf = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var installProblem = (args, context) => {
+  const [m, mode, t, dd, source, dest, ...extra] = args;
+  if (m !== "-m" || mode === undefined || !/^[0-7]{4}$/.test(mode) || t !== "-T" || dd !== "--" || extra.length !== 0) {
+    return "install takes exactly `-m <4 octal digits> -T -- <staged> <temp>`";
+  }
+  if (source === undefined || source !== context.staged) {
+    return "install copies only the file this runner staged";
+  }
+  if (dest === undefined || dest !== context.temp) {
+    return "install writes only the derived temp path for this write";
+  }
+  return prefixOf(dest, context.prefixes) === undefined ? "install destination is not under a declared prefix" : undefined;
+};
+var mvProblem = (args, context) => {
+  const [f, t, dd, source, dest] = args;
+  if (f !== "-f" || t !== "-T" || dd !== "--" || args.length !== 5) {
+    return "mv takes exactly `-f -T -- <temp> <dest>`";
+  }
+  if (source === undefined || source !== context.temp) {
+    return "mv moves only the temp path this runner just installed to";
+  }
+  if (dest === undefined || prefixOf(dest, context.prefixes) === undefined) {
+    return "mv destination is not under a declared prefix";
+  }
+  return dirOf(source) === dirOf(dest) ? undefined : "mv must stay inside the destination’s directory";
+};
+var rmProblem = (args, context) => {
+  const [force, end, path, ...extra] = args;
+  return force === "-f" && end === "--" && extra.length === 0 && path !== undefined && prefixOf(path, context.prefixes) !== undefined ? undefined : "rm takes exactly `-f -- <path under a declared prefix>`";
+};
+var BANNED_SYSTEMCTL_FLAGS = new Set([
+  "--user",
+  "--global",
+  "-H",
+  "-M",
+  "--root"
+]);
+var UNIT_WRITE_VERBS = new Set([
+  "enable",
+  "disable",
+  "start",
+  "stop",
+  "restart"
+]);
+var systemctlProblem = (args, prefixes) => {
+  if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {
+    return "systemctl --user/--global/-H/-M/--root is never run as root";
+  }
+  const [verb, ...rest] = args;
+  if (verb === "daemon-reload")
+    return rest.length === 0 ? undefined : "daemon-reload takes no operands";
+  if (verb !== undefined && UNIT_WRITE_VERBS.has(verb)) {
+    const [dd, unit, ...extra] = rest;
+    return dd === "--" && unit !== undefined && NAME.test(unit) && extra.length === 0 ? undefined : `${verb} takes exactly \`-- <unit>\``;
+  }
+  return `systemctl ${String(verb)} is never run as root`;
+};
+var privilegedProblem2 = (argv, context) => {
+  const [program, ...args] = argv;
+  if (program === INSTALL)
+    return installProblem(args, context);
+  if (program === MV)
+    return mvProblem(args, context);
+  if (program === RM2)
+    return rmProblem(args, context);
+  if (program === SYSTEMCTL_ABS)
+    return systemctlProblem(args, context.prefixes);
+  if (program === CHOWN)
+    return chownProblem(args, context);
+  if (program === MKDIR || program === CHMOD || program === RMDIR) {
+    return dirProgramProblem(program, args, context.prefixes);
+  }
+  return `${String(program)} is not on the sudo allowlist`;
+};
+var routeExec2 = (argv, prefixes) => {
+  const [program, ...args] = argv;
+  if (program === "sudo" || program?.endsWith("/sudo") === true) {
+    return {
+      refuse: "sshSudoRunner never passes a sudo argv through; it elevates only its allowlist"
+    };
+  }
+  if (program === "systemctl" || program === SYSTEMCTL_ABS) {
+    if (args.some((arg) => BANNED_SYSTEMCTL_FLAGS.has(arg))) {
+      return { refuse: "sshSudoRunner refuses systemctl --user/--global/-H/-M/--root" };
+    }
+    const [verb] = args;
+    return verb === "daemon-reload" || verb !== undefined && UNIT_WRITE_VERBS.has(verb) ? { as: "root" } : { as: "operator" };
+  }
+  if (DIRECTORY_PROGRAMS.has(program ?? "") || DIRECTORY_PROGRAMS_ABS.has(program ?? "")) {
+    const path = args[args.length - 1];
+    return path !== undefined && prefixOf(path, prefixes) !== undefined ? { as: "root" } : { as: "operator" };
+  }
+  return { as: "operator" };
+};
+
+// src/launchd/sudo-acl.ts
+var LS = "/bin/ls";
+var WRITE_RIGHTS = new Set([
+  "add_file",
+  "add_subdirectory",
+  "append",
+  "chown",
+  "delete",
+  "delete_child",
+  "write",
+  "writesecurity"
+]);
+var ENTRY = /^\s*\d+:\s+\S+\s+(?:inherited\s+)?allow\s+(\S+)/;
+var aclGrants = (listing) => listing.split(`
+`).filter((line) => {
+  const rights = ENTRY.exec(line)?.[1];
+  return rights !== undefined && rights.split(",").some((right) => WRITE_RIGHTS.has(right));
+}).map((line) => line.trim());
+var assertNoAclGrants = async (base, path, chain) => {
+  const listed = await base.exec([LS, "-lden", "--", ...chain]);
+  if (listed.exitCode !== 0) {
+    throw new SudoRefusedError(`sudoRunner ${path}: could not read the ACLs of the directories from / down to it ` + `(${LS} -lden exit ${String(listed.exitCode)}). Nothing ran as root.`);
+  }
+  const grants = aclGrants(listed.stdout);
+  if (grants.length === 0)
+    return;
+  throw new SudoRefusedError(`sudoRunner ${path}: a directory from / down to it carries an ACL that lets someone other ` + `than root change what it holds (${grants.join("; ")}). Remove the entry (chmod -a), or ` + "declare a prefix without one. Nothing ran as root.");
+};
+
+// src/launchd/sudo-guard-mode.ts
+var refuse5 = (path, message) => new SudoRefusedError(`sudoRunner ${path}: ${message}`);
+var modeProblem = (options) => {
+  const rootAdjacent = options.uid === undefined || options.uid === 0 || options.gid === undefined || options.gid === 0;
+  if (!rootAdjacent)
+    return;
+  const found = [];
+  if ((options.mode & 3072) !== 0)
+    found.push("setuid/setgid");
+  if ((options.mode & 18) !== 0)
+    found.push("writable by group or other");
+  if (found.length === 0)
+    return;
+  return `mode ${options.mode.toString(8).padStart(4, "0")} is ${found.join(" and ")} on a root-owned file`;
+};
+var canRead = (file, uid, groups) => {
+  if (uid === 0)
+    return true;
+  if (file.uid === uid)
+    return (file.mode & 256) !== 0;
+  const groupRead = (file.mode & 32) !== 0;
+  const otherRead = (file.mode & 4) !== 0;
+  if (groupRead === otherRead)
+    return groupRead;
+  if (groups === undefined)
+    return;
+  return groups.includes(file.gid) ? groupRead : otherRead;
+};
+var assertReadableBack = async (base, path, options, groups) => {
+  const operator = base.effectiveUid();
+  const parent = path.slice(0, path.lastIndexOf("/")) || "/";
+  const gid = options.gid ?? (await base.stat(parent))?.gid ?? 0;
+  const file = { gid, mode: options.mode, uid: options.uid ?? 0 };
+  if (canRead(file, operator, groups) !== false)
+    return;
+  throw refuse5(path, `owner ${String(file.uid)}, group ${String(gid)}, mode ${file.mode.toString(8)} would hide it ` + `from the deploying user (uid ${String(operator)}), who reads every file back. Declare a ` + "mode that user can read, or deploy as root. Nothing was written.");
+};
+var operatorGroups = async (base) => {
+  const result = await base.exec(["/usr/bin/id", "-G"]);
+  const ids = result.stdout.trim().split(/\s+/);
+  return result.exitCode === 0 && ids.every((id) => /^\d+$/.test(id)) ? ids.map(Number) : undefined;
+};
+
+// src/launchd/sudo-guard.ts
+var refuse6 = (path, message) => new SudoRefusedError(`sudoRunner ${path}: ${message}`);
+var betweenDirs = (prefix, path) => {
+  const parts = path.slice(prefix.length + 1).split("/").slice(0, -1);
+  return parts.map((_, index) => `${prefix}/${parts.slice(0, index + 1).join("/")}`);
+};
+var aboveDirs = (prefix) => {
+  const parts = prefix.split("/").slice(1, -1);
+  return ["/", ...parts.map((_, index) => `/${parts.slice(0, index + 1).join("/")}`)];
+};
+var rootOnlyProblem = (stat) => {
+  if (stat === undefined)
+    return "is missing";
+  if (stat.kind !== "directory")
+    return `is a ${stat.kind}, not a directory`;
+  if (stat.uid !== 0)
+    return `is owned by uid ${String(stat.uid)}, not root`;
+  if ((stat.mode & 18) !== 0) {
+    return `is writable by group or other (mode ${stat.mode.toString(8).padStart(4, "0")})`;
+  }
+  return;
+};
+var assertPlainPath = async (base, prefix, path, expect) => {
+  const above = aboveDirs(prefix);
+  for (const [index, stat] of (await Promise.all(above.map((dir) => base.stat(dir)))).entries()) {
+    const up = stat?.kind === "symlink" && stat.uid === 0 ? undefined : rootOnlyProblem(stat);
+    if (up !== undefined) {
+      throw refuse6(path, `${String(above[index])}, above the declared prefix ${prefix}, ${up}. Whoever may change it ` + "may swap the prefix itself; every directory from / down must be root-only. Nothing ran as root.");
+    }
+  }
+  const dirs = betweenDirs(prefix, path);
+  const [prefixStat, ...stats] = await Promise.all([prefix, ...dirs].map((dir) => base.stat(dir)));
+  const bad = rootOnlyProblem(prefixStat);
+  if (bad !== undefined) {
+    throw refuse6(path, `the declared prefix ${prefix} ${bad}. Declare only a real directory that root owns and ` + "only root may write. Nothing ran as root.");
+  }
+  for (const [index, stat] of stats.entries()) {
+    const dir = String(dirs[index]);
+    if (stat?.kind !== "directory") {
+      throw refuse6(path, `${dir} is ${stat === undefined ? "missing" : `a ${stat.kind}`}; root ` + "writes only through real directories under a declared prefix.");
+    }
+    const below = rootOnlyProblem(stat);
+    if (below !== undefined) {
+      throw refuse6(path, `${dir} ${below}. Every directory from the prefix ${prefix} down to the file must be one ` + "that root owns and only root may write. Nothing ran as root.");
+    }
+  }
+  await assertNoAclGrants(base, path, [...above, prefix, ...dirs]);
+  const target = await base.stat(path);
+  if (target === undefined && expect === "file-or-absent")
+    return "absent";
+  if (target?.kind === "file")
+    return "file";
+  throw refuse6(path, `is ${target === undefined ? "missing" : `a ${target.kind}`}, not a file`);
+};
+var assertInstallable = async (base, prefix, path, options, groups) => {
+  const mode = modeProblem(options);
+  if (mode !== undefined) {
+    throw refuse6(path, `${mode}. Declare a mode without those bits (0644, 0640, 0755), or give the file to its ` + "real owner. Nothing ran as root.");
+  }
+  await assertPlainPath(base, prefix, path, "file-or-absent");
+  await assertReadableBack(base, path, options, groups);
+};
+
+// src/linux/sudo-listing.ts
+var KINDS2 = new Map([
+  ["-", "file"],
+  ["d", "directory"],
+  ["l", "symlink"]
+]);
+var permBits = (perms) => {
+  if (perms.length !== 9)
+    return;
+  let mode = 0;
+  for (const index of [0, 1, 2]) {
+    const at = index * 3;
+    const shift = 6 - at;
+    const [read, write, exec] = [perms[at], perms[at + 1], perms[at + 2]];
+    if (read !== "r" && read !== "-" || write !== "w" && write !== "-")
+      return;
+    if (read === "r")
+      mode |= 4 << shift;
+    if (write === "w")
+      mode |= 2 << shift;
+    const [set, unset] = index === 2 ? ["t", "T"] : ["s", "S"];
+    if (exec === "x" || exec === set)
+      mode |= 1 << shift;
+    else if (exec !== "-" && exec !== unset)
+      return;
+    if (exec === set || exec === unset)
+      mode |= 2048 >> index;
+  }
+  return mode;
+};
+var LINE = /^([-dlbcps])(\S{9})([+.@]?)\s+\d+\s+(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/;
+var nameOf = (tail, paths) => [...paths].sort((left, right) => right.length - left.length).find((path) => tail.endsWith(` ${path}`) || tail.includes(` ${path} -> `));
+var parseListing = (stdout, paths) => {
+  const entries = new Map;
+  for (const line of stdout.split(`
+`).filter((text) => text.trim() !== "")) {
+    const match = LINE.exec(line);
+    if (match === null)
+      return;
+    const [, type, perms, flag, uid, gid, size, tail] = match;
+    const mode = permBits(perms ?? "");
+    const path = nameOf(tail ?? "", paths);
+    if (mode === undefined || path === undefined || entries.has(path))
+      return;
+    entries.set(path, {
+      acl: flag === "+",
+      gid: Number(gid),
+      kind: KINDS2.get(type ?? "") ?? "other",
+      mode,
+      size: Number(size),
+      uid: Number(uid)
+    });
+  }
+  return entries.size === paths.length ? entries : undefined;
+};
+var readListing = async (base, ls, what, paths) => {
+  const result = await base.exec([ls, "-ldn", "--", ...paths]);
+  const entries = result.exitCode === 0 ? parseListing(result.stdout, paths) : undefined;
+  if (entries === undefined) {
+    throw new SudoRefusedError(`sudoRunner ${what}: could not read ${paths.join(", ")} (${ls} -ldn exit ` + `${String(result.exitCode)}: ${result.stderr.trim().slice(0, 200)}). Nothing ran as root.`);
+  }
+  return entries;
+};
+
+// src/linux/sudo-guard.ts
+var refuse7 = (path, message) => new SudoRefusedError(`sshSudoRunner ${path}: ${message}`);
+var rootOnlyProblem2 = (entry) => {
+  if (entry === undefined)
+    return "is missing";
+  if (entry.kind !== "directory")
+    return `is a ${entry.kind}, not a directory`;
+  if (entry.uid !== 0)
+    return `is owned by uid ${String(entry.uid)}, not root`;
+  if ((entry.mode & 18) !== 0) {
+    return `is writable by group or other (mode ${entry.mode.toString(8).padStart(4, "0")})`;
+  }
+  if (entry.acl)
+    return "carries a POSIX ACL this runner cannot verify the grants of (ls -ldn `+`)";
+  return;
+};
+var targetProblem = (entry, expect) => {
+  if (expect === "absent")
+    return entry === undefined ? undefined : `already exists (a ${entry.kind})`;
+  if (entry === undefined)
+    return expect === "file-or-absent" ? undefined : "is missing";
+  if (expect === "file-or-absent")
+    return entry.kind === "file" ? undefined : `is a ${entry.kind}, not a file`;
+  return entry.kind === expect ? undefined : `is a ${entry.kind}, not a ${expect}`;
+};
+var assertGuardedChain = async (base, prefix, path, expect) => {
+  const above = aboveDirs(prefix);
+  const between = betweenDirs(prefix, path);
+  const chain = [...above, prefix, ...between];
+  const listed = await readListing(base, "/usr/bin/ls", path, chain);
+  for (const dir of above) {
+    const entry = listed.get(dir);
+    const problem2 = entry?.kind === "symlink" && entry.uid === 0 ? undefined : rootOnlyProblem2(entry);
+    if (problem2 !== undefined) {
+      throw refuse7(path, `${dir}, above the declared prefix ${prefix}, ${problem2}. Whoever may change it may swap ` + "the prefix itself; every directory from / down must be root-only. Nothing ran as root.");
+    }
+  }
+  const prefixProblem = rootOnlyProblem2(listed.get(prefix));
+  if (prefixProblem !== undefined) {
+    throw refuse7(path, `the declared prefix ${prefix} ${prefixProblem}. Declare only a real directory that root ` + "owns and only root may write. Nothing ran as root.");
+  }
+  for (const dir of between) {
+    const problem2 = rootOnlyProblem2(listed.get(dir));
+    if (problem2 !== undefined) {
+      throw refuse7(path, `${dir} ${problem2}. Every directory from the prefix ${prefix} down to the file must be ` + "one that root owns and only root may write. Nothing ran as root.");
+    }
+  }
+  const target = await base.stat(path);
+  const problem = targetProblem(target, expect);
+  if (problem !== undefined)
+    throw refuse7(path, `${problem}. Nothing ran as root.`);
+  return target;
+};
+var assertInstallable2 = async (base, prefix, path, options, groups) => {
+  const mode = modeProblem(options);
+  if (mode !== undefined) {
+    throw refuse7(path, `${mode}. Declare a mode without those bits (0644, 0640, 0755), or give the file to its ` + "real owner. Nothing ran as root.");
+  }
+  await assertGuardedChain(base, prefix, path, "file-or-absent");
+  await assertReadableBack(base, path, options, groups);
+};
+
+// src/linux/sudo-exec.ts
+var DIR_EXPECT = {
+  chmod: "directory",
+  chown: "directory",
+  mkdir: "absent",
+  rmdir: "directory"
+};
+var EMPTY_FRAGMENT_OK = new Set(["stop", "disable"]);
+var unitStatusOf = async (base, unit) => {
+  const result = await base.exec([
+    SYSTEMCTL_ABS,
+    "show",
+    "--no-pager",
+    "-p",
+    "FragmentPath,LoadState",
+    "--",
+    unit
+  ]);
+  if (result.exitCode !== 0) {
+    throw new SudoRefusedError(`sshSudoRunner ${unit}: could not read FragmentPath/LoadState (systemctl show exit ` + `${String(result.exitCode)}). Nothing ran as root.`);
+  }
+  const fields = parseShow(result.stdout);
+  return {
+    fragmentPath: fields.get("FragmentPath") ?? "",
+    loadState: fields.get("LoadState") ?? ""
+  };
+};
+var elevatedExec = (base, elevate, prefixes, argv) => {
+  const canonical = canonicalize(argv);
+  const expect = DIR_EXPECT[argv[0] ?? ""];
+  if (expect !== undefined) {
+    const path = argv[argv.length - 1] ?? "";
+    const prefix = prefixOf(path, prefixes);
+    return elevate(canonical, {}, async () => {
+      if (prefix === undefined) {
+        throw new SudoRefusedError(`sshSudoRunner ${path}: not under a declared prefix. Nothing ran as root.`);
+      }
+      await assertGuardedChain(base, prefix, path, expect);
+    });
+  }
+  if (canonical[0] !== SYSTEMCTL_ABS || canonical[1] === "daemon-reload")
+    return elevate(canonical);
+  const verb = canonical[1] ?? "";
+  const unit = canonical[3] ?? "";
+  return elevate(canonical, {}, async () => {
+    const { fragmentPath, loadState } = await unitStatusOf(base, unit);
+    if (loadState === "masked") {
+      throw new SudoRefusedError(`sshSudoRunner ${unit}: is masked. Masking is someone's decision, not drift; unmask it ` + "deliberately, then redeploy. Nothing ran as root.");
+    }
+    if (fragmentPath === "") {
+      if (EMPTY_FRAGMENT_OK.has(verb))
+        return;
+      throw new SudoRefusedError(`sshSudoRunner ${unit}: has no unit file (FragmentPath empty), and ${verb} is not ` + "stop/disable — refusing rather than run it against whatever systemd currently thinks " + `${unit} is (a kernel-generated unit, say). Nothing ran as root.`);
+    }
+    if (prefixOf(fragmentPath, prefixes) === undefined) {
+      throw new SudoRefusedError(`sshSudoRunner ${unit}: FragmentPath ${fragmentPath} is outside every declared prefix ` + `(${prefixes.join(", ")}); refusing to touch a unit this runner does not own. Nothing ran as root.`);
+    }
+  });
+};
+
+// src/linux/sudo-stage.ts
+var refuse8 = (message) => new Error(`sshSudoRunner stage: ${message}`);
+var stageRemote = (base) => async (bytes) => {
+  const made = await base.exec(["/usr/bin/mktemp", "-d"]);
+  if (made.exitCode !== 0)
+    throw refuse8(`mktemp -d -> ${String(made.exitCode)}: ${made.stderr.trim()}`);
+  const dir = made.stdout.trim();
+  if (dir === "" || !dir.startsWith("/")) {
+    throw refuse8(`mktemp -d printed ${JSON.stringify(made.stdout)}, not an absolute path`);
+  }
+  const dispose = async () => {
+    const removed = await base.exec(["/usr/bin/rm", "-rf", "--", dir]);
+    if (removed.exitCode !== 0) {
+      process.stderr.write(`sshSudoRunner: could not remove staging dir ${dir}: ${removed.stderr.trim()}
+`);
+    }
+  };
+  try {
+    const path = `${dir}/staged`;
+    await base.writeFileAtomic(path, bytes, { mode: 384 });
+    return { dispose, path };
+  } catch (cause) {
+    await dispose();
+    throw cause;
+  }
+};
+
+// src/linux/sudo-write.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+var basename2 = (path) => path.slice(path.lastIndexOf("/") + 1);
+var dirOf2 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+var deriveTemp = (dest) => `${dirOf2(dest)}/.${basename2(dest)}.hf-${randomBytes3(6).toString("hex")}.tmp`;
+var mustSucceed = (result, argv) => {
+  if (result.exitCode !== 0) {
+    throw new Error(`sudo -n ${JSON.stringify(argv)} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+  }
+};
+var describeCleanupFailure = (cleaned) => {
+  if (typeof cleaned === "object" && cleaned !== null && "exitCode" in cleaned && "stderr" in cleaned) {
+    const result = cleaned;
+    return `exit ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`;
+  }
+  return cleaned instanceof Error ? cleaned.message : String(cleaned);
+};
+var vetWrite = async (base, prefixes, path, options) => {
+  const prefix = prefixOf(path, prefixes);
+  if (prefix === undefined)
+    return;
+  const mode = octalMode(options.mode);
+  if (mode === undefined)
+    throw new SudoRefusedError(`sshSudoRunner ${path}: mode must be 0–0o7777`);
+  const groups = await operatorGroups(base);
+  await assertInstallable2(base, prefix, path, options, groups);
+  return { mode, prefix };
+};
+var safeOwnerSpec = (uid, gid) => `${uid === undefined ? "" : `+${uid}`}${gid === undefined ? "" : `:+${gid}`}`;
+var chownNeeded = (options) => {
+  const uid = options.uid !== undefined && options.uid !== 0 ? options.uid : undefined;
+  const gid = options.gid !== undefined && options.gid !== 0 ? options.gid : undefined;
+  return uid === undefined && gid === undefined ? undefined : { ...uid === undefined ? {} : { uid }, ...gid === undefined ? {} : { gid } };
+};
+var writeUnderPrefix = async (base, elevate, stage, path, bytes, options, mode) => {
+  const temp = deriveTemp(path);
+  const staged = await stage(bytes);
+  try {
+    const installArgv = [INSTALL, "-m", mode, "-T", "--", staged.path, temp];
+    const before = async () => {
+      const existing = await base.stat(temp);
+      if (existing !== undefined) {
+        throw new SudoRefusedError(`sshSudoRunner ${temp}: already exists (a ${existing.kind}); refusing to install over ` + "it. Nothing ran as root.");
+      }
+    };
+    mustSucceed(await elevate(installArgv, { staged: staged.path, temp }, before), installArgv);
+    try {
+      const owner = chownNeeded(options);
+      if (owner !== undefined) {
+        const chownArgv = [CHOWN, safeOwnerSpec(owner.uid, owner.gid), "--", temp];
+        mustSucceed(await elevate(chownArgv, { temp }), chownArgv);
+      }
+      const mvArgv = [MV, "-f", "-T", "--", temp, path];
+      mustSucceed(await elevate(mvArgv, { temp }), mvArgv);
+    } catch (cause) {
+      const rmArgv = [RM2, "-f", "--", temp];
+      const cleaned = await elevate(rmArgv, { temp }).then((result) => result.exitCode === 0 ? undefined : result).catch((rmCause) => rmCause);
+      if (cleaned !== undefined) {
+        throw new Error(`${cause instanceof Error ? cause.message : String(cause)} — AND removing the leftover ` + `temp ${temp} also failed (${describeCleanupFailure(cleaned)}); it needs manual ` + "cleanup as root.", { cause });
+      }
+      throw cause;
+    }
+  } finally {
+    await staged.dispose();
+  }
+};
+
+// src/linux/sudo-runner.ts
+var outsidePrefixHint = (path, prefixes) => (cause) => {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  if (!/permission denied|operation not permitted/i.test(message))
+    throw cause;
+  throw new Error(`sshSudoRunner ${path}: the operator could not do this, and the path is under no declared ` + `prefix (${prefixes.join(", ")}). If root owns its directory, declare that directory as ` + "a prefix.", { cause });
+};
+var makeSshSudoRunner = (prefixList, deps) => {
+  const prefixes = checkPrefixes(prefixList);
+  const { base } = deps;
+  const elevate = async (argv, context, before) => {
+    const shown = JSON.stringify(argv);
+    const problem = privilegedProblem2(argv, { prefixes, ...context });
+    if (problem !== undefined)
+      throw new SudoRefusedError(`sshSudoRunner refused ${shown}: ${problem}`);
+    await before?.();
+    deps.log(`homeflare/linux sudo -n ${shown}`);
+    const result = await base.exec([SUDO, "-n", "--", ...argv]);
+    const refused = sudoRefusal(shown, result);
+    if (refused !== undefined)
+      throw refused;
+    return result;
+  };
+  return {
+    checkWrite: async (path, options) => {
+      await vetWrite(base, prefixes, path, options);
+    },
+    effectiveUid: () => base.effectiveUid(),
+    exec: async (argv) => {
+      const route = routeExec2(argv, prefixes);
+      if ("refuse" in route)
+        throw new SudoRefusedError(`sshSudoRunner: ${route.refuse}`);
+      if (route.as === "operator")
+        return base.exec(argv);
+      return elevatedExec(base, elevate, prefixes, argv);
+    },
+    lookupGroup: (nameOrId) => base.lookupGroup(nameOrId),
+    lookupUser: (nameOrId) => base.lookupUser(nameOrId),
+    privileged: true,
+    readFile: (path) => base.readFile(path),
+    removeFile: async (path) => {
+      const prefix = prefixOf(path, prefixes);
+      if (prefix === undefined)
+        return base.removeFile(path).catch(outsidePrefixHint(path, prefixes));
+      const target = await assertGuardedChain(base, prefix, path, "file-or-absent");
+      if (target === undefined)
+        return;
+      const argv = [RM2, "-f", "--", path];
+      const result = await elevate(argv);
+      if (result.exitCode !== 0) {
+        throw new Error(`sudo -n ${JSON.stringify(argv)} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+      }
+    },
+    sleep: (ms) => base.sleep(ms),
+    stat: (path) => base.stat(path),
+    writeFileAtomic: async (path, bytes, options) => {
+      const vetted = await vetWrite(base, prefixes, path, options);
+      if (vetted === undefined) {
+        return base.writeFileAtomic(path, bytes, options).catch(outsidePrefixHint(path, prefixes));
+      }
+      await writeUnderPrefix(base, elevate, deps.stage, path, bytes, options, vetted.mode);
+    }
+  };
+};
+var REQUIRED_PROGRAMS = [SUDO, INSTALL, MV, RM2, MKDIR, CHMOD, CHOWN, RMDIR, SYSTEMCTL_ABS];
+var checkProgramsExist = async (base, host) => {
+  const script = REQUIRED_PROGRAMS.map((p) => `test -x '${p}' || { echo "$0: ${p}"; exit 1; }`).join(" && ");
+  const result = await base.exec(["/bin/sh", "-c", script, "sshSudoRunner"]);
+  if (result.exitCode !== 0) {
+    throw new Error(`sshSudoRunner ${host}: ${result.stdout.trim() || result.stderr.trim()} is missing or not ` + "executable on this host. sshSudoRunner sends absolute GNU coreutils and systemd paths.");
+  }
+};
+var sshSudoRunner = async (options) => {
+  const base = await sshRunner(options);
+  await checkProgramsExist(base, options.host);
+  return makeSshSudoRunner(options.prefixes, {
+    base,
+    log: options.log ?? ((line) => {
+      process.stderr.write(`${line}
+`);
+    }),
+    stage: stageRemote(base)
+  });
+};
 export {
   DEFAULT_UNIT_DIRECTORY,
   HostDirectory,
@@ -1605,8 +2736,9 @@ export {
   hostRunnerLayer,
   linuxProviders,
   renderUnit,
-  sshRunner
+  sshRunner,
+  sshSudoRunner
 };
 
-//# debugId=EAA28AD7F62613BA64756E2164756E21
+//# debugId=19CF970890A2548664756E2164756E21
 //# sourceMappingURL=index.js.map