@homeflare/alchemy 0.37.7 → 0.38.0

package/dist/linux/container-preflight.d.ts

@@ -27,6 +27,40 @@ export declare const assertUsable: (props: Pick<ContainerProps, 'name'>, status:
  *   this declaration's own leftover, not someone else's.
  */
 export declare const assertUnclaimed: (runner: HostRunner, props: ContainerProps) => Promise<void>;
+/**
+ * ⛔ A PLAIN UNIT SHARING THE SERVICE NAME CAN OUTRANK QUADLET'S GENERATOR, SILENTLY — but only
+ *   when it sits in one of the directories that actually search BEFORE `${GENERATED_UNIT_DIRECTORY}`
+ *   in systemd's own unit load path (systemd.unit(5) "Unit File Load Path") — `/etc/systemd/system`
+ *   chief among them (`isShadowingFragment`, container-generator.ts, has the full list and the
+ *   measured facts). ⛔ CORRECTED ON ADVERSARIAL RE-REVIEW: an EARLIER version of this check refused
+ *   for ANY `FragmentPath` not literally under the generator directory, including the vendor
+ *   directories (`/usr/local/lib/systemd/system`, `/usr/lib/systemd/system`) — those are LOWER
+ *   precedence than the generator, not higher, so a plain unit there is harmlessly shadowed BY our
+ *   generated unit once we write and reload; refusing for it was a false positive that blocked a
+ *   create/adopt apply would have handled fine (exactly what S49 "neither looser nor stricter"
+ *   forbids). With no `.container` file of ours on disk yet, a `FragmentPath` under one of the
+ *   genuinely higher-precedence directories means some OTHER unit file — hand-written, or shipped by
+ *   a package, and admin-controlled rather than vendor-controlled — already answers to this name:
+ *   writing and reloading would generate a unit systemd never actually loads, because the
+ *   higher-precedence plain one still wins.
+ * ★ TWIN OF `unit-preflight.ts`'s `assertUnclaimed`, for the one failure mode `Systemd.Unit` can't
+ *   have: there is no generator standing between ITS file and the unit systemd loads, so nothing
+ *   there can be shadowed the way a Quadlet generation can.
+ * ★ ONLY WHEN THE `.container` FILE ITSELF IS ABSENT (called from `readContainer` in that branch):
+ *   a present file with different content is `assertUnclaimed`'s job; a present file that IS ours
+ *   generating a shadowed unit is `verifyGenerated`'s job (container-generator.ts, hardened to check
+ *   this same `FragmentPath` fact), at apply time, once daemon-reload has actually run — this is the
+ *   "nothing declared yet" half neither of those covers, and the one this bug leaves refusing only
+ *   mid-apply instead of at plan time for the directories that genuinely shadow.
+ * ⚠️ NEVER FIRES WITHOUT A CONCRETE `fragmentPath` TO NAME, AND NEVER FOR A MASKED UNIT — MEASURED
+ *   against this family's own fake (`fakeQuadletHost`, unlike `sudo-lifecycle.test.ts`'s, which is
+ *   a different fake and reads differently): `placeUnit(path, text, {masked: true})` still reports
+ *   a real `FragmentPath`. Refusing there anyway would work, but with THIS function's generic
+ *   "plain unit" wording instead of `assertUsable`'s specific, more actionable "is masked, run
+ *   `systemctl unmask` deliberately" — masking is a person's decision, not an accident to explain
+ *   as a name collision. `assertUsable` stays the one place that message comes from.
+ */
+export declare const assertUnshadowed: (props: Pick<ContainerProps, 'name'>, status: UnitStatus) => void;
 /** The half of a rename check that needs only the NEW NAME — mirrors `assertRenameTarget`. */
 export declare const assertRenameTarget: (runner: HostRunner, old: ContainerAttributes, name: string) => Promise<void>;
 /** A rename, checked at plan time, before the plan may promise a delete-first replace. */

package/dist/linux/container-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/container-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAMpB,MAAM,qBAAqB,CAAC;AAI7B,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,cAAc,KAAG,IAGnD,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAQjE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,UAAU,KAAG,IAQtF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,WAAkB,UAAU,SAAS,cAAc,KAAG,OAAO,CAAC,IAAI,CAW7F,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,WACrB,UAAU,OACb,mBAAmB,QAClB,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,cAAc,OACf,mBAAmB,KACvB,OAAO,CAAC,IAAI,CAKd,CAAC"}
+{"version":3,"file":"container-preflight.d.ts","sourceRoot":"","sources":["../../src/linux/container-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,KAAK,UAAU,EAAY,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAMpB,MAAM,qBAAqB,CAAC;AAI7B,qEAAqE;AACrE,eAAO,MAAM,WAAW,UAAW,cAAc,KAAG,IAGnD,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,WAAY,UAAU,QAAQ,MAAM,KAAG,IAQjE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,UAAU,KAAG,IAQtF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,WAAkB,UAAU,SAAS,cAAc,KAAG,OAAO,CAAC,IAAI,CAW7F,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB,UAAW,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,UAAU,KAAG,IAW1F,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,WACrB,UAAU,OACb,mBAAmB,QAClB,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,WACpB,UAAU,QACZ,cAAc,OACf,mBAAmB,KACvB,OAAO,CAAC,IAAI,CAKd,CAAC"}

package/dist/linux/container-settle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-settle.d.ts","sourceRoot":"","sources":["../../src/linux/container-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,YAAY,UAChB,cAAc,gBACP,MAAM,mBACH,MAAM,iBACR,MAAM,eACR,MAAM,UACX,UAAU,KACjB,mBAWD,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,WACT,UAAU,SACX,cAAc,gBACP,MAAM,QACd,MAAM,KACX,OAAO,CAAC,mBAAmB,CA0B7B,CAAC"}
+{"version":3,"file":"container-settle.d.ts","sourceRoot":"","sources":["../../src/linux/container-settle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEpB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,YAAY,UAChB,cAAc,gBACP,MAAM,mBACH,MAAM,iBACR,MAAM,eACR,MAAM,UACX,UAAU,KACjB,mBAWD,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,MAAM,WACT,UAAU,SACX,cAAc,gBACP,MAAM,QACd,MAAM,KACX,OAAO,CAAC,mBAAmB,CAqC7B,CAAC"}

package/dist/linux/fake-sudo.d.ts

@@ -12,19 +12,31 @@
  *   `mktemp -d` registers a fresh 0700 directory the operator owns.
  * ★ SUDO REFUSES A CALL THAT WAS NOT LOGGED FIRST, so every test holds the runner to "logged
  *   before it runs", exactly as the Mac fake does.
+ * ★ `hostFactory`/`prefixes` (below) let sudo-lifecycle.test.ts drive `fakeQuadletHost` (not just
+ *   the plain `fakeLinuxHost`) through this SAME elevation wiring, for the Podman.Container-through
+ *   -sshSudoRunner regression tests — `fakeQuadletHost` returns the exact shape `fakeLinuxHost`
+ *   does (`FakeLinuxOptions` in, the same fields out), so every handler below that reads
+ *   `fake.dirs`/`fake.modes`/`fake.files` or calls `fake.runner.exec` works unchanged either way.
  */
 import type { FileStat, HostRunner } from '../launchd/runner.ts';
 import { SUDO_SAYS } from '../launchd/fake-sudo.ts';
+import { type FakeLinuxOptions, fakeLinuxHost } from './fake-linux-host.ts';
 import { type RootState } from './fake-sudo-root.ts';
 export { SUDO_SAYS } from '../launchd/fake-sudo.ts';
 export declare const OPERATOR = 1000;
 export declare const PREFIXES: string[];
+export type FakeSudoHostOptions = {
+    /** Swap `fakeLinuxHost` for a variant that models more than plain units — `fakeQuadletHost`. */
+    readonly hostFactory?: (options: FakeLinuxOptions) => ReturnType<typeof fakeLinuxHost>;
+    /** The runner's own declared prefixes. @default PREFIXES */
+    readonly prefixes?: readonly string[];
+};
 /**
  * `extraDirs` adds more directories to the fake filesystem (a pre-existing tree outside every
- * prefix, say); it never changes the runner's OWN prefixes, which stay `PREFIXES` throughout.
+ * prefix, say); it never changes the runner's OWN prefixes, which default to `PREFIXES`.
  * `acl` is the set of directory paths a test wants to carry the `+` (POSIX ACL) flag.
  */
-export declare const fakeSudoHost: (extraDirs?: Record<string, number>, acl?: ReadonlySet<string>) => {
+export declare const fakeSudoHost: (extraDirs?: Record<string, number>, acl?: ReadonlySet<string>, { hostFactory, prefixes }?: FakeSudoHostOptions) => {
     base: HostRunner;
     fake: {
         calls: string[][];

package/dist/linux/fake-sudo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/linux/fake-sudo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAc,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,qBAAqB,CAAC;AAK7D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,QAAQ,UAA4C,CAAC;AAyBlE;;;;GAIG;AACH,eAAO,MAAM,YAAY,eACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAC5B,WAAW,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;cAUS,IAAI,GAAG,MAAM,OAAO,SAAS;;CAyE/D,CAAC"}
+{"version":3,"file":"fake-sudo.d.ts","sourceRoot":"","sources":["../../src/linux/fake-sudo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAc,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,KAAK,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,KAAK,SAAS,EAAU,MAAM,qBAAqB,CAAC;AAK7D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,QAAQ,UAA4C,CAAC;AAyBlE,MAAM,MAAM,mBAAmB,GAAG;IAChC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;IACvF,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,eACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAC5B,WAAW,CAAC,MAAM,CAAC,8BAC8B,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;cAaxC,IAAI,GAAG,MAAM,OAAO,SAAS;;CAyE/D,CAAC"}

package/dist/linux/index.js

@@ -635,6 +635,29 @@ var renderJob = (props) => {
   return { bytes, sha256: sha256Hex(bytes), text };
 };
 
+// src/linux/unit-text.ts
+var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
+var hasInstallSection = (text) => {
+  if (!text.includes("[Install]"))
+    return false;
+  const after = text.slice(text.indexOf("[Install]"));
+  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
+};
+var firstSubstantiveLine = (text) => text.split(`
+`).find((line) => !(line.trim() === "" || line.startsWith("#") || line.startsWith(";")));
+var textProblems = (text) => {
+  const found = [];
+  if (text.trim() === "")
+    found.push("the unit file is empty");
+  if (text.includes("\x00"))
+    found.push("the unit file contains NUL");
+  const first = firstSubstantiveLine(text);
+  if (first === undefined || !/^\s*\[[A-Za-z]+]/.test(first)) {
+    found.push("a unit file must begin with a [Section] (blank lines and #/; comments before it are fine)");
+  }
+  return found;
+};
+
 // src/linux/unit-form.ts
 var DEFAULT_UNIT_DIRECTORY = "/etc/systemd/system";
 var UNIT_SEARCH_DIRECTORIES = [
@@ -678,7 +701,6 @@ var TYPES = new Set([
   "target",
   "timer"
 ]);
-var INSTALL_KEYS = new Set(["WantedBy", "RequiredBy", "UpsertedBy", "Also", "Alias"]);
 var unitProblems = (props, expect) => {
   const found = [];
   const type = NAME.exec(props.name)?.[1];
@@ -698,7 +720,7 @@ var unitProblems = (props, expect) => {
   if (props.enabled !== false && !UNIT_SEARCH_DIRECTORIES.includes(directory)) {
     found.push(`an enabled unit must live where systemd looks for it by name (${UNIT_SEARCH_DIRECTORIES.join(", ")}); ` + `${directory} is not one of them. Move it, or declare enabled: false.`);
   }
-  if (props.enabled !== false && !hasInstall(props)) {
+  if (props.enabled !== false && !hasInstallSection(unitText(props))) {
     found.push("enabled units need an [Install] section with WantedBy/RequiredBy/Also/Alias; without one " + 'systemd calls the unit "static" and `systemctl enable` has nothing to link. Add one, or ' + "declare enabled: false and let something else pull it in.");
   }
   if (type === "timer" && !unitText(props).includes("[Timer]")) {
@@ -706,23 +728,6 @@ var unitProblems = (props, expect) => {
   }
   return found;
 };
-var hasInstall = (props) => {
-  const text = unitText(props);
-  if (!text.includes("[Install]"))
-    return false;
-  const after = text.slice(text.indexOf("[Install]"));
-  return [...INSTALL_KEYS].some((key) => new RegExp(`^${key}=`, "m").test(after));
-};
-var textProblems = (text) => {
-  const found = [];
-  if (text.trim() === "")
-    found.push("the unit file is empty");
-  if (text.includes("\x00"))
-    found.push("the unit file contains NUL");
-  if (!/^\s*\[[A-Za-z]+]/.test(text))
-    found.push("a unit file must begin with a [Section]");
-  return found;
-};
 
 // src/linux/systemctl.ts
 var SYSTEMCTL = "systemctl";
@@ -802,6 +807,19 @@ var stopUnit = (runner, name) => run(runner, ["stop", "--", name]);
 var restartUnit = (runner, name) => run(runner, ["restart", "--", name]);
 
 // src/linux/container-generator.ts
+var GENERATED_UNIT_DIRECTORY = "/run/systemd/generator";
+var isGeneratorFragment = (fragmentPath) => fragmentPath !== undefined && fragmentPath.startsWith(`${GENERATED_UNIT_DIRECTORY}/`);
+var SHADOWING_UNIT_DIRECTORIES = [
+  "/etc/systemd/system.control",
+  "/run/systemd/system.control",
+  "/run/systemd/transient",
+  "/etc/systemd/system",
+  "/etc/systemd/system.attached",
+  "/run/systemd/system",
+  "/run/systemd/system.attached"
+];
+var isShadowingFragment = (fragmentPath) => fragmentPath !== undefined && SHADOWING_UNIT_DIRECTORIES.some((dir) => fragmentPath.startsWith(`${dir}/`));
+
 class QuadletGeneratorError extends Error {
   constructor(name, detail) {
     super(`Podman.Container ${name}: ${detail}`);
@@ -814,6 +832,9 @@ var verifyGenerated = (name, containerPath, serviceName, status) => {
   if (!status.known || status.loadState !== "loaded") {
     throw new QuadletGeneratorError(name, `${serviceName} does not exist after daemon-reload (LoadState=${status.loadState}). The ` + ".container file was written and reloaded, so Quadlet’s generator refused it — a bad " + "key, a bad value, or an interaction this validation does not check. Debug on the host " + "with '/usr/lib/systemd/system-generators/podman-system-generator --dryrun' or " + `'systemd-analyze --generators=true verify ${serviceName}' (podman-systemd.unit(5), Podman 5.4).`);
   }
+  if (status.fragmentPath !== undefined && !isGeneratorFragment(status.fragmentPath)) {
+    throw new QuadletGeneratorError(name, `${serviceName} is loaded from ${status.fragmentPath}, not from Quadlet’s generator ` + `(${GENERATED_UNIT_DIRECTORY}/…) — daemon-reload ran, but a plain unit at that path still ` + "answers to this name, and systemd loaded IT, not ours. Move the plain unit aside — a " + "cutover — and redeploy.");
+  }
   if (status.sourcePath !== undefined && status.sourcePath !== containerPath) {
     throw new QuadletGeneratorError(name, `${serviceName}'s SourcePath is ${status.sourcePath}, not ${containerPath} — a same-named ` + ".container file earlier in Quadlet’s search path is generating this unit instead of ours " + "(podman-systemd.unit(5) “Podman Unit Search Path”, Podman 5.4).");
   }
@@ -954,6 +975,15 @@ var assertUnclaimed = async (runner, props) => {
     throw refuseContainer(props.name, `${path} is already on this host and is not this resource. Remove it, or declare it as a ` + "new resource and deploy with --adopt.");
   }
 };
+var assertUnshadowed = (props, status) => {
+  if (!status.known || status.fragmentPath === undefined)
+    return;
+  if (status.loadState === "masked" || status.unitFileState === "masked")
+    return;
+  if (!isShadowingFragment(status.fragmentPath))
+    return;
+  throw refuseContainer(props.name, `${serviceNameFor(props)} already exists as a plain unit at ${status.fragmentPath}, not a ` + `Quadlet generation — Quadlet's own output (${GENERATED_UNIT_DIRECTORY}/…) would be ` + "shadowed by it and never actually run: systemd loads the higher-precedence file first. " + "Move the plain unit aside — a cutover — before declaring this container.");
+};
 var assertRenameTarget = async (runner, old, name) => {
   assertMayWrite(runner, old.name);
   assertMayWrite(runner, name);
@@ -991,7 +1021,11 @@ var settle = async (runner, props, configSha256, step) => {
         return;
       });
     }
-    throw refuseContainer(props.name, `${detail} The container's unit is NOT running.`);
+    const after2 = await showUnit(runner, step.serviceName).catch(() => {
+      return;
+    });
+    const stateNote = after2 === undefined ? "Its running state was not re-checked." : `Its unit is now ${after2.activeState}.`;
+    throw refuseContainer(props.name, `${detail} ${stateNote}`);
   };
   try {
     if (!wantStarted) {
@@ -1018,8 +1052,11 @@ var readContainer = async (runner, props) => {
   const path = containerPathFor(props);
   const bytes = await runner.readFile(path);
   const status = await showUnit(runner, serviceNameFor(props));
-  if (bytes === undefined && !status.known)
-    return;
+  if (bytes === undefined) {
+    if (!status.known)
+      return;
+    assertUnshadowed(props, status);
+  }
   const sha = bytes === undefined ? "" : digestOf(decoder2.decode(bytes));
   return attributesOf(props, configDigest(props.restartOn), sha, path, serviceNameFor(props), status);
 };
@@ -2870,6 +2907,11 @@ var assertInstallable2 = async (base, prefix, path, options, groups) => {
 };
 
 // src/linux/sudo-exec.ts
+var GENERATOR_DIRECTORIES = [
+  GENERATED_UNIT_DIRECTORY,
+  `${GENERATED_UNIT_DIRECTORY}.late`
+];
+var isUnderGeneratorDirectory = (fragmentPath) => GENERATOR_DIRECTORIES.some((dir) => fragmentPath.startsWith(`${dir}/`));
 var DIR_EXPECT = {
   chmod: "directory",
   chown: "directory",
@@ -2883,17 +2925,18 @@ var unitStatusOf = async (base, unit) => {
     "show",
     "--no-pager",
     "-p",
-    "FragmentPath,LoadState",
+    "FragmentPath,LoadState,SourcePath",
     "--",
     unit
   ]);
   if (result.exitCode !== 0) {
-    throw new SudoRefusedError(`sshSudoRunner ${unit}: could not read FragmentPath/LoadState (systemctl show exit ` + `${String(result.exitCode)}). Nothing ran as root.`);
+    throw new SudoRefusedError(`sshSudoRunner ${unit}: could not read FragmentPath/LoadState/SourcePath (systemctl show ` + `exit ${String(result.exitCode)}). Nothing ran as root.`);
   }
   const fields = parseShow(result.stdout);
   return {
     fragmentPath: fields.get("FragmentPath") ?? "",
-    loadState: fields.get("LoadState") ?? ""
+    loadState: fields.get("LoadState") ?? "",
+    sourcePath: fields.get("SourcePath") ?? ""
   };
 };
 var elevatedExec = (base, elevate, prefixes, argv) => {
@@ -2914,7 +2957,7 @@ var elevatedExec = (base, elevate, prefixes, argv) => {
   const verb = canonical[1] ?? "";
   const unit = canonical[3] ?? "";
   return elevate(canonical, {}, async () => {
-    const { fragmentPath, loadState } = await unitStatusOf(base, unit);
+    const { fragmentPath, loadState, sourcePath } = await unitStatusOf(base, unit);
     if (loadState === "masked") {
       throw new SudoRefusedError(`sshSudoRunner ${unit}: is masked. Masking is someone's decision, not drift; unmask it ` + "deliberately, then redeploy. Nothing ran as root.");
     }
@@ -2923,9 +2966,13 @@ var elevatedExec = (base, elevate, prefixes, argv) => {
         return;
       throw new SudoRefusedError(`sshSudoRunner ${unit}: has no unit file (FragmentPath empty), and ${verb} is not ` + "stop/disable — refusing rather than run it against whatever systemd currently thinks " + `${unit} is (a kernel-generated unit, say). Nothing ran as root.`);
     }
-    if (prefixOf(fragmentPath, prefixes) === undefined) {
-      throw new SudoRefusedError(`sshSudoRunner ${unit}: FragmentPath ${fragmentPath} is outside every declared prefix ` + `(${prefixes.join(", ")}); refusing to touch a unit this runner does not own. Nothing ran as root.`);
+    if (prefixOf(fragmentPath, prefixes) !== undefined)
+      return;
+    if (isUnderGeneratorDirectory(fragmentPath) && sourcePath !== "" && prefixOf(sourcePath, prefixes) !== undefined) {
+      return;
     }
+    const sourceNote = sourcePath === "" ? "" : `, and its SourcePath ${sourcePath} is not under one either`;
+    throw new SudoRefusedError(`sshSudoRunner ${unit}: FragmentPath ${fragmentPath} is outside every declared prefix ` + `(${prefixes.join(", ")})${sourceNote}; refusing to touch a unit this runner does not ` + "own. Nothing ran as root.");
   });
 };
 
@@ -3132,5 +3179,5 @@ export {
   sshSudoRunner
 };
 
-//# debugId=F28A7095F5BC6E5964756E2164756E21
+//# debugId=47589007F27006E864756E2164756E21
 //# sourceMappingURL=index.js.map