@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/commands/secret.js

@@ -9,19 +9,60 @@
  */
 import { log, prism } from '@xec-sh/kit';
 import { createDaemonClient } from '../daemon/daemon-client.js';
+/**
+ * Decide whether to fall back to direct file access, and say so when the
+ * fallback is hiding something.
+ *
+ * The four commands below each carried `catch { /* Fall through *\/ }`. A
+ * daemon that is not running is the case the fallback exists for, and
+ * silence there is right. A daemon that IS running and whose RPC failed is a
+ * different event entirely, and it was reported as success: `omnitron secret
+ * list` printed the keys it read from disk while the daemon could not
+ * decrypt the same file — the two sides had different default passphrases,
+ * and the CLI's silent fallback is why that could persist unnoticed while
+ * the console and the MCP tools failed.
+ *
+ * Returns true when the caller should read the file directly.
+ */
+function warnIfHidingAFailure(err, reachable) {
+    if (!reachable)
+        return;
+    log.warn(`Daemon is running but its secrets RPC failed: ${err?.message ?? String(err)}`);
+    log.warn('Falling back to direct file access — these two can disagree; the daemon\'s answer is what the console and MCP tools see.');
+}
+/**
+ * A write refused by a running daemon ends there.
+ *
+ * The daemon holds the decrypted vault in memory (`SecretsService.load`
+ * answers from its cache) and `save` writes the whole map. A key the CLI wrote
+ * to the store behind it was invisible to the daemon, and the daemon's next
+ * write of any key put back the map it had — the CLI's write gone, after it
+ * had printed «set (direct mode)». Reads may still fall back; a write may not.
+ */
+function refuseAWriteBehindTheDaemon(what, err) {
+    log.error(`Could not ${what}: the daemon is running and refused it — ${err?.message ?? String(err)}. ` +
+        'Nothing was written: the daemon holds the vault in memory, and a write to the file behind it would be undone by its next one.');
+    process.exitCode = 1;
+}
 export async function secretSetCommand(key, value) {
     // Try daemon RPC first, fall back to direct file access
     const client = createDaemonClient();
+    let reachable = false;
     try {
-        if (await client.isReachable()) {
-            await invokeSecretsRpc(client, 'set', { key, value });
+        reachable = await client.isReachable();
+        if (reachable) {
+            await (await secretsRpc(client)).set({ key, value });
             log.success(`Secret '${key}' set`);
             await client.disconnect();
             return;
         }
     }
-    catch {
-        // Fall through to direct mode
+    catch (err) {
+        if (reachable) {
+            refuseAWriteBehindTheDaemon(`set '${key}'`, err);
+            await client.disconnect();
+            return;
+        }
     }
     await client.disconnect();
     // Direct file access (daemon offline)
@@ -31,9 +72,11 @@ export async function secretSetCommand(key, value) {
 }
 export async function secretGetCommand(key) {
     const client = createDaemonClient();
+    let reachable = false;
     try {
-        if (await client.isReachable()) {
-            const result = await invokeSecretsRpc(client, 'get', { key });
+        reachable = await client.isReachable();
+        if (reachable) {
+            const result = await (await secretsRpc(client)).get({ key });
             if (result.value !== null) {
                 // Output raw value to stdout for scripting compatibility
                 process.stdout.write(result.value + '\n');
@@ -45,8 +88,8 @@ export async function secretGetCommand(key) {
             return;
         }
     }
-    catch {
-        // Fall through
+    catch (err) {
+        warnIfHidingAFailure(err, reachable);
     }
     await client.disconnect();
     // Direct file access
@@ -61,16 +104,18 @@ export async function secretGetCommand(key) {
 }
 export async function secretListCommand() {
     const client = createDaemonClient();
+    let reachable = false;
     try {
-        if (await client.isReachable()) {
-            const result = await invokeSecretsRpc(client, 'list');
+        reachable = await client.isReachable();
+        if (reachable) {
+            const result = await (await secretsRpc(client)).list();
             printKeys(result.keys);
             await client.disconnect();
             return;
         }
     }
-    catch {
-        // Fall through
+    catch (err) {
+        warnIfHidingAFailure(err, reachable);
     }
     await client.disconnect();
     // Direct file access
@@ -80,9 +125,11 @@ export async function secretListCommand() {
 }
 export async function secretDeleteCommand(key) {
     const client = createDaemonClient();
+    let reachable = false;
     try {
-        if (await client.isReachable()) {
-            const result = await invokeSecretsRpc(client, 'delete', { key });
+        reachable = await client.isReachable();
+        if (reachable) {
+            const result = await (await secretsRpc(client)).delete({ key });
             if (result.existed) {
                 log.success(`Secret '${key}' deleted`);
             }
@@ -93,11 +140,15 @@ export async function secretDeleteCommand(key) {
             return;
         }
     }
-    catch {
-        // Fall through
+    catch (err) {
+        if (reachable) {
+            refuseAWriteBehindTheDaemon(`delete '${key}'`, err);
+            await client.disconnect();
+            return;
+        }
     }
     await client.disconnect();
-    // Direct file access
+    // Direct file access (daemon offline)
     const secrets = await createDirectService();
     const existed = await secrets.delete(key);
     if (existed) {
@@ -120,29 +171,180 @@ function printKeys(keys) {
         log.info(`  ${key}`);
     }
 }
-async function invokeSecretsRpc(client, method, data) {
-    await client['ensureConnected']();
-    const netron = client['netron'];
-    const peers = netron.getPeers ? netron.getPeers() : [];
-    for (const peer of peers) {
-        try {
-            const svc = await peer.queryInterface('OmnitronSecrets');
-            if (svc && typeof svc[method] === 'function') {
-                return data ? await svc[method](data) : await svc[method]();
-            }
+/**
+ * The daemon's secrets service.
+ *
+ * Through `client.service()`, the way every other command reaches a service.
+ * This used to reach into the client's privates — `client['netron']`,
+ * `getPeers()` — walk the peers itself and swallow every error with
+ * `continue`, so a lookup that failed for any reason at all ended as
+ *
+ *     Daemon is running but its secrets RPC failed: OmnitronSecrets service not found
+ *
+ * on a daemon that exposes `OmnitronSecrets` unconditionally at startup.
+ * Every write then went through the file fallback, which the warning beside
+ * it says can disagree with what the console and the MCP tools see — and six
+ * writes made that way in one sequence landed as none.
+ */
+/**
+ * `omnitron secret rotate-rpcauth <passwordKey> --user-key <key> --auth-key <key>`
+ *
+ * A new RPC password, and the `rpcauth` value bitcoind keeps in its place,
+ * written as a pair — the one writer of both, so the two cannot disagree.
+ *
+ * The password is born in this process and goes to the vault and nowhere
+ * else: not on a command line (`secret set` takes its value as an argument,
+ * which puts it in the shell history and the process table), not on the
+ * terminal. What is printed is the key names and the user.
+ */
+export async function secretRotateRpcauthCommand(passwordKey, opts) {
+    const { randomBytes } = await import('node:crypto');
+    const { rpcauth, rpcauthAccepts } = await import('../shared/rpcauth.js');
+    const client = createDaemonClient();
+    let reachable = false;
+    try {
+        reachable = await client.isReachable();
+        const vault = reachable
+            ? await (async () => {
+                const rpc = await secretsRpc(client);
+                return {
+                    get: async (key) => (await rpc.get({ key })).value,
+                    set: async (key, value) => void (await rpc.set({ key, value })),
+                };
+            })()
+            : await (async () => {
+                const direct = await createDirectService();
+                return { get: (key) => direct.get(key), set: (key, value) => direct.set(key, value) };
+            })();
+        const user = await vault.get(opts.userKey);
+        if (!user) {
+            log.error(`'${opts.userKey}' is not in the vault — the rpcauth value names a user, and there is none to name.`);
+            process.exitCode = 1;
+            return;
+        }
+        // 32 random bytes, URL-safe: it may travel in a URL's userinfo.
+        const password = randomBytes(32).toString('base64url');
+        const auth = rpcauth(user, password);
+        await vault.set(passwordKey, password);
+        await vault.set(opts.authKey, auth);
+        const [storedPassword, storedAuth] = [await vault.get(passwordKey), await vault.get(opts.authKey)];
+        if (storedPassword !== password || !storedAuth || !rpcauthAccepts(storedAuth, user, password)) {
+            log.error(`The vault did not keep the pair: '${passwordKey}' and '${opts.authKey}' may disagree — rotate again.`);
+            process.exitCode = 1;
+            return;
+        }
+        log.success(`Rotated '${passwordKey}' for user ${user}; '${opts.authKey}' holds its rpcauth value${reachable ? '' : ' (direct mode)'}. ` +
+            'A deployment writes both where they go.');
+    }
+    catch (err) {
+        warnIfHidingAFailure(err, reachable);
+        log.error(`Could not rotate '${passwordKey}': ${err.message}`);
+        process.exitCode = 1;
+    }
+    finally {
+        await client.disconnect();
+    }
+}
+/**
+ * `omnitron secret generate <key> [--bytes 32] [--encoding base64]`
+ *
+ * A key nobody should type or paste — a master key, a signing seed — made
+ * where it is kept and never shown: by the daemon when it is running, by this
+ * process against the same store when it is not. What is printed is the key
+ * name, the length and the encoding. `secret get` reads it, on purpose, later.
+ *
+ * A key the vault already holds is refused, not replaced.
+ */
+export async function secretGenerateCommand(key, opts) {
+    const bytes = opts.bytes === undefined ? 32 : Number(opts.bytes);
+    const encoding = (opts.encoding ?? 'base64');
+    const client = createDaemonClient();
+    let reachable = false;
+    try {
+        reachable = await client.isReachable();
+        if (reachable) {
+            const made = await (await secretsRpc(client)).generate({ key, bytes, encoding });
+            log.success(`Generated '${made.key}': ${made.bytes} random bytes, ${made.encoding} — kept in the vault, not shown`);
+            return;
+        }
+        // The daemon's own rules, here: the same refusal, the same bounds.
+        if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024)
+            throw new Error(`--bytes must be a whole number from 16 to 1024`);
+        if (!['base64', 'base64url', 'hex'].includes(encoding))
+            throw new Error('--encoding must be base64, base64url or hex');
+        const direct = await createDirectService();
+        if ((await direct.get(key)) !== null) {
+            throw new Error(`The vault already holds '${key}' — nothing was generated. Delete it first if replacing it is the intent`);
         }
-        catch {
-            continue;
+        const { randomBytes } = await import('node:crypto');
+        await direct.set(key, randomBytes(bytes).toString(encoding));
+        log.success(`Generated '${key}': ${bytes} random bytes, ${encoding} — kept in the vault (direct mode), not shown`);
+    }
+    catch (err) {
+        warnIfHidingAFailure(err, reachable);
+        log.error(`Could not generate '${key}': ${err.message}`);
+        process.exitCode = 1;
+    }
+    finally {
+        await client.disconnect();
+    }
+}
+/**
+ * `omnitron secret copy <from> <to>`
+ *
+ * A second key holding the same secret, made where it is kept — by the daemon
+ * when it is running, by this process against the same store when it is not.
+ * For splitting one secret into two before rotating either: the value never
+ * passes through a command line, a terminal or this process's output. What is
+ * printed is the two key names. A `to` the vault already holds is refused.
+ */
+export async function secretCopyCommand(from, to) {
+    const client = createDaemonClient();
+    try {
+        if (await client.isReachable()) {
+            await (await secretsRpc(client)).copy({ from, to });
+            log.success(`Copied '${from}' to '${to}' — kept in the vault, not shown`);
+            return;
         }
+        const direct = await createDirectService();
+        await direct.copy(from, to);
+        log.success(`Copied '${from}' to '${to}' — kept in the vault (direct mode), not shown`);
+    }
+    catch (err) {
+        // No fallback to the file behind a running daemon: it holds the vault in
+        // memory, and its next write would put back the map it had.
+        log.error(`Could not copy '${from}' to '${to}': ${err.message}`);
+        process.exitCode = 1;
     }
-    throw new Error('OmnitronSecrets service not found');
+    finally {
+        await client.disconnect();
+    }
+}
+async function secretsRpc(client) {
+    return client.service('OmnitronSecrets');
 }
 async function createDirectService() {
     const { SecretsService } = await import('../services/secrets.service.js');
-    const { DEFAULT_DAEMON_CONFIG } = await import('../config/defaults.js');
+    const { DaemonStateStore } = await import('../daemon/daemon-state-store.service.js');
+    const { DEFAULT_DAEMON_CONFIG, DEFAULT_SECRETS_PASSPHRASE } = await import('../config/defaults.js');
+    const { expandPath } = await import('../shared/paths.js');
     const dc = DEFAULT_DAEMON_CONFIG;
-    const path = (dc.secrets?.path ?? '~/.omnitron/secrets.enc').replace('~', process.env['HOME'] ?? '');
-    const passphrase = dc.secrets?.passphrase ?? 'omnitron-default-passphrase';
-    return new SecretsService(path, passphrase);
+    // T-7 — the CLI doesn't have a daemon DI container, so we
+    // construct a DaemonStateStore inline against the same SQLite
+    // file the daemon uses. WAL mode + busy_timeout means a
+    // concurrent daemon writer is safe; the CLI just waits up to 5s.
+    const noopLogger = {
+        trace: () => undefined,
+        debug: () => undefined,
+        info: () => undefined,
+        warn: () => undefined,
+        error: () => undefined,
+        fatal: () => undefined,
+    };
+    noopLogger.child = () => noopLogger;
+    const store = new DaemonStateStore(noopLogger);
+    const legacyPath = expandPath(dc.secrets?.path ?? '~/.omnitron/secrets.enc');
+    const passphrase = dc.secrets?.passphrase ?? DEFAULT_SECRETS_PASSPHRASE;
+    return new SecretsService(store, passphrase, legacyPath);
 }
 //# sourceMappingURL=secret.js.map

package/dist/commands/secret.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/commands/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAC/D,wDAAwD;IACxD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1B,yDAAyD;gBACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACtD,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,SAAS,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,yBAAyB,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAW,EAAE,MAAc,EAAE,IAAU;IACrE,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;YACzD,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAC1E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,qBAAqB,CAAC;IAEjC,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,6BAA6B,CAAC;IAE3E,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/commands/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,SAAkB;IAC5D,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,GAAG,CAAC,IAAI,CACN,iDAAkD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,0HAA0H,CAAC,CAAC;AACvI,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,IAAY,EAAE,GAAY;IAC7D,GAAG,CAAC,KAAK,CACP,aAAa,IAAI,4CAA6C,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI;QACrG,+HAA+H,CAClI,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAC/D,wDAAwD;IACxD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,EAAE,CAAC;YACd,2BAA2B,CAAC,QAAQ,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,qBAAqB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1B,yDAAyD;gBACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,SAAS,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAEpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,EAAE,CAAC;YACd,2BAA2B,CAAC,WAAW,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAE1B,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,yBAAyB,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,SAAS,CAAC,IAAc;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,IAA0C;IAE1C,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS;YACrB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;gBACrC,OAAO;oBACL,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK;oBAC1D,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;iBAChF,CAAC;YACJ,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;gBAC3C,OAAO,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAChH,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,oFAAoF,CAAC,CAAC;YAChH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,gEAAgE;QAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEpC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACnG,IAAI,cAAc,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,KAAK,CAAC,qCAAqC,WAAW,UAAU,IAAI,CAAC,OAAO,gCAAgC,CAAC,CAAC;YAClH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,OAAO,CACT,YAAY,WAAW,cAAc,IAAI,MAAM,IAAI,CAAC,OAAO,4BAA4B,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI;YAC1H,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,qBAAqB,WAAW,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,IAA2C;IAClG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAmC,CAAC;IAC/E,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,kBAAkB,IAAI,CAAC,QAAQ,iCAAiC,CAAC,CAAC;YACpH,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9H,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvH,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,0EAA0E,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,cAAc,GAAG,MAAM,KAAK,kBAAkB,QAAQ,+CAA+C,CAAC,CAAC;IACrH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,GAAG,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,EAAU;IAC9D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,EAAE,kCAAkC,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,EAAE,gDAAgD,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,4DAA4D;QAC5D,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAA6C;IAE7C,OAAO,MAAM,CAAC,OAAO,CAA0B,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAC1E,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IACrF,MAAM,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACpG,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,qBAAqB,CAAC;IAEjC,0DAA0D;IAC1D,8DAA8D;IAC9D,wDAAwD;IACxD,iEAAiE;IACjE,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;KAEhB,CAAC;IACT,UAAU,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,yBAAyB,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,0BAA0B,CAAC;IAExE,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/service-units.d.ts

@@ -0,0 +1,181 @@
+/**
+ * The OS supervisor definitions omnitron writes, as pure functions.
+ *
+ * Separated from `service.ts` so the units can be rendered and read without
+ * a machine: every input is an argument, nothing here consults `process` or
+ * the filesystem. The command layer supplies the facts.
+ *
+ * The distinction this file exists for is SCOPE.
+ *
+ * A `user` service belongs to the account that installed it. On macOS that is
+ * a LaunchAgent, on Linux a systemd user unit, and on both it is tied to a
+ * login session: the unit says `WantedBy=default.target`, and when the last
+ * session for that user ends, systemd stops it. For a workstation that is
+ * exactly right — the daemon is there while you are.
+ *
+ * A slave node is the opposite case. Its entire purpose is to be reachable
+ * when nobody is logged in, so a supervision mode whose default is "stops at
+ * logout" does not implement the role. `serviceInstall` had only that mode,
+ * and printed `Tip: loginctl enable-linger …` beside it. A printed tip is not
+ * a control: it changes nothing unless a human reads it, remembers, and runs
+ * it, and the failure it prevents shows up hours later as a node that was
+ * installed and is gone.
+ *
+ * So `system` scope: `/etc/systemd/system` and `WantedBy=multi-user.target`
+ * on Linux, `/Library/LaunchDaemons` on macOS. Both start at boot with no
+ * session involved.
+ *
+ * Root installs the unit; root does not run the daemon. The unit carries
+ * `User=` naming the account that owns `~/.omnitron`, because the daemon's
+ * unix socket IS its local authentication check — the whole local trust model
+ * is "whoever can open the socket is the owner". A daemon running as root
+ * with a socket anywhere shared redefines that silently, from "the owner" to
+ * "anyone on the box".
+ */
+/** Who supervises the daemon, and from where. */
+export type ServiceScope = 'user' | 'system';
+export interface ServiceIdentity {
+    /** Account the daemon runs as. Never root for a system unit. */
+    readonly user: string;
+    /** That account's home, so `~/.omnitron` resolves to the right place. */
+    readonly home: string;
+}
+export interface UnitInputs {
+    readonly scope: ServiceScope;
+    /** Absolute path to the node binary. */
+    readonly execPath: string;
+    /** Absolute path to `daemon-entry.js`. */
+    readonly entryPath: string;
+    /** Working directory for the supervised daemon. */
+    readonly workdir: string;
+    /** PATH the service is given — supervisors provide almost none. */
+    readonly path: string;
+    /** Where stderr is kept. */
+    readonly stderrLog: string;
+    /** Only meaningful for `system` scope. */
+    readonly identity?: ServiceIdentity | undefined;
+}
+export declare const LAUNCHD_LABEL = "dev.omnitron.daemon";
+export declare const SYSTEMD_UNIT = "omnitron-daemon.service";
+/** Where the definition file lives, for a scope and a home directory. */
+export declare function unitPathFor(platform: NodeJS.Platform, scope: ServiceScope, home: string): string;
+/**
+ * A value as systemd will read it.
+ *
+ * Two things a unit file does to a value that look like nothing:
+ *
+ * **`%` is a specifier, not a character.** systemd expands `%h`, `%i`, `%n`
+ * and the rest everywhere — `ExecStart=`, `Environment=`,
+ * `WorkingDirectory=`. Measured on a live Ubuntu host, 2026-09-14:
+ *
+ *     WorkingDirectory=/tmp/a%hb   →  /tmp/a/rootb
+ *     Environment=X=/opt/a%hb      →  X=/opt/a/rootb
+ *     Environment=X=/opt/a%%hb     →  X=/opt/a%hb
+ *
+ * It does not fail; it substitutes. `%%` is the literal.
+ *
+ * ## What `systemd-analyze verify` proves, and what it does not
+ *
+ * It said nothing about the unit above. Not a warning — the substitution is
+ * not an error to systemd, it is the feature working.
+ *
+ * So a clean `verify` means the syntax parses and the files it names exist.
+ * It does NOT mean a value arrives the way it was written, and reading it
+ * that way is how these two defects survived a check that had already been
+ * run against this renderer and reported no findings.
+ *
+ * The question "did the value survive" has its own command:
+ *
+ *     systemctl show <unit> -p Environment -p WorkingDirectory -p ExecStart
+ *
+ * which prints what systemd actually holds. Both of the rules below were
+ * confirmed with it, and the one correction to them — that
+ * `WorkingDirectory=` must NOT be quoted — came from it too.
+ *
+ * **Whitespace splits.** `Environment=` takes a LIST of assignments separated
+ * by spaces, so a value with one in it is read as an assignment plus
+ * rubbish — measured on the same host:
+ *
+ *     Environment=X=/opt/a b/c     →  X=/opt/a
+ *                                     "Invalid environment assignment, ignoring: b/c"
+ *     Environment="X=/opt/a b/c"   →  X=/opt/a b/c
+ *
+ * The quotes go around the WHOLE assignment, which is why this function
+ * returns the value and `environmentLine` below composes the line: quoting
+ * only the right-hand side is a different thing to systemd.
+ *
+ * Raised by a colleague from the documentation, who could not test it —
+ * macOS has no systemd — and asked for the measurement. Both predictions
+ * held.
+ */
+export declare function escapeSpecifiers(value: string): string;
+/**
+ * A value for a directive that parses its argument as a LIST — `ExecStart=`'s
+ * command line, where whitespace separates arguments.
+ *
+ * Not every directive does. `WorkingDirectory=` takes one path and reads
+ * quotes as part of it; measured on the same host, quoting it produced
+ *
+ *     WorkingDirectory= path is not absolute: "/opt/my omnitron"
+ *     omni-escape-probe.service: Unit configuration has fatal error
+ *
+ * — a unit that will not start, from a fix for a value that did not need one.
+ * The escaping rule is per directive, and applying one rule to all of them
+ * trades a quiet defect for a loud one.
+ */
+export declare function unitValue(value: string): string;
+/** One `Environment=` line, quoted as a whole assignment when it needs to be. */
+export declare function environmentLine(name: string, value: string): string;
+/**
+ * A systemd unit.
+ *
+ * `--import tsx/esm` is in the ExecStart because project configs are
+ * TypeScript. That loader is a declared runtime dependency of the package —
+ * it was a devDependency until 2026-09-14, which npm does not install, so a
+ * node prepared from the registry got a unit whose ExecStart could not
+ * resolve its own loader. Measured there: ERR_MODULE_NOT_FOUND.
+ */
+export declare function renderSystemdUnit(inputs: UnitInputs): string;
+/**
+ * A launchd job — LaunchAgent for `user` scope, LaunchDaemon for `system`.
+ *
+ * `ProcessType` is `Interactive`. Without the key a job is `Standard`, which
+ * launchd.plist(5) describes as «light resource limits» on CPU and I/O —
+ * while anything started from a terminal has none. On a machine that also
+ * compiles, the control plane is the first thing the scheduler starves: on
+ * 2026-09-23 the dev master logged 139 stalls in 40 min at load 120 (another
+ * project's `rustc` and Python jobs), every one `off-cpu` — 1 to 4.6 s of a
+ * daemon that answered nothing, at 0 to 93 ms of CPU — and its mesh
+ * connection to the test node dropped under them. `Interactive` runs a job
+ * with the limits of an app, which is to say none. Not `Adaptive`: that moves
+ * a job between classes by its XPC transactions, and this daemon has none.
+ */
+export declare function renderLaunchdPlist(inputs: UnitInputs): string;
+export interface ScopeDecision {
+    readonly scope: ServiceScope;
+    /** Why, in the operator's terms. */
+    readonly because: string;
+    /** Set when the requested scope cannot be installed, and what to do. */
+    readonly refusal?: string;
+}
+export interface ScopeInputs {
+    /** What the operator asked for, if anything. */
+    readonly requested?: ServiceScope | undefined;
+    /** The daemon's role — a slave must survive a logout. */
+    readonly role?: string | undefined;
+    /** Whether this process can write to the system unit directory. */
+    readonly isRoot: boolean;
+    /** Whether the account's user services survive its last session ending. */
+    readonly lingerEnabled: boolean;
+    readonly platform: NodeJS.Platform;
+}
+/**
+ * Decide which supervision scope to install, or refuse and say why.
+ *
+ * The refusal is the point. Installing a user unit on a slave because root
+ * was unavailable produces something that looks installed, reports installed,
+ * and stops the moment the operator logs out — a failure that arrives later
+ * and elsewhere, with nothing linking it back to this decision.
+ */
+export declare function decideScope(inputs: ScopeInputs): ScopeDecision;
+//# sourceMappingURL=service-units.d.ts.map

package/dist/commands/service-units.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-units.d.ts","sourceRoot":"","sources":["../../src/commands/service-units.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACjD;AAED,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,YAAY,4BAA4B,CAAC;AAEtD,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAShG;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA0D5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAwD7D;AAMD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC9C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAyC9D"}