@primafuture/systemd-tasks 1.1.0 → 1.2.0

package/dist/runtime.cjs

@@ -1164,12 +1164,12 @@ var require_validators = __commonJS({
       }
     }
     var pathRe = /^[A-Za-z0-9_]+$/;
-    function isObjectPathValid(path4) {
-      return !!(typeof path4 === "string" && path4 && path4[0] === "/" && (path4.length === 1 || path4[path4.length - 1] !== "/" && path4.split("/").slice(1).every((p) => p && pathRe.test(p))));
+    function isObjectPathValid(path5) {
+      return !!(typeof path5 === "string" && path5 && path5[0] === "/" && (path5.length === 1 || path5[path5.length - 1] !== "/" && path5.split("/").slice(1).every((p) => p && pathRe.test(p))));
     }
-    function assertObjectPathValid(path4) {
-      if (!isObjectPathValid(path4)) {
-        throw new Error(`Invalid object path: ${path4}`);
+    function assertObjectPathValid(path5) {
+      if (!isObjectPathValid(path5)) {
+        throw new Error(`Invalid object path: ${path5}`);
       }
     }
     var elementRe = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -1334,11 +1334,11 @@ var require_message_type = __commonJS({
        * @param {Array] body - The body of the message as an array of arguments.
        * Must match the signature.
        */
-      static newSignal(path4, iface, name, signature = "", body = []) {
+      static newSignal(path5, iface, name, signature = "", body = []) {
         return new _Message({
           type: SIGNAL,
           interface: iface,
-          path: path4,
+          path: path5,
           member: name,
           signature,
           body
@@ -1755,7 +1755,7 @@ var require_errors = __commonJS({
 var require_handlers = __commonJS({
   "node_modules/dbus-next/lib/service/handlers.js"(exports2, module2) {
     "use strict";
-    var fs5 = require("fs");
+    var fs6 = require("fs");
     var variant = require_variant();
     var Variant2 = variant.Variant;
     var { Message: Message2 } = require_message_type();
@@ -1769,26 +1769,26 @@ var require_handlers = __commonJS({
       ACCESS_WRITE,
       ACCESS_READWRITE
     } = require_interface();
-    var constants4 = require_constants();
+    var constants5 = require_constants();
     var {
       METHOD_RETURN
-    } = constants4.MessageType;
+    } = constants5.MessageType;
     var { DBusError } = require_errors();
     var INVALID_ARGS = "org.freedesktop.DBus.Error.InvalidArgs";
     function sendServiceError(bus, msg, errorMessage) {
       bus.send(Message2.newError(msg, "com.github.dbus_next.ServiceError", `Service error: ${errorMessage}`));
       return true;
     }
-    function handleIntrospect(bus, msg, path4) {
-      bus.send(Message2.newMethodReturn(msg, "s", [bus._introspect(path4)]));
+    function handleIntrospect(bus, msg, path5) {
+      bus.send(Message2.newMethodReturn(msg, "s", [bus._introspect(path5)]));
     }
-    function handleGetProperty(bus, msg, path4) {
+    function handleGetProperty(bus, msg, path5) {
       const [ifaceName, prop] = msg.body;
-      if (!bus._serviceObjects[path4]) {
-        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path4}'`));
+      if (!bus._serviceObjects[path5]) {
+        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path5}'`));
         return;
       }
-      const obj = bus._getServiceObject(path4);
+      const obj = bus._getServiceObject(path5);
       const iface = obj.interfaces[ifaceName];
       if (!iface) {
         bus.send(Message2.newError(msg, INVALID_ARGS, `No such interface: '${ifaceName}'`));
@@ -1832,13 +1832,13 @@ ${e.stack}`);
       const body = new Variant2(options.signature, propertyValue);
       bus.send(Message2.newMethodReturn(msg, "v", [body]));
     }
-    function handleGetAllProperties(bus, msg, path4) {
+    function handleGetAllProperties(bus, msg, path5) {
       const ifaceName = msg.body[0];
-      if (!bus._serviceObjects[path4]) {
-        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path4}'`));
+      if (!bus._serviceObjects[path5]) {
+        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path5}'`));
         return;
       }
-      const obj = bus._getServiceObject(path4);
+      const obj = bus._getServiceObject(path5);
       const iface = obj.interfaces[ifaceName];
       const result = {};
       if (iface) {
@@ -1871,13 +1871,13 @@ ${e.stack}`);
       }
       bus.send(Message2.newMethodReturn(msg, "a{sv}", [result]));
     }
-    function handleSetProperty(bus, msg, path4) {
+    function handleSetProperty(bus, msg, path5) {
       const [ifaceName, prop, value] = msg.body;
-      if (!bus._serviceObjects[path4]) {
-        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path4}'`));
+      if (!bus._serviceObjects[path5]) {
+        bus.send(Message2.newError(msg, INVALID_ARGS, `Path not exported on bus: '${path5}'`));
         return;
       }
-      const obj = bus._getServiceObject(path4);
+      const obj = bus._getServiceObject(path5);
       const iface = obj.interfaces[ifaceName];
       if (!iface) {
         bus.send(Message2.newError(msg, INVALID_ARGS, `Interface not found: '${ifaceName}'`));
@@ -1920,7 +1920,7 @@ ${e.stack}`);
     function handleStdIfaces(bus, msg) {
       const {
         member,
-        path: path4,
+        path: path5,
         signature
       } = msg;
       const ifaceName = msg.interface;
@@ -1932,22 +1932,22 @@ ${e.stack}`);
         bus.send(Message2.newError(msg, INVALID_ARGS, `Invalid member name: '${member}'`));
         return true;
       }
-      if (!isObjectPathValid(path4)) {
-        bus.send(Message2.newError(msg, INVALID_ARGS, `Invalid path name: '${path4}'`));
+      if (!isObjectPathValid(path5)) {
+        bus.send(Message2.newError(msg, INVALID_ARGS, `Invalid path name: '${path5}'`));
         return true;
       }
       if (ifaceName === "org.freedesktop.DBus.Introspectable" && member === "Introspect" && !signature) {
-        handleIntrospect(bus, msg, path4);
+        handleIntrospect(bus, msg, path5);
         return true;
       } else if (ifaceName === "org.freedesktop.DBus.Properties") {
         if (member === "Get" && signature === "ss") {
-          handleGetProperty(bus, msg, path4);
+          handleGetProperty(bus, msg, path5);
           return true;
         } else if (member === "Set" && signature === "ssv") {
-          handleSetProperty(bus, msg, path4);
+          handleSetProperty(bus, msg, path5);
           return true;
         } else if (member === "GetAll") {
-          handleGetAllProperties(bus, msg, path4);
+          handleGetAllProperties(bus, msg, path5);
           return true;
         }
       } else if (ifaceName === "org.freedesktop.DBus.Peer") {
@@ -1960,7 +1960,7 @@ ${e.stack}`);
           });
           return true;
         } else if (member === "GetMachineId" && !signature) {
-          const machineId = fs5.readFileSync("/var/lib/dbus/machine-id").toString().trim();
+          const machineId = fs6.readFileSync("/var/lib/dbus/machine-id").toString().trim();
           bus._connection.message({
             type: METHOD_RETURN,
             serial: bus._serial++,
@@ -1976,7 +1976,7 @@ ${e.stack}`);
     }
     function handleMessage(msg, bus) {
       let {
-        path: path4,
+        path: path5,
         member,
         signature
       } = msg;
@@ -1985,10 +1985,10 @@ ${e.stack}`);
       if (handleStdIfaces(bus, msg)) {
         return true;
       }
-      if (!bus._serviceObjects[path4]) {
+      if (!bus._serviceObjects[path5]) {
         return false;
       }
-      const obj = bus._getServiceObject(path4);
+      const obj = bus._getServiceObject(path5);
       const iface = obj.interfaces[ifaceName];
       if (!iface) {
         return false;
@@ -2050,9 +2050,9 @@ var require_object = __commonJS({
     var Interface = require_interface().Interface;
     var assertObjectPathValid = require_validators().assertObjectPathValid;
     var ServiceObject = class _ServiceObject {
-      constructor(path4, bus) {
-        assertObjectPathValid(path4);
-        this.path = path4;
+      constructor(path5, bus) {
+        assertObjectPathValid(path5);
+        this.path = path5;
         this.bus = bus;
         this.interfaces = {};
         this._handlers = {};
@@ -8190,12 +8190,12 @@ var require_parser = __commonJS({
         };
         Parser.prototype.parseStringPromise = function(str) {
           return new Promise(/* @__PURE__ */ (function(_this) {
-            return function(resolve2, reject) {
+            return function(resolve3, reject) {
               return _this.parseString(str, function(err, value) {
                 if (err) {
                   return reject(err);
                 } else {
-                  return resolve2(value);
+                  return resolve3(value);
                 }
               });
             };
@@ -8459,12 +8459,12 @@ var require_proxy_object = __commonJS({
        * Create a new `ProxyObject`. This constructor should not be called
        * directly. Use {@link MessageBus#getProxyObject} to get a proxy object.
        */
-      constructor(bus, name, path4) {
+      constructor(bus, name, path5) {
         assertBusNameValid(name);
-        assertObjectPathValid(path4);
+        assertObjectPathValid(path5);
         this.bus = bus;
         this.name = name;
-        this.path = path4;
+        this.path = path5;
         this.nodes = [];
         this.interfaces = {};
         this._parser = new xml2js.Parser();
@@ -8492,9 +8492,9 @@ var require_proxy_object = __commonJS({
               continue;
             }
             const name = n.$.name;
-            const path4 = `${this.path}/${name}`;
-            if (isObjectPathValid(path4)) {
-              this.nodes.push(path4);
+            const path5 = `${this.path}/${name}`;
+            if (isObjectPathValid(path5)) {
+              this.nodes.push(path5);
             }
           }
         }
@@ -8508,7 +8508,7 @@ var require_proxy_object = __commonJS({
         }
       }
       _init(xml) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           if (xml) {
             this._parser.parseString(xml, (err, data) => {
               if (err) {
@@ -8525,10 +8525,10 @@ var require_proxy_object = __commonJS({
               });
               this.bus.call(nameOwnerMessage).then((msg) => {
                 this.bus._nameOwners[this.name] = msg.body[0];
-                resolve2(this);
+                resolve3(this);
               }).catch((err2) => {
                 if (err2.type === "org.freedesktop.DBus.Error.NameHasNoOwner") {
-                  return resolve2(this);
+                  return resolve3(this);
                 }
                 return reject(err2);
               });
@@ -8549,7 +8549,7 @@ var require_proxy_object = __commonJS({
                   return reject(err);
                 }
                 this._initXml(data);
-                resolve2(this);
+                resolve3(this);
               });
             }).catch((err) => {
               return reject(err);
@@ -8558,7 +8558,7 @@ var require_proxy_object = __commonJS({
         });
       }
       _callMethod(iface, member, inSignature, outSignature, ...args) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           args = args || [];
           const methodCallMessage = new Message2({
             destination: this.name,
@@ -8571,13 +8571,13 @@ var require_proxy_object = __commonJS({
           this.bus.call(methodCallMessage).then((msg) => {
             const outSignatureTree = parseSignature(outSignature);
             if (outSignatureTree.length === 0) {
-              resolve2(null);
+              resolve3(null);
               return;
             }
             if (outSignatureTree.length === 1) {
-              resolve2(msg.body[0]);
+              resolve3(msg.body[0]);
             } else {
-              resolve2(msg.body);
+              resolve3(msg.body);
             }
           }).catch((err) => {
             return reject(err);
@@ -8594,7 +8594,7 @@ var require_bus = __commonJS({
   "node_modules/dbus-next/lib/bus.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("events").EventEmitter;
-    var constants4 = require_constants();
+    var constants5 = require_constants();
     var handleMethod = require_handlers();
     var { DBusError } = require_errors();
     var { Message: Message2 } = require_message_type();
@@ -8605,10 +8605,10 @@ var require_bus = __commonJS({
       METHOD_RETURN,
       ERROR,
       SIGNAL
-    } = constants4.MessageType;
+    } = constants5.MessageType;
     var {
       NO_REPLY_EXPECTED
-    } = constants4.MessageFlag;
+    } = constants5.MessageFlag;
     var {
       assertBusNameValid,
       assertObjectPathValid
@@ -8649,8 +8649,8 @@ var require_bus = __commonJS({
               handler(msg);
             }
           } else if (msg.type === SIGNAL) {
-            const { sender, path: path4, iface, member } = msg;
-            if (sender === "org.freedesktop.DBus" && path4 === "/org/freedesktop/DBus" && iface === "org.freedesktop.DBus" && member === "NameOwnerChanged") {
+            const { sender, path: path5, iface, member } = msg;
+            if (sender === "org.freedesktop.DBus" && path5 === "/org/freedesktop/DBus" && iface === "org.freedesktop.DBus" && member === "NameOwnerChanged") {
               const name = msg.body[0];
               const newOwner = msg.body[2];
               if (!name.startsWith(":")) {
@@ -8720,8 +8720,8 @@ ${e.stack}`));
        * @param [xml] {string} - xml introspection data.
        * @returns {Promise} - a Promise that resolves with the `ProxyObject`.
        */
-      getProxyObject(name, path4, xml) {
-        const obj = new ProxyObject(this, name, path4);
+      getProxyObject(name, path5, xml) {
+        const obj = new ProxyObject(this, name, path5);
         return obj._init(xml);
       }
       /**
@@ -8735,7 +8735,7 @@ ${e.stack}`));
        */
       requestName(name, flags) {
         flags = flags || 0;
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           assertBusNameValid(name);
           const requestNameMessage = new Message2({
             path: "/org/freedesktop/DBus",
@@ -8746,7 +8746,7 @@ ${e.stack}`));
             body: [name, flags]
           });
           this.call(requestNameMessage).then((msg) => {
-            return resolve2(msg.body[0]);
+            return resolve3(msg.body[0]);
           }).catch((err) => {
             return reject(err);
           });
@@ -8759,7 +8759,7 @@ ${e.stack}`));
        * @returns {Promise} A Promise that will resolve with the {@link ReleaseNameReply}.
        */
       releaseName(name) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           const msg = new Message2({
             path: "/org/freedesktop/DBus",
             destination: "org.freedesktop.DBus",
@@ -8769,7 +8769,7 @@ ${e.stack}`));
             body: [name]
           });
           this.call(msg).then((reply) => {
-            return resolve2(reply.body[0]);
+            return resolve3(reply.body[0]);
           }).catch((err) => {
             return reject(err);
           });
@@ -8843,7 +8843,7 @@ ${e.stack}`));
        * Message} which is a reply to the call.
        */
       call(msg) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           if (!(msg instanceof Message2)) {
             throw new Error("The call() method takes a Message class as the first argument.");
           }
@@ -8855,14 +8855,14 @@ ${e.stack}`));
           }
           msg._sent = true;
           if (msg.flags & NO_REPLY_EXPECTED) {
-            resolve2(null);
+            resolve3(null);
           } else {
             this._methodReturnHandlers[msg.serial] = (reply) => {
               this._nameOwners[msg.destination] = reply.sender;
               if (reply.type === ERROR) {
                 return reject(new DBusError(reply.errorName, reply.body[0], reply));
               } else {
-                return resolve2(reply);
+                return resolve3(reply);
               }
             };
           }
@@ -8896,8 +8896,8 @@ ${e.stack}`));
        * @param path {string} - The object path to export this `Interface` on.
        * @param iface {module:interface~Interface} - The service interface to export.
        */
-      export(path4, iface) {
-        const obj = this._getServiceObject(path4);
+      export(path5, iface) {
+        const obj = this._getServiceObject(path5);
         obj.addInterface(iface);
       }
       /**
@@ -8908,29 +8908,29 @@ ${e.stack}`));
        * @param {module:interface~Interface} [iface] - The `Interface` to unexport.
        * If not given, this will remove all interfaces on the path.
        */
-      unexport(path4, iface) {
+      unexport(path5, iface) {
         iface = iface || null;
         if (iface === null) {
-          this._removeServiceObject(path4);
+          this._removeServiceObject(path5);
         } else {
-          const obj = this._getServiceObject(path4);
+          const obj = this._getServiceObject(path5);
           obj.removeInterface(iface);
           if (!obj.interfaces.length) {
-            this._removeServiceObject(path4);
+            this._removeServiceObject(path5);
           }
         }
       }
-      _introspect(path4) {
-        assertObjectPathValid(path4);
+      _introspect(path5) {
+        assertObjectPathValid(path5);
         const xml = {
           node: {
             node: []
           }
         };
-        if (this._serviceObjects[path4]) {
-          xml.node.interface = this._serviceObjects[path4].introspect();
+        if (this._serviceObjects[path5]) {
+          xml.node.interface = this._serviceObjects[path5].introspect();
         }
-        const pathSplit = path4.split("/").filter((n) => n);
+        const pathSplit = path5.split("/").filter((n) => n);
         const children2 = /* @__PURE__ */ new Set();
         for (const key of Object.keys(this._serviceObjects)) {
           const keySplit = key.split("/").filter((n) => n);
@@ -8950,21 +8950,21 @@ ${e.stack}`));
         }
         return xmlHeader + this._builder.buildObject(xml);
       }
-      _getServiceObject(path4) {
-        assertObjectPathValid(path4);
-        if (!this._serviceObjects[path4]) {
-          this._serviceObjects[path4] = new ServiceObject(path4, this);
+      _getServiceObject(path5) {
+        assertObjectPathValid(path5);
+        if (!this._serviceObjects[path5]) {
+          this._serviceObjects[path5] = new ServiceObject(path5, this);
         }
-        return this._serviceObjects[path4];
+        return this._serviceObjects[path5];
       }
-      _removeServiceObject(path4) {
-        assertObjectPathValid(path4);
-        if (this._serviceObjects[path4]) {
-          const obj = this._serviceObjects[path4];
+      _removeServiceObject(path5) {
+        assertObjectPathValid(path5);
+        if (this._serviceObjects[path5]) {
+          const obj = this._serviceObjects[path5];
           for (const i of Object.keys(obj.interfaces)) {
             obj.removeInterface(obj.interfaces[i]);
           }
-          delete this._serviceObjects[path4];
+          delete this._serviceObjects[path5];
         }
       }
       _addMatch(match) {
@@ -10648,7 +10648,7 @@ var require_message = __commonJS({
     "use strict";
     var Buffer2 = require_safe_buffer().Buffer;
     var marshall = require_marshall();
-    var constants4 = require_constants();
+    var constants5 = require_constants();
     var DBusBuffer = require_dbus_buffer();
     var headerSignature = require_header_signature();
     module2.exports.unmarshalMessages = function messageParser(stream, onMessage, opts) {
@@ -10658,7 +10658,7 @@ var require_message = __commonJS({
       let fieldsAndBodyLength = 0;
       let bodyLength = 0;
       let endian = 0;
-      const LE = constants4.endianness.le;
+      const LE = constants5.endianness.le;
       stream.on("readable", function() {
         while (1) {
           if (state === 0) {
@@ -10689,7 +10689,7 @@ var require_message = __commonJS({
             const message = {};
             message.serial = endian === LE ? header.readUInt32LE(8) : header.readUInt32BE(8);
             for (let i = 0; i < unmarshalledHeader.length; ++i) {
-              headerName = constants4.headerTypeName[unmarshalledHeader[i][0]];
+              headerName = constants5.headerTypeName[unmarshalledHeader[i][0]];
               message[headerName] = unmarshalledHeader[i][1][1][0];
             }
             message.type = header[1];
@@ -10708,7 +10708,7 @@ var require_message = __commonJS({
       const headers = msgBuf.read("yyyyuua(yv)");
       const message = {};
       for (let i = 0; i < headers[6].length; ++i) {
-        const headerName = constants4.headerTypeName[headers[6][i][0]];
+        const headerName = constants5.headerTypeName[headers[6][i][0]];
         message[headerName] = headers[6][i][1][1][0];
       }
       message.type = headers[1];
@@ -10721,7 +10721,7 @@ var require_message = __commonJS({
     module2.exports.marshall = function marshallMessage(message) {
       if (!message.serial) throw new Error("Missing or invalid serial");
       const flags = message.flags || 0;
-      const type = message.type || constants4.messageType.METHOD_CALL;
+      const type = message.type || constants5.messageType.METHOD_CALL;
       let bodyLength = 0;
       let bodyBuff;
       const fds = [];
@@ -10731,21 +10731,21 @@ var require_message = __commonJS({
         message.unixFd = fds.length;
       }
       const header = [
-        constants4.endianness.le,
+        constants5.endianness.le,
         type,
         flags,
-        constants4.protocolVersion,
+        constants5.protocolVersion,
         bodyLength,
         message.serial
       ];
       const headerBuff = marshall("yyyyuu", header);
       const fields = [];
-      constants4.headerTypeName.forEach(function(fieldName) {
+      constants5.headerTypeName.forEach(function(fieldName) {
         const fieldVal = message[fieldName];
         if (fieldVal) {
           fields.push([
-            constants4.headerTypeId[fieldName],
-            [constants4.fieldSignature[fieldName], fieldVal]
+            constants5.headerTypeId[fieldName],
+            [constants5.fieldSignature[fieldName], fieldVal]
           ]);
         }
       });
@@ -10795,13 +10795,13 @@ var require_handshake = __commonJS({
   "node_modules/dbus-next/lib/handshake.js"(exports2, module2) {
     "use strict";
     var Buffer2 = require_safe_buffer().Buffer;
-    var crypto4 = require("crypto");
-    var fs5 = require("fs");
-    var path4 = require("path");
-    var constants4 = require_constants();
+    var crypto5 = require("crypto");
+    var fs6 = require("fs");
+    var path5 = require("path");
+    var constants5 = require_constants();
     var readLine = require_readline();
     function sha1(input) {
-      const shasum = crypto4.createHash("sha1");
+      const shasum = crypto5.createHash("sha1");
       shasum.update(input);
       return shasum.digest("hex");
     }
@@ -10809,26 +10809,26 @@ var require_handshake = __commonJS({
       return process.env[process.platform.match(/$win/) ? "USERPROFILE" : "HOME"];
     }
     function getCookie(context, id, cb) {
-      const dirname = path4.join(getUserHome(), ".dbus-keyrings");
+      const dirname = path5.join(getUserHome(), ".dbus-keyrings");
       if (context.length === 0) context = "org_freedesktop_general";
-      const filename = path4.join(dirname, context);
-      fs5.stat(dirname, function(err, stat3) {
+      const filename = path5.join(dirname, context);
+      fs6.stat(dirname, function(err, stat4) {
         if (err) return cb(err);
-        if (stat3.mode & 18) {
+        if (stat4.mode & 18) {
           return cb(
             new Error(
               "User keyrings directory is writeable by other users. Aborting authentication"
             )
           );
         }
-        if ("getuid" in process && stat3.uid !== process.getuid()) {
+        if ("getuid" in process && stat4.uid !== process.getuid()) {
           return cb(
             new Error(
               "Keyrings directory is not owned by the current user. Aborting authentication!"
             )
           );
         }
-        fs5.readFile(filename, "ascii", function(err2, keyrings) {
+        fs6.readFile(filename, "ascii", function(err2, keyrings) {
           if (err2) return cb(err2);
           const lines = keyrings.split("\n");
           for (let l = 0; l < lines.length; ++l) {
@@ -10847,7 +10847,7 @@ var require_handshake = __commonJS({
       if (opts.authMethods) {
         authMethods = opts.authMethods;
       } else {
-        authMethods = constants4.defaultAuthMethods;
+        authMethods = constants5.defaultAuthMethods;
       }
       stream.write("\0");
       tryAuth(stream, authMethods.slice(), cb);
@@ -10911,7 +10911,7 @@ var require_handshake = __commonJS({
             const cookieContext = data[0];
             const cookieId = data[1];
             const serverChallenge = data[2];
-            const clientChallenge = crypto4.randomBytes(16).toString("hex");
+            const clientChallenge = crypto5.randomBytes(16).toString("hex");
             getCookie(cookieContext, cookieId, function(err, cookie) {
               if (err) return cb(err);
               const response = sha1(
@@ -10941,14 +10941,14 @@ var require_handshake = __commonJS({
 var require_address_x11 = __commonJS({
   "node_modules/dbus-next/lib/address-x11.js"(exports2, module2) {
     "use strict";
-    var fs5 = require("fs");
+    var fs6 = require("fs");
     var os = require("os");
     function getDbusAddressFromWindowSelection(callback) {
       const x11 = require("x11");
       if (x11 === null) {
         throw new Error("cannot get session bus address from window selection: dbus-next was installed without x11 support");
       }
-      fs5.readFile("/var/lib/dbus/machine-id", "ascii", function(err, uuid2) {
+      fs6.readFile("/var/lib/dbus/machine-id", "ascii", function(err, uuid2) {
         if (err) return callback(err);
         const hostname = os.hostname().split("-")[0];
         x11.createClient(function(err2, display) {
@@ -10984,8 +10984,8 @@ var require_address_x11 = __commonJS({
         throw new Error("could not parse DISPLAY environment variable to get dbus address");
       }
       const displayNum = match[1];
-      const machineId = fs5.readFileSync("/var/lib/dbus/machine-id").toString().trim();
-      const dbusInfo = fs5.readFileSync(`${home}/.dbus/session-bus/${machineId}-${displayNum}`).toString().trim();
+      const machineId = fs6.readFileSync("/var/lib/dbus/machine-id").toString().trim();
+      const dbusInfo = fs6.readFileSync(`${home}/.dbus/session-bus/${machineId}-${displayNum}`).toString().trim();
       for (let line of dbusInfo.split("\n")) {
         line = line.trim();
         if (line.startsWith("DBUS_SESSION_BUS_ADDRESS=")) {
@@ -11971,7 +11971,7 @@ var require_connection = __commonJS({
 var require_dbus_next = __commonJS({
   "node_modules/dbus-next/index.js"(exports2, module2) {
     "use strict";
-    var constants4 = require_constants();
+    var constants5 = require_constants();
     var MessageBus = require_bus();
     var errors = require_errors();
     var { Variant: Variant2 } = require_variant();
@@ -11994,11 +11994,11 @@ var require_dbus_next = __commonJS({
       return createClient(opts);
     };
     module2.exports.setBigIntCompat = require_library_options().setBigIntCompat;
-    module2.exports.NameFlag = constants4.NameFlag;
-    module2.exports.RequestNameReply = constants4.RequestNameReply;
-    module2.exports.ReleaseNameReply = constants4.ReleaseNameReply;
-    module2.exports.MessageType = constants4.MessageType;
-    module2.exports.MessageFlag = constants4.MessageFlag;
+    module2.exports.NameFlag = constants5.NameFlag;
+    module2.exports.RequestNameReply = constants5.RequestNameReply;
+    module2.exports.ReleaseNameReply = constants5.ReleaseNameReply;
+    module2.exports.MessageType = constants5.MessageType;
+    module2.exports.MessageFlag = constants5.MessageFlag;
     module2.exports.interface = iface;
     module2.exports.Variant = Variant2;
     module2.exports.Message = Message2;
@@ -12020,7 +12020,7 @@ __export(runtime_exports, {
 module.exports = __toCommonJS(runtime_exports);
 
 // src/client.ts
-var crypto3 = __toESM(require("crypto"), 1);
+var crypto4 = __toESM(require("crypto"), 1);
 
 // src/errors.ts
 var util = __toESM(require("util"), 1);
@@ -12119,23 +12119,23 @@ var ObservationHub = class {
   /** Entries exist only while a caller is waiting on a unit. */
   groups = /* @__PURE__ */ new Map();
   /** Wake one task, or every task after manager disconnection. */
-  notify(unitName) {
+  notify(unitName2) {
     for (const [name, group] of this.groups) {
-      if (unitName !== void 0 && unitName !== name) continue;
+      if (unitName2 !== void 0 && unitName2 !== name) continue;
       group.generation++;
       for (const callback of [...group.callbacks]) callback();
     }
   }
   /** Subscribe before the first snapshot, then compare generations before sleeping. */
-  watch(unitName) {
-    let group = this.groups.get(unitName);
+  watch(unitName2) {
+    let group = this.groups.get(unitName2);
     if (!group) {
       group = { generation: 0, callbacks: /* @__PURE__ */ new Set(), users: 0, timer: setInterval(
         /** Reconcile snapshots even if systemd notifications are missed. */
-        () => this.notify(unitName),
+        () => this.notify(unitName2),
         1e3
       ) };
-      this.groups.set(unitName, group);
+      this.groups.set(unitName2, group);
     }
     const state = group;
     state.users++;
@@ -12149,12 +12149,12 @@ var ObservationHub = class {
         if (closed || version2 !== state.generation) return;
         await new Promise(
           /** Retain a single wake callback for this observer. */
-          (resolve2) => {
+          (resolve3) => {
             pending = /** Remove this wake callback before resolving the observer. */
             () => {
               if (pending) state.callbacks.delete(pending);
               pending = void 0;
-              resolve2();
+              resolve3();
             };
             state.callbacks.add(pending);
           }
@@ -12168,7 +12168,7 @@ var ObservationHub = class {
         state.users--;
         if (state.users === 0) {
           clearInterval(state.timer);
-          this.groups.delete(unitName);
+          this.groups.delete(unitName2);
         }
       }
     };
@@ -12230,7 +12230,7 @@ var ClientCore = class {
     this.diagnostics = sink;
     this.unsubscribe = adapter.onChange(
       /** Směruje všechny relevantní unit změny do společného hubu. */
-      (unitName) => this.hub.notify(unitName)
+      (unitName2) => this.hub.notify(unitName2)
     );
   }
   /** Odmítne operaci před jakýmkoliv manager I/O, pokud už klient skončil. */
@@ -12371,8 +12371,8 @@ var Diagnostics = class {
 // src/io.ts
 var fs = __toESM(require("fs"), 1);
 function fileIdentity(fd) {
-  const stat3 = fs.fstatSync(fd, { bigint: true });
-  return `${stat3.dev}:${stat3.ino}`;
+  const stat4 = fs.fstatSync(fd, { bigint: true });
+  return `${stat4.dev}:${stat4.ino}`;
 }
 function openIO(io) {
   const owned = /* @__PURE__ */ new Set();
@@ -12433,233 +12433,8 @@ function openIO(io) {
   }
 }
 
-// src/observed-framing.ts
-var magic = Buffer.from("SDTO", "ascii");
-var version = 1;
-var headerBytes = 10;
-var maximumPayloadBytes = 64 * 1024;
-var kind = Object.freeze({ ready: 1, stdout: 2, stderr: 3, complete: 4 });
-
-// src/observed-protocol.ts
-var receiveBudgetBytes = 256 * 1024;
-function observationError(error, reason = "observer-transport") {
-  if (error instanceof TaskError) return error;
-  const code = errorCode(error);
-  if (code === "ERR_FDX_PLATFORM" || code === "ERR_FDX_ABI" || code === "ERR_FDX_BINARY_MISSING") {
-    return new TaskError("UNSUPPORTED_ENVIRONMENT", "The installed Unix socket transport does not support observed tasks.", { reason: code }, error);
-  }
-  return new TaskError("OBSERVATION_FAILED", "The observed output connection failed.", { reason }, error);
-}
-var OutputObservation = class {
-  /** Veřejný terminal promise zůstává stejný pro všechny callery. */
-  completion;
-  /** Settluje public completion nezávisle na případně visícím application callbacku. */
-  completionResolve;
-  /** Propaguje jedinou redigovanou observation chybu do public completion. */
-  completionReject;
-  /** Package-owned bounded socket po úspěšné adopci. */
-  socket;
-  /** Callback se volá sekvenčně a jeho promise je skutečný backpressure. */
-  onOutput;
-  /** Odstraní handle ze společného client bookkeeping po libovolném settlementu. */
-  onTerminal;
-  /** Start čeká na jediný validní ready frame odděleně od celého output lifecycle. */
-  ready;
-  /** Settluje readiness právě jednou. */
-  readyResolve;
-  /** Propaguje pre-ready protocol nebo detach chybu do startObserved. */
-  readyReject;
-  /** Brání dvojímu settlementu readiness promise. */
-  readySettled = false;
-  /** Explicitní public detach se hlásí jako úspěšný lokální outcome. */
-  detached = false;
-  /** Interní start/protocol chyba má přednost před destroy error z native socketu. */
-  forcedFailure;
-  /** Terminal observation ignoruje pozdější detach nebo abort. */
-  terminal = false;
-  /** Spustí pull pump okamžitě, aby guardian readiness nemohla uváznout na bufferu. */
-  constructor(socket, onOutput, onTerminal) {
-    this.socket = socket;
-    this.onOutput = onOutput;
-    this.onTerminal = onTerminal;
-    this.ready = new Promise(
-      /** Uchová jednorázové readiness settlement funkce. */
-      (resolve2, reject) => {
-        this.readyResolve = resolve2;
-        this.readyReject = reject;
-      }
-    );
-    void this.ready.catch(
-      /** Interní readiness může selhat dřív, než start boundary připojí waiter. */
-      () => {
-      }
-    );
-    this.completion = new Promise(
-      /** Lokální detach nesmí čekat na settlement cizího callback promise. */
-      (resolve2, reject) => {
-        this.completionResolve = resolve2;
-        this.completionReject = reject;
-      }
-    );
-    void this.completion.catch(
-      /** Caller smí completion připojit později bez unhandled-rejection závodu. */
-      () => {
-      }
-    );
-    void this.pump();
-  }
-  /** Přečte exact frame a odmítne neznámou verzi, ancillary FD i oversized payload. */
-  async readFrame() {
-    const header = await this.socket.read({ bytes: headerBytes, fdCount: 0 });
-    if (header === null) return null;
-    if (this.socket.stats.bufferedReceiveFds !== 0 || !header.data.subarray(0, 4).equals(magic) || header.data[4] !== version) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an invalid protocol header.", { reason: "guardian-frame-header" });
-    const frameKind = header.data[5];
-    if (!Object.values(kind).includes(frameKind)) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an unknown frame kind.", { reason: "guardian-frame-kind" });
-    const length = header.data.readUInt32BE(6);
-    if (length > maximumPayloadBytes) throw new TaskError("OBSERVATION_FAILED", "The guardian frame exceeds the protocol limit.", { reason: "guardian-frame-limit" });
-    const payload = length === 0 ? Buffer.alloc(0) : (await this.socket.read({ bytes: length, fdCount: 0 }))?.data;
-    if (!payload || this.socket.stats.bufferedReceiveFds !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian stream ended inside a frame.", { reason: "guardian-frame-truncated" });
-    return Object.freeze({ kind: frameKind, payload: Buffer.from(payload) });
-  }
-  /** Settluje readiness jen jednou a zachová původní chybu pro start boundary. */
-  settleReady(error) {
-    if (this.readySettled) return;
-    this.readySettled = true;
-    if (error) this.readyReject(error);
-    else this.readyResolve();
-  }
-  /** Settluje public observation a client bookkeeping právě jednou. */
-  settleCompletion(outcome, error) {
-    if (this.terminal) return;
-    this.terminal = true;
-    if (error) this.completionReject(error);
-    else this.completionResolve(outcome);
-    try {
-      this.onTerminal();
-    } catch {
-    }
-  }
-  /** Vynutí ready→data*→complete→EOF pořadí a sekvenční callback backpressure. */
-  async pump() {
-    try {
-      const ready = await this.readFrame();
-      if (ready === null || ready.kind !== kind.ready || ready.payload.byteLength !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian did not begin with an empty ready frame.", { reason: "guardian-ready-order" });
-      this.settleReady();
-      for (; ; ) {
-        const frame = await this.readFrame();
-        if (frame === null) throw new TaskError("OBSERVATION_FAILED", "The guardian ended before the complete frame.", { reason: "guardian-unexpected-eof" });
-        if (frame.kind === kind.ready) throw new TaskError("OBSERVATION_FAILED", "The guardian repeated its ready frame.", { reason: "guardian-frame-order" });
-        if (frame.kind === kind.complete) {
-          if (frame.payload.byteLength !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian complete frame carried data.", { reason: "guardian-frame-order" });
-          const trailing = await this.socket.read({ bytes: 1, fdCount: 0 });
-          if (trailing !== null || this.socket.stats.bufferedReceiveFds !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian sent trailing protocol data.", { reason: "guardian-trailing-data" });
-          this.socket.destroy();
-          this.settleCompletion(Object.freeze({ outcome: "complete" }));
-          return;
-        }
-        if (frame.kind !== kind.stdout && frame.kind !== kind.stderr || frame.payload.byteLength === 0) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an invalid output frame.", { reason: "guardian-frame-order" });
-        try {
-          await this.onOutput(Object.freeze({ stream: frame.kind === kind.stdout ? "stdout" : "stderr", data: Buffer.from(frame.payload) }));
-        } catch (error) {
-          throw new TaskError("OBSERVATION_FAILED", "The observed output callback failed.", { reason: "output-callback" }, error);
-        }
-      }
-    } catch (error) {
-      if (this.detached && !this.forcedFailure) return;
-      const reported = this.forcedFailure ?? observationError(error);
-      this.settleReady(reported);
-      this.socket.destroy();
-      this.settleCompletion(void 0, reported);
-    }
-  }
-  /** Čeká na readiness v pevném budgetu a timeout převádí na terminal observation failure. */
-  async waitReady(timeoutMs) {
-    let timer;
-    const timeout = new Promise(
-      /** Readiness timeout není task runtime timeout ani stop request. */
-      (_resolve, reject) => {
-        timer = setTimeout(
-          /** Odpojí jen lokální peer; přijatý guardian přejde do drain režimu. */
-          () => reject(new TaskError("OBSERVATION_FAILED", "The guardian readiness deadline expired.", { reason: "guardian-readiness-timeout" })),
-          timeoutMs
-        );
-      }
-    );
-    try {
-      await Promise.race([this.ready, timeout]);
-    } catch (error) {
-      const reported = observationError(error, "guardian-readiness");
-      await this.abort(reported);
-      throw reported;
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  /** Interní start chyba ukončí observation jako failure, nikoliv user-requested detach. */
-  async abort(error) {
-    if (this.terminal) return;
-    this.forcedFailure = error;
-    this.settleReady(error);
-    this.socket.destroy();
-    this.settleCompletion(void 0, error);
-  }
-  /** Explicitní detach zavře lokální socket bez čekání na případně visící application callback. */
-  async detach() {
-    if (this.terminal) return;
-    this.detached = true;
-    this.settleReady(new TaskError("OBSERVATION_FAILED", "The output observation detached before guardian readiness.", { reason: "detached-before-ready" }));
-    this.socket.destroy();
-    this.settleCompletion(Object.freeze({ outcome: "detached" }));
-  }
-};
-async function loadFdx() {
-  return await import("usocket");
-}
-function prepareSocketsWithRuntime(socketFdx, options, onTerminal) {
-  const owned = [];
-  let adopted;
-  try {
-    const stdout = socketFdx.socketPair();
-    owned.push(...stdout);
-    const stderr = socketFdx.socketPair();
-    owned.push(...stderr);
-    const observer = socketFdx.socketPair();
-    owned.push(...observer);
-    adopted = socketFdx.adoptSocket({ descriptor: observer[0], limits: { receiveBytes: receiveBudgetBytes, receiveFds: 1, readOperations: 2 } });
-    const observation = new OutputObservation(adopted, options.onOutput, onTerminal);
-    let closed = false;
-    return Object.freeze({
-      descriptors: Object.freeze({
-        taskStdout: stdout[0].fd,
-        guardianStdout: stdout[1].fd,
-        taskStderr: stderr[0].fd,
-        guardianStderr: stderr[1].fd,
-        guardianObserver: observer[1].fd
-      }),
-      observation,
-      closeSubmitted: () => {
-        if (closed) return;
-        closed = true;
-        for (const descriptor of owned) descriptor.close();
-      }
-    });
-  } catch (error) {
-    adopted?.destroy();
-    for (const descriptor of owned) descriptor.close();
-    throw observationError(error, "socket-setup");
-  }
-}
-async function prepareSockets(options, onTerminal) {
-  return prepareSocketsWithRuntime(await loadFdx(), options, onTerminal);
-}
-function validateStartOptions(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) throw new TaskError("INVALID_INPUT", "The observed start options are invalid.", { reason: "observed-start-options", mutationOutcome: "not-submitted" });
-  const source = value;
-  if (Object.keys(source).length !== 1 || typeof source.onOutput !== "function" || Object.getOwnPropertySymbols(source).length !== 0) throw new TaskError("INVALID_INPUT", "The observed start options are invalid.", { reason: "observed-start-options", mutationOutcome: "not-submitted" });
-  return Object.freeze({ onOutput: source.onOutput });
-}
-
-// src/observed-systemd.ts
+// src/observed-finalization.ts
+var crypto3 = __toESM(require("crypto"), 1);
 var fs3 = __toESM(require("fs/promises"), 1);
 var path3 = __toESM(require("path"), 1);
 
@@ -13168,32 +12943,347 @@ async function snapshot(identity3, manager, pair, readPopulation = cgroupPopulat
   return Object.freeze({ reference: captured, identity: captured.invocationId && captured.retentionInvocationId ? "complete" : "incomplete", phase, ...process2 });
 }
 
+// src/observed-finalization.ts
+var maximumBootstrapBytes = maximumObservedInputBytes * 2;
+function requireCompleteReference(value) {
+  const reference3 = validateObservedReference(value);
+  if (!reference3.invocationId || !reference3.retentionInvocationId || !reference3.guardianInvocationId) {
+    invalid("finalization-reference-incomplete");
+  }
+  return reference3;
+}
+function prepare2(reference3, value) {
+  const source = record(value, "finalization-options");
+  keys(source, ["afterRelease", "timeoutMs"], "finalization-option-keys");
+  return Object.freeze({
+    reference: requireCompleteReference(reference3),
+    timeoutMs: duration(source.timeoutMs, maximumLocalTimeoutMs, "finalization-timeout"),
+    afterRelease: normalizeSpec(source.afterRelease)
+  });
+}
+function unitName(reference3) {
+  return reference3.unitName.replace(/\.service$/u, "-finalizer.service");
+}
+function marker3(bootstrap) {
+  const fingerprint2 = crypto3.createHash("sha256").update(JSON.stringify(bootstrap)).digest("hex");
+  return `@primafuture/systemd-tasks:observed-finalizer:v1:${bootstrap.reference.id}:${fingerprint2}`;
+}
+function assertRegistered(bootstrap, unit) {
+  const properties2 = unit.properties;
+  if (properties2.Transient !== true || properties2.Description !== marker3(bootstrap) || properties2.Type !== "exec" || properties2.ExitType !== "main" || properties2.Restart !== "no" || properties2.KillMode !== "control-group" || properties2.RemainAfterExit !== false || properties2.CollectMode !== "inactive-or-failed") {
+    throw new TaskError("IDENTITY_CONFLICT", "The finalizer is not the registered owned instance.", {
+      reason: "finalizer-ownership",
+      taskId: bootstrap.reference.id
+    });
+  }
+  if (properties2.ActiveState === "failed") {
+    throw new TaskError("RESULT_UNAVAILABLE", "The registered finalizer failed.", {
+      reason: "finalizer-failed",
+      taskId: bootstrap.reference.id
+    });
+  }
+}
+async function executablePath() {
+  const directory = typeof __systemdTasksRuntimeDirectory === "string" ? __systemdTasksRuntimeDirectory : path3.resolve(process.cwd(), "src");
+  const executable = path3.basename(directory) === "src" ? path3.resolve(directory, "..", "dist", "finalizer.mjs") : path3.join(directory, "finalizer.mjs");
+  try {
+    const stat4 = await fs3.stat(executable);
+    if (!stat4.isFile()) {
+      throw new Error("Finalizer is not a regular file.");
+    }
+    await fs3.access(executable, fs3.constants.R_OK);
+  } catch (error) {
+    throw new TaskError("UNSUPPORTED_ENVIRONMENT", "The packaged finalizer is unavailable.", {
+      reason: "finalizer-unavailable"
+    }, error);
+  }
+  return executable;
+}
+async function creationProperties2(bootstrap, inheritedEnvironment) {
+  const input = Buffer.from(JSON.stringify(bootstrap), "utf8");
+  if (input.byteLength > maximumBootstrapBytes) {
+    invalid("finalization-bootstrap-limit");
+  }
+  const executable = await executablePath();
+  const properties2 = [
+    property("Description", "s", marker3(bootstrap)),
+    property("Type", "s", "exec"),
+    property("ExitType", "s", "main"),
+    property("Restart", "s", "no"),
+    property("RemainAfterExit", "b", false),
+    property("CollectMode", "s", "inactive-or-failed"),
+    property("KillMode", "s", "control-group"),
+    property("TimeoutStopUSec", "t", BigInt(bootstrap.afterRelease.spec.stopGraceMs) * 1000n),
+    property("RuntimeMaxUSec", "t", infinityUsec),
+    property("WorkingDirectory", "s", "/"),
+    property("Environment", "as", []),
+    property("UnsetEnvironment", "as", unsetEnvironment(inheritedEnvironment)),
+    property("ExecStartEx", "a(sasas)", [[process.execPath, [process.execPath, executable], ["no-env-expand"]]]),
+    property("StandardInput", "s", "data"),
+    property("StandardInputData", "ay", input),
+    property("StandardOutput", "s", "null"),
+    property("StandardError", "s", "journal")
+  ];
+  for (const resource of bootstrap.afterRelease.spec.systemdProperties ?? []) {
+    properties2.push(property(resource.name, resource.signature, BigInt(resource.value)));
+  }
+  return Object.freeze(properties2);
+}
+
+// src/observed-framing.ts
+var magic = Buffer.from("SDTO", "ascii");
+var version = 1;
+var headerBytes = 10;
+var maximumPayloadBytes = 64 * 1024;
+var kind = Object.freeze({ ready: 1, stdout: 2, stderr: 3, complete: 4 });
+
+// src/observed-protocol.ts
+var receiveBudgetBytes = 256 * 1024;
+function observationError(error, reason = "observer-transport") {
+  if (error instanceof TaskError) return error;
+  const code = errorCode(error);
+  if (code === "ERR_FDX_PLATFORM" || code === "ERR_FDX_ABI" || code === "ERR_FDX_BINARY_MISSING") {
+    return new TaskError("UNSUPPORTED_ENVIRONMENT", "The installed Unix socket transport does not support observed tasks.", { reason: code }, error);
+  }
+  return new TaskError("OBSERVATION_FAILED", "The observed output connection failed.", { reason }, error);
+}
+var OutputObservation = class {
+  /** Veřejný terminal promise zůstává stejný pro všechny callery. */
+  completion;
+  /** Settluje public completion nezávisle na případně visícím application callbacku. */
+  completionResolve;
+  /** Propaguje jedinou redigovanou observation chybu do public completion. */
+  completionReject;
+  /** Package-owned bounded socket po úspěšné adopci. */
+  socket;
+  /** Callback se volá sekvenčně a jeho promise je skutečný backpressure. */
+  onOutput;
+  /** Odstraní handle ze společného client bookkeeping po libovolném settlementu. */
+  onTerminal;
+  /** Start čeká na jediný validní ready frame odděleně od celého output lifecycle. */
+  ready;
+  /** Settluje readiness právě jednou. */
+  readyResolve;
+  /** Propaguje pre-ready protocol nebo detach chybu do startObserved. */
+  readyReject;
+  /** Brání dvojímu settlementu readiness promise. */
+  readySettled = false;
+  /** Explicitní public detach se hlásí jako úspěšný lokální outcome. */
+  detached = false;
+  /** Interní start/protocol chyba má přednost před destroy error z native socketu. */
+  forcedFailure;
+  /** Terminal observation ignoruje pozdější detach nebo abort. */
+  terminal = false;
+  /** Spustí pull pump okamžitě, aby guardian readiness nemohla uváznout na bufferu. */
+  constructor(socket, onOutput, onTerminal) {
+    this.socket = socket;
+    this.onOutput = onOutput;
+    this.onTerminal = onTerminal;
+    this.ready = new Promise(
+      /** Uchová jednorázové readiness settlement funkce. */
+      (resolve3, reject) => {
+        this.readyResolve = resolve3;
+        this.readyReject = reject;
+      }
+    );
+    void this.ready.catch(
+      /** Interní readiness může selhat dřív, než start boundary připojí waiter. */
+      () => {
+      }
+    );
+    this.completion = new Promise(
+      /** Lokální detach nesmí čekat na settlement cizího callback promise. */
+      (resolve3, reject) => {
+        this.completionResolve = resolve3;
+        this.completionReject = reject;
+      }
+    );
+    void this.completion.catch(
+      /** Caller smí completion připojit později bez unhandled-rejection závodu. */
+      () => {
+      }
+    );
+    void this.pump();
+  }
+  /** Přečte exact frame a odmítne neznámou verzi, ancillary FD i oversized payload. */
+  async readFrame() {
+    const header = await this.socket.read({ bytes: headerBytes, fdCount: 0 });
+    if (header === null) return null;
+    if (this.socket.stats.bufferedReceiveFds !== 0 || !header.data.subarray(0, 4).equals(magic) || header.data[4] !== version) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an invalid protocol header.", { reason: "guardian-frame-header" });
+    const frameKind = header.data[5];
+    if (!Object.values(kind).includes(frameKind)) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an unknown frame kind.", { reason: "guardian-frame-kind" });
+    const length = header.data.readUInt32BE(6);
+    if (length > maximumPayloadBytes) throw new TaskError("OBSERVATION_FAILED", "The guardian frame exceeds the protocol limit.", { reason: "guardian-frame-limit" });
+    const payload = length === 0 ? Buffer.alloc(0) : (await this.socket.read({ bytes: length, fdCount: 0 }))?.data;
+    if (!payload || this.socket.stats.bufferedReceiveFds !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian stream ended inside a frame.", { reason: "guardian-frame-truncated" });
+    return Object.freeze({ kind: frameKind, payload: Buffer.from(payload) });
+  }
+  /** Settluje readiness jen jednou a zachová původní chybu pro start boundary. */
+  settleReady(error) {
+    if (this.readySettled) return;
+    this.readySettled = true;
+    if (error) this.readyReject(error);
+    else this.readyResolve();
+  }
+  /** Settluje public observation a client bookkeeping právě jednou. */
+  settleCompletion(outcome, error) {
+    if (this.terminal) return;
+    this.terminal = true;
+    if (error) this.completionReject(error);
+    else this.completionResolve(outcome);
+    try {
+      this.onTerminal();
+    } catch {
+    }
+  }
+  /** Vynutí ready→data*→complete→EOF pořadí a sekvenční callback backpressure. */
+  async pump() {
+    try {
+      const ready = await this.readFrame();
+      if (ready === null || ready.kind !== kind.ready || ready.payload.byteLength !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian did not begin with an empty ready frame.", { reason: "guardian-ready-order" });
+      this.settleReady();
+      for (; ; ) {
+        const frame = await this.readFrame();
+        if (frame === null) throw new TaskError("OBSERVATION_FAILED", "The guardian ended before the complete frame.", { reason: "guardian-unexpected-eof" });
+        if (frame.kind === kind.ready) throw new TaskError("OBSERVATION_FAILED", "The guardian repeated its ready frame.", { reason: "guardian-frame-order" });
+        if (frame.kind === kind.complete) {
+          if (frame.payload.byteLength !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian complete frame carried data.", { reason: "guardian-frame-order" });
+          const trailing = await this.socket.read({ bytes: 1, fdCount: 0 });
+          if (trailing !== null || this.socket.stats.bufferedReceiveFds !== 0) throw new TaskError("OBSERVATION_FAILED", "The guardian sent trailing protocol data.", { reason: "guardian-trailing-data" });
+          this.socket.destroy();
+          this.settleCompletion(Object.freeze({ outcome: "complete" }));
+          return;
+        }
+        if (frame.kind !== kind.stdout && frame.kind !== kind.stderr || frame.payload.byteLength === 0) throw new TaskError("OBSERVATION_FAILED", "The guardian sent an invalid output frame.", { reason: "guardian-frame-order" });
+        try {
+          await this.onOutput(Object.freeze({ stream: frame.kind === kind.stdout ? "stdout" : "stderr", data: Buffer.from(frame.payload) }));
+        } catch (error) {
+          throw new TaskError("OBSERVATION_FAILED", "The observed output callback failed.", { reason: "output-callback" }, error);
+        }
+      }
+    } catch (error) {
+      if (this.detached && !this.forcedFailure) return;
+      const reported = this.forcedFailure ?? observationError(error);
+      this.settleReady(reported);
+      this.socket.destroy();
+      this.settleCompletion(void 0, reported);
+    }
+  }
+  /** Čeká na readiness v pevném budgetu a timeout převádí na terminal observation failure. */
+  async waitReady(timeoutMs) {
+    let timer;
+    const timeout = new Promise(
+      /** Readiness timeout není task runtime timeout ani stop request. */
+      (_resolve, reject) => {
+        timer = setTimeout(
+          /** Odpojí jen lokální peer; přijatý guardian přejde do drain režimu. */
+          () => reject(new TaskError("OBSERVATION_FAILED", "The guardian readiness deadline expired.", { reason: "guardian-readiness-timeout" })),
+          timeoutMs
+        );
+      }
+    );
+    try {
+      await Promise.race([this.ready, timeout]);
+    } catch (error) {
+      const reported = observationError(error, "guardian-readiness");
+      await this.abort(reported);
+      throw reported;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /** Interní start chyba ukončí observation jako failure, nikoliv user-requested detach. */
+  async abort(error) {
+    if (this.terminal) return;
+    this.forcedFailure = error;
+    this.settleReady(error);
+    this.socket.destroy();
+    this.settleCompletion(void 0, error);
+  }
+  /** Explicitní detach zavře lokální socket bez čekání na případně visící application callback. */
+  async detach() {
+    if (this.terminal) return;
+    this.detached = true;
+    this.settleReady(new TaskError("OBSERVATION_FAILED", "The output observation detached before guardian readiness.", { reason: "detached-before-ready" }));
+    this.socket.destroy();
+    this.settleCompletion(Object.freeze({ outcome: "detached" }));
+  }
+};
+async function loadFdx() {
+  return await import("usocket");
+}
+function prepareSocketsWithRuntime(socketFdx, options, onTerminal) {
+  const owned = [];
+  let adopted;
+  try {
+    const stdout = socketFdx.socketPair();
+    owned.push(...stdout);
+    const stderr = socketFdx.socketPair();
+    owned.push(...stderr);
+    const observer = socketFdx.socketPair();
+    owned.push(...observer);
+    adopted = socketFdx.adoptSocket({ descriptor: observer[0], limits: { receiveBytes: receiveBudgetBytes, receiveFds: 1, readOperations: 2 } });
+    const observation = new OutputObservation(adopted, options.onOutput, onTerminal);
+    let closed = false;
+    return Object.freeze({
+      descriptors: Object.freeze({
+        taskStdout: stdout[0].fd,
+        guardianStdout: stdout[1].fd,
+        taskStderr: stderr[0].fd,
+        guardianStderr: stderr[1].fd,
+        guardianObserver: observer[1].fd
+      }),
+      observation,
+      closeSubmitted: () => {
+        if (closed) return;
+        closed = true;
+        for (const descriptor of owned) descriptor.close();
+      }
+    });
+  } catch (error) {
+    adopted?.destroy();
+    for (const descriptor of owned) descriptor.close();
+    throw observationError(error, "socket-setup");
+  }
+}
+async function prepareSockets(options, onTerminal) {
+  return prepareSocketsWithRuntime(await loadFdx(), options, onTerminal);
+}
+function validateStartOptions(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) throw new TaskError("INVALID_INPUT", "The observed start options are invalid.", { reason: "observed-start-options", mutationOutcome: "not-submitted" });
+  const source = value;
+  if (Object.keys(source).length !== 1 || typeof source.onOutput !== "function" || Object.getOwnPropertySymbols(source).length !== 0) throw new TaskError("INVALID_INPUT", "The observed start options are invalid.", { reason: "observed-start-options", mutationOutcome: "not-submitted" });
+  return Object.freeze({ onOutput: source.onOutput });
+}
+
 // src/observed-systemd.ts
+var fs4 = __toESM(require("fs/promises"), 1);
+var path4 = __toESM(require("path"), 1);
 var guardianReadinessTimeoutMs = 5e3;
 function guardianPath() {
-  const directory = typeof __systemdTasksRuntimeDirectory === "string" ? __systemdTasksRuntimeDirectory : path3.resolve(process.cwd(), "src");
-  return path3.basename(directory) === "src" ? path3.resolve(directory, "..", "dist", "guardian.mjs") : path3.join(directory, "guardian.mjs");
+  const directory = typeof __systemdTasksRuntimeDirectory === "string" ? __systemdTasksRuntimeDirectory : path4.resolve(process.cwd(), "src");
+  return path4.basename(directory) === "src" ? path4.resolve(directory, "..", "dist", "guardian.mjs") : path4.join(directory, "guardian.mjs");
 }
 async function assertObservedAvailable() {
   await assertRetentionAvailable();
   for (const executable of [process.execPath, "/usr/bin/systemd-notify", "/usr/bin/systemctl"]) {
     try {
-      const stat3 = await fs3.stat(executable);
-      if (!stat3.isFile()) throw new Error("Internal executable is not a regular file.");
-      await fs3.access(executable, fs3.constants.X_OK);
+      const stat4 = await fs4.stat(executable);
+      if (!stat4.isFile()) throw new Error("Internal executable is not a regular file.");
+      await fs4.access(executable, fs4.constants.X_OK);
     } catch (error) {
       throw new TaskError("UNSUPPORTED_ENVIRONMENT", "Observed tasks require their internal executables.", { reason: "observed-executable-unavailable" }, error);
     }
   }
   try {
-    const stat3 = await fs3.stat(guardianPath());
-    if (!stat3.isFile()) throw new Error("Packaged guardian is not a regular file.");
-    await fs3.access(guardianPath(), fs3.constants.R_OK);
+    const stat4 = await fs4.stat(guardianPath());
+    if (!stat4.isFile()) throw new Error("Packaged guardian is not a regular file.");
+    await fs4.access(guardianPath(), fs4.constants.R_OK);
   } catch (error) {
     throw new TaskError("UNSUPPORTED_ENVIRONMENT", "The packaged observed-task guardian is unavailable.", { reason: "guardian-unavailable" }, error);
   }
 }
-function creationProperties2(intent, descriptors, managerEnvironment) {
+function creationProperties3(intent, descriptors, managerEnvironment) {
   const spec = intent.spec;
   const task = [
     property("Description", "s", marker2(intent, "task")),
@@ -13369,7 +13459,7 @@ var ObservedOperations = class {
           );
           unregister = this.core.register(sockets.observation);
           if (terminal) unregister();
-          const mapped = creationProperties2(intent, sockets.descriptors, inherited);
+          const mapped = creationProperties3(intent, sockets.descriptors, inherited);
           this.core.assertOpen();
           this.core.markAttempt(intent);
           stage = "submitted";
@@ -13409,6 +13499,65 @@ var ObservedOperations = class {
       async () => await this.lookupInternal(target)
     );
   }
+  /** Registruje právě jeden exact finalizer; nejasný start se bez lookupu neopakuje. */
+  async finalizeAfterCompletion(value, options) {
+    const bootstrap = prepare2(value, options);
+    const reference3 = bootstrap.reference;
+    const unitName2 = unitName(reference3);
+    return await this.core.diagnostics.run(
+      reference3,
+      /** Registrace používá stejnou task mutation frontu i redigovaný kontext. */
+      async () => {
+        return await this.core.mutate(
+          reference3,
+          /** Jediná registrační mutation stejného tasku drží společnou klientskou frontu. */
+          async () => {
+            let stage = "before-submission";
+            try {
+              this.core.assertOpen();
+              assertManager(reference3.manager, this.core.manager);
+              const existing = await this.core.transport.readUnit(unitName2);
+              if (existing !== null) {
+                assertRegistered(bootstrap, existing);
+                return Object.freeze({ outcome: "already-registered", unitName: unitName2, manager: this.core.manager, jobPath: null });
+              }
+              const found = await this.lookupInternal(reference3);
+              if (found.status !== "found") {
+                throw new TaskError("RESULT_UNAVAILABLE", "The task to finalize is unavailable.", {
+                  reason: found.status === "not-found" ? "unit-not-found" : "observed-topology-incomplete"
+                });
+              }
+              const inherited = await this.core.transport.readEnvironment();
+              const properties2 = await creationProperties2(bootstrap, inherited);
+              this.core.assertOpen();
+              stage = "submitted";
+              this.core.diagnostics.emit("observed.finalization.submitted");
+              let jobPath;
+              try {
+                jobPath = await this.core.transport.start(unitName2, properties2, []);
+              } catch (error) {
+                if (error instanceof TaskError && error.details.mutationOutcome === "rejected") {
+                  const concurrent = await this.core.transport.readUnit(unitName2);
+                  if (concurrent !== null) {
+                    assertRegistered(bootstrap, concurrent);
+                    return Object.freeze({ outcome: "already-registered", unitName: unitName2, manager: this.core.manager, jobPath: null });
+                  }
+                }
+                throw error;
+              }
+              stage = "accepted";
+              this.core.diagnostics.emit("observed.finalization.accepted");
+              return Object.freeze({ outcome: "accepted", unitName: unitName2, manager: this.core.manager, jobPath });
+            } catch (error) {
+              const reported = mutationError(error, "finalizeAfterCompletion", reference3, stage);
+              this.core.diagnostics.emit("observed.finalization.error", reported.code);
+              throw reported;
+            }
+          }
+        );
+      }
+    );
+  }
   /** Vyžaduje kompletní exact topologii reference. */
   async inspect(value) {
     const reference3 = validateObservedReference(value);
@@ -13619,7 +13768,7 @@ var ObservedOperations = class {
 
 // src/transport.ts
 var dbus = __toESM(require_dbus_next(), 1);
-var fs4 = __toESM(require("fs/promises"), 1);
+var fs5 = __toESM(require("fs/promises"), 1);
 var managerPath = "/org/freedesktop/systemd1";
 var managerInterface = "org.freedesktop.systemd1.Manager";
 var busPath = "/org/freedesktop/DBus";
@@ -13701,7 +13850,7 @@ var DbusTransport = class _DbusTransport {
     const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
     if (process.platform !== "linux" || major < 24 || major === 24 && minor < 13 || !process.getuid) throw new TaskError("UNSUPPORTED_ENVIRONMENT", "Linux and Node 24.13.0 or newer are required.");
     try {
-      await fs4.access("/sys/fs/cgroup/cgroup.controllers");
+      await fs5.access("/sys/fs/cgroup/cgroup.controllers");
     } catch (error) {
       throw new TaskError("UNSUPPORTED_ENVIRONMENT", "A cgroup v2 hierarchy is required.", {}, error);
     }
@@ -13715,7 +13864,7 @@ var DbusTransport = class _DbusTransport {
       if (typeof managerProperties.Version !== "string" || Number.parseInt(managerProperties.Version, 10) < 257 || !/^\d/.test(managerProperties.Version)) throw new TaskError("UNSUPPORTED_ENVIRONMENT", "Systemd 257 or newer is required.", { reason: "systemd-version" });
       const machineId = scalar(await transport.invoke("GetMachineId", "", [], false, transport.owner, managerPath, "org.freedesktop.DBus.Peer"));
       const busId = scalar(await transport.invoke("GetId", "", [], false, "org.freedesktop.DBus", busPath, "org.freedesktop.DBus"));
-      const bootId = (await fs4.readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+      const bootId = (await fs5.readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
       transport.boundIdentity = Object.freeze({ scope: "user", uid: process.getuid(), machineId, bootId, busId, owner: transport.owner });
       await transport.invoke("AddMatch", "s", [`type='signal',sender='${transport.owner}',path_namespace='${managerPath}'`], false, "org.freedesktop.DBus", busPath, "org.freedesktop.DBus");
       await transport.invoke("Subscribe", "", [], false);
@@ -13738,10 +13887,10 @@ var DbusTransport = class _DbusTransport {
     if (this.failure) throw this.failure;
   }
   /** Wake observers without letting a callback disrupt the transport's message dispatch. */
-  notify(unitName) {
+  notify(unitName2) {
     for (const listener of this.listeners) {
       try {
-        listener(unitName);
+        listener(unitName2);
       } catch {
       }
     }
@@ -13810,7 +13959,7 @@ var DbusTransport = class _DbusTransport {
     const serial = message.serial;
     return await new Promise(
       /** Own the deadline and settlement of exactly one D-Bus request. */
-      (resolve2, reject) => {
+      (resolve3, reject) => {
         const timer = setTimeout(
           /** Invalidate the connection before releasing possibly queued descriptors. */
           () => this.fail(new TaskError("MANAGER_UNAVAILABLE", "The manager request deadline expired.", { operation: member, reason: "request-timeout" })),
@@ -13822,7 +13971,7 @@ var DbusTransport = class _DbusTransport {
           (reply) => {
             if (!this.pending.delete(serial)) return;
             clearTimeout(timer);
-            if (reply) resolve2(reply.body);
+            if (reply) resolve3(reply.body);
             else reject(new TaskError(mutation ? "UNKNOWN_MUTATION_OUTCOME" : "RESULT_UNAVAILABLE", "The manager returned no reply.", { operation: member, ...mutation ? { mutationOutcome: "unknown" } : {} }));
           },
           /** Translate delivery evidence and clean abandoned upstream reply handlers. */
@@ -13970,6 +14119,10 @@ var SystemdTaskClient = class {
   async startObserved(intent, options) {
     return await this.observed.startObserved(intent, options);
   }
+  /** Registruje manager-owned dokončení bez změny standardního retention kontraktu. */
+  async finalizeAfterCompletion(reference3, options) {
+    return await this.observed.finalizeAfterCompletion(reference3, options);
+  }
   /** Směruje podle explicitního versioned kind, nikoliv podle package entrypointu. */
   async lookup(value) {
     if (isObservedValue(value)) return await this.observed.lookup(value);
@@ -14190,7 +14343,7 @@ var SystemdTaskClient = class {
 };
 async function openClient(options, observed) {
   const validated = validateConnectOptions(options);
-  const sink = new Diagnostics(crypto3.randomUUID(), validated.onDiagnostic);
+  const sink = new Diagnostics(crypto4.randomUUID(), validated.onDiagnostic);
   try {
     if (observed) await assertObservedAvailable();
     else await assertRetentionAvailable();