@push.rocks/smartdaemon 2.2.0 → 2.4.0

package/dist_ts/classes.systemdunitfile.js

@@ -0,0 +1,242 @@
+import * as plugins from './smartdaemon.plugins.js';
+import { SystemdServiceDefinition } from './classes.systemdservicedefinition.js';
+import { SystemdUnit, } from './classes.systemdunit.js';
+export class SystemdUnitFileError extends Error {
+    constructor(code) {
+        super(`Systemd unit definition installation failed: ${code}.`);
+        this.code = code;
+        this.name = 'SystemdUnitFileError';
+    }
+}
+const requireValue = (value, code) => {
+    if (!value)
+        throw new SystemdUnitFileError(code);
+};
+const digest = (bytes) => plugins.crypto.createHash('sha256').update(bytes).digest('hex');
+const quiet = (state) => state.mainPid === 0 && state.controlPid === 0 &&
+    state.controlGroup === '' && state.job === '' &&
+    (state.activeState === 'inactive' && state.subState === 'dead' ||
+        state.activeState === 'failed' && state.subState === 'failed');
+const masked = (state) => state.loadState === 'masked' &&
+    ['masked', 'masked-runtime'].includes(state.unitFileState);
+const sameFile = (left, right) => left.dev === right.dev && left.ino === right.ino;
+/**
+ * Protected code/config installation, inside the caller's cross-process installation ownership scope.
+ * Other privileged writers must be serialized by that owner. Never changes enablement or masks.
+ */
+export class SystemdUnitFile {
+    constructor(options) {
+        this.busy = false;
+        this.unit = new SystemdUnit(options);
+        this.name = options.unitName;
+        this.directory = options.unitDirectory ?? '/usr/local/lib/systemd/system';
+        this.uid = options.expectedUid ?? 0;
+        requireValue(typeof this.directory === 'string' && this.directory !== '/' &&
+            plugins.path.isAbsolute(this.directory) &&
+            plugins.path.normalize(this.directory) === this.directory &&
+            !this.directory.endsWith('/') && !/[\x00-\x1f\x7f]/.test(this.directory) &&
+            this.directory.length <= 4000 && Number.isSafeInteger(this.uid) && this.uid >= 0, 'invalid_options');
+        this.path = plugins.path.join(this.directory, this.name);
+    }
+    /** Reads only the exact protected definition; no systemd or filesystem mutation. */
+    async inspect() {
+        if (!await this.directories(false))
+            return null;
+        const file = await this.read(this.path);
+        return file ? Object.freeze({ path: this.path, sha256: digest(file.bytes) }) : null;
+    }
+    /**
+     * Expected previous digest is mandatory; null admits an absent file. Exact desired bytes are idempotent.
+     * Retains changed definitions beside the unit before replacement. A failed reload never rolls code back.
+     */
+    async install(definition, expectedSha256) {
+        requireValue(definition instanceof SystemdServiceDefinition && definition.unitName === this.name &&
+            (expectedSha256 === null ||
+                typeof expectedSha256 === 'string' && /^[a-f0-9]{64}$/.test(expectedSha256)), 'invalid_options');
+        requireValue(!this.busy, 'busy');
+        this.busy = true;
+        let temporary;
+        let temporaryInfo;
+        try {
+            const before = await this.unit.inspect();
+            await this.admit(before);
+            await this.directories(true);
+            const parent = await plugins.fs.lstat(this.directory);
+            const previous = await this.read(this.path);
+            const previousSha = previous ? digest(previous.bytes) : null;
+            const changed = previousSha !== definition.sha256;
+            requireValue(!changed || previousSha === expectedSha256, 'changed');
+            if (changed) {
+                if (previous) {
+                    const backup = `${this.path}.previous-${previousSha}`;
+                    try {
+                        await this.create(backup, previous.bytes);
+                    }
+                    catch (error) {
+                        if (error.code !== 'EEXIST')
+                            throw error;
+                        requireValue(digest((await this.read(backup)).bytes) === previousSha, 'changed');
+                    }
+                    await this.flushDirectory(parent);
+                }
+                temporary = plugins.path.join(this.directory, `.${this.name}.${plugins.crypto.randomUUID()}.tmp`);
+                await this.create(temporary, Buffer.from(definition.content));
+                temporaryInfo = await plugins.fs.lstat(temporary);
+                const current = await this.read(this.path);
+                requireValue((current ? digest(current.bytes) : null) === previousSha &&
+                    (!current || previous && sameFile(current.info, previous.info)), 'changed');
+                requireValue(sameFile(parent, await plugins.fs.lstat(this.directory)), 'unsafe_path');
+                const rechecked = await this.unit.inspect();
+                requireValue(JSON.stringify(rechecked) === JSON.stringify(before), 'changed');
+                await this.admit(rechecked);
+                await plugins.fs.rename(temporary, this.path);
+                temporary = undefined;
+                await this.flushDirectory(parent);
+            }
+            try {
+                await this.unit.reloadConfiguration();
+                const after = await this.unit.inspect();
+                requireValue(quiet(after) &&
+                    (before.loadState === 'not-found'
+                        ? after.loadState === 'loaded' && after.unitFileState === 'disabled'
+                        : after.loadState === before.loadState &&
+                            after.unitFileState === before.unitFileState), 'changed');
+                const configuration = await this.unit.inspectConfiguration();
+                requireValue(!configuration.needsReload && configuration.dropInPaths === '' &&
+                    configuration.fragmentPath === (masked(after) ? '/dev/null' : this.path), 'unsafe_unit');
+                const installed = await this.inspect();
+                requireValue(installed?.sha256 === definition.sha256, 'changed');
+                return Object.freeze({ changed, record: installed, masked: masked(after) });
+            }
+            catch {
+                throw new SystemdUnitFileError('reload_failed');
+            }
+        }
+        catch (error) {
+            if (error instanceof SystemdUnitFileError)
+                throw error;
+            throw new SystemdUnitFileError('write_failed');
+        }
+        finally {
+            try {
+                if (temporary && temporaryInfo) {
+                    const named = await plugins.fs.lstat(temporary);
+                    requireValue(sameFile(temporaryInfo, named), 'unsafe_path');
+                    await plugins.fs.unlink(temporary);
+                }
+            }
+            finally {
+                this.busy = false;
+            }
+        }
+    }
+    async admit(state) {
+        requireValue(quiet(state) && (masked(state) ||
+            state.loadState === 'loaded' &&
+                ['enabled', 'enabled-runtime', 'disabled'].includes(state.unitFileState) ||
+            state.loadState === 'not-found' && state.unitFileState === ''), 'unsafe_unit');
+        const configuration = await this.unit.inspectConfiguration();
+        requireValue(configuration.dropInPaths === '' && configuration.fragmentPath ===
+            (masked(state) ? '/dev/null' : state.loadState === 'not-found' ? '' : this.path), 'unsafe_unit');
+    }
+    async directories(create) {
+        requireValue(process.platform === 'linux' && process.getuid?.() === this.uid, 'unsafe_path');
+        let directory = '/';
+        for (const part of this.directory.split('/').filter(Boolean)) {
+            directory = plugins.path.join(directory, part);
+            let info;
+            try {
+                info = await plugins.fs.lstat(directory);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                if (!create)
+                    return false;
+                await plugins.fs.mkdir(directory, { mode: 0o755 });
+                const parent = await plugins.fs.open(plugins.path.dirname(directory), plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_DIRECTORY |
+                    plugins.fsConstants.O_NOFOLLOW);
+                try {
+                    await parent.sync();
+                }
+                finally {
+                    await parent.close();
+                }
+                info = await plugins.fs.lstat(directory);
+            }
+            requireValue(info.isDirectory() && !info.isSymbolicLink() && [0, this.uid].includes(info.uid) &&
+                ((info.mode & 0o022) === 0 || directory === '/tmp' && info.uid === 0 &&
+                    (info.mode & 0o7777) === 0o1777), 'unsafe_path');
+        }
+        return true;
+    }
+    async read(path) {
+        let file;
+        try {
+            file = await plugins.fs.open(path, plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_NOFOLLOW |
+                plugins.fsConstants.O_NONBLOCK);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw new SystemdUnitFileError('unsafe_path');
+        }
+        try {
+            const info = await file.stat();
+            requireValue(info.isFile() && info.uid === this.uid && info.nlink === 1 &&
+                (info.mode & 0o7777) === 0o644 && info.size <= 16384, 'unsafe_path');
+            const bytes = Buffer.alloc(16385);
+            let size = 0;
+            for (;;) {
+                const result = await file.read(bytes, size, bytes.length - size, size);
+                if (result.bytesRead === 0)
+                    break;
+                size += result.bytesRead;
+                requireValue(size <= 16384, 'unsafe_path');
+            }
+            const after = await file.stat(), named = await plugins.fs.lstat(path);
+            requireValue(sameFile(info, named) && !named.isSymbolicLink() && after.size === size &&
+                info.size === after.size && info.mtimeMs === after.mtimeMs &&
+                info.ctimeMs === after.ctimeMs, 'changed');
+            return { bytes: bytes.subarray(0, size), info };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async create(path, bytes) {
+        const file = await plugins.fs.open(path, plugins.fsConstants.O_CREAT | plugins.fsConstants.O_EXCL |
+            plugins.fsConstants.O_WRONLY | plugins.fsConstants.O_NOFOLLOW, 0o644);
+        let created;
+        try {
+            try {
+                created = await file.stat();
+                await file.chmod(0o644);
+                await file.writeFile(bytes);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+        }
+        catch (error) {
+            if (created) {
+                requireValue(sameFile(created, await plugins.fs.lstat(path)), 'unsafe_path');
+                await plugins.fs.unlink(path);
+            }
+            throw error;
+        }
+    }
+    async flushDirectory(expected) {
+        const directory = await plugins.fs.open(this.directory, plugins.fsConstants.O_RDONLY |
+            plugins.fsConstants.O_DIRECTORY | plugins.fsConstants.O_NOFOLLOW);
+        try {
+            requireValue(sameFile(expected, await directory.stat()), 'unsafe_path');
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kdW5pdGZpbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWR1bml0ZmlsZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLHVDQUF1QyxDQUFDO0FBQ2pGLE9BQU8sRUFHTCxXQUFXLEdBQ1osTUFBTSwwQkFBMEIsQ0FBQztBQVlsQyxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsS0FBSztJQUM3QyxZQUNrQixJQU9HO1FBRW5CLEtBQUssQ0FBQyxnREFBZ0QsSUFBSSxHQUFHLENBQUMsQ0FBQztRQVQvQyxTQUFJLEdBQUosSUFBSSxDQU9EO1FBR25CLElBQUksQ0FBQyxJQUFJLEdBQUcsc0JBQXNCLENBQUM7SUFDckMsQ0FBQztDQUNGO0FBQ0QsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBa0MsRUFBUSxFQUFFO0lBQ2hGLElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ25ELENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBaUIsRUFBRSxFQUFFLENBQ25DLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDbEUsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUF3QixFQUFFLEVBQUUsQ0FDekMsS0FBSyxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxDQUFDO0lBQzdDLEtBQUssQ0FBQyxZQUFZLEtBQUssRUFBRSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssRUFBRTtJQUM3QyxDQUFDLEtBQUssQ0FBQyxXQUFXLEtBQUssVUFBVSxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssTUFBTTtRQUM1RCxLQUFLLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0FBQ25FLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBd0IsRUFBRSxFQUFFLENBQzFDLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtJQUM1QixDQUFDLFFBQVEsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDN0QsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFrQyxFQUFFLEtBQW1DLEVBQUUsRUFBRSxDQUMzRixJQUFJLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDO0FBRW5EOzs7R0FHRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBUTFCLFlBQVksT0FBZ0M7UUFGcEMsU0FBSSxHQUFHLEtBQUssQ0FBQztRQUduQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUM3QixJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxhQUFhLElBQUksK0JBQStCLENBQUM7UUFDMUUsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsQ0FBQztRQUNwQyxZQUFZLENBQ1YsT0FBTyxJQUFJLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsU0FBUyxLQUFLLEdBQUc7WUFDMUQsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN2QyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVM7WUFDekQsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3hFLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxJQUFJLElBQUksSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsRUFDbEYsaUJBQWlCLENBQ2xCLENBQUM7UUFDRixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRCxvRkFBb0Y7SUFDN0UsS0FBSyxDQUFDLE9BQU87UUFDbEIsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUNoRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEYsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQ2xCLFVBQW9DLEVBQ3BDLGNBQTZCO1FBRTdCLFlBQVksQ0FDVixVQUFVLFlBQVksd0JBQXdCLElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsSUFBSTtZQUNqRixDQUFDLGNBQWMsS0FBSyxJQUFJO2dCQUN0QixPQUFPLGNBQWMsS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQ2hGLGlCQUFpQixDQUNsQixDQUFDO1FBQ0YsWUFBWSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQixJQUFJLFNBQTZCLENBQUM7UUFDbEMsSUFBSSxhQUF3QyxDQUFDO1FBQzdDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDekIsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzdCLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ3RELE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDNUMsTUFBTSxXQUFXLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7WUFDN0QsTUFBTSxPQUFPLEdBQUcsV0FBVyxLQUFLLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDbEQsWUFBWSxDQUFDLENBQUMsT0FBTyxJQUFJLFdBQVcsS0FBSyxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDcEUsSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDWixJQUFJLFFBQVEsRUFBRSxDQUFDO29CQUNiLE1BQU0sTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLElBQUksYUFBYSxXQUFXLEVBQUUsQ0FBQztvQkFDdEQsSUFBSSxDQUFDO3dCQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUM1QyxDQUFDO29CQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7d0JBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFROzRCQUFFLE1BQU0sS0FBSyxDQUFDO3dCQUNwRSxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssV0FBVyxFQUFFLFNBQVMsQ0FBQyxDQUFDO29CQUNwRixDQUFDO29CQUNELE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDcEMsQ0FBQztnQkFDRCxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQzNCLElBQUksQ0FBQyxTQUFTLEVBQ2QsSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FDbkQsQ0FBQztnQkFDRixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7Z0JBQzlELGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNsRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUMzQyxZQUFZLENBQ1YsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLFdBQVc7b0JBQ3RELENBQUMsQ0FBQyxPQUFPLElBQUksUUFBUSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUNqRSxTQUFTLENBQ1YsQ0FBQztnQkFDRixZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO2dCQUN0RixNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQzVDLFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQzlFLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDNUIsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUM5QyxTQUFTLEdBQUcsU0FBUyxDQUFDO2dCQUN0QixNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDcEMsQ0FBQztZQUNELElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztnQkFDdEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUN4QyxZQUFZLENBQ1YsS0FBSyxDQUFDLEtBQUssQ0FBQztvQkFDVixDQUFDLE1BQU0sQ0FBQyxTQUFTLEtBQUssV0FBVzt3QkFDL0IsQ0FBQyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxhQUFhLEtBQUssVUFBVTt3QkFDcEUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVM7NEJBQ3BDLEtBQUssQ0FBQyxhQUFhLEtBQUssTUFBTSxDQUFDLGFBQWEsQ0FBQyxFQUNuRCxTQUFTLENBQ1YsQ0FBQztnQkFDRixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztnQkFDN0QsWUFBWSxDQUNWLENBQUMsYUFBYSxDQUFDLFdBQVcsSUFBSSxhQUFhLENBQUMsV0FBVyxLQUFLLEVBQUU7b0JBQzVELGFBQWEsQ0FBQyxZQUFZLEtBQUssQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUMxRSxhQUFhLENBQ2QsQ0FBQztnQkFDRixNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDdkMsWUFBWSxDQUFDLFNBQVMsRUFBRSxNQUFNLEtBQUssVUFBVSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQztnQkFDakUsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFVLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDL0UsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxNQUFNLElBQUksb0JBQW9CLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbEQsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksb0JBQW9CO2dCQUFFLE1BQU0sS0FBSyxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxvQkFBb0IsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNqRCxDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLENBQUM7Z0JBQ0gsSUFBSSxTQUFTLElBQUksYUFBYSxFQUFFLENBQUM7b0JBQy9CLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBQ2hELFlBQVksQ0FBQyxRQUFRLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO29CQUM1RCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUNyQyxDQUFDO1lBQ0gsQ0FBQztvQkFBUyxDQUFDO2dCQUNULElBQUksQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDO1lBQ3BCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBd0I7UUFDMUMsWUFBWSxDQUNWLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDNUIsS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRO2dCQUMxQixDQUFDLFNBQVMsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQztZQUMxRSxLQUFLLENBQUMsU0FBUyxLQUFLLFdBQVcsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLEVBQUUsQ0FBQyxFQUNoRSxhQUFhLENBQ2QsQ0FBQztRQUNGLE1BQU0sYUFBYSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1FBQzdELFlBQVksQ0FDVixhQUFhLENBQUMsV0FBVyxLQUFLLEVBQUUsSUFBSSxhQUFhLENBQUMsWUFBWTtZQUMxRCxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQ3BGLGFBQWEsQ0FDZCxDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxXQUFXLENBQUMsTUFBZTtRQUN2QyxZQUFZLENBQUMsT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLEtBQUssSUFBSSxDQUFDLEdBQUcsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUM3RixJQUFJLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDcEIsS0FBSyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUM3RCxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksSUFBbUIsQ0FBQztZQUN4QixJQUFJLENBQUM7Z0JBQ0gsSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDM0MsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxRQUFRO29CQUFFLE1BQU0sS0FBSyxDQUFDO2dCQUNwRSxJQUFJLENBQUMsTUFBTTtvQkFBRSxPQUFPLEtBQUssQ0FBQztnQkFDMUIsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztnQkFDbkQsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksQ0FDbEMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQy9CLE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVztvQkFDNUQsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQ2pDLENBQUM7Z0JBQ0YsSUFBSSxDQUFDO29CQUNILE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUN0QixDQUFDO3dCQUFTLENBQUM7b0JBQ1QsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQ3ZCLENBQUM7Z0JBQ0QsSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDM0MsQ0FBQztZQUNELFlBQVksQ0FDVixJQUFJLENBQUMsV0FBVyxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLElBQUksQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO2dCQUM5RSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksU0FBUyxLQUFLLE1BQU0sSUFBSSxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUM7b0JBQ2hFLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxNQUFNLENBQUMsS0FBSyxNQUFNLENBQUMsRUFDdEMsYUFBYSxDQUNkLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRU8sS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFZO1FBQzdCLElBQUksSUFBaUQsQ0FBQztRQUN0RCxJQUFJLENBQUM7WUFDSCxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksQ0FDMUIsSUFBSSxFQUNKLE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVTtnQkFDM0QsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQ2pDLENBQUM7UUFDSixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtnQkFBRSxPQUFPLElBQUksQ0FBQztZQUNwRSxNQUFNLElBQUksb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDaEQsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQy9CLFlBQVksQ0FDVixJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxJQUFJLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssQ0FBQztnQkFDeEQsQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLEtBQUssRUFDdEQsYUFBYSxDQUNkLENBQUM7WUFDRixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ2xDLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQztZQUNiLFNBQVMsQ0FBQztnQkFDUixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsTUFBTSxHQUFHLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztnQkFDdkUsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLENBQUM7b0JBQUUsTUFBTTtnQkFDbEMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUM7Z0JBQ3pCLFlBQVksQ0FBQyxJQUFJLElBQUksS0FBSyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1lBQzdDLENBQUM7WUFDRCxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUN0RSxZQUFZLENBQ1YsUUFBUSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQUUsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLElBQUk7Z0JBQ3JFLElBQUksQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLEtBQUssQ0FBQyxPQUFPO2dCQUMxRCxJQUFJLENBQUMsT0FBTyxLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQ2hDLFNBQVMsQ0FDVixDQUFDO1lBQ0YsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUNsRCxDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNyQixDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBWSxFQUFFLEtBQWlCO1FBQ2xELE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQ2hDLElBQUksRUFDSixPQUFPLENBQUMsV0FBVyxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLE1BQU07WUFDdEQsT0FBTyxDQUFDLFdBQVcsQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQy9ELEtBQUssQ0FDTixDQUFDO1FBQ0YsSUFBSSxPQUFrQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQztZQUNILElBQUksQ0FBQztnQkFDSCxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDeEIsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUM1QixNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNwQixDQUFDO29CQUFTLENBQUM7Z0JBQ1QsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDckIsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDWixZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7Z0JBQzdFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDaEMsQ0FBQztZQUNELE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsY0FBYyxDQUFDLFFBQXVCO1FBQ2xELE1BQU0sU0FBUyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQ3JDLElBQUksQ0FBQyxTQUFTLEVBQ2QsT0FBTyxDQUFDLFdBQVcsQ0FBQyxRQUFRO1lBQzFCLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUNuRSxDQUFDO1FBQ0YsSUFBSSxDQUFDO1lBQ0gsWUFBWSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztZQUN4RSxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts/index.d.ts

@@ -1,2 +1,5 @@
 export * from './smartdaemon.classes.smartdaemon.js';
 export * from './smartdaemon.classes.service.js';
+export * from './classes.systemdunit.js';
+export * from './classes.systemdservicedefinition.js';
+export * from './classes.systemdunitfile.js';

package/dist_ts/index.js

@@ -1,3 +1,6 @@
 export * from './smartdaemon.classes.smartdaemon.js';
 export * from './smartdaemon.classes.service.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBQ3JELGNBQWMsa0NBQWtDLENBQUMifQ==
+export * from './classes.systemdunit.js';
+export * from './classes.systemdservicedefinition.js';
+export * from './classes.systemdunitfile.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBQ3JELGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsOEJBQThCLENBQUMifQ==

package/dist_ts/smartdaemon.plugins.d.ts

@@ -1,5 +1,10 @@
 import * as path from 'path';
-export { path };
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as crypto from 'node:crypto';
+export type { Stats } from 'node:fs';
+export { path, childProcess, fs, fsConstants, crypto };
 import * as lik from '@push.rocks/lik';
 import * as smartfm from '@push.rocks/smartfm';
 import * as smartfs from '@push.rocks/smartfs';

package/dist_ts/smartdaemon.plugins.js

@@ -1,6 +1,10 @@
 // node native scope
 import * as path from 'path';
-export { path };
+import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as crypto from 'node:crypto';
+export { path, childProcess, fs, fsConstants, crypto };
 // @pushrocks scope
 import * as lik from '@push.rocks/lik';
 import * as smartfm from '@push.rocks/smartfm';
@@ -12,4 +16,4 @@ import * as smartshell from '@push.rocks/smartshell';
 import * as smartsystem from '@push.rocks/smartsystem';
 export { lik, smartfm, smartfs, smartlog, smartlogDestinationLocal, smartpath, smartshell, smartsystem, };
 // third party
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRkYWVtb24ucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0ZGFlbW9uLnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUVoQixtQkFBbUI7QUFDbkIsT0FBTyxLQUFLLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQztBQUN2QyxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssd0JBQXdCLE1BQU0sd0NBQXdDLENBQUM7QUFDbkYsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUNMLEdBQUcsRUFDSCxPQUFPLEVBQ1AsT0FBTyxFQUNQLFFBQVEsRUFDUix3QkFBd0IsRUFDeEIsU0FBUyxFQUNULFVBQVUsRUFDVixXQUFXLEdBQ1osQ0FBQztBQUVGLGNBQWMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRkYWVtb24ucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0ZGFlbW9uLnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUN2QyxPQUFPLEVBQUUsU0FBUyxJQUFJLFdBQVcsRUFBRSxNQUFNLFNBQVMsQ0FBQztBQUNuRCxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUd0QyxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBRXZELG1CQUFtQjtBQUNuQixPQUFPLEtBQUssR0FBRyxNQUFNLGlCQUFpQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx3Q0FBd0MsQ0FBQztBQUNuRixPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUV2RCxPQUFPLEVBQ0wsR0FBRyxFQUNILE9BQU8sRUFDUCxPQUFPLEVBQ1AsUUFBUSxFQUNSLHdCQUF3QixFQUN4QixTQUFTLEVBQ1QsVUFBVSxFQUNWLFdBQVcsR0FDWixDQUFDO0FBRUYsY0FBYyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdaemon",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "private": false,
   "description": "Start scripts as long running daemons and manage them.",
   "main": "dist_ts/index.js",
@@ -27,9 +27,9 @@
   "homepage": "https://code.foss.global/push.rocks/smartdaemon",
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsrun": "^2.0.4",
-    "@git.zone/tstest": "^3.6.6",
-    "@types/node": "^25.9.1"
+    "@git.zone/tsrun": "^2.0.6",
+    "@git.zone/tstest": "^6.0.0",
+    "@types/node": "^26.4.1"
   },
   "dependencies": {
     "@push.rocks/lik": "^6.4.1",

package/readme.md

@@ -1,6 +1,10 @@
 # @push.rocks/smartdaemon 🚀
 **Turn your Node.js scripts into production-ready system daemons**
 
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
+
 [![npm version](https://img.shields.io/npm/v/@push.rocks/smartdaemon.svg?style=flat-square)](https://www.npmjs.com/package/@push.rocks/smartdaemon)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
@@ -147,6 +151,104 @@ class SmartDaemon {
 }
 ```
 
+### Inspecting and controlling an existing systemd unit
+
+`SystemdUnit` works with an exact canonical `.service` name. Construction performs
+no I/O. It does not create or rewrite a unit, enable it, remove a mask, or invoke
+sudo. The caller must already have permission for lifecycle commands.
+
+```typescript
+import { SystemdUnit } from '@push.rocks/smartdaemon';
+
+const unit = new SystemdUnit({ unitName: 'smartdaemon_my-api-server.service' });
+const state = await unit.inspect();
+console.log(state.loadState, state.activeState, state.unitFileState);
+
+// Application code decides whether stopping or restarting is appropriate.
+// await unit.stop();
+// await unit.start();
+```
+
+Snapshots are immutable and also include `subState`, `mainPid`, `controlPid`,
+`controlGroup`, `killMode`, and `job`. An empty `job` means no systemd job was
+reported. Missing and masked units remain distinct from inactive or disabled
+units. Aliases resolving to a different canonical unit are rejected.
+
+`start()` and `stop()` await the systemctl command and return a fresh snapshot.
+They do not establish application readiness or prove database shutdown; callers
+must apply the owning application's lifecycle contract. A command failure or
+timeout rejects with `SystemdUnitError` and a local code, without returning raw
+command diagnostics. The systemd job can continue after a client timeout, so a
+failed command must not be treated as cancelled or successfully completed.
+
+Calls use an absolute `systemctlPath` (default `/usr/bin/systemctl`), a clean
+environment, no shell or password prompt, and bounded output. Trusted owning code
+can choose another absolute executable path and `commandTimeoutMs` (default
+120000, maximum 600000). This timeout bounds the client process only.
+
+`inspectConfiguration()` reports the selected `fragmentPath`, opaque `dropInPaths`
+list and `needsReload` flag. `reloadConfiguration()` explicitly reloads the manager's
+unit definitions globally and returns a fresh configuration snapshot. Neither
+operation changes enablement or masks.
+
+### Installing a direct systemd service definition
+
+`SystemdServiceDefinition` encodes a literal executable and argument list, with
+explicit user, group, restart policy, kill mode and stop timeout. It uses `Type=exec`,
+journal output and null stdin. It introduces no shell; percent specifiers and
+argument environment expansion are escaped. Paths must be absolute and normalized;
+control characters are rejected. Descriptions and working directories cannot have
+backslashes or surrounding whitespace; executable paths also reject quotes and
+backslashes. Arguments may contain spaces, quotes, backslashes and empty strings.
+
+```typescript
+import { SystemdServiceDefinition, SystemdUnitFile } from '@push.rocks/smartdaemon';
+
+const definition = new SystemdServiceDefinition({
+  unitName: 'smartdaemon_my-api-server.service',
+  description: 'My API server',
+  executable: '/opt/my-api/bin/server',
+  args: ['serve'],
+  workingDirectory: '/opt/my-api',
+  user: 'root',
+  group: 'root',
+  restart: 'no',
+  killMode: 'mixed',
+  timeoutStopSeconds: 360,
+});
+const file = new SystemdUnitFile({ unitName: definition.unitName });
+// Inside the privileged installer's existing cross-process ownership scope:
+const previous = await file.inspect();
+const installed = await file.install(definition, previous?.sha256 ?? null);
+console.log(installed.changed, installed.masked, installed.record.sha256);
+```
+
+Installation requires Linux, root and a quiescent exact unit with no process,
+cgroup or job. It rejects effective drop-ins and shadowing fragments. Definitions
+default to `/usr/local/lib/systemd/system`, below administrator configuration in
+the load path, so existing persistent/runtime masks remain intact. Existing
+enablement is preserved; an absent unit becomes disabled. It never enables,
+unmasks, starts or stops a service, or invokes sudo.
+
+The caller must already serialize privileged installation across processes;
+`SystemdUnitFile` only excludes simultaneous operations on the same instance.
+The expected previous SHA-256 is mandatory (`null` requires an absent file),
+while already matching bytes are idempotent. Installation checks protected
+directories and regular single-link mode-0644 files, retains changed definitions
+as `<unit>.previous-<sha256>`, flushes them before atomic replacement, reloads
+the manager and checks its selected fragment and final bytes. A reload failure
+leaves the new file and retained previous definition in place; recovery requires
+inspection, never an automatic rollback. Filesystem and definition errors use
+`SystemdUnitFileError` with a local code. Trusted qualification code can set
+`unitDirectory`, `expectedUid` and the inherited `SystemdUnit` command options.
+
+With `killMode: 'mixed'`, the main process owns graceful child shutdown and must
+remain alive until its children have joined. Systemd sends SIGTERM to the main
+process first and can send SIGKILL to the whole cgroup when the main process exits
+or the stop deadline expires. `control-group` sends the initial signal to the
+whole group. A successful systemd start still requires application readiness
+verification, and a completed stop alone does not prove database drain.
+
 ### SmartDaemonService Class
 
 ```typescript
@@ -424,4 +526,4 @@ Registered at District court Bremen HRB 35230 HB, Germany
 
 For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
 
-By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdaemon',
-  version: '2.2.0',
+  version: '2.4.0',
   description: 'Start scripts as long running daemons and manage them.'
 }

package/ts/classes.systemdservicedefinition.ts

@@ -0,0 +1,134 @@
+import * as plugins from './smartdaemon.plugins.js';
+
+export interface ISystemdServiceDefinitionOptions {
+  unitName: string;
+  description: string;
+  executable: string;
+  args: readonly string[];
+  workingDirectory: string;
+  user: string;
+  group: string;
+  restart: 'no' | 'on-failure' | 'always';
+  killMode: 'mixed' | 'control-group';
+  timeoutStopSeconds: number;
+}
+
+export class SystemdServiceDefinitionError extends Error {
+  constructor() {
+    super('Invalid direct systemd service definition.');
+    this.name = 'SystemdServiceDefinitionError';
+  }
+}
+
+/** Literal direct-execution definition; never introduces a shell or environment expansion. */
+export class SystemdServiceDefinition {
+  public readonly unitName: string;
+  public readonly content: string;
+  public readonly sha256: string;
+
+  constructor(options: ISystemdServiceDefinitionOptions) {
+    const requireValue = (value: unknown): void => {
+      if (!value) throw new SystemdServiceDefinitionError();
+    };
+    const text = (value: unknown, maximum = 4096): value is string =>
+      typeof value === 'string' && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value) &&
+      !/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(value);
+    const absolute = (value: unknown) =>
+      text(value) && plugins.path.isAbsolute(value) &&
+      plugins.path.normalize(value) === value;
+    const keys = [
+      'unitName',
+      'description',
+      'executable',
+      'args',
+      'workingDirectory',
+      'user',
+      'group',
+      'restart',
+      'killMode',
+      'timeoutStopSeconds',
+    ];
+    requireValue(
+      options && Object.getPrototypeOf(options) === Object.prototype &&
+        Reflect.ownKeys(options).length === keys.length && keys.every((key) => {
+          const descriptor = Object.getOwnPropertyDescriptor(options, key);
+          return descriptor && 'value' in descriptor;
+        }),
+    );
+    requireValue(
+      typeof options.unitName === 'string' &&
+        /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName),
+    );
+    requireValue(
+      text(options.description, 1024) && options.description.length > 0 &&
+        options.description.trim() === options.description && !options.description.includes('\\'),
+    );
+    requireValue(
+      absolute(options.executable) && options.executable !== '/' &&
+        !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
+        absolute(options.workingDirectory) &&
+        options.workingDirectory.trim() === options.workingDirectory &&
+        !options.workingDirectory.includes('\\'),
+    );
+    requireValue(
+      Array.isArray(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
+        options.args.length <= 128 &&
+        Reflect.ownKeys(options.args).length === options.args.length + 1 &&
+        Array.from(
+          { length: options.args.length },
+          (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)),
+        )
+          .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)),
+    );
+    requireValue(
+      [options.user, options.group].every((value) =>
+        typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)
+      ),
+    );
+    requireValue(
+      ['no', 'on-failure', 'always'].includes(options.restart) &&
+        ['mixed', 'control-group'].includes(options.killMode) &&
+        Number.isSafeInteger(options.timeoutStopSeconds) &&
+        options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600,
+    );
+    // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
+    const quote = (value: string, command = false) =>
+      '"' + value
+        .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
+        .replaceAll('$', () => command ? '$$' : '$') +
+      '"';
+    this.unitName = options.unitName;
+    this.content = [
+      '[Unit]',
+      `Description=${options.description.replaceAll('%', '%%')}`,
+      'After=local-fs.target',
+      '',
+      '[Service]',
+      'Type=exec',
+      `User=${options.user}`,
+      `Group=${options.group}`,
+      `ExecStart=${
+        [quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')
+      }`,
+      // WorkingDirectory is a raw path value, not an ExecStart word list.
+      `WorkingDirectory=${options.workingDirectory.replaceAll('%', '%%')}`,
+      `Restart=${options.restart}`,
+      `KillMode=${options.killMode}`,
+      'KillSignal=SIGTERM',
+      'FinalKillSignal=SIGKILL',
+      'SendSIGKILL=yes',
+      'SendSIGHUP=no',
+      `TimeoutStopSec=${options.timeoutStopSeconds}s`,
+      'StandardInput=null',
+      'StandardOutput=journal',
+      'StandardError=journal',
+      '',
+      '[Install]',
+      'WantedBy=multi-user.target',
+      '',
+    ].join('\n');
+    requireValue(Buffer.byteLength(this.content) <= 16384);
+    this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
+    Object.freeze(this);
+  }
+}