@push.rocks/smartdaemon 2.3.1 → 2.4.1

package/.smartconfig.json

@@ -20,7 +20,6 @@
     },
     "release": {
       "preflight": {
-        "requireCleanTree": true,
         "test": true,
         "build": true
       },

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartdaemon',
-    version: '2.3.1',
+    version: '2.4.1',
     description: 'Start scripts as long running daemons and manage them.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHdEQUF3RDtDQUN0RSxDQUFBIn0=

package/dist_ts/classes.systemdservicedefinition.d.ts

@@ -0,0 +1,22 @@
+export interface ISystemdServiceDefinitionOptions {
+    unitName: string;
+    description: string;
+    executable: string;
+    args: readonly string[];
+    workingDirectory: string;
+    user: string;
+    group: string;
+    restart: 'no' | 'on-failure' | 'always';
+    killMode: 'mixed' | 'control-group';
+    timeoutStopSeconds: number;
+}
+export declare class SystemdServiceDefinitionError extends Error {
+    constructor();
+}
+/** Literal direct-execution definition; never introduces a shell or environment expansion. */
+export declare class SystemdServiceDefinition {
+    readonly unitName: string;
+    readonly content: string;
+    readonly sha256: string;
+    constructor(options: ISystemdServiceDefinitionOptions);
+}

package/dist_ts/classes.systemdservicedefinition.js

@@ -0,0 +1,93 @@
+import * as plugins from './smartdaemon.plugins.js';
+export class SystemdServiceDefinitionError extends Error {
+    constructor() {
+        super('Invalid direct systemd service definition.');
+        this.name = 'SystemdServiceDefinitionError';
+    }
+}
+/** Literal direct-execution definition; never introduces a shell or environment expansion. */
+export class SystemdServiceDefinition {
+    constructor(options) {
+        const requireValue = (value) => {
+            if (!value)
+                throw new SystemdServiceDefinitionError();
+        };
+        const text = (value, maximum = 4096) => typeof value === 'string' && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value) &&
+            !/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(value);
+        const absolute = (value) => text(value) && plugins.path.isAbsolute(value) &&
+            plugins.path.normalize(value) === value;
+        const keys = [
+            'unitName',
+            'description',
+            'executable',
+            'args',
+            'workingDirectory',
+            'user',
+            'group',
+            'restart',
+            'killMode',
+            'timeoutStopSeconds',
+        ];
+        requireValue(options && Object.getPrototypeOf(options) === Object.prototype &&
+            Reflect.ownKeys(options).length === keys.length && keys.every((key) => {
+            const descriptor = Object.getOwnPropertyDescriptor(options, key);
+            return descriptor && 'value' in descriptor;
+        }));
+        requireValue(typeof options.unitName === 'string' &&
+            /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName));
+        requireValue(text(options.description, 1024) && options.description.length > 0 &&
+            options.description.trim() === options.description && !options.description.includes('\\'));
+        requireValue(absolute(options.executable) && options.executable !== '/' &&
+            !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
+            absolute(options.workingDirectory) &&
+            options.workingDirectory.trim() === options.workingDirectory &&
+            !options.workingDirectory.includes('\\'));
+        requireValue(Array.isArray(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
+            options.args.length <= 128 &&
+            Reflect.ownKeys(options.args).length === options.args.length + 1 &&
+            Array.from({ length: options.args.length }, (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)))
+                .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)));
+        requireValue([options.user, options.group].every((value) => typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)));
+        requireValue(['no', 'on-failure', 'always'].includes(options.restart) &&
+            ['mixed', 'control-group'].includes(options.killMode) &&
+            Number.isSafeInteger(options.timeoutStopSeconds) &&
+            options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600);
+        // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
+        const quote = (value, command = false) => '"' + value
+            .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
+            .replaceAll('$', () => command ? '$$' : '$') +
+            '"';
+        this.unitName = options.unitName;
+        this.content = [
+            '[Unit]',
+            `Description=${options.description.replaceAll('%', '%%')}`,
+            'After=local-fs.target',
+            '',
+            '[Service]',
+            'Type=exec',
+            `User=${options.user}`,
+            `Group=${options.group}`,
+            `ExecStart=${[quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')}`,
+            // WorkingDirectory is a raw path value, not an ExecStart word list.
+            `WorkingDirectory=${options.workingDirectory.replaceAll('%', '%%')}`,
+            `Restart=${options.restart}`,
+            `KillMode=${options.killMode}`,
+            'KillSignal=SIGTERM',
+            'FinalKillSignal=SIGKILL',
+            'SendSIGKILL=yes',
+            'SendSIGHUP=no',
+            `TimeoutStopSec=${options.timeoutStopSeconds}s`,
+            'StandardInput=null',
+            'StandardOutput=journal',
+            'StandardError=journal',
+            '',
+            '[Install]',
+            'WantedBy=multi-user.target',
+            '',
+        ].join('\n');
+        requireValue(Buffer.byteLength(this.content) <= 16384);
+        this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
+        Object.freeze(this);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kc2VydmljZWRlZmluaXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWRzZXJ2aWNlZGVmaW5pdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBZXBELE1BQU0sT0FBTyw2QkFBOEIsU0FBUSxLQUFLO0lBQ3REO1FBQ0UsS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFFRCw4RkFBOEY7QUFDOUYsTUFBTSxPQUFPLHdCQUF3QjtJQUtuQyxZQUFZLE9BQXlDO1FBQ25ELE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYyxFQUFRLEVBQUU7WUFDNUMsSUFBSSxDQUFDLEtBQUs7Z0JBQUUsTUFBTSxJQUFJLDZCQUE2QixFQUFFLENBQUM7UUFDeEQsQ0FBQyxDQUFDO1FBQ0YsTUFBTSxJQUFJLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBTyxHQUFHLElBQUksRUFBbUIsRUFBRSxDQUMvRCxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO1lBQ3RGLENBQUMseUVBQXlFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3pGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUFFLEVBQUUsQ0FDbEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztZQUM3QyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLENBQUM7UUFDMUMsTUFBTSxJQUFJLEdBQUc7WUFDWCxVQUFVO1lBQ1YsYUFBYTtZQUNiLFlBQVk7WUFDWixNQUFNO1lBQ04sa0JBQWtCO1lBQ2xCLE1BQU07WUFDTixPQUFPO1lBQ1AsU0FBUztZQUNULFVBQVU7WUFDVixvQkFBb0I7U0FDckIsQ0FBQztRQUNGLFlBQVksQ0FDVixPQUFPLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztZQUM1RCxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtZQUNwRSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ2pFLE9BQU8sVUFBVSxJQUFJLE9BQU8sSUFBSSxVQUFVLENBQUM7UUFDN0MsQ0FBQyxDQUFDLENBQ0wsQ0FBQztRQUNGLFlBQVksQ0FDVixPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtZQUNsQyw2Q0FBNkMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUN2RSxDQUFDO1FBQ0YsWUFBWSxDQUNWLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLElBQUksQ0FBQyxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDL0QsT0FBTyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQzVGLENBQUM7UUFDRixZQUFZLENBQ1YsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLEdBQUc7WUFDeEQsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztZQUN2RSxRQUFRLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDO1lBQ2xDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsS0FBSyxPQUFPLENBQUMsZ0JBQWdCO1lBQzVELENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FDM0MsQ0FBQztRQUNGLFlBQVksQ0FDVixLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUztZQUNwRixPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHO1lBQzFCLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQ2hFLEtBQUssQ0FBQyxJQUFJLENBQ1IsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFDL0IsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDM0U7aUJBQ0UsS0FBSyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLElBQUksT0FBTyxJQUFJLFVBQVUsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQzFGLENBQUM7UUFDRixZQUFZLENBQ1YsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUM1QyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksZ0NBQWdDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUMxRSxDQUNGLENBQUM7UUFDRixZQUFZLENBQ1YsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1lBQ3RELENBQUMsT0FBTyxFQUFFLGVBQWUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1lBQ3JELE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1lBQ2hELE9BQU8sQ0FBQyxrQkFBa0IsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLGtCQUFrQixJQUFJLEdBQUcsQ0FDdkUsQ0FBQztRQUNGLGlGQUFpRjtRQUNqRixNQUFNLEtBQUssR0FBRyxDQUFDLEtBQWEsRUFBRSxPQUFPLEdBQUcsS0FBSyxFQUFFLEVBQUUsQ0FDL0MsR0FBRyxHQUFHLEtBQUs7YUFDUixVQUFVLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUM7YUFDckUsVUFBVSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQzlDLEdBQUcsQ0FBQztRQUNOLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUNqQyxJQUFJLENBQUMsT0FBTyxHQUFHO1lBQ2IsUUFBUTtZQUNSLGVBQWUsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQzFELHVCQUF1QjtZQUN2QixFQUFFO1lBQ0YsV0FBVztZQUNYLFdBQVc7WUFDWCxRQUFRLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFDdEIsU0FBUyxPQUFPLENBQUMsS0FBSyxFQUFFO1lBQ3hCLGFBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQzFGLEVBQUU7WUFDRixvRUFBb0U7WUFDcEUsb0JBQW9CLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQ3BFLFdBQVcsT0FBTyxDQUFDLE9BQU8sRUFBRTtZQUM1QixZQUFZLE9BQU8sQ0FBQyxRQUFRLEVBQUU7WUFDOUIsb0JBQW9CO1lBQ3BCLHlCQUF5QjtZQUN6QixpQkFBaUI7WUFDakIsZUFBZTtZQUNmLGtCQUFrQixPQUFPLENBQUMsa0JBQWtCLEdBQUc7WUFDL0Msb0JBQW9CO1lBQ3BCLHdCQUF3QjtZQUN4Qix1QkFBdUI7WUFDdkIsRUFBRTtZQUNGLFdBQVc7WUFDWCw0QkFBNEI7WUFDNUIsRUFBRTtTQUNILENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2IsWUFBWSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDO1FBQ3ZELElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckYsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBQ0YifQ==

package/dist_ts/classes.systemdunit.d.ts

@@ -18,6 +18,13 @@ export interface ISystemdUnitState {
     /** Empty when no systemd job is pending; otherwise systemctl's job description. */
     readonly job: string;
 }
+export interface ISystemdUnitConfigurationState {
+    readonly unitName: string;
+    readonly fragmentPath: string;
+    /** Opaque systemctl path list. An empty value proves no effective drop-ins. */
+    readonly dropInPaths: string;
+    readonly needsReload: boolean;
+}
 export declare class SystemdUnitError extends Error {
     readonly code: 'invalid_options' | 'command_failed' | 'invalid_state';
     constructor(code: 'invalid_options' | 'command_failed' | 'invalid_state');
@@ -34,5 +41,9 @@ export declare class SystemdUnit {
     start(): Promise<ISystemdUnitState>;
     /** Await the systemd job, then inspect. The snapshot alone is not an application data-drain proof. */
     stop(): Promise<ISystemdUnitState>;
+    /** Reports the manager's selected definition without reading or changing its contents. */
+    inspectConfiguration(): Promise<ISystemdUnitConfigurationState>;
+    /** Reloads unit definitions globally; does not enable, unmask, start or stop a unit. */
+    reloadConfiguration(): Promise<ISystemdUnitConfigurationState>;
     private command;
 }

package/dist_ts/classes.systemdunit.js

@@ -75,6 +75,34 @@ export class SystemdUnit {
         await this.command(['stop', this.unitName]);
         return this.inspect();
     }
+    /** Reports the manager's selected definition without reading or changing its contents. */
+    async inspectConfiguration() {
+        const keys = ['Id', 'FragmentPath', 'DropInPaths', 'NeedDaemonReload'];
+        const stdout = await this.command(['show', this.unitName, `--property=${keys.join(',')}`, '--all']);
+        const fields = new Map();
+        for (const line of stdout.trimEnd().split('\n')) {
+            const separator = line.indexOf('='), key = line.slice(0, separator);
+            if (separator < 1 || !keys.includes(key) || fields.has(key)) {
+                throw new SystemdUnitError('invalid_state');
+            }
+            fields.set(key, line.slice(separator + 1));
+        }
+        if (fields.size !== keys.length || fields.get('Id') !== this.unitName ||
+            !['yes', 'no'].includes(fields.get('NeedDaemonReload'))) {
+            throw new SystemdUnitError('invalid_state');
+        }
+        return Object.freeze({
+            unitName: this.unitName,
+            fragmentPath: fields.get('FragmentPath'),
+            dropInPaths: fields.get('DropInPaths'),
+            needsReload: fields.get('NeedDaemonReload') === 'yes',
+        });
+    }
+    /** Reloads unit definitions globally; does not enable, unmask, start or stop a unit. */
+    async reloadConfiguration() {
+        await this.command(['daemon-reload']);
+        return this.inspectConfiguration();
+    }
     command(argsArg) {
         return new Promise((resolve, reject) => {
             plugins.childProcess.execFile(this.executable, ['--system', '--no-ask-password', '--no-pager', ...argsArg], {
@@ -94,4 +122,4 @@ export class SystemdUnit {
         });
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kdW5pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuc3lzdGVtZHVuaXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSwwQkFBMEIsQ0FBQztBQXdCcEQsTUFBTSxPQUFPLGdCQUFpQixTQUFRLEtBQUs7SUFDekMsWUFBNEIsSUFBNEQ7UUFDdEYsS0FBSyxDQUFDLGtDQUFrQyxJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBRHZCLFNBQUksR0FBSixJQUFJLENBQXdEO1FBRXRGLElBQUksQ0FBQyxJQUFJLEdBQUcsa0JBQWtCLENBQUM7SUFDakMsQ0FBQztDQUNGO0FBRUQsTUFBTSxVQUFVLEdBQUc7SUFDakIsSUFBSTtJQUNKLFdBQVc7SUFDWCxhQUFhO0lBQ2IsVUFBVTtJQUNWLGVBQWU7SUFDZixTQUFTO0lBQ1QsWUFBWTtJQUNaLGNBQWM7SUFDZCxVQUFVO0lBQ1YsS0FBSztDQUNHLENBQUM7QUFFWCw2R0FBNkc7QUFDN0csTUFBTSxPQUFPLFdBQVc7SUFLdEIsWUFBWSxVQUErQjtRQUN6QyxJQUFJLENBQUMsUUFBUSxHQUFHLFVBQVUsRUFBRSxRQUFRLENBQUM7UUFDckMsSUFBSSxDQUFDLFVBQVUsR0FBRyxVQUFVLEVBQUUsYUFBYSxJQUFJLG9CQUFvQixDQUFDO1FBQ3BFLElBQUksQ0FBQyxPQUFPLEdBQUcsVUFBVSxFQUFFLGdCQUFnQixJQUFJLE1BQU0sQ0FBQztRQUN0RCxJQUNFLE9BQU8sSUFBSSxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ2pDLENBQUMsK0NBQStDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7WUFDcEUsT0FBTyxJQUFJLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7WUFDaEYsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDckUsSUFBSSxDQUFDLE9BQU8sR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sR0FBRyxNQUFNO1lBQ3pDLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFRCxvRkFBb0Y7SUFDN0UsS0FBSyxDQUFDLE9BQU87UUFDbEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQ2hDLE1BQU07WUFDTixJQUFJLENBQUMsUUFBUTtZQUNiLGNBQWMsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUNwQyxPQUFPO1NBQ1IsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFDekMsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNwQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNyQyxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUksQ0FBRSxVQUFnQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3pGLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFDRSxNQUFNLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUTtZQUN2RSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDeEUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDckMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQzNGO1lBQ0QsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzlDLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNuQixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7WUFDdkIsU0FBUyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFFO1lBQ25DLFdBQVcsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBRTtZQUN2QyxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUU7WUFDakMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFFO1lBQzNDLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUN0QyxVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDNUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFFO1lBQ3pDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBRTtZQUNqQyxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUU7U0FDeEIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELG9GQUFvRjtJQUM3RSxLQUFLLENBQUMsS0FBSztRQUNoQixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDN0MsT0FBTyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELHNHQUFzRztJQUMvRixLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUM1QyxPQUFPLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUN4QixDQUFDO0lBRU8sT0FBTyxDQUFDLE9BQWlCO1FBQy9CLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsT0FBTyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQzNCLElBQUksQ0FBQyxVQUFVLEVBQ2YsQ0FBQyxVQUFVLEVBQUUsbUJBQW1CLEVBQUUsWUFBWSxFQUFFLEdBQUcsT0FBTyxDQUFDLEVBQzNEO2dCQUNFLFFBQVEsRUFBRSxNQUFNO2dCQUNoQixPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU87Z0JBQ3JCLFVBQVUsRUFBRSxTQUFTO2dCQUNyQixTQUFTLEVBQUUsS0FBSztnQkFDaEIsV0FBVyxFQUFFLElBQUk7Z0JBQ2pCLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFO2FBQ3ZELEVBQ0QsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLEVBQUU7Z0JBQ2hCLDBGQUEwRjtnQkFDMUYsSUFBSSxLQUFLO29CQUFFLE1BQU0sQ0FBQyxJQUFJLGdCQUFnQixDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQzs7b0JBQ3JELE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUN2QixDQUFDLENBQ0YsQ0FBQztRQUNKLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kdW5pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuc3lzdGVtZHVuaXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSwwQkFBMEIsQ0FBQztBQWdDcEQsTUFBTSxPQUFPLGdCQUFpQixTQUFRLEtBQUs7SUFDekMsWUFBNEIsSUFBNEQ7UUFDdEYsS0FBSyxDQUFDLGtDQUFrQyxJQUFJLEdBQUcsQ0FBQyxDQUFDO1FBRHZCLFNBQUksR0FBSixJQUFJLENBQXdEO1FBRXRGLElBQUksQ0FBQyxJQUFJLEdBQUcsa0JBQWtCLENBQUM7SUFDakMsQ0FBQztDQUNGO0FBRUQsTUFBTSxVQUFVLEdBQUc7SUFDakIsSUFBSTtJQUNKLFdBQVc7SUFDWCxhQUFhO0lBQ2IsVUFBVTtJQUNWLGVBQWU7SUFDZixTQUFTO0lBQ1QsWUFBWTtJQUNaLGNBQWM7SUFDZCxVQUFVO0lBQ1YsS0FBSztDQUNHLENBQUM7QUFFWCw2R0FBNkc7QUFDN0csTUFBTSxPQUFPLFdBQVc7SUFLdEIsWUFBWSxVQUErQjtRQUN6QyxJQUFJLENBQUMsUUFBUSxHQUFHLFVBQVUsRUFBRSxRQUFRLENBQUM7UUFDckMsSUFBSSxDQUFDLFVBQVUsR0FBRyxVQUFVLEVBQUUsYUFBYSxJQUFJLG9CQUFvQixDQUFDO1FBQ3BFLElBQUksQ0FBQyxPQUFPLEdBQUcsVUFBVSxFQUFFLGdCQUFnQixJQUFJLE1BQU0sQ0FBQztRQUN0RCxJQUNFLE9BQU8sSUFBSSxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ2pDLENBQUMsK0NBQStDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7WUFDcEUsT0FBTyxJQUFJLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7WUFDaEYsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDckUsSUFBSSxDQUFDLE9BQU8sR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sR0FBRyxNQUFNO1lBQ3pDLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFFRCxvRkFBb0Y7SUFDN0UsS0FBSyxDQUFDLE9BQU87UUFDbEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQ2hDLE1BQU07WUFDTixJQUFJLENBQUMsUUFBUTtZQUNiLGNBQWMsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUNwQyxPQUFPO1NBQ1IsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFDekMsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNwQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNyQyxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUksQ0FBRSxVQUFnQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3pGLE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFDRSxNQUFNLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUTtZQUN2RSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDeEUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDckMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQzNGO1lBQ0QsTUFBTSxJQUFJLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzlDLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNuQixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7WUFDdkIsU0FBUyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFFO1lBQ25DLFdBQVcsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBRTtZQUN2QyxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUU7WUFDakMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFFO1lBQzNDLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUN0QyxVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDNUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFFO1lBQ3pDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBRTtZQUNqQyxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUU7U0FDeEIsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELG9GQUFvRjtJQUM3RSxLQUFLLENBQUMsS0FBSztRQUNoQixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDN0MsT0FBTyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELHNHQUFzRztJQUMvRixLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUM1QyxPQUFPLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUN4QixDQUFDO0lBRUQsMEZBQTBGO0lBQ25GLEtBQUssQ0FBQyxvQkFBb0I7UUFDL0IsTUFBTSxJQUFJLEdBQUcsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLGNBQWMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDcEcsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFDekMsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDaEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDcEUsSUFBSSxTQUFTLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzVELE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUTtZQUNuRSxDQUFDLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFFLENBQUMsRUFBRSxDQUFDO1lBQzNELE1BQU0sSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM5QyxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ25CLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUTtZQUN2QixZQUFZLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUU7WUFDekMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFFO1lBQ3ZDLFdBQVcsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDLEtBQUssS0FBSztTQUN0RCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsd0ZBQXdGO0lBQ2pGLEtBQUssQ0FBQyxtQkFBbUI7UUFDOUIsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQztRQUN0QyxPQUFPLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO0lBQ3JDLENBQUM7SUFFTyxPQUFPLENBQUMsT0FBaUI7UUFDL0IsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxPQUFPLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FDM0IsSUFBSSxDQUFDLFVBQVUsRUFDZixDQUFDLFVBQVUsRUFBRSxtQkFBbUIsRUFBRSxZQUFZLEVBQUUsR0FBRyxPQUFPLENBQUMsRUFDM0Q7Z0JBQ0UsUUFBUSxFQUFFLE1BQU07Z0JBQ2hCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsVUFBVSxFQUFFLFNBQVM7Z0JBQ3JCLFNBQVMsRUFBRSxLQUFLO2dCQUNoQixXQUFXLEVBQUUsSUFBSTtnQkFDakIsR0FBRyxFQUFFLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUU7YUFDdkQsRUFDRCxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsRUFBRTtnQkFDaEIsMEZBQTBGO2dCQUMxRixJQUFJLEtBQUs7b0JBQUUsTUFBTSxDQUFDLElBQUksZ0JBQWdCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDOztvQkFDckQsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3ZCLENBQUMsQ0FDRixDQUFDO1FBQ0osQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0YifQ==

package/dist_ts/classes.systemdunitfile.d.ts

@@ -0,0 +1,45 @@
+import { SystemdServiceDefinition } from './classes.systemdservicedefinition.js';
+import { type ISystemdUnitOptions } from './classes.systemdunit.js';
+export interface ISystemdUnitFileOptions extends ISystemdUnitOptions {
+    /** Local vendor definitions can be installed without removing an administrator's mask. */
+    unitDirectory?: string;
+    /** Trusted owning-code qualification only. Defaults to root. */
+    expectedUid?: number;
+}
+export interface ISystemdUnitFileRecord {
+    readonly path: string;
+    readonly sha256: string;
+}
+export declare class SystemdUnitFileError extends Error {
+    readonly code: 'invalid_options' | 'unsafe_path' | 'busy' | 'changed' | 'unsafe_unit' | 'write_failed' | 'reload_failed';
+    constructor(code: 'invalid_options' | 'unsafe_path' | 'busy' | 'changed' | 'unsafe_unit' | 'write_failed' | 'reload_failed');
+}
+/**
+ * Protected code/config installation, inside the caller's cross-process installation ownership scope.
+ * Other privileged writers must be serialized by that owner. Never changes enablement or masks.
+ */
+export declare class SystemdUnitFile {
+    readonly path: string;
+    private readonly directory;
+    private readonly uid;
+    private readonly unit;
+    private readonly name;
+    private busy;
+    constructor(options: ISystemdUnitFileOptions);
+    /** Reads only the exact protected definition; no systemd or filesystem mutation. */
+    inspect(): Promise<ISystemdUnitFileRecord | null>;
+    /**
+     * Expected previous digest is mandatory; null admits an absent file. Exact desired bytes are idempotent.
+     * Retains changed definitions beside the unit before replacement. A failed reload never rolls code back.
+     */
+    install(definition: SystemdServiceDefinition, expectedSha256: string | null): Promise<Readonly<{
+        changed: boolean;
+        record: ISystemdUnitFileRecord;
+        masked: boolean;
+    }>>;
+    private admit;
+    private directories;
+    private read;
+    private create;
+    private flushDirectory;
+}

package/dist_ts/classes.systemdunitfile.js

@@ -0,0 +1,249 @@
+import * as plugins from './smartdaemon.plugins.js';
+import { SystemdServiceDefinition } from './classes.systemdservicedefinition.js';
+import { SystemdUnit, } from './classes.systemdunit.js';
+export class SystemdUnitFileError extends Error {
+    constructor(code) {
+        super(`Systemd unit definition installation failed: ${code}.`);
+        this.code = code;
+        this.name = 'SystemdUnitFileError';
+    }
+}
+const requireValue = (value, code) => {
+    if (!value)
+        throw new SystemdUnitFileError(code);
+};
+const digest = (bytes) => plugins.crypto.createHash('sha256').update(bytes).digest('hex');
+const quiet = (state) => state.mainPid === 0 && state.controlPid === 0 &&
+    state.controlGroup === '' && state.job === '' &&
+    (state.activeState === 'inactive' && state.subState === 'dead' ||
+        state.activeState === 'failed' && state.subState === 'failed');
+const masked = (state) => state.loadState === 'masked' &&
+    ['masked', 'masked-runtime'].includes(state.unitFileState);
+const sameFile = (left, right) => left.dev === right.dev && left.ino === right.ino;
+/**
+ * Protected code/config installation, inside the caller's cross-process installation ownership scope.
+ * Other privileged writers must be serialized by that owner. Never changes enablement or masks.
+ */
+export class SystemdUnitFile {
+    constructor(options) {
+        this.busy = false;
+        this.unit = new SystemdUnit(options);
+        this.name = options.unitName;
+        this.directory = options.unitDirectory ?? '/usr/local/lib/systemd/system';
+        this.uid = options.expectedUid ?? 0;
+        requireValue(typeof this.directory === 'string' && this.directory !== '/' &&
+            plugins.path.isAbsolute(this.directory) &&
+            plugins.path.normalize(this.directory) === this.directory &&
+            !this.directory.endsWith('/') && !/[\x00-\x1f\x7f]/.test(this.directory) &&
+            this.directory.length <= 4000 && Number.isSafeInteger(this.uid) && this.uid >= 0, 'invalid_options');
+        this.path = plugins.path.join(this.directory, this.name);
+    }
+    /** Reads only the exact protected definition; no systemd or filesystem mutation. */
+    async inspect() {
+        if (!await this.directories(false))
+            return null;
+        const file = await this.read(this.path);
+        return file ? Object.freeze({ path: this.path, sha256: digest(file.bytes) }) : null;
+    }
+    /**
+     * Expected previous digest is mandatory; null admits an absent file. Exact desired bytes are idempotent.
+     * Retains changed definitions beside the unit before replacement. A failed reload never rolls code back.
+     */
+    async install(definition, expectedSha256) {
+        requireValue(definition instanceof SystemdServiceDefinition && definition.unitName === this.name &&
+            (expectedSha256 === null ||
+                typeof expectedSha256 === 'string' && /^[a-f0-9]{64}$/.test(expectedSha256)), 'invalid_options');
+        requireValue(!this.busy, 'busy');
+        this.busy = true;
+        let temporary;
+        let temporaryInfo;
+        try {
+            const before = await this.unit.inspect();
+            const beforeConfiguration = await this.admit(before);
+            await this.directories(true);
+            const parent = await plugins.fs.lstat(this.directory);
+            const previous = await this.read(this.path);
+            const previousSha = previous ? digest(previous.bytes) : null;
+            const changed = previousSha !== definition.sha256;
+            requireValue(!changed || previousSha === expectedSha256, 'changed');
+            if (changed) {
+                if (previous) {
+                    const backup = `${this.path}.previous-${previousSha}`;
+                    try {
+                        await this.create(backup, previous.bytes);
+                    }
+                    catch (error) {
+                        if (error.code !== 'EEXIST')
+                            throw error;
+                        requireValue(digest((await this.read(backup)).bytes) === previousSha, 'changed');
+                    }
+                    await this.flushDirectory(parent);
+                }
+                temporary = plugins.path.join(this.directory, `.${this.name}.${plugins.crypto.randomUUID()}.tmp`);
+                await this.create(temporary, Buffer.from(definition.content));
+                temporaryInfo = await plugins.fs.lstat(temporary);
+                const current = await this.read(this.path);
+                requireValue((current ? digest(current.bytes) : null) === previousSha &&
+                    (!current || previous && sameFile(current.info, previous.info)), 'changed');
+                requireValue(sameFile(parent, await plugins.fs.lstat(this.directory)), 'unsafe_path');
+                const rechecked = await this.unit.inspect();
+                requireValue(JSON.stringify(rechecked) === JSON.stringify(before), 'changed');
+                const recheckedConfiguration = await this.admit(rechecked);
+                requireValue(recheckedConfiguration.fragmentPath === beforeConfiguration.fragmentPath, 'changed');
+                await plugins.fs.rename(temporary, this.path);
+                temporary = undefined;
+                await this.flushDirectory(parent);
+            }
+            try {
+                const reloadedConfiguration = await this.unit.reloadConfiguration();
+                const after = await this.unit.inspect();
+                requireValue(quiet(after) &&
+                    (before.loadState === 'not-found'
+                        ? after.loadState === 'loaded' && after.unitFileState === 'disabled'
+                        : after.loadState === before.loadState &&
+                            after.unitFileState === before.unitFileState), 'changed');
+                const configuration = await this.unit.inspectConfiguration();
+                requireValue([reloadedConfiguration, configuration].every((snapshot) => !snapshot.needsReload && snapshot.dropInPaths === '' &&
+                    snapshot.fragmentPath ===
+                        (masked(after) ? beforeConfiguration.fragmentPath : this.path)), 'unsafe_unit');
+                const installed = await this.inspect();
+                requireValue(installed?.sha256 === definition.sha256, 'changed');
+                return Object.freeze({ changed, record: installed, masked: masked(after) });
+            }
+            catch {
+                throw new SystemdUnitFileError('reload_failed');
+            }
+        }
+        catch (error) {
+            if (error instanceof SystemdUnitFileError)
+                throw error;
+            throw new SystemdUnitFileError('write_failed');
+        }
+        finally {
+            try {
+                if (temporary && temporaryInfo) {
+                    const named = await plugins.fs.lstat(temporary);
+                    requireValue(sameFile(temporaryInfo, named), 'unsafe_path');
+                    await plugins.fs.unlink(temporary);
+                }
+            }
+            finally {
+                this.busy = false;
+            }
+        }
+    }
+    async admit(state) {
+        requireValue(quiet(state) && (masked(state) ||
+            state.loadState === 'loaded' &&
+                ['enabled', 'enabled-runtime', 'disabled'].includes(state.unitFileState) ||
+            state.loadState === 'not-found' && state.unitFileState === ''), 'unsafe_unit');
+        const configuration = await this.unit.inspectConfiguration();
+        const maskPath = plugins.path.join(state.unitFileState === 'masked-runtime' ? '/run/systemd/system' : '/etc/systemd/system', this.name);
+        requireValue(!configuration.needsReload && configuration.dropInPaths === '' &&
+            (masked(state)
+                ? configuration.fragmentPath !== this.path &&
+                    ['/dev/null', maskPath].includes(configuration.fragmentPath)
+                : configuration.fragmentPath === (state.loadState === 'not-found' ? '' : this.path)), 'unsafe_unit');
+        return configuration;
+    }
+    async directories(create) {
+        requireValue(process.platform === 'linux' && process.getuid?.() === this.uid, 'unsafe_path');
+        let directory = '/';
+        for (const part of this.directory.split('/').filter(Boolean)) {
+            directory = plugins.path.join(directory, part);
+            let info;
+            try {
+                info = await plugins.fs.lstat(directory);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                if (!create)
+                    return false;
+                await plugins.fs.mkdir(directory, { mode: 0o755 });
+                const parent = await plugins.fs.open(plugins.path.dirname(directory), plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_DIRECTORY |
+                    plugins.fsConstants.O_NOFOLLOW);
+                try {
+                    await parent.sync();
+                }
+                finally {
+                    await parent.close();
+                }
+                info = await plugins.fs.lstat(directory);
+            }
+            requireValue(info.isDirectory() && !info.isSymbolicLink() && [0, this.uid].includes(info.uid) &&
+                ((info.mode & 0o022) === 0 || directory === '/tmp' && info.uid === 0 &&
+                    (info.mode & 0o7777) === 0o1777), 'unsafe_path');
+        }
+        return true;
+    }
+    async read(path) {
+        let file;
+        try {
+            file = await plugins.fs.open(path, plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_NOFOLLOW |
+                plugins.fsConstants.O_NONBLOCK);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw new SystemdUnitFileError('unsafe_path');
+        }
+        try {
+            const info = await file.stat();
+            requireValue(info.isFile() && info.uid === this.uid && info.nlink === 1 &&
+                (info.mode & 0o7777) === 0o644 && info.size <= 16384, 'unsafe_path');
+            const bytes = Buffer.alloc(16385);
+            let size = 0;
+            for (;;) {
+                const result = await file.read(bytes, size, bytes.length - size, size);
+                if (result.bytesRead === 0)
+                    break;
+                size += result.bytesRead;
+                requireValue(size <= 16384, 'unsafe_path');
+            }
+            const after = await file.stat(), named = await plugins.fs.lstat(path);
+            requireValue(sameFile(info, named) && !named.isSymbolicLink() && after.size === size &&
+                info.size === after.size && info.mtimeMs === after.mtimeMs &&
+                info.ctimeMs === after.ctimeMs, 'changed');
+            return { bytes: bytes.subarray(0, size), info };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async create(path, bytes) {
+        const file = await plugins.fs.open(path, plugins.fsConstants.O_CREAT | plugins.fsConstants.O_EXCL |
+            plugins.fsConstants.O_WRONLY | plugins.fsConstants.O_NOFOLLOW, 0o644);
+        let created;
+        try {
+            try {
+                created = await file.stat();
+                await file.chmod(0o644);
+                await file.writeFile(bytes);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+        }
+        catch (error) {
+            if (created) {
+                requireValue(sameFile(created, await plugins.fs.lstat(path)), 'unsafe_path');
+                await plugins.fs.unlink(path);
+            }
+            throw error;
+        }
+    }
+    async flushDirectory(expected) {
+        const directory = await plugins.fs.open(this.directory, plugins.fsConstants.O_RDONLY |
+            plugins.fsConstants.O_DIRECTORY | plugins.fsConstants.O_NOFOLLOW);
+        try {
+            requireValue(sameFile(expected, await directory.stat()), 'unsafe_path');
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zeXN0ZW1kdW5pdGZpbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLnN5c3RlbWR1bml0ZmlsZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLDBCQUEwQixDQUFDO0FBQ3BELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLHVDQUF1QyxDQUFDO0FBQ2pGLE9BQU8sRUFJTCxXQUFXLEdBQ1osTUFBTSwwQkFBMEIsQ0FBQztBQVlsQyxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsS0FBSztJQUM3QyxZQUNrQixJQU9HO1FBRW5CLEtBQUssQ0FBQyxnREFBZ0QsSUFBSSxHQUFHLENBQUMsQ0FBQztRQVQvQyxTQUFJLEdBQUosSUFBSSxDQU9EO1FBR25CLElBQUksQ0FBQyxJQUFJLEdBQUcsc0JBQXNCLENBQUM7SUFDckMsQ0FBQztDQUNGO0FBQ0QsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBa0MsRUFBUSxFQUFFO0lBQ2hGLElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ25ELENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBaUIsRUFBRSxFQUFFLENBQ25DLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDbEUsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUF3QixFQUFFLEVBQUUsQ0FDekMsS0FBSyxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxDQUFDO0lBQzdDLEtBQUssQ0FBQyxZQUFZLEtBQUssRUFBRSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssRUFBRTtJQUM3QyxDQUFDLEtBQUssQ0FBQyxXQUFXLEtBQUssVUFBVSxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssTUFBTTtRQUM1RCxLQUFLLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0FBQ25FLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBd0IsRUFBRSxFQUFFLENBQzFDLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtJQUM1QixDQUFDLFFBQVEsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDN0QsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFrQyxFQUFFLEtBQW1DLEVBQUUsRUFBRSxDQUMzRixJQUFJLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDO0FBRW5EOzs7R0FHRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBUTFCLFlBQVksT0FBZ0M7UUFGcEMsU0FBSSxHQUFHLEtBQUssQ0FBQztRQUduQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUM3QixJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxhQUFhLElBQUksK0JBQStCLENBQUM7UUFDMUUsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsQ0FBQztRQUNwQyxZQUFZLENBQ1YsT0FBTyxJQUFJLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsU0FBUyxLQUFLLEdBQUc7WUFDMUQsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUN2QyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVM7WUFDekQsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3hFLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxJQUFJLElBQUksSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsRUFDbEYsaUJBQWlCLENBQ2xCLENBQUM7UUFDRixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFRCxvRkFBb0Y7SUFDN0UsS0FBSyxDQUFDLE9BQU87UUFDbEIsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUNoRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEYsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQ2xCLFVBQW9DLEVBQ3BDLGNBQTZCO1FBRTdCLFlBQVksQ0FDVixVQUFVLFlBQVksd0JBQXdCLElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsSUFBSTtZQUNqRixDQUFDLGNBQWMsS0FBSyxJQUFJO2dCQUN0QixPQUFPLGNBQWMsS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQ2hGLGlCQUFpQixDQUNsQixDQUFDO1FBQ0YsWUFBWSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQixJQUFJLFNBQTZCLENBQUM7UUFDbEMsSUFBSSxhQUF3QyxDQUFDO1FBQzdDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QyxNQUFNLG1CQUFtQixHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNyRCxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDN0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDdEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1QyxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUM3RCxNQUFNLE9BQU8sR0FBRyxXQUFXLEtBQUssVUFBVSxDQUFDLE1BQU0sQ0FBQztZQUNsRCxZQUFZLENBQUMsQ0FBQyxPQUFPLElBQUksV0FBVyxLQUFLLGNBQWMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNwRSxJQUFJLE9BQU8sRUFBRSxDQUFDO2dCQUNaLElBQUksUUFBUSxFQUFFLENBQUM7b0JBQ2IsTUFBTSxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsSUFBSSxhQUFhLFdBQVcsRUFBRSxDQUFDO29CQUN0RCxJQUFJLENBQUM7d0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBQzVDLENBQUM7b0JBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQzt3QkFDZixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7NEJBQUUsTUFBTSxLQUFLLENBQUM7d0JBQ3BFLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxXQUFXLEVBQUUsU0FBUyxDQUFDLENBQUM7b0JBQ3BGLENBQUM7b0JBQ0QsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUNwQyxDQUFDO2dCQUNELFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDM0IsSUFBSSxDQUFDLFNBQVMsRUFDZCxJQUFJLElBQUksQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUNuRCxDQUFDO2dCQUNGLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztnQkFDOUQsYUFBYSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ2xELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQzNDLFlBQVksQ0FDVixDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssV0FBVztvQkFDdEQsQ0FBQyxDQUFDLE9BQU8sSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQ2pFLFNBQVMsQ0FDVixDQUFDO2dCQUNGLFlBQVksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7Z0JBQ3RGLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDNUMsWUFBWSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQztnQkFDOUUsTUFBTSxzQkFBc0IsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQzNELFlBQVksQ0FDVixzQkFBc0IsQ0FBQyxZQUFZLEtBQUssbUJBQW1CLENBQUMsWUFBWSxFQUN4RSxTQUFTLENBQ1YsQ0FBQztnQkFDRixNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQzlDLFNBQVMsR0FBRyxTQUFTLENBQUM7Z0JBQ3RCLE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNwQyxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0scUJBQXFCLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3BFLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDeEMsWUFBWSxDQUNWLEtBQUssQ0FBQyxLQUFLLENBQUM7b0JBQ1YsQ0FBQyxNQUFNLENBQUMsU0FBUyxLQUFLLFdBQVc7d0JBQy9CLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFVBQVU7d0JBQ3BFLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTOzRCQUNwQyxLQUFLLENBQUMsYUFBYSxLQUFLLE1BQU0sQ0FBQyxhQUFhLENBQUMsRUFDbkQsU0FBUyxDQUNWLENBQUM7Z0JBQ0YsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7Z0JBQzdELFlBQVksQ0FDVixDQUFDLHFCQUFxQixFQUFFLGFBQWEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQ3hELENBQUMsUUFBUSxDQUFDLFdBQVcsSUFBSSxRQUFRLENBQUMsV0FBVyxLQUFLLEVBQUU7b0JBQ3BELFFBQVEsQ0FBQyxZQUFZO3dCQUNuQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsbUJBQW1CLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQ2pFLEVBQ0QsYUFBYSxDQUNkLENBQUM7Z0JBQ0YsTUFBTSxTQUFTLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3ZDLFlBQVksQ0FBQyxTQUFTLEVBQUUsTUFBTSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQ2pFLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBVSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQy9FLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsTUFBTSxJQUFJLG9CQUFvQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQ2xELENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksS0FBSyxZQUFZLG9CQUFvQjtnQkFBRSxNQUFNLEtBQUssQ0FBQztZQUN2RCxNQUFNLElBQUksb0JBQW9CLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDakQsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxDQUFDO2dCQUNILElBQUksU0FBUyxJQUFJLGFBQWEsRUFBRSxDQUFDO29CQUMvQixNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO29CQUNoRCxZQUFZLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxLQUFLLENBQUMsRUFBRSxhQUFhLENBQUMsQ0FBQztvQkFDNUQsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDckMsQ0FBQztZQUNILENBQUM7b0JBQVMsQ0FBQztnQkFDVCxJQUFJLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQztZQUNwQixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQXdCO1FBQzFDLFlBQVksQ0FDVixLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO1lBQzVCLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtnQkFDMUIsQ0FBQyxTQUFTLEVBQUUsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDMUUsS0FBSyxDQUFDLFNBQVMsS0FBSyxXQUFXLElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxFQUFFLENBQUMsRUFDaEUsYUFBYSxDQUNkLENBQUM7UUFDRixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUM3RCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDaEMsS0FBSyxDQUFDLGFBQWEsS0FBSyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixFQUN4RixJQUFJLENBQUMsSUFBSSxDQUNWLENBQUM7UUFDRixZQUFZLENBQ1YsQ0FBQyxhQUFhLENBQUMsV0FBVyxJQUFJLGFBQWEsQ0FBQyxXQUFXLEtBQUssRUFBRTtZQUM1RCxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQ1osQ0FBQyxDQUFDLGFBQWEsQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLElBQUk7b0JBQ3hDLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDO2dCQUM5RCxDQUFDLENBQUMsYUFBYSxDQUFDLFlBQVksS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUN4RixhQUFhLENBQ2QsQ0FBQztRQUNGLE9BQU8sYUFBYSxDQUFDO0lBQ3ZCLENBQUM7SUFFTyxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQWU7UUFDdkMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLElBQUksQ0FBQyxHQUFHLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFDN0YsSUFBSSxTQUFTLEdBQUcsR0FBRyxDQUFDO1FBQ3BCLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDN0QsU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQztZQUMvQyxJQUFJLElBQW1CLENBQUM7WUFDeEIsSUFBSSxDQUFDO2dCQUNILElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzNDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUssS0FBK0IsQ0FBQyxJQUFJLEtBQUssUUFBUTtvQkFBRSxNQUFNLEtBQUssQ0FBQztnQkFDcEUsSUFBSSxDQUFDLE1BQU07b0JBQUUsT0FBTyxLQUFLLENBQUM7Z0JBQzFCLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7Z0JBQ25ELE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQ2xDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUMvQixPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFdBQVc7b0JBQzVELE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUNqQyxDQUFDO2dCQUNGLElBQUksQ0FBQztvQkFDSCxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDdEIsQ0FBQzt3QkFBUyxDQUFDO29CQUNULE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUN2QixDQUFDO2dCQUNELElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzNDLENBQUM7WUFDRCxZQUFZLENBQ1YsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztnQkFDOUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLFNBQVMsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDO29CQUNoRSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssTUFBTSxDQUFDLEVBQ3RDLGFBQWEsQ0FDZCxDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBWTtRQUM3QixJQUFJLElBQWlELENBQUM7UUFDdEQsSUFBSSxDQUFDO1lBQ0gsSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQzFCLElBQUksRUFDSixPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVU7Z0JBQzNELE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUNqQyxDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxJQUFJLENBQUM7WUFDcEUsTUFBTSxJQUFJLG9CQUFvQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2hELENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUMvQixZQUFZLENBQ1YsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLElBQUksQ0FBQyxHQUFHLEtBQUssSUFBSSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLENBQUM7Z0JBQ3hELENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxNQUFNLENBQUMsS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLElBQUksSUFBSSxLQUFLLEVBQ3RELGFBQWEsQ0FDZCxDQUFDO1lBQ0YsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNsQyxJQUFJLElBQUksR0FBRyxDQUFDLENBQUM7WUFDYixTQUFTLENBQUM7Z0JBQ1IsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7Z0JBQ3ZFLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxDQUFDO29CQUFFLE1BQU07Z0JBQ2xDLElBQUksSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDO2dCQUN6QixZQUFZLENBQUMsSUFBSSxJQUFJLEtBQUssRUFBRSxhQUFhLENBQUMsQ0FBQztZQUM3QyxDQUFDO1lBQ0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDdEUsWUFBWSxDQUNWLFFBQVEsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUFFLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxJQUFJO2dCQUNyRSxJQUFJLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxLQUFLLENBQUMsT0FBTztnQkFDMUQsSUFBSSxDQUFDLE9BQU8sS0FBSyxLQUFLLENBQUMsT0FBTyxFQUNoQyxTQUFTLENBQ1YsQ0FBQztZQUNGLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDbEQsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDckIsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQVksRUFBRSxLQUFpQjtRQUNsRCxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUNoQyxJQUFJLEVBQ0osT0FBTyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNO1lBQ3RELE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUMvRCxLQUFLLENBQ04sQ0FBQztRQUNGLElBQUksT0FBa0MsQ0FBQztRQUN2QyxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUM7Z0JBQ0gsT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUM1QixNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ3hCLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDcEIsQ0FBQztvQkFBUyxDQUFDO2dCQUNULE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3JCLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksT0FBTyxFQUFFLENBQUM7Z0JBQ1osWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLGFBQWEsQ0FBQyxDQUFDO2dCQUM3RSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ2hDLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLGNBQWMsQ0FBQyxRQUF1QjtRQUNsRCxNQUFNLFNBQVMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUNyQyxJQUFJLENBQUMsU0FBUyxFQUNkLE9BQU8sQ0FBQyxXQUFXLENBQUMsUUFBUTtZQUMxQixPQUFPLENBQUMsV0FBVyxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FDbkUsQ0FBQztRQUNGLElBQUksQ0FBQztZQUNILFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLE1BQU0sU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7WUFDeEUsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDekIsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDMUIsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts/index.d.ts

@@ -1,3 +1,5 @@
 export * from './smartdaemon.classes.smartdaemon.js';
 export * from './smartdaemon.classes.service.js';
 export * from './classes.systemdunit.js';
+export * from './classes.systemdservicedefinition.js';
+export * from './classes.systemdunitfile.js';

package/dist_ts/index.js

@@ -1,4 +1,6 @@
 export * from './smartdaemon.classes.smartdaemon.js';
 export * from './smartdaemon.classes.service.js';
 export * from './classes.systemdunit.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBQ3JELGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYywwQkFBMEIsQ0FBQyJ9
+export * from './classes.systemdservicedefinition.js';
+export * from './classes.systemdunitfile.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLHNDQUFzQyxDQUFDO0FBQ3JELGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsOEJBQThCLENBQUMifQ==

package/dist_ts/smartdaemon.plugins.d.ts

@@ -1,6 +1,10 @@
 import * as path from 'path';
 import * as childProcess from 'node:child_process';
-export { path, childProcess };
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as crypto from 'node:crypto';
+export type { Stats } from 'node:fs';
+export { path, childProcess, fs, fsConstants, crypto };
 import * as lik from '@push.rocks/lik';
 import * as smartfm from '@push.rocks/smartfm';
 import * as smartfs from '@push.rocks/smartfs';

package/dist_ts/smartdaemon.plugins.js

@@ -1,7 +1,10 @@
 // node native scope
 import * as path from 'path';
 import * as childProcess from 'node:child_process';
-export { path, childProcess };
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as crypto from 'node:crypto';
+export { path, childProcess, fs, fsConstants, crypto };
 // @pushrocks scope
 import * as lik from '@push.rocks/lik';
 import * as smartfm from '@push.rocks/smartfm';
@@ -13,4 +16,4 @@ import * as smartshell from '@push.rocks/smartshell';
 import * as smartsystem from '@push.rocks/smartsystem';
 export { lik, smartfm, smartfs, smartlog, smartlogDestinationLocal, smartpath, smartshell, smartsystem, };
 // third party
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRkYWVtb24ucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0ZGFlbW9uLnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFFbkQsT0FBTyxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUU5QixtQkFBbUI7QUFDbkIsT0FBTyxLQUFLLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQztBQUN2QyxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssd0JBQXdCLE1BQU0sd0NBQXdDLENBQUM7QUFDbkYsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUNMLEdBQUcsRUFDSCxPQUFPLEVBQ1AsT0FBTyxFQUNQLFFBQVEsRUFDUix3QkFBd0IsRUFDeEIsU0FBUyxFQUNULFVBQVUsRUFDVixXQUFXLEdBQ1osQ0FBQztBQUVGLGNBQWMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRkYWVtb24ucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0ZGFlbW9uLnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxZQUFZLE1BQU0sb0JBQW9CLENBQUM7QUFDbkQsT0FBTyxLQUFLLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUN2QyxPQUFPLEVBQUUsU0FBUyxJQUFJLFdBQVcsRUFBRSxNQUFNLFNBQVMsQ0FBQztBQUNuRCxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUd0QyxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBRXZELG1CQUFtQjtBQUNuQixPQUFPLEtBQUssR0FBRyxNQUFNLGlCQUFpQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx3Q0FBd0MsQ0FBQztBQUNuRixPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUV2RCxPQUFPLEVBQ0wsR0FBRyxFQUNILE9BQU8sRUFDUCxPQUFPLEVBQ1AsUUFBUSxFQUNSLHdCQUF3QixFQUN4QixTQUFTLEVBQ1QsVUFBVSxFQUNWLFdBQVcsR0FDWixDQUFDO0FBRUYsY0FBYyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdaemon",
-  "version": "2.3.1",
+  "version": "2.4.1",
   "private": false,
   "description": "Start scripts as long running daemons and manage them.",
   "main": "dist_ts/index.js",
@@ -28,7 +28,7 @@
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^4.0.0",
+    "@git.zone/tstest": "^6.0.0",
     "@types/node": "^26.4.1"
   },
   "dependencies": {

package/readme.md

@@ -186,6 +186,76 @@ environment, no shell or password prompt, and bounded output. Trusted owning cod
 can choose another absolute executable path and `commandTimeoutMs` (default
 120000, maximum 600000). This timeout bounds the client process only.
 
+`inspectConfiguration()` reports the selected `fragmentPath`, opaque `dropInPaths`
+list and `needsReload` flag. `reloadConfiguration()` explicitly reloads the manager's
+unit definitions globally and returns a fresh configuration snapshot. Neither
+operation changes enablement or masks.
+
+### Installing a direct systemd service definition
+
+`SystemdServiceDefinition` encodes a literal executable and argument list, with
+explicit user, group, restart policy, kill mode and stop timeout. It uses `Type=exec`,
+journal output and null stdin. It introduces no shell; percent specifiers and
+argument environment expansion are escaped. Paths must be absolute and normalized;
+control characters are rejected. Descriptions and working directories cannot have
+backslashes or surrounding whitespace; executable paths also reject quotes and
+backslashes. Arguments may contain spaces, quotes, backslashes and empty strings.
+
+```typescript
+import { SystemdServiceDefinition, SystemdUnitFile } from '@push.rocks/smartdaemon';
+
+const definition = new SystemdServiceDefinition({
+  unitName: 'smartdaemon_my-api-server.service',
+  description: 'My API server',
+  executable: '/opt/my-api/bin/server',
+  args: ['serve'],
+  workingDirectory: '/opt/my-api',
+  user: 'root',
+  group: 'root',
+  restart: 'no',
+  killMode: 'mixed',
+  timeoutStopSeconds: 360,
+});
+const file = new SystemdUnitFile({ unitName: definition.unitName });
+// Inside the privileged installer's existing cross-process ownership scope:
+const previous = await file.inspect();
+const installed = await file.install(definition, previous?.sha256 ?? null);
+console.log(installed.changed, installed.masked, installed.record.sha256);
+```
+
+Installation requires Linux, root and a quiescent exact unit with no process,
+cgroup or job. It rejects effective drop-ins and shadowing fragments. Definitions
+default to `/usr/local/lib/systemd/system`, below administrator configuration in
+the load path, so existing persistent/runtime masks remain intact. Existing
+enablement is preserved; an absent unit becomes disabled. It never enables,
+unmasks, starts or stops a service, or invokes sudo.
+
+Masked units may report `/dev/null` or their exact administrator mask path:
+`/etc/systemd/system/<unit>` for a persistent mask, `/run/systemd/system/<unit>`
+for a runtime mask. Installation preserves that exact manager-selected fragment
+through the write and reload, and never replaces the masking fragment itself.
+Pending manager reloads are rejected before writing; inspect and explicitly
+reload an existing changed configuration before retrying installation.
+
+The caller must already serialize privileged installation across processes;
+`SystemdUnitFile` only excludes simultaneous operations on the same instance.
+The expected previous SHA-256 is mandatory (`null` requires an absent file),
+while already matching bytes are idempotent. Installation checks protected
+directories and regular single-link mode-0644 files, retains changed definitions
+as `<unit>.previous-<sha256>`, flushes them before atomic replacement, reloads
+the manager and checks its selected fragment and final bytes. A reload failure
+leaves the new file and retained previous definition in place; recovery requires
+inspection, never an automatic rollback. Filesystem and definition errors use
+`SystemdUnitFileError` with a local code. Trusted qualification code can set
+`unitDirectory`, `expectedUid` and the inherited `SystemdUnit` command options.
+
+With `killMode: 'mixed'`, the main process owns graceful child shutdown and must
+remain alive until its children have joined. Systemd sends SIGTERM to the main
+process first and can send SIGKILL to the whole cgroup when the main process exits
+or the stop deadline expires. `control-group` sends the initial signal to the
+whole group. A successful systemd start still requires application readiness
+verification, and a completed stop alone does not prove database drain.
+
 ### SmartDaemonService Class
 
 ```typescript

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdaemon',
-  version: '2.3.1',
+  version: '2.4.1',
   description: 'Start scripts as long running daemons and manage them.'
 }

package/ts/classes.systemdservicedefinition.ts

@@ -0,0 +1,134 @@
+import * as plugins from './smartdaemon.plugins.js';
+
+export interface ISystemdServiceDefinitionOptions {
+  unitName: string;
+  description: string;
+  executable: string;
+  args: readonly string[];
+  workingDirectory: string;
+  user: string;
+  group: string;
+  restart: 'no' | 'on-failure' | 'always';
+  killMode: 'mixed' | 'control-group';
+  timeoutStopSeconds: number;
+}
+
+export class SystemdServiceDefinitionError extends Error {
+  constructor() {
+    super('Invalid direct systemd service definition.');
+    this.name = 'SystemdServiceDefinitionError';
+  }
+}
+
+/** Literal direct-execution definition; never introduces a shell or environment expansion. */
+export class SystemdServiceDefinition {
+  public readonly unitName: string;
+  public readonly content: string;
+  public readonly sha256: string;
+
+  constructor(options: ISystemdServiceDefinitionOptions) {
+    const requireValue = (value: unknown): void => {
+      if (!value) throw new SystemdServiceDefinitionError();
+    };
+    const text = (value: unknown, maximum = 4096): value is string =>
+      typeof value === 'string' && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value) &&
+      !/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u.test(value);
+    const absolute = (value: unknown) =>
+      text(value) && plugins.path.isAbsolute(value) &&
+      plugins.path.normalize(value) === value;
+    const keys = [
+      'unitName',
+      'description',
+      'executable',
+      'args',
+      'workingDirectory',
+      'user',
+      'group',
+      'restart',
+      'killMode',
+      'timeoutStopSeconds',
+    ];
+    requireValue(
+      options && Object.getPrototypeOf(options) === Object.prototype &&
+        Reflect.ownKeys(options).length === keys.length && keys.every((key) => {
+          const descriptor = Object.getOwnPropertyDescriptor(options, key);
+          return descriptor && 'value' in descriptor;
+        }),
+    );
+    requireValue(
+      typeof options.unitName === 'string' &&
+        /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,230}\.service$/.test(options.unitName),
+    );
+    requireValue(
+      text(options.description, 1024) && options.description.length > 0 &&
+        options.description.trim() === options.description && !options.description.includes('\\'),
+    );
+    requireValue(
+      absolute(options.executable) && options.executable !== '/' &&
+        !/[\\"']/.test(options.executable) && !options.executable.endsWith('/') &&
+        absolute(options.workingDirectory) &&
+        options.workingDirectory.trim() === options.workingDirectory &&
+        !options.workingDirectory.includes('\\'),
+    );
+    requireValue(
+      Array.isArray(options.args) && Object.getPrototypeOf(options.args) === Array.prototype &&
+        options.args.length <= 128 &&
+        Reflect.ownKeys(options.args).length === options.args.length + 1 &&
+        Array.from(
+          { length: options.args.length },
+          (_, index) => Object.getOwnPropertyDescriptor(options.args, String(index)),
+        )
+          .every((descriptor) => descriptor && 'value' in descriptor && text(descriptor.value)),
+    );
+    requireValue(
+      [options.user, options.group].every((value) =>
+        typeof value === 'string' && /^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/.test(value)
+      ),
+    );
+    requireValue(
+      ['no', 'on-failure', 'always'].includes(options.restart) &&
+        ['mixed', 'control-group'].includes(options.killMode) &&
+        Number.isSafeInteger(options.timeoutStopSeconds) &&
+        options.timeoutStopSeconds >= 1 && options.timeoutStopSeconds <= 600,
+    );
+    // Quoting and percent/dollar escaping follow systemd.syntax and systemd.service.
+    const quote = (value: string, command = false) =>
+      '"' + value
+        .replaceAll('\\', '\\\\').replaceAll('"', '\\"').replaceAll('%', '%%')
+        .replaceAll('$', () => command ? '$$' : '$') +
+      '"';
+    this.unitName = options.unitName;
+    this.content = [
+      '[Unit]',
+      `Description=${options.description.replaceAll('%', '%%')}`,
+      'After=local-fs.target',
+      '',
+      '[Service]',
+      'Type=exec',
+      `User=${options.user}`,
+      `Group=${options.group}`,
+      `ExecStart=${
+        [quote(options.executable), ...options.args.map((value) => quote(value, true))].join(' ')
+      }`,
+      // WorkingDirectory is a raw path value, not an ExecStart word list.
+      `WorkingDirectory=${options.workingDirectory.replaceAll('%', '%%')}`,
+      `Restart=${options.restart}`,
+      `KillMode=${options.killMode}`,
+      'KillSignal=SIGTERM',
+      'FinalKillSignal=SIGKILL',
+      'SendSIGKILL=yes',
+      'SendSIGHUP=no',
+      `TimeoutStopSec=${options.timeoutStopSeconds}s`,
+      'StandardInput=null',
+      'StandardOutput=journal',
+      'StandardError=journal',
+      '',
+      '[Install]',
+      'WantedBy=multi-user.target',
+      '',
+    ].join('\n');
+    requireValue(Buffer.byteLength(this.content) <= 16384);
+    this.sha256 = plugins.crypto.createHash('sha256').update(this.content).digest('hex');
+    Object.freeze(this);
+  }
+}

package/ts/classes.systemdunit.ts

@@ -22,6 +22,14 @@ export interface ISystemdUnitState {
   readonly job: string;
 }
 
+export interface ISystemdUnitConfigurationState {
+  readonly unitName: string;
+  readonly fragmentPath: string;
+  /** Opaque systemctl path list. An empty value proves no effective drop-ins. */
+  readonly dropInPaths: string;
+  readonly needsReload: boolean;
+}
+
 export class SystemdUnitError extends Error {
   constructor(public readonly code: 'invalid_options' | 'command_failed' | 'invalid_state') {
     super(`Systemd unit operation failed: ${code}.`);
@@ -111,6 +119,36 @@ export class SystemdUnit {
     return this.inspect();
   }
 
+  /** Reports the manager's selected definition without reading or changing its contents. */
+  public async inspectConfiguration(): Promise<ISystemdUnitConfigurationState> {
+    const keys = ['Id', 'FragmentPath', 'DropInPaths', 'NeedDaemonReload'];
+    const stdout = await this.command(['show', this.unitName, `--property=${keys.join(',')}`, '--all']);
+    const fields = new Map<string, string>();
+    for (const line of stdout.trimEnd().split('\n')) {
+      const separator = line.indexOf('='), key = line.slice(0, separator);
+      if (separator < 1 || !keys.includes(key) || fields.has(key)) {
+        throw new SystemdUnitError('invalid_state');
+      }
+      fields.set(key, line.slice(separator + 1));
+    }
+    if (fields.size !== keys.length || fields.get('Id') !== this.unitName ||
+      !['yes', 'no'].includes(fields.get('NeedDaemonReload')!)) {
+      throw new SystemdUnitError('invalid_state');
+    }
+    return Object.freeze({
+      unitName: this.unitName,
+      fragmentPath: fields.get('FragmentPath')!,
+      dropInPaths: fields.get('DropInPaths')!,
+      needsReload: fields.get('NeedDaemonReload') === 'yes',
+    });
+  }
+
+  /** Reloads unit definitions globally; does not enable, unmask, start or stop a unit. */
+  public async reloadConfiguration(): Promise<ISystemdUnitConfigurationState> {
+    await this.command(['daemon-reload']);
+    return this.inspectConfiguration();
+  }
+
   private command(argsArg: string[]): Promise<string> {
     return new Promise((resolve, reject) => {
       plugins.childProcess.execFile(

package/ts/classes.systemdunitfile.ts

@@ -0,0 +1,327 @@
+import * as plugins from './smartdaemon.plugins.js';
+import { SystemdServiceDefinition } from './classes.systemdservicedefinition.js';
+import {
+  type ISystemdUnitOptions,
+  type ISystemdUnitConfigurationState,
+  type ISystemdUnitState,
+  SystemdUnit,
+} from './classes.systemdunit.js';
+
+export interface ISystemdUnitFileOptions extends ISystemdUnitOptions {
+  /** Local vendor definitions can be installed without removing an administrator's mask. */
+  unitDirectory?: string;
+  /** Trusted owning-code qualification only. Defaults to root. */
+  expectedUid?: number;
+}
+export interface ISystemdUnitFileRecord {
+  readonly path: string;
+  readonly sha256: string;
+}
+export class SystemdUnitFileError extends Error {
+  constructor(
+    public readonly code:
+      | 'invalid_options'
+      | 'unsafe_path'
+      | 'busy'
+      | 'changed'
+      | 'unsafe_unit'
+      | 'write_failed'
+      | 'reload_failed',
+  ) {
+    super(`Systemd unit definition installation failed: ${code}.`);
+    this.name = 'SystemdUnitFileError';
+  }
+}
+const requireValue = (value: unknown, code: SystemdUnitFileError['code']): void => {
+  if (!value) throw new SystemdUnitFileError(code);
+};
+const digest = (bytes: Uint8Array) =>
+  plugins.crypto.createHash('sha256').update(bytes).digest('hex');
+const quiet = (state: ISystemdUnitState) =>
+  state.mainPid === 0 && state.controlPid === 0 &&
+  state.controlGroup === '' && state.job === '' &&
+  (state.activeState === 'inactive' && state.subState === 'dead' ||
+    state.activeState === 'failed' && state.subState === 'failed');
+const masked = (state: ISystemdUnitState) =>
+  state.loadState === 'masked' &&
+  ['masked', 'masked-runtime'].includes(state.unitFileState);
+const sameFile = (left: { dev: number; ino: number }, right: { dev: number; ino: number }) =>
+  left.dev === right.dev && left.ino === right.ino;
+
+/**
+ * Protected code/config installation, inside the caller's cross-process installation ownership scope.
+ * Other privileged writers must be serialized by that owner. Never changes enablement or masks.
+ */
+export class SystemdUnitFile {
+  public readonly path: string;
+  private readonly directory: string;
+  private readonly uid: number;
+  private readonly unit: SystemdUnit;
+  private readonly name: string;
+  private busy = false;
+
+  constructor(options: ISystemdUnitFileOptions) {
+    this.unit = new SystemdUnit(options);
+    this.name = options.unitName;
+    this.directory = options.unitDirectory ?? '/usr/local/lib/systemd/system';
+    this.uid = options.expectedUid ?? 0;
+    requireValue(
+      typeof this.directory === 'string' && this.directory !== '/' &&
+        plugins.path.isAbsolute(this.directory) &&
+        plugins.path.normalize(this.directory) === this.directory &&
+        !this.directory.endsWith('/') && !/[\x00-\x1f\x7f]/.test(this.directory) &&
+        this.directory.length <= 4000 && Number.isSafeInteger(this.uid) && this.uid >= 0,
+      'invalid_options',
+    );
+    this.path = plugins.path.join(this.directory, this.name);
+  }
+
+  /** Reads only the exact protected definition; no systemd or filesystem mutation. */
+  public async inspect(): Promise<ISystemdUnitFileRecord | null> {
+    if (!await this.directories(false)) return null;
+    const file = await this.read(this.path);
+    return file ? Object.freeze({ path: this.path, sha256: digest(file.bytes) }) : null;
+  }
+
+  /**
+   * Expected previous digest is mandatory; null admits an absent file. Exact desired bytes are idempotent.
+   * Retains changed definitions beside the unit before replacement. A failed reload never rolls code back.
+   */
+  public async install(
+    definition: SystemdServiceDefinition,
+    expectedSha256: string | null,
+  ): Promise<Readonly<{ changed: boolean; record: ISystemdUnitFileRecord; masked: boolean }>> {
+    requireValue(
+      definition instanceof SystemdServiceDefinition && definition.unitName === this.name &&
+        (expectedSha256 === null ||
+          typeof expectedSha256 === 'string' && /^[a-f0-9]{64}$/.test(expectedSha256)),
+      'invalid_options',
+    );
+    requireValue(!this.busy, 'busy');
+    this.busy = true;
+    let temporary: string | undefined;
+    let temporaryInfo: plugins.Stats | undefined;
+    try {
+      const before = await this.unit.inspect();
+      const beforeConfiguration = await this.admit(before);
+      await this.directories(true);
+      const parent = await plugins.fs.lstat(this.directory);
+      const previous = await this.read(this.path);
+      const previousSha = previous ? digest(previous.bytes) : null;
+      const changed = previousSha !== definition.sha256;
+      requireValue(!changed || previousSha === expectedSha256, 'changed');
+      if (changed) {
+        if (previous) {
+          const backup = `${this.path}.previous-${previousSha}`;
+          try {
+            await this.create(backup, previous.bytes);
+          } catch (error) {
+            if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+            requireValue(digest((await this.read(backup))!.bytes) === previousSha, 'changed');
+          }
+          await this.flushDirectory(parent);
+        }
+        temporary = plugins.path.join(
+          this.directory,
+          `.${this.name}.${plugins.crypto.randomUUID()}.tmp`,
+        );
+        await this.create(temporary, Buffer.from(definition.content));
+        temporaryInfo = await plugins.fs.lstat(temporary);
+        const current = await this.read(this.path);
+        requireValue(
+          (current ? digest(current.bytes) : null) === previousSha &&
+            (!current || previous && sameFile(current.info, previous.info)),
+          'changed',
+        );
+        requireValue(sameFile(parent, await plugins.fs.lstat(this.directory)), 'unsafe_path');
+        const rechecked = await this.unit.inspect();
+        requireValue(JSON.stringify(rechecked) === JSON.stringify(before), 'changed');
+        const recheckedConfiguration = await this.admit(rechecked);
+        requireValue(
+          recheckedConfiguration.fragmentPath === beforeConfiguration.fragmentPath,
+          'changed',
+        );
+        await plugins.fs.rename(temporary, this.path);
+        temporary = undefined;
+        await this.flushDirectory(parent);
+      }
+      try {
+        const reloadedConfiguration = await this.unit.reloadConfiguration();
+        const after = await this.unit.inspect();
+        requireValue(
+          quiet(after) &&
+            (before.loadState === 'not-found'
+              ? after.loadState === 'loaded' && after.unitFileState === 'disabled'
+              : after.loadState === before.loadState &&
+                after.unitFileState === before.unitFileState),
+          'changed',
+        );
+        const configuration = await this.unit.inspectConfiguration();
+        requireValue(
+          [reloadedConfiguration, configuration].every((snapshot) =>
+            !snapshot.needsReload && snapshot.dropInPaths === '' &&
+            snapshot.fragmentPath ===
+              (masked(after) ? beforeConfiguration.fragmentPath : this.path)
+          ),
+          'unsafe_unit',
+        );
+        const installed = await this.inspect();
+        requireValue(installed?.sha256 === definition.sha256, 'changed');
+        return Object.freeze({ changed, record: installed!, masked: masked(after) });
+      } catch {
+        throw new SystemdUnitFileError('reload_failed');
+      }
+    } catch (error) {
+      if (error instanceof SystemdUnitFileError) throw error;
+      throw new SystemdUnitFileError('write_failed');
+    } finally {
+      try {
+        if (temporary && temporaryInfo) {
+          const named = await plugins.fs.lstat(temporary);
+          requireValue(sameFile(temporaryInfo, named), 'unsafe_path');
+          await plugins.fs.unlink(temporary);
+        }
+      } finally {
+        this.busy = false;
+      }
+    }
+  }
+
+  private async admit(state: ISystemdUnitState): Promise<ISystemdUnitConfigurationState> {
+    requireValue(
+      quiet(state) && (masked(state) ||
+        state.loadState === 'loaded' &&
+          ['enabled', 'enabled-runtime', 'disabled'].includes(state.unitFileState) ||
+        state.loadState === 'not-found' && state.unitFileState === ''),
+      'unsafe_unit',
+    );
+    const configuration = await this.unit.inspectConfiguration();
+    const maskPath = plugins.path.join(
+      state.unitFileState === 'masked-runtime' ? '/run/systemd/system' : '/etc/systemd/system',
+      this.name,
+    );
+    requireValue(
+      !configuration.needsReload && configuration.dropInPaths === '' &&
+        (masked(state)
+          ? configuration.fragmentPath !== this.path &&
+            ['/dev/null', maskPath].includes(configuration.fragmentPath)
+          : configuration.fragmentPath === (state.loadState === 'not-found' ? '' : this.path)),
+      'unsafe_unit',
+    );
+    return configuration;
+  }
+
+  private async directories(create: boolean): Promise<boolean> {
+    requireValue(process.platform === 'linux' && process.getuid?.() === this.uid, 'unsafe_path');
+    let directory = '/';
+    for (const part of this.directory.split('/').filter(Boolean)) {
+      directory = plugins.path.join(directory, part);
+      let info: plugins.Stats;
+      try {
+        info = await plugins.fs.lstat(directory);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+        if (!create) return false;
+        await plugins.fs.mkdir(directory, { mode: 0o755 });
+        const parent = await plugins.fs.open(
+          plugins.path.dirname(directory),
+          plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_DIRECTORY |
+            plugins.fsConstants.O_NOFOLLOW,
+        );
+        try {
+          await parent.sync();
+        } finally {
+          await parent.close();
+        }
+        info = await plugins.fs.lstat(directory);
+      }
+      requireValue(
+        info.isDirectory() && !info.isSymbolicLink() && [0, this.uid].includes(info.uid) &&
+          ((info.mode & 0o022) === 0 || directory === '/tmp' && info.uid === 0 &&
+              (info.mode & 0o7777) === 0o1777),
+        'unsafe_path',
+      );
+    }
+    return true;
+  }
+
+  private async read(path: string): Promise<{ bytes: Buffer; info: plugins.Stats } | null> {
+    let file: Awaited<ReturnType<typeof plugins.fs.open>>;
+    try {
+      file = await plugins.fs.open(
+        path,
+        plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_NOFOLLOW |
+          plugins.fsConstants.O_NONBLOCK,
+      );
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+      throw new SystemdUnitFileError('unsafe_path');
+    }
+    try {
+      const info = await file.stat();
+      requireValue(
+        info.isFile() && info.uid === this.uid && info.nlink === 1 &&
+          (info.mode & 0o7777) === 0o644 && info.size <= 16384,
+        'unsafe_path',
+      );
+      const bytes = Buffer.alloc(16385);
+      let size = 0;
+      for (;;) {
+        const result = await file.read(bytes, size, bytes.length - size, size);
+        if (result.bytesRead === 0) break;
+        size += result.bytesRead;
+        requireValue(size <= 16384, 'unsafe_path');
+      }
+      const after = await file.stat(), named = await plugins.fs.lstat(path);
+      requireValue(
+        sameFile(info, named) && !named.isSymbolicLink() && after.size === size &&
+          info.size === after.size && info.mtimeMs === after.mtimeMs &&
+          info.ctimeMs === after.ctimeMs,
+        'changed',
+      );
+      return { bytes: bytes.subarray(0, size), info };
+    } finally {
+      await file.close();
+    }
+  }
+
+  private async create(path: string, bytes: Uint8Array): Promise<void> {
+    const file = await plugins.fs.open(
+      path,
+      plugins.fsConstants.O_CREAT | plugins.fsConstants.O_EXCL |
+        plugins.fsConstants.O_WRONLY | plugins.fsConstants.O_NOFOLLOW,
+      0o644,
+    );
+    let created: plugins.Stats | undefined;
+    try {
+      try {
+        created = await file.stat();
+        await file.chmod(0o644);
+        await file.writeFile(bytes);
+        await file.sync();
+      } finally {
+        await file.close();
+      }
+    } catch (error) {
+      if (created) {
+        requireValue(sameFile(created, await plugins.fs.lstat(path)), 'unsafe_path');
+        await plugins.fs.unlink(path);
+      }
+      throw error;
+    }
+  }
+
+  private async flushDirectory(expected: plugins.Stats): Promise<void> {
+    const directory = await plugins.fs.open(
+      this.directory,
+      plugins.fsConstants.O_RDONLY |
+        plugins.fsConstants.O_DIRECTORY | plugins.fsConstants.O_NOFOLLOW,
+    );
+    try {
+      requireValue(sameFile(expected, await directory.stat()), 'unsafe_path');
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  }
+}

package/ts/index.ts

@@ -1,3 +1,5 @@
 export * from './smartdaemon.classes.smartdaemon.js';
 export * from './smartdaemon.classes.service.js';
 export * from './classes.systemdunit.js';
+export * from './classes.systemdservicedefinition.js';
+export * from './classes.systemdunitfile.js';

package/ts/smartdaemon.plugins.ts

@@ -1,8 +1,12 @@
 // node native scope
 import * as path from 'path';
 import * as childProcess from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as crypto from 'node:crypto';
+export type { Stats } from 'node:fs';
 
-export { path, childProcess };
+export { path, childProcess, fs, fsConstants, crypto };
 
 // @pushrocks scope
 import * as lik from '@push.rocks/lik';