@appforge-ci/admin-cli 0.3.13 → 0.3.15

package/dist/lib/vm-user-apply.test.js

@@ -0,0 +1,272 @@
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { AGENT_DAEMON_PLIST, KCPASSWORD_PATH, LOGINWINDOW_PREFS, applyRefusals, applyVmUser, kcpasswordBytes, runnerLaunchAgentAccounts, helperAgentPlist, HELPER_AGENT_LABEL, } from "./vm-user-apply.js";
+const SECRET = "S3cretRandomPassw0rdForTests1234"; // 32 chars; the real generator makes 31
+function world(over = {}) {
+    return {
+        users: new Set(["tooming", "ci-runner"]),
+        autoLogin: "ci-runner",
+        plist: {},
+        files: {},
+        dirs: { "/Users": ["Shared", "tooming", "ci-runner"], "/Users/ci-runner": ["actions-runner"] },
+        sysadminctlWorks: true,
+        sudoUser: "tooming",
+        euid: 0,
+        agentPlistPresent: true,
+        fileVault: "FileVault is Off.\n",
+        battery: "Now drawing from 'AC Power'\n",
+        ...over,
+    };
+}
+function fake(w) {
+    const calls = [];
+    const logs = [];
+    const tried = [];
+    const secretCalls = [];
+    const written = [];
+    const ownedWrites = [];
+    const deps = {
+        userExists: (u) => w.users.has(u),
+        listUserUids: () => "tooming 501\nci-runner 502\n",
+        run: (cmd, args) => {
+            calls.push(`${cmd} ${args.join(" ")}`);
+            if (cmd === "defaults" && args[0] === "write" && args[2] === "autoLoginUser")
+                w.autoLogin = args[4];
+            if (cmd === "plutil" && args[0] === "-replace")
+                w.plist[args[1].replace("EnvironmentVariables.", "")] = args[3];
+            if (cmd === "sudo" && args[0] === "dscl" && args.includes("UniqueID"))
+                w.users.add(args[2].split("/")[2]);
+        },
+        tryRun: (cmd, args) => {
+            tried.push(`${cmd} ${args.join(" ")}`);
+            return true;
+        },
+        exists: () => false,
+        mkdirp: () => { },
+        log: (l) => logs.push(l),
+        arch: "arm64",
+        platform: "darwin",
+        capture: (cmd, args) => {
+            const key = `${cmd} ${args.join(" ")}`;
+            if (key === "/usr/bin/pmset -g batt")
+                return w.battery;
+            if (key === "/usr/bin/fdesetup status")
+                return w.fileVault;
+            if (cmd === "/usr/bin/defaults" && args[2] === "autoLoginUser")
+                return w.autoLogin ? `${w.autoLogin}\n` : null;
+            if (cmd === "/usr/bin/plutil" && args[0] === "-extract" && args[1] === "ProgramArguments.0")
+                return "/opt/homebrew/bin/node\n";
+            if (cmd === "/usr/bin/plutil" && args[0] === "-extract")
+                return w.plist[args[1].replace("EnvironmentVariables.", "")] ?? null;
+            return null;
+        },
+        euid: () => w.euid,
+        sudoUser: () => w.sudoUser,
+        readText: (p) => (p === AGENT_DAEMON_PLIST ? (w.agentPlistPresent ? "<plist/>" : null) : (w.files[p] ?? null)),
+        listDir: (p) => w.dirs[p] ?? null,
+        randomPassword: () => SECRET,
+        runSecret: (cmd, args, label) => {
+            secretCalls.push({ cmd, args, label });
+            if (cmd === "dscl")
+                w.users.add(args[2].split("/")[2]);
+            if (cmd === "sysadminctl") {
+                if (!w.sysadminctlWorks)
+                    throw new Error("sysadminctl failed");
+                w.autoLogin = args[3];
+            }
+        },
+        writeSecretFile: (path, data) => void written.push({ path, data }),
+        writeOwnedText: (path, text, owner, group) => {
+            ownedWrites.push({ path, text, owner, group });
+            w.files[path] = text;
+        },
+    };
+    return { deps, calls, tried, logs, secretCalls, written, ownedWrites };
+}
+test("kcpasswordBytes is the fixed XOR encoding, zero-padded to a multiple of 12", () => {
+    assert.equal(kcpasswordBytes("abc").toString("hex"), "1ceb3123d2bcddeaa3b91f7d");
+    assert.equal(kcpasswordBytes("a".repeat(12)).length, 12);
+    assert.equal(kcpasswordBytes("a".repeat(31)).length, 36);
+});
+test("runnerLaunchAgentAccounts finds runners that are LaunchAgents, from each runner dir's .service file", () => {
+    const w = world({ files: { "/Users/ci-runner/actions-runner/.service": "/Users/ci-runner/Library/LaunchAgents/actions.runner.x.plist\n" } });
+    assert.deepEqual(runnerLaunchAgentAccounts(fake(w).deps), ["ci-runner"]);
+    const daemon = world({ files: { "/Users/ci-runner/actions-runner/.service": "/Library/LaunchDaemons/actions.runner.x.plist\n" } });
+    assert.deepEqual(runnerLaunchAgentAccounts(fake(daemon).deps), []);
+});
+test("refuses, naming each reason: not root, no agent account, agent not a daemon, a runner LaunchAgent that would be orphaned", () => {
+    const w = world({
+        euid: 501,
+        sudoUser: null,
+        agentPlistPresent: false,
+        files: { "/Users/ci-runner/actions-runner/.service": "/Users/ci-runner/Library/LaunchAgents/actions.runner.x.plist" },
+    });
+    const reasons = applyRefusals({ user: "appforge-vm" }, fake(w).deps).join(" | ");
+    assert.match(reasons, /has to run as root/);
+    assert.match(reasons, /cannot tell which account runs the agent/);
+    assert.match(reasons, /not installed as a boot-time LaunchDaemon/);
+    assert.match(reasons, /a GitHub Actions runner is a LaunchAgent of ci-runner/);
+    assert.match(reasons, /appforge-ci#780/);
+    const f = fake(w);
+    assert.throws(() => applyVmUser({ user: "appforge-vm" }, f.deps), /^Error: refused:/);
+    assert.deepEqual(f.calls, [], "a refusal changes nothing");
+    assert.deepEqual(f.secretCalls, []);
+});
+test("a laptop and FileVault on refuse, as the print-only command does", () => {
+    const reasons = applyRefusals({ user: "appforge-vm" }, fake(world({ fileVault: "FileVault is On.\n", battery: "Battery Power\n -InternalBattery-0" })).deps).join(" | ");
+    assert.match(reasons, /FileVault is on/);
+    assert.match(reasons, /has a battery/);
+});
+test("a first run creates the account, sets the random password and auto-login, makes the folder, sets the knobs and restarts the agent", () => {
+    const w = world();
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.ok(f.calls.some((c) => c.includes("dscl . -create /Users/appforge-vm UniqueID 503")), "the account is created");
+    assert.equal(f.secretCalls[0].cmd, "dscl");
+    assert.deepEqual(f.secretCalls[0].args, [".", "-passwd", "/Users/appforge-vm", SECRET]);
+    assert.equal(f.secretCalls[1].cmd, "sysadminctl");
+    assert.equal(w.autoLogin, "appforge-vm");
+    assert.deepEqual(f.written, [], "sysadminctl worked, so kcpassword is not written by hand");
+    assert.ok(f.calls.includes("install -d -o tooming -g appforge-vm -m 770 /Users/Shared/appforge"));
+    assert.equal(w.plist.APPFORGE_STATUS_MIRROR_DIR, "/Users/Shared/appforge");
+    assert.equal(w.plist.APPFORGE_VM_INVENTORY_FILE, "/Users/Shared/appforge/inventory.json");
+    assert.equal(w.plist.APPFORGE_VM_TOOLING_DIR, "/Users/Shared/appforge", "the agent is told to deliver the signed VM tooling there");
+    // launchd keeps the job it loaded, so a plist edit needs the job reloaded; kickstart -k would restart it with the OLD environment
+    assert.deepEqual(f.tried.filter((c) => c.startsWith("launchctl")), ["launchctl bootout system/com.appforge.agent", "launchctl bootstrap system /Library/LaunchDaemons/com.appforge.agent.plist"]);
+    assert.ok(!f.calls.some((c) => c.includes("kickstart")), "kickstart does not re-read the plist");
+    assert.match(f.logs.join("\n"), /Reboot to start the helper's session/);
+    assert.equal(f.ownedWrites.length, 1);
+    assert.equal(f.ownedWrites[0].path, `/Users/appforge-vm/Library/LaunchAgents/${HELPER_AGENT_LABEL}.plist`);
+    assert.equal(f.ownedWrites[0].owner, "appforge-vm", "the helper owns its own LaunchAgent so launchd loads it at its login");
+    assert.ok(f.calls.includes("install -d -o appforge-vm -g appforge-vm -m 755 /Users/appforge-vm/.appforge-infra"));
+});
+test("when the agent's job cannot be loaded again, the apply says the agent is NOT running and fails loudly", () => {
+    const w = world();
+    const f = fake(w);
+    let bootstraps = 0;
+    const realTry = f.deps.tryRun;
+    f.deps.tryRun = (cmd, args) => {
+        realTry(cmd, args);
+        if (cmd === "launchctl" && args[0] === "bootstrap") {
+            bootstraps++;
+            return false;
+        }
+        return true;
+    };
+    f.deps.run = (cmd, args) => {
+        if (cmd === "launchctl" && args[0] === "bootstrap")
+            throw new Error("Bootstrap failed: 5: Input/output error");
+    };
+    const deps = { ...f.deps, run: f.deps.run };
+    assert.throws(() => applyVmUser({ user: "appforge-vm", agentUser: "tooming" }, deps), /Bootstrap failed/);
+    assert.equal(bootstraps, 5, "it retried before giving up (bootout can still be settling)");
+    assert.match(f.logs.join("\n"), /the agent is NOT running: run `sudo launchctl bootstrap system \/Library\/LaunchDaemons\/com\.appforge\.agent\.plist`/);
+});
+test("the generated password is never echoed or logged: only the secret runner sees it, and its label hides it", () => {
+    const f = fake(world());
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.equal(f.logs.join("\n").includes(SECRET), false);
+    assert.equal(f.calls.join("\n").includes(SECRET), false);
+    for (const s of f.secretCalls)
+        assert.equal(s.label.includes(SECRET), false);
+    assert.match(f.secretCalls[0].label, /<random password, not shown>/);
+});
+test("when sysadminctl cannot set auto-login, /etc/kcpassword and the loginwindow preference are written instead, and read back", () => {
+    const w = world({ sysadminctlWorks: false });
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.equal(f.written.length, 1);
+    assert.equal(f.written[0].path, KCPASSWORD_PATH);
+    assert.deepEqual(f.written[0].data, kcpasswordBytes(SECRET));
+    assert.ok(f.calls.includes(`defaults write ${LOGINWINDOW_PREFS} autoLoginUser -string appforge-vm`));
+    assert.equal(w.autoLogin, "appforge-vm");
+    assert.match(f.logs.join("\n"), /writing \/etc\/kcpassword/);
+});
+test("if auto-login still does not read back as the helper, the run fails loudly instead of claiming success", () => {
+    const w = world({ sysadminctlWorks: false });
+    const f = fake(w);
+    f.deps.run = (cmd, args) => void f.calls.push(`${cmd} ${args.join(" ")}`); // the preference write is ignored
+    assert.throws(() => applyVmUser({ user: "appforge-vm" }, f.deps), /auto-login for 'appforge-vm' did not stick/);
+});
+test("re-running when everything is already true changes nothing and never touches the password", () => {
+    const w = world({
+        users: new Set(["tooming", "ci-runner", "appforge-vm"]),
+        autoLogin: "appforge-vm",
+        plist: { APPFORGE_STATUS_MIRROR_DIR: "/Users/Shared/appforge", APPFORGE_VM_INVENTORY_FILE: "/Users/Shared/appforge/inventory.json", APPFORGE_VM_TOOLING_DIR: "/Users/Shared/appforge" },
+    });
+    w.files[`/Users/appforge-vm/Library/LaunchAgents/${HELPER_AGENT_LABEL}.plist`] = helperAgentPlist({ shareDir: "/Users/Shared/appforge", nodePath: "/opt/homebrew/bin/node", home: "/Users/appforge-vm" });
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.deepEqual(f.secretCalls, [], "no password is set for an existing account");
+    assert.deepEqual(f.ownedWrites, [], "an identical LaunchAgent is not rewritten");
+    assert.deepEqual(f.written, []);
+    assert.equal(f.calls.some((c) => c.includes("-create") || c.startsWith("plutil") || c.startsWith("launchctl")), false);
+    assert.match(f.logs.join("\n"), /already the auto-login account/);
+    assert.match(f.logs.join("\n"), /already set/);
+});
+test("an existing account that is not the auto-login account is left alone and the run warns, unless --reset-password", () => {
+    const w = world({ users: new Set(["tooming", "ci-runner", "appforge-vm"]) });
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.deepEqual(f.secretCalls, []);
+    assert.equal(w.autoLogin, "ci-runner");
+    assert.match(f.logs.join("\n"), /auto-login is NOT set/);
+    assert.match(f.logs.join("\n"), /WARNING: 'appforge-vm' is NOT the auto-login account/);
+    const w2 = world({ users: new Set(["tooming", "ci-runner", "appforge-vm"]) });
+    const f2 = fake(w2);
+    applyVmUser({ user: "appforge-vm", resetPassword: true }, f2.deps);
+    assert.equal(f2.secretCalls[0].cmd, "dscl");
+    assert.equal(w2.autoLogin, "appforge-vm");
+});
+test("--dry-run prints every step and changes nothing", () => {
+    const w = world();
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm", dryRun: true }, f.deps);
+    assert.deepEqual(f.calls, []);
+    assert.deepEqual(f.secretCalls, []);
+    assert.deepEqual(f.written, []);
+    assert.equal(w.autoLogin, "ci-runner");
+    const out = f.logs.join("\n");
+    assert.match(out, /DRY RUN: nothing will be changed/);
+    assert.match(out, /\[1\/5\] create the 'appforge-vm' account/);
+    assert.match(out, /\[4\/5\] add the mirror knobs/);
+    assert.match(out, /Dry run finished/);
+});
+test("the agent account comes from --agent-user when given, else from the sudo user", () => {
+    const f = fake(world({ sudoUser: null }));
+    applyVmUser({ user: "appforge-vm", agentUser: "tooming" }, f.deps);
+    assert.ok(f.calls.includes("install -d -o tooming -g appforge-vm -m 770 /Users/Shared/appforge"));
+});
+test("the helper's LaunchAgent runs the delivered bundle with an auto host name, the agent's node, and the shared-folder wiring", () => {
+    const plist = helperAgentPlist({ shareDir: "/Users/Shared/appforge", nodePath: "/opt/homebrew/bin/node", home: "/Users/appforge-vm" });
+    assert.match(plist, /<string>com\.appforge\.vm-reconcile<\/string>/);
+    assert.match(plist, /\[ -f "\$0" \] \|\| exit 0; exec \/bin\/bash "\$0" "\$1" auto/, "quiet until the first bundle is delivered, host derived on the Mac");
+    assert.match(plist, /<string>\/Users\/Shared\/appforge\/vm-tooling\/current\/reconcile-bundle\.sh<\/string>/);
+    assert.match(plist, /<key>APPFORGE_NODE<\/key>\s*<string>\/opt\/homebrew\/bin\/node<\/string>/);
+    assert.match(plist, /<key>APPFORGE_AGENT_STATUS<\/key>\s*<string>\/Users\/Shared\/appforge\/status\.json<\/string>/);
+    assert.match(plist, /<key>APPFORGE_INVENTORY_MIRROR_DIR<\/key>\s*<string>\/Users\/Shared\/appforge<\/string>/);
+    assert.match(plist, /<key>StartInterval<\/key>\s*<integer>300<\/integer>/);
+    assert.match(plist, /<string>\/Users\/appforge-vm\/\.appforge-infra\/reconcile\.log<\/string>/);
+    assert.equal(plist.includes("git"), false, "no git and no credential anywhere in it");
+    assert.match(helperAgentPlist({ shareDir: "/Users/Shared/a&b", nodePath: "/n<ode", home: "/Users/x" }), /a&amp;b[\s\S]*\/n&lt;ode/, "paths are XML-escaped");
+});
+test("the LaunchAgent is installed on a first run, using the node found in the agent's own LaunchDaemon, and a changed definition is rewritten", () => {
+    const w = world();
+    const f = fake(w);
+    applyVmUser({ user: "appforge-vm" }, f.deps);
+    assert.match(f.ownedWrites[0].text, /<key>APPFORGE_NODE<\/key>\s*<string>\/opt\/homebrew\/bin\/node<\/string>/);
+    // a stale definition on disk is replaced
+    const w2 = world({ users: new Set(["tooming", "ci-runner", "appforge-vm"]), autoLogin: "appforge-vm" });
+    w2.files[`/Users/appforge-vm/Library/LaunchAgents/${HELPER_AGENT_LABEL}.plist`] = "<plist>old</plist>";
+    const f2 = fake(w2);
+    applyVmUser({ user: "appforge-vm" }, f2.deps);
+    assert.equal(f2.ownedWrites.length, 1);
+});
+test("--dry-run writes no LaunchAgent either", () => {
+    const f = fake(world());
+    applyVmUser({ user: "appforge-vm", dryRun: true }, f.deps);
+    assert.deepEqual(f.ownedWrites, []);
+    assert.match(f.logs.join("\n"), /\[5\/5\] install the helper's reconcile LaunchAgent/);
+});
+//# sourceMappingURL=vm-user-apply.test.js.map

package/dist/lib/vm-user-apply.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-user-apply.test.js","sourceRoot":"","sources":["../../src/lib/vm-user-apply.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,GAAG,kCAAkC,CAAC,CAAC,wCAAwC;AAgB3F,SAAS,KAAK,CAAC,OAAuB,EAAE;IACtC,OAAO;QACL,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxC,SAAS,EAAE,WAAW;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,EAAE;QAC9F,gBAAgB,EAAE,IAAI;QACtB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,CAAC;QACP,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,+BAA+B;QACxC,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,CAAQ;IACpB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAqD,EAAE,CAAC;IACzE,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,MAAM,WAAW,GAAmE,EAAE,CAAC;IACvF,MAAM,IAAI,GAAoB;QAC5B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;QAClD,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;gBAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrG,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;gBAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YAClH,IAAI,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;QAChB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,GAAG,KAAK,wBAAwB;gBAAE,OAAO,CAAC,CAAC,OAAO,CAAC;YACvD,IAAI,GAAG,KAAK,0BAA0B;gBAAE,OAAO,CAAC,CAAC,SAAS,CAAC;YAC3D,IAAI,GAAG,KAAK,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;gBAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/G,IAAI,GAAG,KAAK,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBAAE,OAAO,0BAA0B,CAAC;YAC/H,IAAI,GAAG,KAAK,iBAAiB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAC/H,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;QAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC1B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9G,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACjC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM;QAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC9B,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,MAAM;gBAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACzD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,gBAAgB;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAC/D,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACzB,CAAC;QACH,CAAC;QACD,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClE,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,CAAC;KACF,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACzE,CAAC;AAED,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qGAAqG,EAAE,GAAG,EAAE;IAC/G,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0CAA0C,EAAE,gEAAgE,EAAE,EAAE,CAAC,CAAC;IAC7I,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0CAA0C,EAAE,iDAAiD,EAAE,EAAE,CAAC,CAAC;IACnI,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0HAA0H,EAAE,GAAG,EAAE;IACpI,MAAM,CAAC,GAAG,KAAK,CAAC;QACd,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,KAAK;QACxB,KAAK,EAAE,EAAE,0CAA0C,EAAE,8DAA8D,EAAE;KACtH,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mIAAmI,EAAE,GAAG,EAAE;IAC7I,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACzC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,0DAA0D,CAAC,CAAC;IAC5F,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAClG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IAC1F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,0DAA0D,CAAC,CAAC;IACpI,kIAAkI;IAClI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,6CAA6C,EAAE,4EAA4E,CAAC,CAAC,CAAC;IAClM,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,2CAA2C,kBAAkB,QAAQ,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,aAAa,EAAE,sEAAsE,CAAC,CAAC;IAC7H,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,oFAAoF,CAAC,CAAC,CAAC;AACpH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uGAAuG,EAAE,GAAG,EAAE;IACjH,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnB,IAAI,GAAG,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnD,UAAU,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACjH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,6DAA6D,CAAC,CAAC;IAC3F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,uHAAuH,CAAC,CAAC;AAC3J,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,GAAG,EAAE;IACpH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;QAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2HAA2H,EAAE,GAAG,EAAE;IACrI,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,iBAAiB,oCAAoC,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wGAAwG,EAAE,GAAG,EAAE;IAClH,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC;IAC7G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,4CAA4C,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,CAAC,GAAG,KAAK,CAAC;QACd,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACvD,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,uCAAuC,EAAE,uBAAuB,EAAE,wBAAwB,EAAE;KACxL,CAAC,CAAC;IACH,CAAC,CAAC,KAAK,CAAC,2CAA2C,kBAAkB,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1M,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAC;IAClF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,2CAA2C,CAAC,CAAC;IACjF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,gCAAgC,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iHAAiH,EAAE,GAAG,EAAE;IAC3H,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,sDAAsD,CAAC,CAAC;IAExF,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+EAA+E,EAAE,GAAG,EAAE;IACzF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,oEAAoE,CAAC,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2HAA2H,EAAE,GAAG,EAAE;IACrI,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACvI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,+DAA+D,EAAE,oEAAoE,CAAC,CAAC;IAC3J,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,wFAAwF,CAAC,CAAC;IAC9G,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,0EAA0E,CAAC,CAAC;IAChG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,+FAA+F,CAAC,CAAC;IACrH,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,yFAAyF,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,0EAA0E,CAAC,CAAC;IAChG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,0BAA0B,EAAE,uBAAuB,CAAC,CAAC;AAC/J,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0IAA0I,EAAE,GAAG,EAAE;IACpJ,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,0EAA0E,CAAC,CAAC;IACjH,yCAAyC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACxG,EAAE,CAAC,KAAK,CAAC,2CAA2C,kBAAkB,QAAQ,CAAC,GAAG,oBAAoB,CAAC;IACvG,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxB,WAAW,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,qDAAqD,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC"}

package/dist/lib/vm-user.d.ts

@@ -0,0 +1,35 @@
+import { type InstallRunnerUserDeps } from "./runner-user.js";
+/**
+ * Creates the dedicated auto-login "helper" account that holds a Mac's graphical session and runs the VM tooling
+ * (Tart, vm-reconcile, xcode-image), and prints the steps that finish the job. Run ON the target Mac, by the operator,
+ * in their own terminal (`appforge-admin agents install-vm-user`).
+ *
+ * Why. A macOS Tart guest only starts for a user with a graphical session, and after an unattended reboot only the
+ * auto-login account has one (appforge-ci#812; docs/fleet-management.md, "macOS guests need a graphical session").
+ * On a Mac that shares the box with a GitHub Actions runner, option C of that issue puts the VM tooling in a third
+ * account, so VM disks are out of reach of CI jobs and of the agent's own builds.
+ *
+ * What it does, idempotently: refuses on a laptop or while FileVault is on (auto-login cannot work), then creates an
+ * ordinary account with no password, and prints the next steps.
+ *
+ * What it deliberately does NOT do: set a password, enable auto-login, or install any LaunchAgent. Auto-login stores
+ * the account's password on this Mac and decides who is logged in at the console, a call about this Mac's physical
+ * security that the operator (or their MDM) makes, so the command prints the steps and changes nothing else.
+ */
+export declare const DEFAULT_VM_USER = "appforge-vm";
+export interface InstallVmUserDeps extends InstallRunnerUserDeps {
+    platform: string;
+    /** stdout of a read-only command, or null when it could not run. */
+    capture(cmd: string, args: string[]): string | null;
+}
+export declare const realInstallVmUserDeps: InstallVmUserDeps;
+/** The reasons this Mac cannot use an auto-login helper account; empty means go ahead. Fails closed: an unreadable answer refuses. */
+export declare function vmUserRefusals(deps: Pick<InstallVmUserDeps, "platform" | "capture">): string[];
+/** Where the agent mirrors its status.json for the helper account (group-readable; made in step 2 below). */
+export declare const STATUS_SHARE_DIR = "/Users/Shared/appforge";
+/** The steps the operator does next, as printable text. Pure, so a test can read exactly what will be shown. */
+export declare function vmUserNextSteps(user: string, agentUser?: string): string;
+export declare function installVmUser(opts?: {
+    user?: string;
+}, deps?: InstallVmUserDeps): void;
+//# sourceMappingURL=vm-user.d.ts.map

package/dist/lib/vm-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-user.d.ts","sourceRoot":"","sources":["../../src/lib/vm-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE7G;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC;CACrD;AAED,eAAO,MAAM,qBAAqB,EAAE,iBAUnC,CAAC;AAEF,sIAAsI;AACtI,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,SAAS,CAAC,GAAG,MAAM,EAAE,CAW9F;AAED,6GAA6G;AAC7G,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD,gHAAgH;AAChH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAA4B,GAAG,MAAM,CAiC7F;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,EAAE,IAAI,GAAE,iBAAyC,GAAG,IAAI,CAajH"}

package/dist/lib/vm-user.js

@@ -0,0 +1,99 @@
+import { execFileSync } from "node:child_process";
+import { userInfo } from "node:os";
+import { ensureOrdinaryUser, realInstallRunnerUserDeps } from "./runner-user.js";
+/**
+ * Creates the dedicated auto-login "helper" account that holds a Mac's graphical session and runs the VM tooling
+ * (Tart, vm-reconcile, xcode-image), and prints the steps that finish the job. Run ON the target Mac, by the operator,
+ * in their own terminal (`appforge-admin agents install-vm-user`).
+ *
+ * Why. A macOS Tart guest only starts for a user with a graphical session, and after an unattended reboot only the
+ * auto-login account has one (appforge-ci#812; docs/fleet-management.md, "macOS guests need a graphical session").
+ * On a Mac that shares the box with a GitHub Actions runner, option C of that issue puts the VM tooling in a third
+ * account, so VM disks are out of reach of CI jobs and of the agent's own builds.
+ *
+ * What it does, idempotently: refuses on a laptop or while FileVault is on (auto-login cannot work), then creates an
+ * ordinary account with no password, and prints the next steps.
+ *
+ * What it deliberately does NOT do: set a password, enable auto-login, or install any LaunchAgent. Auto-login stores
+ * the account's password on this Mac and decides who is logged in at the console, a call about this Mac's physical
+ * security that the operator (or their MDM) makes, so the command prints the steps and changes nothing else.
+ */
+export const DEFAULT_VM_USER = "appforge-vm";
+export const realInstallVmUserDeps = {
+    ...realInstallRunnerUserDeps,
+    platform: process.platform,
+    capture(cmd, args) {
+        try {
+            return execFileSync(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], cwd: "/" });
+        }
+        catch {
+            return null;
+        }
+    },
+};
+/** The reasons this Mac cannot use an auto-login helper account; empty means go ahead. Fails closed: an unreadable answer refuses. */
+export function vmUserRefusals(deps) {
+    if (deps.platform !== "darwin")
+        return [`this is not macOS (${deps.platform}): the helper account is a macOS auto-login account`];
+    const reasons = [];
+    const batt = deps.capture("/usr/bin/pmset", ["-g", "batt"]);
+    if (batt === null)
+        reasons.push("could not read the power source (pmset -g batt), so this cannot be shown not to be a laptop");
+    else if (/InternalBattery/.test(batt))
+        reasons.push("this Mac has a battery (a laptop): auto-login on a laptop is not a good idea, use a Mac mini");
+    const fv = deps.capture("/usr/bin/fdesetup", ["status"]);
+    if (fv === null)
+        reasons.push("could not read the FileVault state (fdesetup status)");
+    else if (/FileVault is On/i.test(fv))
+        reasons.push("FileVault is on: macOS cannot log an account in automatically while it is");
+    else if (!/FileVault is Off/i.test(fv))
+        reasons.push(`unrecognised FileVault state: ${fv.trim().slice(0, 80)}`);
+    return reasons;
+}
+/** Where the agent mirrors its status.json for the helper account (group-readable; made in step 2 below). */
+export const STATUS_SHARE_DIR = "/Users/Shared/appforge";
+/** The steps the operator does next, as printable text. Pure, so a test can read exactly what will be shown. */
+export function vmUserNextSteps(user, agentUser = userInfo().username) {
+    const home = `/Users/${user}`;
+    return [
+        `Next steps. Nothing below was done for you: this print-only form is the manual path for one Mac.`,
+        `On many Macs, do steps 1, 2, 3 and 5 in one go with:  sudo appforge-admin agents install-vm-user --apply --agent-user ${agentUser}`,
+        `(non-interactive and idempotent, so an MDM script or Ansible can run it; --dry-run shows what it would do).`,
+        ``,
+        `  1. Give '${user}' a password (it has none yet, so it cannot log in):`,
+        `       sudo dscl . -passwd ${home}`,
+        `  2. Make a folder both accounts use: the agent writes its status there ('${user}' needs it to know when the agent is busy,`,
+        `     and ~/.appforge-agent is private to the agent's own account), and '${user}' writes its VM and image lists there so`,
+        `     the agent can report them to Fleet (the agent's own \`tart list\` cannot see a store in '${user}'). Group-writable for that:`,
+        `       sudo install -d -o ${agentUser} -g ${user} -m 770 ${STATUS_SHARE_DIR}`,
+        `  3. Tell the agent to write its status there and to report the helper's inventory, by re-installing its service from a`,
+        `     shell that exports the knobs it already has (APPFORGE_MAX_CONCURRENT_BUILDS, APPFORGE_SANDBOX_MONITOR=1, ...) plus:`,
+        `       APPFORGE_STATUS_MIRROR_DIR=${STATUS_SHARE_DIR} APPFORGE_VM_INVENTORY_FILE=${STATUS_SHARE_DIR}/inventory.json \\`,
+        `         APPFORGE_VM_TOOLING_DIR=${STATUS_SHARE_DIR} \\`,
+        `         appforge-agent install-service --daemon`,
+        `  4. Make '${user}' the auto-login account: System Settings > Users & Groups > "Automatically log in as" > ${user}`,
+        `     (FileVault is off, as this needs), or push the same setting with your MDM.`,
+        `  5. Reboot, let it log in by itself, then check the layout:`,
+        `       appforge-agent doctor        (macos-guest-session should say "the helper-account layout")`,
+        `  6. Start the VM tooling in that session, as a LaunchAgent of '${user}': follow infra/vms/README.md, "Running it on a Mac",`,
+        `     as that user (sudo -u ${user} ...), passing  --agent-status ${STATUS_SHARE_DIR}/status.json --inventory-dir ${STATUS_SHARE_DIR}`,
+        `     to install-launchd.sh, then load it`,
+        `     into its graphical session:`,
+        `       sudo launchctl bootstrap gui/$(id -u ${user}) ${home}/Library/LaunchAgents/com.appforge.vm-reconcile.plist`,
+        ``,
+        `Heads-up: only ONE account auto-logs in. If this Mac also hosts a GitHub Actions runner as a LaunchAgent (svc.sh installs one),`,
+        `that runner will not come back after the reboot in step 5 until it runs as a boot-time daemon instead (a follow-up for`,
+        `appforge-ci#812). 'appforge-agent doctor' shows it as runner-session. Until then macOS guests cannot start after a reboot,`,
+        `so do not do step 4 on a Mac whose runner you cannot afford to lose.`,
+    ].join("\n");
+}
+export function installVmUser(opts = {}, deps = realInstallVmUserDeps) {
+    const user = opts.user ?? DEFAULT_VM_USER;
+    const refusals = vmUserRefusals(deps);
+    if (refusals.length > 0) {
+        throw new Error(`refused: ${refusals.join("; ")}`);
+    }
+    ensureOrdinaryUser(user, "AppForge VM helper (dedicated)", `Creating the dedicated '${user}' account (it will hold this Mac's graphical session and run the VM tooling)`, deps);
+    deps.log(`\n${vmUserNextSteps(user)}`);
+}
+//# sourceMappingURL=vm-user.js.map

package/dist/lib/vm-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-user.js","sourceRoot":"","sources":["../../src/lib/vm-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAA8B,MAAM,kBAAkB,CAAC;AAE7G;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAQ7C,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,GAAG,yBAAyB;IAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,OAAO,CAAC,GAAG,EAAE,IAAI;QACf,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAC;AAEF,sIAAsI;AACtI,MAAM,UAAU,cAAc,CAAC,IAAqD;IAClF,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,sBAAsB,IAAI,CAAC,QAAQ,qDAAqD,CAAC,CAAC;IAClI,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;SAC1H,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACpJ,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;SACjF,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;SAC3H,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD,gHAAgH;AAChH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,YAAoB,QAAQ,EAAE,CAAC,QAAQ;IACnF,MAAM,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,kGAAkG;QAClG,yHAAyH,SAAS,EAAE;QACpI,6GAA6G;QAC7G,EAAE;QACF,cAAc,IAAI,sDAAsD;QACxE,8BAA8B,IAAI,EAAE;QACpC,6EAA6E,IAAI,4CAA4C;QAC7H,2EAA2E,IAAI,0CAA0C;QACzH,iGAAiG,IAAI,8BAA8B;QACnI,6BAA6B,SAAS,OAAO,IAAI,WAAW,gBAAgB,EAAE;QAC9E,yHAAyH;QACzH,0HAA0H;QAC1H,qCAAqC,gBAAgB,+BAA+B,gBAAgB,oBAAoB;QACxH,oCAAoC,gBAAgB,KAAK;QACzD,kDAAkD;QAClD,cAAc,IAAI,4FAA4F,IAAI,EAAE;QACpH,iFAAiF;QACjF,8DAA8D;QAC9D,kGAAkG;QAClG,mEAAmE,IAAI,uDAAuD;QAC9H,8BAA8B,IAAI,kCAAkC,gBAAgB,gCAAgC,gBAAgB,EAAE;QACtI,0CAA0C;QAC1C,kCAAkC;QAClC,+CAA+C,IAAI,KAAK,IAAI,uDAAuD;QACnH,EAAE;QACF,iIAAiI;QACjI,wHAAwH;QACxH,4HAA4H;QAC5H,sEAAsE;KACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA0B,EAAE,EAAE,OAA0B,qBAAqB;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,kBAAkB,CAChB,IAAI,EACJ,gCAAgC,EAChC,2BAA2B,IAAI,8EAA8E,EAC7G,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/vm-user.test.d.ts

@@ -0,0 +1,2 @@
+import "../test-support/home-sandbox.js";
+//# sourceMappingURL=vm-user.test.d.ts.map

package/dist/lib/vm-user.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-user.test.d.ts","sourceRoot":"","sources":["../../src/lib/vm-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC"}

package/dist/lib/vm-user.test.js

@@ -0,0 +1,75 @@
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { DEFAULT_VM_USER, installVmUser, vmUserNextSteps, vmUserRefusals } from "./vm-user.js";
+const BATT_MINI = "Now drawing from 'AC Power'\n";
+const BATT_LAPTOP = "Now drawing from 'Battery Power'\n -InternalBattery-0 (id=1) 80%; discharging\n";
+function fakeDeps(over = {}) {
+    const calls = [];
+    const logs = [];
+    const answers = { "/usr/bin/pmset -g batt": BATT_MINI, "/usr/bin/fdesetup status": "FileVault is Off.\n", ...(over.answers ?? {}) };
+    const deps = {
+        userExists: () => false,
+        listUserUids: () => "someone 501\nci-runner 502\n",
+        run: (cmd, args) => calls.push({ cmd, args }),
+        tryRun: () => true,
+        exists: () => false,
+        mkdirp: () => { },
+        log: (l) => logs.push(l),
+        arch: "arm64",
+        platform: "darwin",
+        capture: (cmd, args) => answers[[cmd, ...args].join(" ")] ?? null,
+        ...over,
+    };
+    return { deps, calls, logs };
+}
+test("a Mac mini with FileVault off has nothing refusing it", () => {
+    assert.deepEqual(vmUserRefusals(fakeDeps().deps), []);
+});
+test("a laptop, FileVault on, a non-macOS host and unreadable answers all refuse (fail closed)", () => {
+    assert.match(vmUserRefusals(fakeDeps({ answers: { "/usr/bin/pmset -g batt": BATT_LAPTOP } }).deps).join(";"), /has a battery/);
+    assert.match(vmUserRefusals(fakeDeps({ answers: { "/usr/bin/fdesetup status": "FileVault is On.\n" } }).deps).join(";"), /FileVault is on/);
+    assert.match(vmUserRefusals(fakeDeps({ platform: "linux" }).deps).join(";"), /not macOS/);
+    assert.match(vmUserRefusals(fakeDeps({ answers: { "/usr/bin/pmset -g batt": null } }).deps).join(";"), /could not read the power source/);
+    assert.match(vmUserRefusals(fakeDeps({ answers: { "/usr/bin/fdesetup status": null } }).deps).join(";"), /could not read the FileVault state/);
+    assert.match(vmUserRefusals(fakeDeps({ answers: { "/usr/bin/fdesetup status": "weird\n" } }).deps).join(";"), /unrecognised FileVault state/);
+});
+test("a refusal throws before anything is created", () => {
+    const { deps, calls } = fakeDeps({ answers: { "/usr/bin/fdesetup status": "FileVault is On.\n" } });
+    assert.throws(() => installVmUser({}, deps), /refused: FileVault is on/);
+    assert.deepEqual(calls, [], "no command ran");
+});
+test("creates the default account the way install-runner-user does, then prints the steps and runs nothing else", () => {
+    const { deps, calls, logs } = fakeDeps();
+    installVmUser({}, deps);
+    const joined = calls.map((c) => `${c.cmd} ${c.args.join(" ")}`);
+    assert.ok(joined.includes(`sudo dscl . -create /Users/${DEFAULT_VM_USER} UniqueID 503`), "next free uid after 502");
+    assert.ok(joined.includes(`sudo dscl . -create /Users/${DEFAULT_VM_USER} RealName AppForge VM helper (dedicated)`));
+    assert.ok(joined.includes(`sudo createhomedir -c -u ${DEFAULT_VM_USER}`));
+    assert.ok(!joined.some((c) => /IsHidden|-passwd|autologin|kcpassword|launchctl|defaults write|sysadminctl/.test(c)), `only account creation ran: ${joined.join(" | ")}`);
+    assert.match(logs.join("\n"), /Next steps\. Nothing below was done for you/);
+});
+test("an account that already exists is left alone, and the steps are still printed", () => {
+    const { deps, calls, logs } = fakeDeps({ userExists: () => true });
+    installVmUser({ user: "vmhelper" }, deps);
+    assert.deepEqual(calls, []);
+    assert.match(logs.join("\n"), /user 'vmhelper' already exists, leaving it alone/);
+    assert.match(logs.join("\n"), /sudo dscl \. -passwd \/Users\/vmhelper/);
+});
+test("the printed steps cover password, the shared status folder, the agent mirror, auto-login, the reboot check, the LaunchAgent and the runner heads-up", () => {
+    const text = vmUserNextSteps("appforge-vm", "tooming");
+    assert.match(text, /sudo dscl \. -passwd \/Users\/appforge-vm/);
+    assert.match(text, /sudo install -d -o tooming -g appforge-vm -m 770 \/Users\/Shared\/appforge/, "group-writable: the helper publishes its inventory there");
+    assert.match(text, /APPFORGE_VM_INVENTORY_FILE=\/Users\/Shared\/appforge\/inventory\.json/);
+    assert.match(text, /--inventory-dir \/Users\/Shared\/appforge/);
+    assert.match(text, /APPFORGE_STATUS_MIRROR_DIR=\/Users\/Shared\/appforge APPFORGE_VM_INVENTORY_FILE=\/Users\/Shared\/appforge\/inventory\.json \\\n\s+APPFORGE_VM_TOOLING_DIR=\/Users\/Shared\/appforge \\\n\s+appforge-agent install-service --daemon/);
+    assert.match(text, /Automatically log in as" > appforge-vm/);
+    assert.match(text, /appforge-agent doctor/);
+    assert.match(text, /helper-account layout/);
+    assert.match(text, /--agent-status \/Users\/Shared\/appforge\/status\.json/);
+    assert.match(text, /launchctl bootstrap gui\/\$\(id -u appforge-vm\) \/Users\/appforge-vm\/Library\/LaunchAgents\/com\.appforge\.vm-reconcile\.plist/);
+    assert.match(text, /only ONE account auto-logs in/i);
+    // the order matters: the folder exists before the agent is told to write there, auto-login comes after both
+    assert.ok(text.indexOf("sudo install -d") < text.indexOf("APPFORGE_STATUS_MIRROR_DIR") && text.indexOf("APPFORGE_STATUS_MIRROR_DIR") < text.indexOf("Automatically log in as"));
+});
+//# sourceMappingURL=vm-user.test.js.map

package/dist/lib/vm-user.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm-user.test.js","sourceRoot":"","sources":["../../src/lib/vm-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAA0B,MAAM,cAAc,CAAC;AAEvH,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,MAAM,WAAW,GAAG,iFAAiF,CAAC;AAEtG,SAAS,QAAQ,CAAC,OAAiF,EAAE;IACnG,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE,wBAAwB,EAAE,SAAS,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACpI,MAAM,IAAI,GAAsB;QAC9B,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;QAClD,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI;QAClB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;QACnB,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC;QAChB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAyB,CAAC,IAAI,IAAI;QACzF,GAAG,IAAI;KACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE;IACpG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/H,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC5I,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1F,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,iCAAiC,CAAC,CAAC;IAC1I,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,oCAAoC,CAAC,CAAC;IAC/I,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;AAChJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACzE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,eAAe,eAAe,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACpH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,eAAe,0CAA0C,CAAC,CAAC,CAAC;IACpH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,eAAe,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4EAA4E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,6CAA6C,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+EAA+E,EAAE,GAAG,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,kDAAkD,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qJAAqJ,EAAE,GAAG,EAAE;IAC/J,MAAM,IAAI,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4EAA4E,EAAE,0DAA0D,CAAC,CAAC;IAC7J,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,uEAAuE,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,oOAAoO,CAAC,CAAC;IACzP,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,kIAAkI,CAAC,CAAC;IACvJ,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACrD,4GAA4G;IAC5G,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAClL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appforge-ci/admin-cli",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -15,8 +15,8 @@
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
-    "@appforge-ci/agent": "0.3.13",
-    "@appforge-ci/core": "0.3.13"
+    "@appforge-ci/agent": "0.3.15",
+    "@appforge-ci/core": "0.3.15"
   },
   "devDependencies": {
     "@types/node": "^20.16.5",