@appforge-ci/admin-cli 0.3.19 → 0.3.20

package/dist/lib/build-user.d.ts

@@ -30,8 +30,14 @@ import { BUILD_USER_NAME } from "@appforge-ci/agent/dist/lib/sandbox/build-user.
  *   6. Appends (never replaces) exactly two lines to the EXISTING `/etc/sudoers.d/appforge-agent`
  *      (`infra/mac-mini-setup/bootstrap.sh`'s `REBOOT_HOST` line stays untouched) — one scoping the agent's
  *      user to run ONLY the fixed helper path as root, one scoping it to become ONLY `_appforgebuild`.
- *      Validated with `visudo -c` on a scratch copy BEFORE either line ever reaches the real file: a
- *      syntax error in sudoers can lock sudo out entirely, so this never lets one through.
+ *      Validated with `visudo -c` on the EXACT staged bytes BEFORE they replace the real file, which
+ *      they do by one atomic rename: a syntax error in sudoers can lock sudo out entirely, so this never
+ *      lets one through, and a reader of the file never sees half of it.
+ *
+ * Every file this installer puts in place as root (the helper script, the pf rules, the sudoers file) goes
+ * through `installRootOwnedFile` below, which never lets the bytes touch a directory the agent's account
+ * can write: the agent's account is also the account ordinary builds run as, and a file it can rewrite
+ * between "written" and "installed" would be a path to root.
  *
  * None of this is run by anything unattended: every `sudo` below prompts in the operator's own terminal,
  * the same model `agents bootstrap --full` already uses for the sudoers/pmset/Xcode steps.
@@ -57,19 +63,45 @@ export interface BuildUserInstallDeps {
      *  the top of the 300-399 band. */
     listGroupGids(): string;
     etcDirExists(): boolean;
-    /** Current content of the live sudoers file (`sudo cat`), or "" if it does not exist yet. */
+    /** Current content of the live sudoers file, or "" when it does not exist yet. THROWS when it exists but cannot be read: an unreadable
+     *  file is never treated as an empty one (the installer would replace it with just the lines it adds). */
     readSudoers(): string;
-    /** `sudo visudo -c -f <path to this exact content>`. Throws on a syntax error — never reaches the real file. */
-    validateSudoers(content: string): void;
-    /** Installs `content` at `path`, root:wheel, with `mode` — via a throwaway tmp file the caller never
-     *  has to manage. */
-    writeRootOwnedFile(path: string, content: string, mode: string): void;
+    /** Installs `content` at `path`, root:wheel, with `mode`, atomically, through a staging directory only root can enter (see
+     *  `installRootOwnedFile`). With `check: "sudoers"` the staged bytes are validated with `visudo -c` first; a rejection throws and
+     *  the real file is never touched. */
+    writeRootOwnedFile(path: string, content: string, mode: string, opts?: {
+        check?: "sudoers";
+    }): void;
     run(cmd: string, args: string[]): void;
     whoami(): string;
     /** `$SUDO_USER`: who typed `sudo appforge-admin ...`, when this process is running as root because of it. */
     sudoUser(): string | null;
     log(line: string): void;
 }
+/** Runs `sudo <args>`; `input` goes to the command's stdin, `capture` returns its stdout instead of showing it. Injectable for the tests. */
+export type SudoRunner = (args: string[], opts?: {
+    input?: string;
+    capture?: boolean;
+}) => string;
+export declare const realSudo: SudoRunner;
+/**
+ * Puts `content` at `path` as root:wheel with `mode`, so that no process running as an unprivileged user can change the bytes between
+ * "the installer has them" and "root owns them".
+ *
+ * The earlier version wrote the file to the invoking user's temp directory and ran `sudo install` on it. The invoking user is the
+ * agent's account, which also runs ordinary tenant builds (and, for the same-uid sandbox tier, sandboxed ones that may write that very
+ * directory): anything running as it could rewrite the file in the window, and the root-owned helper or the sudoers file would hold its
+ * bytes. Now:
+ *   1. `mktemp -d` AS ROOT makes a 0700 root-owned staging directory beside the destination (the destination's own directory is root-owned
+ *      too, so nobody else could create or rename anything there, and the final rename stays on one filesystem);
+ *   2. the content reaches root on STDIN (`sudo tee`), never through a path the unprivileged user could write;
+ *   3. owner and mode are set on the staged copy; a sudoers file is checked with `visudo -c` right there, on those exact bytes;
+ *   4. one `mv -f` replaces the destination atomically; the staging directory is removed whatever happened.
+ */
+export declare function installRootOwnedFile(sudo: SudoRunner, path: string, content: string, mode: string, opts?: {
+    check?: "sudoers";
+}): void;
+export declare function readSudoersFile(sudo?: SudoRunner): string;
 export declare const realBuildUserInstallDeps: BuildUserInstallDeps;
 /**
  * The account that runs the agent, which every sudoers line this installer writes is for. It is the user running the
@@ -105,8 +137,10 @@ export declare function requiredSudoersLines(agentUser: string, buildUser: strin
  *  without needing to intercept a file write. */
 export declare function renderBuildHelperScript(user: string, jobsRoot: string, cacheRoot: string): string;
 /** Appends whichever of `lines` are not already present in the live sudoers file, validated with `visudo`
- *  first — existing content (the `REBOOT_HOST` line from `infra/mac-mini-setup/bootstrap.sh`, or anything
- *  else) is always kept, never replaced. A no-op if every line is already there. */
+ *  on the exact staged bytes first — existing content (the `REBOOT_HOST` line from
+ *  `infra/mac-mini-setup/bootstrap.sh`, or anything else) is always kept, never replaced. A no-op if every
+ *  line is already there. A file that cannot be read stops the install (`readSudoers` throws): it is never
+ *  treated as an empty one. */
 export declare function ensureSudoersLines(lines: readonly string[], deps?: BuildUserInstallDeps): void;
 export declare function installBuildUser(opts?: {
     user?: string;

package/dist/lib/build-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-user.d.ts","sourceRoot":"","sources":["../../src/lib/build-user.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,eAAe,EAAE,MAAM,mDAAmD,CAAC;AAOvG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,aAAa,QAA+C,CAAC;AAC1E,eAAO,MAAM,YAAY,kCAAkC,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACpD,wFAAwF;IACxF,YAAY,IAAI,MAAM,CAAC;IACvB;;;;uCAImC;IACnC,aAAa,IAAI,MAAM,CAAC;IACxB,YAAY,IAAI,OAAO,CAAC;IACxB,6FAA6F;IAC7F,WAAW,IAAI,MAAM,CAAC;IACtB,gHAAgH;IAChH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;yBACqB;IACrB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,IAAI,MAAM,CAAC;IACjB,6GAA6G;IAC7G,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAyBD,eAAO,MAAM,wBAAwB,EAAE,oBAgDtC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,UAAU,CAAC,GAAG,MAAM,CAQ9H;AAED;;;;;;;;;kFASkF;AAClF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAM,EAAE,EAAE,SAAM,GAAG,MAAM,CAQ9E;AAED;;;2GAG2G;AAC3G,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASlI;AAED;;iDAEiD;AACjD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjG;AAuFD;;oFAEoF;AACpF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,oBAA+C,GAAG,IAAI,CAYxH;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,EACvF,IAAI,GAAE,oBAA+C,GACpD,IAAI,CAmBN;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"build-user.d.ts","sourceRoot":"","sources":["../../src/lib/build-user.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,eAAe,EAAE,MAAM,mDAAmD,CAAC;AAOvG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,aAAa,QAA+C,CAAC;AAC1E,eAAO,MAAM,YAAY,kCAAkC,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACpD,wFAAwF;IACxF,YAAY,IAAI,MAAM,CAAC;IACvB;;;;uCAImC;IACnC,aAAa,IAAI,MAAM,CAAC;IACxB,YAAY,IAAI,OAAO,CAAC;IACxB;8GAC0G;IAC1G,WAAW,IAAI,MAAM,CAAC;IACtB;;0CAEsC;IACtC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,IAAI,MAAM,CAAC;IACjB,6GAA6G;IAC7G,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAWD,6IAA6I;AAC7I,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,MAAM,CAAC;AAElG,eAAO,MAAM,QAAQ,EAAE,UAItB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAAG,IAAI,CAsB1I;AAQD,wBAAgB,eAAe,CAAC,IAAI,GAAE,UAAqB,GAAG,MAAM,CAOnE;AAED,eAAO,MAAM,wBAAwB,EAAE,oBA6BtC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,UAAU,CAAC,GAAG,MAAM,CAQ9H;AAED;;;;;;;;;kFASkF;AAClF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAM,EAAE,EAAE,SAAM,GAAG,MAAM,CAQ9E;AAED;;;2GAG2G;AAC3G,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASlI;AAED;;iDAEiD;AACjD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjG;AA4FD;;;;+BAI+B;AAC/B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,oBAA+C,GAAG,IAAI,CAWxH;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,EACvF,IAAI,GAAE,oBAA+C,GACpD,IAAI,CAmBN;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/build-user.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, unlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { BUILD_HELPER_PATH, BUILD_USER_NAME } from "@appforge-ci/agent/dist/lib/sandbox/build-user.js";
 import { BUILD_HELPER_SCRIPT_TEMPLATE } from "@appforge-ci/agent/dist/lib/sandbox/build-helper-script.generated.js";
 import { BUILD_USER_PF_ANCHOR, renderBuildUserPfRules } from "@appforge-ci/agent/dist/lib/sandbox/pf-rules.js";
@@ -39,8 +39,14 @@ import { cacheRootDir } from "@appforge-ci/agent/dist/lib/sandbox/cache.js";
  *   6. Appends (never replaces) exactly two lines to the EXISTING `/etc/sudoers.d/appforge-agent`
  *      (`infra/mac-mini-setup/bootstrap.sh`'s `REBOOT_HOST` line stays untouched) — one scoping the agent's
  *      user to run ONLY the fixed helper path as root, one scoping it to become ONLY `_appforgebuild`.
- *      Validated with `visudo -c` on a scratch copy BEFORE either line ever reaches the real file: a
- *      syntax error in sudoers can lock sudo out entirely, so this never lets one through.
+ *      Validated with `visudo -c` on the EXACT staged bytes BEFORE they replace the real file, which
+ *      they do by one atomic rename: a syntax error in sudoers can lock sudo out entirely, so this never
+ *      lets one through, and a reader of the file never sees half of it.
+ *
+ * Every file this installer puts in place as root (the helper script, the pf rules, the sudoers file) goes
+ * through `installRootOwnedFile` below, which never lets the bytes touch a directory the agent's account
+ * can write: the agent's account is also the account ordinary builds run as, and a file it can rewrite
+ * between "written" and "installed" would be a path to root.
  *
  * None of this is run by anything unattended: every `sudo` below prompts in the operator's own terminal,
  * the same model `agents bootstrap --full` already uses for the sudoers/pmset/Xcode steps.
@@ -62,21 +68,67 @@ function tryRun(cmd, args) {
         return false;
     }
 }
-function realWriteRootOwnedFile(path, content, mode) {
-    const tmp = join(tmpdir(), `appforge-install-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-    writeFileSync(tmp, content, { mode: 0o600 });
+export const realSudo = (args, opts = {}) => {
+    const out = execFileSync("sudo", args, { input: opts.input, encoding: "utf8", stdio: [opts.input === undefined ? "inherit" : "pipe", "pipe", "inherit"] });
+    if (!opts.capture && out)
+        process.stdout.write(out);
+    return out;
+};
+/**
+ * Puts `content` at `path` as root:wheel with `mode`, so that no process running as an unprivileged user can change the bytes between
+ * "the installer has them" and "root owns them".
+ *
+ * The earlier version wrote the file to the invoking user's temp directory and ran `sudo install` on it. The invoking user is the
+ * agent's account, which also runs ordinary tenant builds (and, for the same-uid sandbox tier, sandboxed ones that may write that very
+ * directory): anything running as it could rewrite the file in the window, and the root-owned helper or the sudoers file would hold its
+ * bytes. Now:
+ *   1. `mktemp -d` AS ROOT makes a 0700 root-owned staging directory beside the destination (the destination's own directory is root-owned
+ *      too, so nobody else could create or rename anything there, and the final rename stays on one filesystem);
+ *   2. the content reaches root on STDIN (`sudo tee`), never through a path the unprivileged user could write;
+ *   3. owner and mode are set on the staged copy; a sudoers file is checked with `visudo -c` right there, on those exact bytes;
+ *   4. one `mv -f` replaces the destination atomically; the staging directory is removed whatever happened.
+ */
+export function installRootOwnedFile(sudo, path, content, mode, opts = {}) {
+    if (!/^[0-7]{3,4}$/.test(mode))
+        throw new Error(`refusing to install ${path}: '${mode}' is not an octal file mode`);
+    const dir = dirname(path);
+    const stage = sudo(["/usr/bin/mktemp", "-d", `${dir}/.appforge-install.XXXXXXXXXX`], { capture: true }).trim();
+    // The path is about to be handed to `rm -rf` as root: it must be exactly what was asked for.
+    if (!new RegExp(`^${dir.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}/\\.appforge-install\\.[A-Za-z0-9]{10}$`).test(stage)) {
+        throw new Error(`mktemp returned an unexpected directory '${stage}'; not continuing`);
+    }
     try {
-        execFileSync("sudo", ["install", "-o", "root", "-g", "wheel", "-m", mode, tmp, path], { stdio: "inherit" });
+        const staged = `${stage}/content`;
+        sudo(["/usr/bin/tee", staged], { input: content, capture: true });
+        sudo(["/usr/sbin/chown", "root:wheel", staged]);
+        sudo(["/bin/chmod", mode, staged]);
+        if (opts.check === "sudoers")
+            sudo(["/usr/sbin/visudo", "-c", "-f", staged]);
+        sudo(["/bin/mv", "-f", staged, path]);
     }
     finally {
         try {
-            unlinkSync(tmp);
+            sudo(["/bin/rm", "-rf", stage]);
         }
         catch {
-            /* best effort */
+            /* best effort: a leftover is a root-owned 0700 directory with a dotted name that sudo and the helper both ignore */
         }
     }
 }
+const realWriteRootOwnedFile = (path, content, mode, opts) => installRootOwnedFile(realSudo, path, content, mode, opts);
+/** The script `readSudoers` runs as root: prints the file, or exits 3 when there is no such file. Any other failure is not "empty". */
+const READ_SUDOERS_SCRIPT = 'if [ -e "$1" ]; then exec /bin/cat "$1"; else exit 3; fi';
+const SUDOERS_ABSENT_STATUS = 3;
+export function readSudoersFile(sudo = realSudo) {
+    try {
+        return sudo(["/bin/sh", "-c", READ_SUDOERS_SCRIPT, "sh", SUDOERS_FILE], { capture: true });
+    }
+    catch (err) {
+        if (err.status === SUDOERS_ABSENT_STATUS)
+            return "";
+        throw new Error(`could not read ${SUDOERS_FILE} (${err instanceof Error ? err.message : String(err)}). It exists or sudo failed; the installer will not rewrite it from nothing. Fix the problem above and run it again.`);
+    }
+}
 export const realBuildUserInstallDeps = {
     // Bare `-read <path>`, no attribute: a record missing a SPECIFIC key (e.g. a group created but not yet
     // given its PrimaryGroupID, exactly the half-finished state a failed run between these two dscl calls
@@ -96,29 +148,7 @@ export const realBuildUserInstallDeps = {
     listUserUids: () => execFileSync("dscl", [".", "-list", "/Users", "UniqueID"], { encoding: "utf8" }),
     listGroupGids: () => execFileSync("dscl", [".", "-list", "/Groups", "PrimaryGroupID"], { encoding: "utf8" }),
     etcDirExists: () => existsSync(APPFORGE_ETC_DIR),
-    readSudoers() {
-        try {
-            return execFileSync("sudo", ["cat", SUDOERS_FILE], { encoding: "utf8" });
-        }
-        catch {
-            return "";
-        }
-    },
-    validateSudoers(content) {
-        const tmp = join(tmpdir(), `appforge-sudoers-check-${Date.now()}`);
-        writeFileSync(tmp, content, { mode: 0o440 });
-        try {
-            execFileSync("sudo", ["visudo", "-c", "-f", tmp], { stdio: "inherit" });
-        }
-        finally {
-            try {
-                unlinkSync(tmp);
-            }
-            catch {
-                /* best effort */
-            }
-        }
-    },
+    readSudoers: () => readSudoersFile(),
     writeRootOwnedFile: realWriteRootOwnedFile,
     run(cmd, args) {
         // eslint-disable-next-line no-console
@@ -268,20 +298,25 @@ function ensurePfRules(user, deps) {
     // re-applies on every start, since pf state does not survive a reboot on its own.
     deps.run("sudo", [BUILD_HELPER_PATH, "pf-reload"]);
 }
+/** Is `line` one of the file's lines (whole line, surrounding blanks ignored)? A commented-out copy, or the line inside a longer one, is not. */
+function hasSudoersLine(current, line) {
+    return current.split("\n").some((l) => l.trim() === line.trim());
+}
 /** Appends whichever of `lines` are not already present in the live sudoers file, validated with `visudo`
- *  first — existing content (the `REBOOT_HOST` line from `infra/mac-mini-setup/bootstrap.sh`, or anything
- *  else) is always kept, never replaced. A no-op if every line is already there. */
+ *  on the exact staged bytes first — existing content (the `REBOOT_HOST` line from
+ *  `infra/mac-mini-setup/bootstrap.sh`, or anything else) is always kept, never replaced. A no-op if every
+ *  line is already there. A file that cannot be read stops the install (`readSudoers` throws): it is never
+ *  treated as an empty one. */
 export function ensureSudoersLines(lines, deps = realBuildUserInstallDeps) {
     const current = deps.readSudoers();
-    const missing = lines.filter((l) => !current.includes(l));
+    const missing = lines.filter((l) => !hasSudoersLine(current, l));
     if (missing.length === 0) {
         deps.log(`  ${SUDOERS_FILE} already has every required line`);
         return;
     }
     const next = `${current.replace(/\n*$/, "")}\n${missing.join("\n")}\n`.replace(/^\n/, "");
     deps.log(`\n==> Adding ${missing.length} sudoers line(s) to ${SUDOERS_FILE} (validated with visudo first)`);
-    deps.validateSudoers(next);
-    deps.writeRootOwnedFile(SUDOERS_FILE, next, "0440");
+    deps.writeRootOwnedFile(SUDOERS_FILE, next, "0440", { check: "sudoers" });
     deps.log(`  wrote ${SUDOERS_FILE}`);
 }
 export function installBuildUser(opts = {}, deps = realBuildUserInstallDeps) {

package/dist/lib/build-user.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-user.js","sourceRoot":"","sources":["../../src/lib/build-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,8CAA8C,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AA6B5D,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9G,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAyB;IAC5D,uGAAuG;IACvG,sGAAsG;IACtG,uGAAuG;IACvG,6EAA6E;IAC7E,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IACtE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,IAAI,EAAE,KAAK;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpG,aAAa,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5G,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAChD,WAAW;QACT,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,eAAe,CAAC,OAAO;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnE,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,kBAAkB,EAAE,sBAAsB;IAC1C,GAAG,CAAC,GAAG,EAAE,IAAI;QACX,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;IACjE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI;IACrD,sCAAsC;IACtC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B,EAAE,IAAuD;IACpH,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACxC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,IAAI,KAAK,CACb,2OAA2O,CAC5O,CAAC;AACJ,CAAC;AAED;;;;;;;;;kFASkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAI,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,QAAQ,IAAI,gCAAgC,CAAC,CAAC;AACxF,CAAC;AAED;;;2GAG2G;AAC3G,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,SAAiB;IACvE,OAAO;QACL,MAAM,EAAE,GAAG,SAAS,yBAAyB,iBAAiB,IAAI;QAClE,UAAU,EAAE,GAAG,SAAS,SAAS,SAAS,qCAAqC;QAC/E,+GAA+G;QAC/G,kHAAkH;QAClH,8EAA8E;QAC9E,OAAO,EAAE,GAAG,SAAS,yBAAyB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC1H,CAAC;AACJ,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAAgB,EAAE,SAAiB;IACvF,OAAO,4BAA4B,CAAC,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;AACzM,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAA0B;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,iGAAiG,CAAC,CAAC;IACjJ,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,uFAAuF;IAC3G,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,uGAAuG;QACvG,iGAAiG;QACjG,mGAAmG;QACnG,oGAAoG;QACpG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,2CAA2C,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,iGAAiG;IACjG,4FAA4F;IAC5F,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,oBAAoB,KAAK,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAiB,EAAE,KAAa,EAAE,IAA0B;IAC/F,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,6BAA6B,KAAK,qBAAqB,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iBAAiB,SAAS,SAAS,KAAK,8EAA8E,CAAC,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;4CAsB4C;AAC5C,SAAS,6BAA6B,CAAC,IAAY,EAAE,SAAiB,EAAE,IAA0B;IAChG,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,kGAAkG,CAAC,CAAC;IACpI,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B;IAC9C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB,EAAE,SAAiB,EAAE,IAA0B;IACvG,IAAI,CAAC,GAAG,CAAC,wCAAwC,iBAAiB,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA0B;IAC7D,IAAI,CAAC,GAAG,CAAC,kDAAkD,IAAI,aAAa,oBAAoB,GAAG,CAAC,CAAC;IACrG,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,wGAAwG;IACxG,kFAAkF;IAClF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;oFAEoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,KAAwB,EAAE,OAA6B,wBAAwB;IAChH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,kCAAkC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,uBAAuB,YAAY,gCAAgC,CAAC,CAAC;IAC5G,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,WAAW,YAAY,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAqF,EAAE,EACvF,OAA6B,wBAAwB;IAErD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;IAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;IAEnD,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,2BAA2B,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,6BAA6B,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,GAAG,CACN,YAAY,IAAI,oGAAoG;QAClH,gHAAgH,CACnH,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"build-user.js","sourceRoot":"","sources":["../../src/lib/build-user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sEAAsE,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,8CAA8C,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AA6B5D,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD,MAAM,CAAC,MAAM,QAAQ,GAAe,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3J,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,OAA8B,EAAE;IAClI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,MAAM,IAAI,6BAA6B,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,GAAG,GAAG,+BAA+B,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/G,6FAA6F;IAC7F,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,yCAAyC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtH,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,mBAAmB,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,KAAK,UAAU,CAAC;QAClC,IAAI,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oHAAoH;QACtH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,GAA+C,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEpK,uIAAuI;AACvI,MAAM,mBAAmB,GAAG,0DAA0D,CAAC;AACvF,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,MAAM,UAAU,eAAe,CAAC,OAAmB,QAAQ;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA2B,CAAC,MAAM,KAAK,qBAAqB;YAAE,OAAO,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,sHAAsH,CAAC,CAAC;IAC7N,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAyB;IAC5D,uGAAuG;IACvG,sGAAsG;IACtG,uGAAuG;IACvG,6EAA6E;IAC7E,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IACtE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,IAAI,EAAE,KAAK;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,KAAK,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpG,aAAa,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5G,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAChD,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C,GAAG,CAAC,GAAG,EAAE,IAAI;QACX,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE;IACjE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI;IACrD,sCAAsC;IACtC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B,EAAE,IAAuD;IACpH,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACxC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,IAAI,KAAK,CACb,2OAA2O,CAC5O,CAAC;AACJ,CAAC;AAED;;;;;;;;;kFASkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,IAAI,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,KAAK,CAAC,sBAAsB,EAAE,QAAQ,IAAI,gCAAgC,CAAC,CAAC;AACxF,CAAC;AAED;;;2GAG2G;AAC3G,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,SAAiB;IACvE,OAAO;QACL,MAAM,EAAE,GAAG,SAAS,yBAAyB,iBAAiB,IAAI;QAClE,UAAU,EAAE,GAAG,SAAS,SAAS,SAAS,qCAAqC;QAC/E,+GAA+G;QAC/G,kHAAkH;QAClH,8EAA8E;QAC9E,OAAO,EAAE,GAAG,SAAS,yBAAyB,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC1H,CAAC;AACJ,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,QAAgB,EAAE,SAAiB;IACvF,OAAO,4BAA4B,CAAC,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;AACzM,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAA0B;IACtE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,oCAAoC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iCAAiC,IAAI,iGAAiG,CAAC,CAAC;IACjJ,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,uFAAuF;IAC3G,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,uGAAuG;QACvG,iGAAiG;QACjG,mGAAmG;QACnG,oGAAoG;QACpG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,2CAA2C,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9E,iGAAiG;IACjG,4FAA4F;IAC5F,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,oBAAoB,KAAK,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAiB,EAAE,KAAa,EAAE,IAA0B;IAC/F,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,6BAA6B,KAAK,qBAAqB,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,iBAAiB,SAAS,SAAS,KAAK,8EAA8E,CAAC,CAAC;IACjI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;4CAsB4C;AAC5C,SAAS,6BAA6B,CAAC,IAAY,EAAE,SAAiB,EAAE,IAA0B;IAChG,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,kGAAkG,CAAC,CAAC;IACpI,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAA0B;IAC9C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB,EAAE,SAAiB,EAAE,IAA0B;IACvG,IAAI,CAAC,GAAG,CAAC,wCAAwC,iBAAiB,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAA0B;IAC7D,IAAI,CAAC,GAAG,CAAC,kDAAkD,IAAI,aAAa,oBAAoB,GAAG,CAAC,CAAC;IACrG,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,wGAAwG;IACxG,kFAAkF;IAClF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,iJAAiJ;AACjJ,SAAS,cAAc,CAAC,OAAe,EAAE,IAAY;IACnD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;+BAI+B;AAC/B,MAAM,UAAU,kBAAkB,CAAC,KAAwB,EAAE,OAA6B,wBAAwB;IAChH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,kCAAkC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,uBAAuB,YAAY,gCAAgC,CAAC,CAAC;IAC5G,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,CAAC,WAAW,YAAY,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAqF,EAAE,EACvF,OAA6B,wBAAwB;IAErD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;IAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;IAEnD,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,2BAA2B,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,6BAA6B,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9E,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,GAAG,CACN,YAAY,IAAI,oGAAoG;QAClH,gHAAgH,CACnH,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/build-user.test.js

@@ -1,10 +1,13 @@
 import "../test-support/home-sandbox.js";
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
 import { BUILD_HELPER_PATH, BUILD_USER_NAME } from "@appforge-ci/agent/dist/lib/sandbox/build-user.js";
 import { BUILD_USER_PF_ANCHOR, pfRulesSha256, renderBuildUserPfRules } from "@appforge-ci/agent/dist/lib/sandbox/pf-rules.js";
-import { APPFORGE_ETC_DIR, PF_RULES_FILE, SUDOERS_FILE, ensureSudoersLines, installBuildUser, resolveAgentUser, nextFreeSystemId, renderBuildHelperScript, requiredSudoersLines, } from "./build-user.js";
+import { APPFORGE_ETC_DIR, PF_RULES_FILE, SUDOERS_FILE, ensureSudoersLines, installBuildUser, installRootOwnedFile, readSudoersFile, resolveAgentUser, nextFreeSystemId, renderBuildHelperScript, requiredSudoersLines, } from "./build-user.js";
 function fakeDeps(over = {}) {
     const calls = [];
     const writes = [];
@@ -17,8 +20,7 @@ function fakeDeps(over = {}) {
         listGroupGids: () => "",
         etcDirExists: () => false,
         readSudoers: () => "",
-        validateSudoers: () => { },
-        writeRootOwnedFile: (path, content, mode) => writes.push({ path, content, mode }),
+        writeRootOwnedFile: (path, content, mode, opts) => void writes.push({ path, content, mode, ...(opts?.check ? { check: opts.check } : {}) }),
         run: (cmd, args) => calls.push({ cmd, args }),
         whoami: () => "tooming",
         sudoUser: () => null,
@@ -78,32 +80,23 @@ test("renderBuildHelperScript substitutes every token and leaves none behind", (
     assert.doesNotMatch(script, /@@[A-Z_]+@@/);
 });
 // ---- ensureSudoersLines: the single most security-relevant piece — exercised directly ----
-test("ensureSudoersLines appends only the missing lines, validates with visudo BEFORE writing, and never touches an existing unrelated line", () => {
+test("ensureSudoersLines appends only the missing lines, asks for the check on the staged bytes (visudo) BEFORE the replace, and never touches an existing unrelated line", () => {
     const { deps, writes } = fakeDeps({ readSudoers: () => "tooming ALL=(root) NOPASSWD: /sbin/shutdown -r now\n" });
-    let validated;
-    deps.validateSudoers = (content) => {
-        validated = content;
-    };
     ensureSudoersLines(["tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *", "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *"], deps);
     assert.equal(writes.length, 1);
     assert.equal(writes[0].path, SUDOERS_FILE);
     assert.equal(writes[0].mode, "0440");
+    assert.equal(writes[0].check, "sudoers", "the install step validates exactly the bytes it installs");
     assert.match(writes[0].content, /^tooming ALL=\(root\) NOPASSWD: \/sbin\/shutdown -r now\n/, "the REBOOT_HOST line from bootstrap.sh is kept, not replaced");
     assert.match(writes[0].content, /build-helper\.sh \*\n/);
     assert.match(writes[0].content, /sandbox-exec \*\n$/);
-    assert.equal(validated, writes[0].content, "the EXACT content that gets written is what was validated — never a different string");
 });
 test("ensureSudoersLines is a no-op when every line is already present — never re-validates, never re-writes", () => {
     const helper = "tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *";
     const becomeUser = "tooming ALL=(_appforgebuild) NOPASSWD: /usr/bin/sandbox-exec *";
-    const { deps, writes } = fakeDeps({ readSudoers: () => `${helper}\n${becomeUser}\n` });
-    let validateCalls = 0;
-    deps.validateSudoers = () => {
-        validateCalls++;
-    };
+    const { deps, writes } = fakeDeps({ readSudoers: () => `${helper}\n  ${becomeUser}  \n` });
     ensureSudoersLines([helper, becomeUser], deps);
     assert.equal(writes.length, 0);
-    assert.equal(validateCalls, 0);
 });
 test("ensureSudoersLines adds only the ONE line that's actually missing when the other already exists", () => {
     const helper = "tooming ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *";
@@ -114,13 +107,132 @@ test("ensureSudoersLines adds only the ONE line that's actually missing when the
     const added = writes[0].content.split("\n").filter(Boolean);
     assert.deepEqual(added, [helper, becomeUser]);
 });
-test("ensureSudoersLines refuses (never writes) when visudo rejects the candidate content", () => {
+test("a line only counts as present when it is a whole line: a commented-out copy, or the line inside a longer one, is added again", () => {
+    const helper = "tooming ALL=(root) NOPASSWD: /etc/appforge/vm-helper.sh *";
+    for (const current of [`# ${helper}\n`, `#${helper}\n`, `x${helper}\n`, `${helper} # old\n`, `${helper}extra\n`, `other${helper}\n`]) {
+        const { deps, writes } = fakeDeps({ readSudoers: () => current });
+        ensureSudoersLines([helper], deps);
+        assert.equal(writes.length, 1, JSON.stringify(current));
+        assert.ok(writes[0].content.split("\n").includes(helper), "the real line is in what gets installed");
+        assert.ok(writes[0].content.startsWith(current.replace(/\n*$/, "")), "and what was there is kept");
+    }
+});
+test("a sudoers file that cannot be read stops the install: it is never treated as an empty file and replaced by just the new lines", () => {
+    const { deps, writes } = fakeDeps({
+        readSudoers: () => {
+            throw new Error("could not read /etc/sudoers.d/appforge-agent");
+        },
+    });
+    assert.throws(() => ensureSudoersLines(["x ALL=(root) NOPASSWD: /bin/true"], deps), /could not read/);
+    assert.equal(writes.length, 0, "nothing was written");
+});
+test("ensureSudoersLines refuses (never replaces the file) when the staged bytes fail the visudo check", () => {
     const { deps, writes } = fakeDeps();
-    deps.validateSudoers = () => {
-        throw new Error("visudo: syntax error");
+    const real = deps.writeRootOwnedFile;
+    deps.writeRootOwnedFile = (path, content, mode, opts) => {
+        if (opts?.check === "sudoers")
+            throw new Error("visudo: syntax error");
+        real(path, content, mode, opts);
     };
     assert.throws(() => ensureSudoersLines(["x ALL=(root) NOPASSWD: /bin/true"], deps), /syntax error/);
-    assert.equal(writes.length, 0, "a rejected candidate must never reach the real sudoers file");
+    assert.equal(writes.length, 0);
+});
+// ---- the install itself: the bytes never touch a directory an unprivileged process can write ----
+/** A `sudo` that runs the command as the current user, in a scratch directory standing in for /etc/appforge, recording each call. chown to root is the only thing skipped. */
+function shimSudo(calls) {
+    return (args, opts = {}) => {
+        calls.push({ args: [...args], ...(opts.input === undefined ? {} : { input: opts.input }) });
+        if (args[0] === "/usr/sbin/chown")
+            return ""; // we are not root; the call itself is asserted on
+        if (args[0] === "/usr/sbin/visudo") {
+            const body = readFileSync(args.at(-1), "utf8");
+            if (body.includes("SYNTAX ERROR"))
+                throw Object.assign(new Error("visudo: syntax error"), { status: 1 });
+            return "";
+        }
+        return execFileSync(args[0], args.slice(1), { encoding: "utf8", input: opts.input, stdio: ["pipe", "pipe", "inherit"] });
+    };
+}
+test("installRootOwnedFile: the content goes to root on STDIN into a root-made 0700 directory beside the destination, owner and mode are set there, and one rename puts it in place; nothing is written to the user's temp directory", () => {
+    const scratch = mkdtempSync(join(tmpdir(), "appforge-install-test-"));
+    const fakeTmp = mkdtempSync(join(tmpdir(), "appforge-fake-tmpdir-"));
+    const savedTmp = process.env.TMPDIR;
+    try {
+        process.env.TMPDIR = fakeTmp; // the old implementation staged its file here
+        const dest = join(scratch, "vm-helper.sh");
+        writeFileSync(dest, "OLD CONTENT");
+        const calls = [];
+        installRootOwnedFile(shimSudo(calls), dest, "#!/bin/bash\necho new\n", "0500");
+        assert.equal(readFileSync(dest, "utf8"), "#!/bin/bash\necho new\n");
+        assert.equal(statSync(dest).mode & 0o777, 0o500);
+        assert.deepEqual(readdirSync(scratch), ["vm-helper.sh"], "the staging directory is gone");
+        assert.deepEqual(readdirSync(fakeTmp), [], "nothing was staged in the user's temp directory");
+        // the sequence, as root would run it
+        const verbs = calls.map((c) => c.args[0]);
+        assert.deepEqual(verbs, ["/usr/bin/mktemp", "/usr/bin/tee", "/usr/sbin/chown", "/bin/chmod", "/bin/mv", "/bin/rm"]);
+        assert.deepEqual(calls[0].args.slice(1, 2), ["-d"]);
+        assert.ok(calls[0].args[2].startsWith(`${scratch}/.appforge-install.`), "the staging directory is made beside the destination");
+        assert.equal(calls[1].input, "#!/bin/bash\necho new\n", "the content travels on stdin");
+        assert.ok(calls[1].args[1].startsWith(`${scratch}/.appforge-install.`), "into the root-made directory");
+        assert.deepEqual(calls[2].args.slice(0, 2), ["/usr/sbin/chown", "root:wheel"]);
+        assert.ok(calls.every((c) => !c.args.some((a) => a.startsWith(tmpdir()) || a.startsWith(fakeTmp))), "no argument names the user's temp directory");
+        assert.ok(calls.slice(0, 2).every((c) => c.args.every((a) => !a.includes("OLD"))), "and the content is in no argument list");
+    }
+    finally {
+        if (savedTmp === undefined)
+            delete process.env.TMPDIR;
+        else
+            process.env.TMPDIR = savedTmp;
+        rmSync(scratch, { recursive: true, force: true });
+        rmSync(fakeTmp, { recursive: true, force: true });
+    }
+});
+test("installRootOwnedFile for sudoers: visudo checks the staged bytes (the very ones that are then renamed in), and a rejection leaves the real file and the directory exactly as they were", () => {
+    const scratch = mkdtempSync(join(tmpdir(), "appforge-install-test-"));
+    try {
+        const dest = join(scratch, "appforge-agent");
+        writeFileSync(dest, "tooming ALL=(root) NOPASSWD: /sbin/shutdown -r now\n");
+        const calls = [];
+        installRootOwnedFile(shimSudo(calls), dest, "tooming ALL=(root) NOPASSWD: /etc/appforge/vm-helper.sh *\n", "0440", { check: "sudoers" });
+        const visudo = calls.find((c) => c.args[0] === "/usr/sbin/visudo");
+        const mv = calls.find((c) => c.args[0] === "/bin/mv");
+        assert.deepEqual(visudo.args.slice(0, 3), ["/usr/sbin/visudo", "-c", "-f"]);
+        assert.equal(visudo.args[3], mv.args[2], "the file visudo checked is the file that is renamed into place");
+        assert.ok(calls.indexOf(visudo) < calls.indexOf(mv), "checked BEFORE the replace");
+        assert.equal(statSync(dest).mode & 0o777, 0o440);
+        const before = readFileSync(dest, "utf8");
+        const bad = [];
+        assert.throws(() => installRootOwnedFile(shimSudo(bad), dest, "SYNTAX ERROR\n", "0440", { check: "sudoers" }), /syntax error/);
+        assert.equal(readFileSync(dest, "utf8"), before, "the real sudoers file is untouched");
+        assert.ok(!bad.some((c) => c.args[0] === "/bin/mv"), "the rename never ran");
+        assert.deepEqual(readdirSync(scratch), ["appforge-agent"], "and the staging directory was cleaned up");
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+});
+test("installRootOwnedFile refuses a mode that is not octal and a staging directory it did not ask for, before it runs anything as root on them", () => {
+    assert.throws(() => installRootOwnedFile(() => "", "/etc/appforge/x", "x", "u+s"), /not an octal file mode/);
+    const ran = [];
+    const evil = (args) => {
+        ran.push(args[0]);
+        return args[0] === "/usr/bin/mktemp" ? "/etc/appforge/../../var/root\n" : "";
+    };
+    assert.throws(() => installRootOwnedFile(evil, "/etc/appforge/x", "x", "0500"), /unexpected directory/);
+    assert.deepEqual(ran, ["/usr/bin/mktemp"], "nothing else ran, in particular no rm -rf of a path mktemp made up");
+});
+test("readSudoersFile: a missing file is empty (the first install), a file sudo cannot read is an error, never an empty string", () => {
+    const status = (n) => () => {
+        throw Object.assign(new Error(`Command failed (status ${n})`), { status: n });
+    };
+    assert.equal(readSudoersFile(() => "tooming ALL=(root) NOPASSWD: /x\n"), "tooming ALL=(root) NOPASSWD: /x\n");
+    assert.equal(readSudoersFile(status(3)), "", "exit 3 is the script's own 'no such file'");
+    assert.throws(() => readSudoersFile(status(1)), /could not read \/etc\/sudoers\.d\/appforge-agent.*will not rewrite it from nothing/s, "a declined or failed sudo");
+    assert.throws(() => readSudoersFile(status(2)), /will not rewrite/);
+    let argv = [];
+    readSudoersFile((a) => ((argv = a), ""));
+    assert.deepEqual(argv.slice(0, 2), ["/bin/sh", "-c"]);
+    assert.equal(argv.at(-1), SUDOERS_FILE, "the path is a positional parameter, never part of the script text");
 });
 // ---- installBuildUser: the full orchestration, each step's idempotency in isolation ----
 test("installBuildUser creates the account, adds the agent user to its group, installs the helper + pf rules, and writes both sudoers lines — on a clean host", () => {

package/dist/lib/build-user.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-user.test.js","sourceRoot":"","sources":["../../src/lib/build-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAC9H,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,SAAS,QAAQ,CAAC,OAAsC,EAAE;IACxD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAyB;QACjC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;QACvB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;QAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;QACpC,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;QACzB,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE;QACrB,eAAe,EAAE,GAAG,EAAE,GAAE,CAAC;QACzB,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjF,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,GAAG,IAAI;KACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,GAAG,EAAE;IACvH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,0FAA0F,CAAC,CAAC;AACpJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gIAAgI,EAAE,GAAG,EAAE;IAC1I,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gCAAgC,iBAAiB,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,gEAAgE,CAAC,CAAC;IAC3F,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,oEAAoE,CAAC,CAAC;IAC/G,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oEAAoE,CAAC,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0IAA0I,EAAE,GAAG,EAAE;IACpJ,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,yFAAyF,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,QAAuB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,+DAA+D,CAAC,CAAC;IACzJ,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,iDAAiD,CAAC,CAAC;IACtI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;AACzH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uHAAuH,EAAE,GAAG,EAAE;IACjI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACpG,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+DAA+D,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+EAA+E,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,0GAA0G,CAAC,CAAC;IAClI,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6DAA6D,CAAC,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,uCAAuC,CAAC,CAAC;IAC1I,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,oBAAoB,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,6FAA6F;AAE7F,IAAI,CAAC,uIAAuI,EAAE,GAAG,EAAE;IACjJ,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC;IACjH,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,EAAE,EAAE;QACjC,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC,CAAC;IACF,kBAAkB,CAAC,CAAC,8DAA8D,EAAE,gEAAgE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,2DAA2D,EAAE,8DAA8D,CAAC,CAAC;IAC9J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,sFAAsF,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wGAAwG,EAAE,GAAG,EAAE;IAClH,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE;QAC1B,aAAa,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,GAAG,EAAE;IAC3G,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;IACxE,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,eAAe,GAAG,GAAG,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,6DAA6D,CAAC,CAAC;AAChG,CAAC,CAAC,CAAC;AAEH,2FAA2F;AAE3F,IAAI,CAAC,yJAAyJ,EAAE,GAAG,EAAE;IACnK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAE1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,4DAA4D,CAAC,CAAC;IACnL,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iDAAiD,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,oDAAoD,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,uDAAuD,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,kCAAkC,OAAO,EAAE,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;IACnK,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mCAAmC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACrJ,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4MAA4M,EAAE,GAAG,EAAE;IACtN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6BAA6B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6BAA6B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,gDAAgD,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uIAAuI,EAAE,GAAG,EAAE;IACjJ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,sCAAsC,CAAC,CAAC;AAC/H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6NAA6N,EAAE,GAAG,EAAE;IACvO,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/B,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,yFAAyF;QACjH,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACnM,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,oDAAoD,CAAC,CAAC;IAC3K,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,6EAA6E,CAAC,CAAC;AACvI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gHAAgH,EAAE,GAAG,EAAE;IAC1H,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,UAAU,CAAC;IAChF,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,KAAK,OAAO,IAAI;KAC5D,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,wGAAwG;IACxG,oGAAoG;IACpG,gHAAgH;IAChH,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,iEAAiE,CAAC,CAAC;IACvH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,SAAS,EAAE,yDAAyD,CAAC,CAAC;IAChI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,iHAAiH,CAAC,CAAC;AAC1M,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qHAAqH,EAAE,GAAG,EAAE;IAC/H,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7L,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACpI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4HAA4H,EAAE,GAAG,EAAE;IACtI,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,+BAA+B,EAAE,8FAA8F,CAAC,CAAC;AAC9J,CAAC,CAAC,CAAC"}
+{"version":3,"file":"build-user.test.js","sourceRoot":"","sources":["../../src/lib/build-user.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,mDAAmD,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAC9H,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EAEf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAEzB,SAAS,QAAQ,CAAC,OAAsC,EAAE;IACxD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAsE,EAAE,CAAC;IACrF,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAyB;QACjC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;QACvB,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;QAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;QACpC,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;QACzB,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE;QACrB,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3I,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,GAAG,IAAI;KACR,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,GAAG,EAAE;IACvH,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,0FAA0F,CAAC,CAAC;AACpJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gIAAgI,EAAE,GAAG,EAAE;IAC1I,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gCAAgC,iBAAiB,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,gEAAgE,CAAC,CAAC;IAC3F,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,oEAAoE,CAAC,CAAC;IAC/G,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,oEAAoE,CAAC,CAAC;AAC3H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0IAA0I,EAAE,GAAG,EAAE;IACpJ,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,yFAAyF,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,MAAM,EAAE,GAAG,CAAC,MAAc,EAAE,QAAuB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,eAAe,EAAE,+DAA+D,CAAC,CAAC;IACzJ,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,iDAAiD,CAAC,CAAC;IACtI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACrF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;AACzH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uHAAuH,EAAE,GAAG,EAAE;IACjI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACpG,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+DAA+D,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,+EAA+E,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,0GAA0G,CAAC,CAAC;IAClI,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6DAA6D,CAAC,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,sCAAsC,EAAE,uCAAuC,CAAC,CAAC;IAC1I,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,oBAAoB,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,6FAA6F;AAE7F,IAAI,CAAC,qKAAqK,EAAE,GAAG,EAAE;IAC/K,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC;IACjH,kBAAkB,CAAC,CAAC,8DAA8D,EAAE,gEAAgE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,SAAS,EAAE,0DAA0D,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,2DAA2D,EAAE,8DAA8D,CAAC,CAAC;IAC9J,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wGAAwG,EAAE,GAAG,EAAE;IAClH,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,OAAO,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3F,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,GAAG,EAAE;IAC3G,MAAM,MAAM,GAAG,8DAA8D,CAAC;IAC9E,MAAM,UAAU,GAAG,gEAAgE,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;IACxE,kBAAkB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8HAA8H,EAAE,GAAG,EAAE;IACxI,MAAM,MAAM,GAAG,2DAA2D,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,SAAS,EAAE,QAAQ,MAAM,IAAI,CAAC,EAAE,CAAC;QACrI,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,kBAAkB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,yCAAyC,CAAC,CAAC;QACtG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACtG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+HAA+H,EAAE,GAAG,EAAE;IACzI,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAChC,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACtG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kGAAkG,EAAE,GAAG,EAAE;IAC5G,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACrC,IAAI,CAAC,kBAAkB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACtD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,oGAAoG;AAEpG,8KAA8K;AAC9K,SAAS,QAAQ,CAAC,KAA2C;IAC3D,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YAAE,OAAO,EAAE,CAAC,CAAC,kDAAkD;QAChG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACzG,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,gOAAgO,EAAE,GAAG,EAAE;IAC1O,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,8CAA8C;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACnC,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC1F,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,iDAAiD,CAAC,CAAC;QAC9F,qCAAqC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACpH,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,OAAO,qBAAqB,CAAC,EAAE,sDAAsD,CAAC,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,yBAAyB,EAAE,8BAA8B,CAAC,CAAC;QACzF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,OAAO,qBAAqB,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC1G,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,6CAA6C,CAAC,CAAC;QACnJ,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC/H,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;;YACjD,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wLAAwL,EAAE,GAAG,EAAE;IAClM,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC7C,aAAa,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAyC,EAAE,CAAC;QACvD,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,6DAA6D,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzI,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAE,CAAC;QACpE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAE,CAAC;QACvD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gEAAgE,CAAC,CAAC;QAC3G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAyC,EAAE,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/H,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,oCAAoC,CAAC,CAAC;QACvF,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC7E,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,0CAA0C,CAAC,CAAC;IACzG,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2IAA2I,EAAE,GAAG,EAAE;IACrJ,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAe,CAAC,IAAI,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACxG,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,oEAAoE,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0HAA0H,EAAE,GAAG,EAAE;IACpI,MAAM,MAAM,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,GAAG,EAAE;QAC7C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,mCAAmC,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC9G,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,2CAA2C,CAAC,CAAC;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,qFAAqF,EAAE,2BAA2B,CAAC,CAAC;IACpK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACpE,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,mEAAmE,CAAC,CAAC;AAC/G,CAAC,CAAC,CAAC;AAEH,2FAA2F;AAE3F,IAAI,CAAC,yJAAyJ,EAAE,GAAG,EAAE;IACnK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAE1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,4DAA4D,CAAC,CAAC;IACnL,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,iDAAiD,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,oDAAoD,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,uDAAuD,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,kCAAkC,OAAO,EAAE,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;IACnK,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mCAAmC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACrJ,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4MAA4M,EAAE,GAAG,EAAE;IACtN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6BAA6B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6BAA6B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,gDAAgD,CAAC,CAAC;IACrG,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uIAAuI,EAAE,GAAG,EAAE;IACjJ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,sCAAsC,CAAC,CAAC;AAC/H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6NAA6N,EAAE,GAAG,EAAE;IACvO,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/B,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,yFAAyF;QACjH,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,iCAAiC,EAAE,oCAAoC,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACnM,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6CAA6C,CAAC,EAAE,oDAAoD,CAAC,CAAC;IAC3K,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,6EAA6E,CAAC,CAAC;AACvI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gHAAgH,EAAE,GAAG,EAAE;IAC1H,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,UAAU,CAAC;IAChF,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QACvC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;QACvB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,KAAK,OAAO,IAAI;KAC5D,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,wGAAwG;IACxG,oGAAoG;IACpG,gHAAgH;IAChH,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,iEAAiE,CAAC,CAAC;IACvH,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,SAAS,EAAE,yDAAyD,CAAC,CAAC;IAChI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,iBAAiB,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,iHAAiH,CAAC,CAAC;AAC1M,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qHAAqH,EAAE,GAAG,EAAE;IAC/H,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7L,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACpI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;IACpC,gBAAgB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4HAA4H,EAAE,GAAG,EAAE;IACtI,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,+BAA+B,EAAE,8FAA8F,CAAC,CAAC;AAC9J,CAAC,CAAC,CAAC"}

package/dist/lib/root-install-scripts.test.d.ts

@@ -0,0 +1,10 @@
+import "../test-support/home-sandbox.js";
+/**
+ * Lines of `text` that put user-writable bytes in front of root:
+ *  - `visudo -c...` on anything but the staged copy (`"$staged"`, the file `install_root_file` made through a root-owned directory);
+ *  - `sudo install|cp|mv|visudo` naming a variable that holds (or is derived from) the result of an UNPRIVILEGED `mktemp`.
+ */
+export declare function findRootInstallRaces(text: string, opts?: {
+    allowRootMovesOfOwnFiles?: boolean;
+}): string[];
+//# sourceMappingURL=root-install-scripts.test.d.ts.map

package/dist/lib/root-install-scripts.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-install-scripts.test.d.ts","sourceRoot":"","sources":["../../src/lib/root-install-scripts.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AA2CzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,EAAE,CA2B9G"}

package/dist/lib/root-install-scripts.test.js

@@ -0,0 +1,126 @@
+import "../test-support/home-sandbox.js";
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * The shell installers under infra/ that put bytes into root-owned places (appforge-ci#901 review, finding 1).
+ *
+ * `installRootOwnedFile` (build-user.ts) closes the TypeScript installers: the bytes root installs never sit in a path the invoking user
+ * can write between "checked" and "installed". The invoking user is the agent's account, which also runs tenant builds, so a temp file that
+ * is `visudo`-checked and then `sudo cp`'d can be rewritten in the window and the sudoers file would hold attacker-chosen bytes. The shell
+ * installers (`ensure-reboot-sudoers.sh`, `first-touch.sh`) had the same shape. This file keeps the whole class closed:
+ *
+ *   1. their own behavioural tests (stub sudo that plays the attacker around every privileged command) run in CI, which they did not before;
+ *   2. the one function they share is byte-identical in both, so a fix to one cannot drift from the other;
+ *   3. a scanner over every infra script rejects the pattern itself (a root-side `install`/`cp`/`mv`/`visudo` of a path made by an
+ *      unprivileged `mktemp`, or `visudo` on anything but the root-made staged copy), so a THIRD script cannot reintroduce it.
+ */
+const INFRA = join(dirname(fileURLToPath(import.meta.url)), "../../../../infra");
+const SETUP = join(INFRA, "mac-mini-setup");
+/** Non-test shell scripts and templates under infra/. */
+function infraScripts() {
+    return readdirSync(INFRA, { recursive: true })
+        .filter((f) => /\.(sh|tmpl)$/.test(f) && !/(^|\/)test-[^/]*\.sh$/.test(f))
+        .sort()
+        .map((f) => ({ path: `infra/${f}`, text: readFileSync(join(INFRA, f), "utf8") }));
+}
+const code = (line) => line.replace(/^\s*#.*$/, "");
+/**
+ * Scripts that run only INSIDE the temporary provisioning window `first-touch.sh` opens (the invoking account has `NOPASSWD: ALL` for it,
+ * by design: docs/datacenter-readiness.md section 5), over ssh from the laptop, on a Mac that is not taking builds yet. Root-side moves of
+ * files from the account's own directories are what that window is for; a root-owned staging directory would protect nothing the account
+ * does not already hold. They are still held to the `visudo` rule. Anything else is not on this list on purpose.
+ */
+const PROVISIONING_WINDOW_ONLY = new Set(["infra/mac-mini-setup/provision-remote.sh"]);
+/**
+ * Lines of `text` that put user-writable bytes in front of root:
+ *  - `visudo -c...` on anything but the staged copy (`"$staged"`, the file `install_root_file` made through a root-owned directory);
+ *  - `sudo install|cp|mv|visudo` naming a variable that holds (or is derived from) the result of an UNPRIVILEGED `mktemp`.
+ */
+export function findRootInstallRaces(text, opts = {}) {
+    const lines = text.split("\n").map(code);
+    const tainted = new Set();
+    for (const line of lines) {
+        if (/\bsudo\b[^;&|]*\bmktemp\b/.test(line))
+            continue; // made by root: fine
+        for (const m of line.matchAll(/(?:^|[\s;(])([A-Za-z_]\w*)=[^\n]*\bmktemp\b/g))
+            tainted.add(m[1]);
+    }
+    // a variable built from a tainted one ("$WORK/appforge-agent", "${TMP}.plist") is just as writable
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const line of lines) {
+            const m = line.match(/(?:^|[\s;(])(?:local\s+)?([A-Za-z_]\w*)=(.*)$/);
+            if (!m || tainted.has(m[1]))
+                continue;
+            if ([...tainted].some((t) => new RegExp(`\\$\\{?${t}\\b`).test(m[2]))) {
+                tainted.add(m[1]);
+                changed = true;
+            }
+        }
+    }
+    const bad = [];
+    lines.forEach((line, i) => {
+        if (/(?:^|[;&|!(]|\bsudo)\s*(?:-\S+\s+)*(?:\/\S*\/)?visudo\s+-c/.test(line) && !/"\$staged"/.test(line))
+            bad.push(`${i + 1}: ${line.trim()}`);
+        else if (!opts.allowRootMovesOfOwnFiles && /\bsudo\s+(?:-\S+\s+)*(?:\/\S*\/)?(?:install|cp|mv|visudo)\b/.test(line) && [...tainted].some((t) => new RegExp(`\\$\\{?${t}\\b`).test(line))) {
+            bad.push(`${i + 1}: ${line.trim()}`);
+        }
+    });
+    return bad;
+}
+test("the scanner flags the shape the review found, and passes the staged one (it is not vacuous)", () => {
+    const ensureOld = [
+        'WORK="$(mktemp -d "${TMPDIR:-/tmp}/reboot-sudoers.XXXXXX")"',
+        'NEW="$WORK/appforge-agent"',
+        'if ! sudo visudo -cf "$NEW" >/dev/null; then exit 1; fi',
+        'sudo cp "$NEW" "$STAGE"',
+    ].join("\n");
+    assert.equal(findRootInstallRaces(ensureOld).length, 2);
+    const firstTouchOld = ['TMP="$(mktemp "${TMPDIR:-/tmp}/appforge-provision.XXXXXX")"', 'sudo install -m 440 -o root -g wheel "$TMP" "$SUDOERS_FILE"', 'sudo install -m 644 "${TMP}.plist" "$PLIST"'].join("\n");
+    assert.equal(findRootInstallRaces(firstTouchOld).length, 2);
+    const staged = [
+        'raw="$(sudo /usr/bin/mktemp -d "$dir/.appforge-install.XXXXXXXXXX")" || return 1',
+        'sudo /usr/sbin/visudo -cf "$staged" >/dev/null 2>&1 || rc=2',
+        'sudo /bin/mv -f "$staged" "$dest"',
+    ].join("\n");
+    assert.deepEqual(findRootInstallRaces(staged), []);
+    // a comment, or a message that merely names the tool, is not code
+    assert.deepEqual(findRootInstallRaces('# was: sudo visudo -cf "$NEW"'), []);
+    assert.deepEqual(findRootInstallRaces('echo "   [dry-run] write the rule (validated with visudo -cf)"'), []);
+    // visudo is held to the staged copy even where root-side moves of the account's own files are allowed
+    assert.equal(findRootInstallRaces('sudo visudo -cf "$NEW"', { allowRootMovesOfOwnFiles: true }).length, 1);
+    assert.deepEqual(findRootInstallRaces(ensureOld.split("\n").slice(0, 2).concat('sudo cp "$NEW" "$X"').join("\n"), { allowRootMovesOfOwnFiles: true }), []);
+});
+test("no infra script validates or installs root-bound bytes from a path the invoking user can write", () => {
+    const offenders = infraScripts().flatMap(({ path, text }) => findRootInstallRaces(text, { allowRootMovesOfOwnFiles: PROVISIONING_WINDOW_ONLY.has(path) }).map((l) => `${path}:${l}`));
+    assert.deepEqual(offenders, [], "use install_root_file (first-touch.sh / ensure-reboot-sudoers.sh) or installRootOwnedFile (build-user.ts)");
+});
+test("install_root_file is the same function in first-touch.sh and ensure-reboot-sudoers.sh", () => {
+    const block = (name) => {
+        const text = readFileSync(join(SETUP, name), "utf8");
+        const m = text.match(/^# --- install_root_file: begin[^\n]*\n[\s\S]*?^# --- install_root_file: end[^\n]*$/m);
+        assert.ok(m, `${name} has no install_root_file block`);
+        return m[0];
+    };
+    const a = block("first-touch.sh");
+    assert.equal(a, block("ensure-reboot-sudoers.sh"));
+    // and the block really does what the review asked for
+    assert.match(a, /sudo \/usr\/bin\/mktemp -d "\$dir\/\.appforge-install\.XXXXXXXXXX"/, "the staging directory is made by root, beside the destination");
+    assert.match(a, /sudo \/usr\/bin\/tee "\$staged"/, "the content reaches root on stdin");
+    assert.match(a, /sudo \/usr\/sbin\/visudo -cf "\$staged"/, "the check runs on the staged bytes");
+    assert.match(a, /sudo \/bin\/mv -f "\$staged" "\$dest"/, "one rename puts them in place");
+});
+function runShellTest(name) {
+    const r = spawnSync("bash", [join(SETUP, name)], { encoding: "utf8", timeout: 180_000, killSignal: "SIGKILL", env: { ...process.env, LC_ALL: "C" } });
+    const failed = (r.stdout ?? "").split("\n").filter((l) => /FAIL/.test(l));
+    assert.equal(r.status, 0, `${name} failed (status ${r.status}, ${r.signal ?? "no signal"}):\n${failed.join("\n")}\n${(r.stderr ?? "").slice(-2000)}`);
+    assert.match(r.stdout, /\d+ passed, 0 failed/);
+}
+test("ensure-reboot-sudoers.sh: its behavioural test passes, including the temp-directory race", () => runShellTest("test-ensure-reboot-sudoers.sh"));
+// BSD stat and plutil: the Mac runners CI uses, not a Linux box.
+test("first-touch.sh: its behavioural test passes, including the temp-directory race", { skip: process.platform !== "darwin" && "needs macOS (stat -f, plutil)" }, () => runShellTest("test-first-touch.sh"));
+//# sourceMappingURL=root-install-scripts.test.js.map

package/dist/lib/root-install-scripts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-install-scripts.test.js","sourceRoot":"","sources":["../../src/lib/root-install-scripts.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;;;GAYG;AAEH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAE5C,yDAAyD;AACzD,SAAS,YAAY;IACnB,OAAQ,WAAW,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAc;SACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACzE,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAA+C,EAAE;IAClG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,qBAAqB;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACpG,CAAC;IACD,mGAAmG;IACnG,KAAK,IAAI,OAAO,GAAG,IAAI,EAAE,OAAO,GAAI,CAAC;QACnC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,CAAC;gBACvE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACzI,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzL,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,CAAC,6FAA6F,EAAE,GAAG,EAAE;IACvG,MAAM,SAAS,GAAG;QAChB,6DAA6D;QAC7D,4BAA4B;QAC5B,yDAAyD;QACzD,yBAAyB;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,CAAC,6DAA6D,EAAE,6DAA6D,EAAE,6CAA6C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/M,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG;QACb,kFAAkF;QAClF,6DAA6D;QAC7D,mCAAmC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,+BAA+B,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,gEAAgE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7G,sGAAsG;IACtG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,wBAAwB,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7J,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1D,oBAAoB,CAAC,IAAI,EAAE,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CACxH,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,2GAA2G,CAAC,CAAC;AAC/I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC7G,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,iCAAiC,CAAC,CAAC;QACvD,OAAO,CAAE,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACnD,sDAAsD;IACtD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oEAAoE,EAAE,+DAA+D,CAAC,CAAC;IACvJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,EAAE,mCAAmC,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,yCAAyC,EAAE,oCAAoC,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,uCAAuC,EAAE,+BAA+B,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtJ,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,WAAW,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtJ,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC,CAAC;AAEtJ,iEAAiE;AACjE,IAAI,CAAC,gFAAgF,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC"}

package/dist/lib/vm-helper.d.ts

@@ -15,14 +15,18 @@ import { type BuildUserInstallDeps } from "./build-user.js";
  *   2. One sudoers line, appended to the EXISTING /etc/sudoers.d/appforge-agent (the other lines stay):
  *          <agent user> ALL=(root) NOPASSWD: /etc/appforge/vm-helper.sh *
  *      It names the one fixed, root-owned path, so the agent can run that script and nothing else as root. It is validated with
- *      `visudo -c` on a copy BEFORE it reaches the real file: a syntax error in sudoers can lock sudo out of the whole Mac.
+ *      `visudo -c` on the exact staged bytes BEFORE they replace the real file (one atomic rename): a syntax error in sudoers can
+ *      lock sudo out of the whole Mac. Both root-owned files are staged in a directory only root can enter (build-user.ts
+ *      `installRootOwnedFile`), never in the agent account's own temp directory.
  *   3. Permission for the helper account to walk through the agent's home directory (`chmod +a "<vm user> allow search"`, the same
  *      narrow entry install-build-user gives the build user): the build's shared folders live in the jobs root under that home,
  *      and the VM, started by the helper account, has to reach them. "Search" lets it open a path it already knows without being
  *      able to list anything.
  *
  * It does NOT create the helper account (install-vm-user does), start anything, or install an image. It checks the first two exist
- * and says what is missing. Idempotent: running it again rewrites the same script and adds no duplicate line.
+ * and says what is missing. Idempotent: running it again rewrites the same script and adds no duplicate line. Run it again after an
+ * agent release whose helper protocol is newer (`appforge-agent doctor` says so, and a Mac with an older helper stops offering
+ * remote-access builds until it is done: the agent updates itself, a root-owned file cannot).
  *
  * Every real-world action is behind the injectable deps (the same seam build-user.ts uses), so the decisions (which lines are
  * written, what is refused, what the script says) are unit-tested without touching a real account, sudoers file or home directory.

package/dist/lib/vm-helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vm-helper.d.ts","sourceRoot":"","sources":["../../src/lib/vm-helper.ts"],"names":[],"mappings":"AAKA,OAAO,EAAkB,YAAY,EAAwB,MAAM,oDAAoD,CAAC;AACxH,OAAO,EAAkG,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5J;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,6FAA6F;IAC7F,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,uBAAuB,EAAE,mBAIrC,CAAC;AAEF,uHAAuH;AACvH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAElF;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,EAAE,IAAI,GAAE,mBAA6C,GAAG,IAAI,CAuC5H;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"vm-helper.d.ts","sourceRoot":"","sources":["../../src/lib/vm-helper.ts"],"names":[],"mappings":"AAKA,OAAO,EAAkB,YAAY,EAAwB,MAAM,oDAAoD,CAAC;AACxH,OAAO,EAAkG,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5J;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,6FAA6F;IAC7F,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,uBAAuB,EAAE,mBAIrC,CAAC;AAEF,uHAAuH;AACvH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAElF;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,EAAE,IAAI,GAAE,mBAA6C,GAAG,IAAI,CAuC5H;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/lib/vm-helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"vm-helper.js","sourceRoot":"","sources":["../../src/lib/vm-helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,EAA6B,MAAM,iBAAiB,CAAC;AAqC5J,MAAM,CAAC,MAAM,uBAAuB,GAAwB;IAC1D,GAAG,wBAAwB;IAC3B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;CAC9F,CAAC;AAEF,uHAAuH;AACvH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,yBAAyB,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE,EAAE,OAA4B,uBAAuB;IACpH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEpD,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,+JAA+J,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,8FAA8F,CAAC,CAAC;IACxI,CAAC;IACD,0IAA0I;IAC1I,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,kBAAkB,MAAM,kBAAkB,IAAI,uFAAuF,CAAC,CAAC;QAChJ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,iBAAiB,QAAQ,eAAe,IAAI,gBAAgB,MAAM,qEAAqE,CAAC,CAAC;IACpJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,qCAAqC,cAAc,qBAAqB,CAAC,CAAC;IACnF,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,kBAAkB,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAE3E,IAAI,CAAC,GAAG,CACN;QACE,EAAE;QACF,UAAU,SAAS,iBAAiB,cAAc,uDAAuD,MAAM,IAAI;QACnH,qIAAqI;QACrI,qGAAqG;QACrG,6EAA6E;QAC7E,IAAI,YAAY,8FAA8F;KAC/G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"vm-helper.js","sourceRoot":"","sources":["../../src/lib/vm-helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,EAA6B,MAAM,iBAAiB,CAAC;AAyC5J,MAAM,CAAC,MAAM,uBAAuB,GAAwB;IAC1D,GAAG,wBAAwB;IAC3B,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;CAC9F,CAAC;AAEF,uHAAuH;AACvH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,yBAAyB,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE,EAAE,OAA4B,uBAAuB;IACpH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEpD,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,+JAA+J,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,8FAA8F,CAAC,CAAC;IACxI,CAAC;IACD,0IAA0I;IAC1I,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,kBAAkB,MAAM,kBAAkB,IAAI,uFAAuF,CAAC,CAAC;QAChJ,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,iBAAiB,QAAQ,eAAe,IAAI,gBAAgB,MAAM,qEAAqE,CAAC,CAAC;IACpJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,qCAAqC,cAAc,qBAAqB,CAAC,CAAC;IACnF,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,kBAAkB,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAE3E,IAAI,CAAC,GAAG,CACN;QACE,EAAE;QACF,UAAU,SAAS,iBAAiB,cAAc,uDAAuD,MAAM,IAAI;QACnH,qIAAqI;QACrI,qGAAqG;QACrG,6EAA6E;QAC7E,IAAI,YAAY,8FAA8F;KAC/G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/lib/vm-helper.test.js

@@ -17,8 +17,7 @@ function fakeDeps(over = {}) {
         listGroupGids: () => "",
         etcDirExists: () => true,
         readSudoers: () => "administrator ALL=(root) NOPASSWD: /etc/appforge/build-helper.sh *\n",
-        validateSudoers: (c) => void validated.push(c),
-        writeRootOwnedFile: (path, content, mode) => void writes.push({ path, content, mode }),
+        writeRootOwnedFile: (path, content, mode, opts) => void (writes.push({ path, content, mode }), opts?.check === "sudoers" && validated.push(content)),
         run: (cmd, args) => void calls.push({ cmd, args }),
         whoami: () => "administrator",
         sudoUser: () => null,
@@ -50,7 +49,8 @@ test("installs the root-owned script (0500), validates the new sudoers content w
     assert.match(sudoers.content, /^administrator ALL=\(root\) NOPASSWD: \/etc\/appforge\/build-helper\.sh \*$/m, "the existing line stays");
     assert.match(sudoers.content, /^administrator ALL=\(root\) NOPASSWD: \/etc\/appforge\/vm-helper\.sh \*$/m);
     assert.equal(validated.length, 1);
-    assert.equal(validated[0], sudoers.content, "visudo saw exactly what was written");
+    assert.equal(validated[0], sudoers.content, "the sudoers install asks for the visudo check on exactly what it writes");
+    assert.equal(writes.filter((w) => w.path === VM_HELPER_PATH).length, 1);
     assert.ok(writes.indexOf(sudoers) > writes.indexOf(script), "the helper exists before the rule that points at it");
     assert.deepEqual(calls, [{ cmd: "chmod", args: ["+a", "appforge-vm allow search", "/Users/administrator"] }], "search-only on the home, nothing else");
 });
@@ -62,8 +62,10 @@ test("running it again adds no second sudoers line and rewrites no sudoers file"
 });
 test("a syntax error visudo finds stops the install before the real sudoers file is touched", () => {
     const { deps, writes } = fakeDeps({
-        validateSudoers: () => {
-            throw new Error("visudo: syntax error");
+        writeRootOwnedFile: (path, content, mode, opts) => {
+            if (opts?.check === "sudoers")
+                throw new Error("visudo: syntax error");
+            writes.push({ path, content, mode });
         },
     });
     assert.throws(() => installVmHelper({ jobsRoot: "/Users/administrator/appforge/jobs.noindex" }, deps), /syntax error/);

package/dist/lib/vm-helper.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"vm-helper.test.js","sourceRoot":"","sources":["../../src/lib/vm-helper.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,YAAY,EAA6B,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAA4B,MAAM,gBAAgB,CAAC;AAEzG,SAAS,QAAQ,CAAC,OAAqC,EAAE;IACvD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAwB;QAChC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa;QACtC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;QAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;QACtB,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,WAAW,EAAE,GAAG,EAAE,CAAC,sEAAsE;QACzF,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtF,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe;QAC7B,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;QAC5B,GAAG,IAAI;KACsC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,GAAG,EAAE;IACvH,MAAM,EAAE,MAAM,EAAE,GAAG,4BAA4B,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,sCAAsC,cAAc,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iLAAiL,EAAE,GAAG,EAAE;IAC3L,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;IACzE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,8EAA8E,EAAE,yBAAyB,CAAC,CAAC;IACzI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,2EAA2E,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;IACnF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qDAAqD,CAAC,CAAC;IACnH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,sBAAsB,CAAC,EAAE,CAAC,EAAE,uCAAuC,CAAC,CAAC;AACzJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,sCAAsC,cAAc,MAAM,EAAE,CAAC,CAAC;IACrH,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,8DAA8D,CAAC,CAAC;AAC1I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAChC,eAAe,EAAE,GAAG,EAAE;YACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,oDAAoD,CAAC,CAAC;IACvG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAE,EAAE,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC5H,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC9I,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7G,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,GAAG,EAAE;IACtG,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,EAAE,2EAA2E,CAAC,CAAC;IACrJ,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,GAAG,EAAE;IACpH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,QAAQ,EAAE,8BAA8B,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"vm-helper.test.js","sourceRoot":"","sources":["../../src/lib/vm-helper.test.ts"],"names":[],"mappings":"AAAA,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,EAAE,YAAY,EAA6B,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAA4B,MAAM,gBAAgB,CAAC;AAEzG,SAAS,QAAQ,CAAC,OAAqC,EAAE;IACvD,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAwB;QAChC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa;QACtC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK;QAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;QACtB,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI;QACxB,WAAW,EAAE,GAAG,EAAE,CAAC,sEAAsE;QACzF,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpJ,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe;QAC7B,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;QACpB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;QAC5B,GAAG,IAAI;KACsC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,GAAG,EAAE;IACvH,MAAM,EAAE,MAAM,EAAE,GAAG,4BAA4B,CAAC,eAAe,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,sCAAsC,cAAc,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iLAAiL,EAAE,GAAG,EAAE;IAC3L,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAE,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,0CAA0C,CAAC,CAAC;IACzE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,8EAA8E,EAAE,yBAAyB,CAAC,CAAC;IACzI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,2EAA2E,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,yEAAyE,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qDAAqD,CAAC,CAAC;IACnH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,sBAAsB,CAAC,EAAE,CAAC,EAAE,uCAAuC,CAAC,CAAC;AACzJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,sCAAsC,cAAc,MAAM,EAAE,CAAC,CAAC;IACrH,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,8DAA8D,CAAC,CAAC;AAC1I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAChC,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAChD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,oDAAoD,CAAC,CAAC;IACvG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAE,EAAE,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC5H,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC9I,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC7G,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,GAAG,EAAE;IACtG,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,eAAe,CAAC,EAAE,QAAQ,EAAE,4CAA4C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,EAAE,2EAA2E,CAAC,CAAC;IACrJ,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;AAC1H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,GAAG,EAAE;IACpH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,QAAQ,EAAE,8BAA8B,EAAE,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appforge-ci/admin-cli",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -15,8 +15,8 @@
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
-    "@appforge-ci/agent": "0.3.19",
-    "@appforge-ci/core": "0.3.19"
+    "@appforge-ci/agent": "0.3.20",
+    "@appforge-ci/core": "0.3.20"
   },
   "devDependencies": {
     "@types/node": "^20.16.5",