camunda-cloud-idac 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jan Rohwer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+# camunda-cloud-idac
+
+Identity-as-code reconciler for Camunda 8: declares tenants, roles, groups,
+mapping rules, and authorizations in a YAML spec, then reconciles a live
+cluster against it via `@camunda8/orchestration-cluster-api`.
+
+Complements (does not replace) Camunda 8.8's built-in "Identity as Code"
+Spring Boot feature, which only creates missing entities once at cluster
+boot and never updates or deletes anything. This tool can run anytime
+against a live cluster, updates entities in place, and supports pruning
+(`--prune`) to delete anything not in the spec.
+
+**Hard safety guarantee** (see `src/reconcile/protect.ts` - the single audit
+point for all of this, applied unconditionally after diffing regardless of
+spec content):
+
+- The `admin` role is never deleted.
+- The `admin` role's authorizations are fully hands-off: never created,
+  updated, or deleted by this tool at all - not merely protected from
+  deletion.
+- This tool's own client (`CAMUNDA_CLIENT_ID`) never loses its assignment to
+  the `admin` role, so a full `--prune` reset can never lock the tool itself
+  out. This guard only protects an *existing* assignment from removal - it
+  does not proactively assign the client if that assignment is missing.
+- The `<default>` system tenant is never deleted (the API already rejects
+  this server-side; this is defense in depth).
+
+The `admin` *group* (if one exists) has **no special protection** - it's
+reconciled like any other group, including deletion under `--prune`. Adding
+or removing members (users/clients/groups/mapping rules) on the `admin`
+role is always fine and unaffected by any of the above; only deleting the
+role itself, mutating its authorizations, or unassigning the tool's own
+client from it are guarded.
+
+## Installation
+
+Set the `CAMUNDA_*` connection env vars first (OAuth client credentials for
+an M2M client with admin authorizations, cluster REST address, optional
+mTLS) - see `.env.example` for the full list.
+
+Run without installing:
+
+```sh
+npx camunda-cloud-idac plan spec.yaml [--prune]
+```
+
+Or install globally and use the `camunda-idac` (or shorter `cci`) command:
+
+```sh
+npm install -g camunda-cloud-idac
+
+camunda-idac validate spec.yaml
+camunda-idac plan spec.yaml [--prune]
+camunda-idac apply spec.yaml [--prune] [--yes]
+
+# cci is an alias for camunda-idac
+cci plan spec.yaml
+```
+
+`--prune` absent = additive mode (default): only creates/updates, never
+deletes. `apply` without `--yes` prints the plan and asks for interactive
+confirmation; it refuses to run without `--yes` on a non-interactive shell
+(CI), so a pipeline can never silently confirm a destructive prune.
+
+## Development
+
+```sh
+npm install
+cp .env.example .env   # fill in CAMUNDA_* connection details, then export them
+
+npx tsx src/cli.ts validate spec.yaml          # schema + referential integrity only, no network
+npx tsx src/cli.ts plan spec.yaml [--prune]    # dry-run diff; exit 1 if there's drift (CI-friendly)
+npx tsx src/cli.ts apply spec.yaml [--prune] [--yes]
+```
+
+Build once for a compiled binary: `npm run build && node dist/cli.js ...`.
+
+## Spec format
+
+See `test/fixtures/valid-spec.yaml` for a complete example. Top-level keys:
+`tenants`, `roles`, `groups`, `mappingRules`, `authorizations` (all
+optional, default to `[]`). The "container" entity is authoritative for its
+own relationships - e.g. a role declares its own `groups`/`mappingRules`;
+there's no reverse field - which avoids conflicting declarations by
+construction.
+
+Roles and groups can also declare direct `users`/`clients` membership (not
+just mapping-rule/group-based provisioning) - useful for OIDC setups where
+some principals are granted access by username/client ID rather than by an
+IdP group claim. These aren't declared entities elsewhere in the spec, so
+there's no referential-integrity check on them (any string is accepted).
+
+## Known limitations
+
+- Direct **tenant**-to-user/client assignments aren't modeled by the spec
+  (only tenant-to-role/group are) - role- and group-level user/client
+  membership is fully supported and reconciled/cascaded by `--prune`, but
+  tenant-level direct user/client assignment is not.
+- `plan`/`apply` read full current state once per run (not continuously),
+  so back-to-back runs within the cluster's eventual-consistency window
+  could theoretically miss very recent changes. Acceptable for an
+  interactively/CI-run admin CLI.
+
+## Testing
+
+```sh
+npm run typecheck   # includes test/ via tsconfig.typecheck.json
+npm test            # vitest - schema, diff, protect (safety-critical), order
+```
+
+`test/reconcile/protect.test.ts` and `test/reconcile/diff.test.ts` are the
+load-bearing suites: they cover the admin/default protection invariant and
+the cascading-delete ordering directly.
+
+No integration test suite against a live cluster yet - run the commands
+above manually against a local `c8run` cluster before relying on `--prune`
+in production, per the design plan's verification section.

package/dist/camunda/client.js

@@ -0,0 +1,33 @@
+import { createCamundaClientLoose } from "@camunda8/orchestration-cluster-api";
+// The SDK also ships `createCamundaResultClient`, a proxy that mirrors CamundaClient
+// but returns Promise<Result<T>> everywhere. Its own .d.ts marks it
+// "@experimental ... not guaranteed to be fully tested or stable", so we deliberately
+// do NOT depend on it here. Instead we use the throwing client and wrap calls
+// ourselves with `toResult`, using the SDK's own `Result`/`ok` discriminant shape so
+// the rest of the codebase still gets Result-style branching without depending on
+// experimental SDK surface.
+//
+// We use the "Loose" client variant (all branded ID types - tenantId, authorizationKey,
+// username - widened to plain string) rather than the strict one: every ID in this tool
+// comes from user-authored YAML or from a prior search response, so the branded-type
+// safety net buys nothing and would otherwise force casts at every tenant/authorization
+// call site.
+let client;
+export function getClient() {
+    if (!client)
+        client = createCamundaClientLoose();
+    return client;
+}
+/** Skip eventual-consistency polling: every get/search in this tool re-reads full
+ * current state right before diffing, so waiting mid-computation buys nothing. */
+export const NO_WAIT = { consistency: { waitUpToMs: 0 } };
+export async function toResult(op) {
+    try {
+        const value = await op();
+        return { ok: true, value };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/camunda/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/camunda/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAwC,MAAM,qCAAqC,CAAC;AAErH,qFAAqF;AACrF,oEAAoE;AACpE,sFAAsF;AACtF,8EAA8E;AAC9E,qFAAqF;AACrF,kFAAkF;AAClF,4BAA4B;AAC5B,EAAE;AACF,wFAAwF;AACxF,wFAAwF;AACxF,qFAAqF;AACrF,wFAAwF;AACxF,aAAa;AAEb,IAAI,MAAsC,CAAC;AAE3C,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,wBAAwB,EAAE,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;kFACkF;AAClF,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAW,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,EAAoB;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/camunda/list-all.js

@@ -0,0 +1,166 @@
+import { getClient, NO_WAIT } from "./client.js";
+const client = () => getClient();
+const PAGE_SIZE = 100;
+async function paginateAll(fetchPage) {
+    const all = [];
+    let from = 0;
+    for (;;) {
+        const { items, page } = await fetchPage({ from, limit: PAGE_SIZE });
+        all.push(...items);
+        from += items.length;
+        if (items.length === 0 || from >= page.totalItems)
+            break;
+    }
+    return all;
+}
+export async function listAllTenants() {
+    const items = await paginateAll((page) => client().searchTenants({ page }, NO_WAIT));
+    return items.map((t) => ({ tenantId: t.tenantId, name: t.name, description: t.description }));
+}
+export async function listAllRoles() {
+    const items = await paginateAll((page) => client().searchRoles({ page }, NO_WAIT));
+    return items.map((r) => ({ roleId: r.roleId, name: r.name, description: r.description }));
+}
+export async function listAllGroups() {
+    const items = await paginateAll((page) => client().searchGroups({ page }, NO_WAIT));
+    return items.map((g) => ({ groupId: g.groupId, name: g.name, description: g.description }));
+}
+export async function listAllMappingRules() {
+    const items = await paginateAll((page) => client().searchMappingRule({ page }, NO_WAIT));
+    return items.map((m) => ({
+        mappingRuleId: m.mappingRuleId,
+        claimName: m.claimName,
+        claimValue: m.claimValue,
+        name: m.name,
+    }));
+}
+export async function listAllAuthorizations() {
+    const items = await paginateAll((page) => client().searchAuthorizations({ page }, NO_WAIT));
+    return items
+        .filter((a) => a.resourceId !== null)
+        .map((a) => ({
+        authorizationKey: a.authorizationKey,
+        ownerId: a.ownerId,
+        ownerType: a.ownerType,
+        resourceType: a.resourceType,
+        resourceId: a.resourceId,
+        permissionTypes: a.permissionTypes,
+    }));
+}
+async function fetchRelationships(roles, groups, tenants, onProgress) {
+    const roleGroup = new Set();
+    const roleMappingRule = new Set();
+    const groupMappingRule = new Set();
+    const tenantRole = new Set();
+    const tenantGroup = new Set();
+    const groupUser = new Set();
+    const groupClient = new Set();
+    const roleUser = new Set();
+    const roleClient = new Set();
+    const tenantMappingRule = new Set();
+    const total = roles.length + groups.length + tenants.length;
+    let completed = 0;
+    const tick = () => onProgress?.(++completed, total);
+    await Promise.all([
+        ...roles.map(async (role) => {
+            const [groupsForRole, mappingRulesForRole, usersForRole, clientsForRole] = await Promise.all([
+                paginateAll((page) => client().searchGroupsForRole({ roleId: role.roleId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchMappingRulesForRole({ roleId: role.roleId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchUsersForRole({ roleId: role.roleId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchClientsForRole({ roleId: role.roleId, page }, NO_WAIT)),
+            ]);
+            for (const g of groupsForRole)
+                roleGroup.add(`${role.roleId}::${g.groupId}`);
+            for (const m of mappingRulesForRole)
+                roleMappingRule.add(`${role.roleId}::${m.mappingRuleId}`);
+            for (const u of usersForRole)
+                roleUser.add(`${role.roleId}::${u.username}`);
+            for (const c of clientsForRole)
+                roleClient.add(`${role.roleId}::${c.clientId}`);
+            tick();
+        }),
+        ...groups.map(async (group) => {
+            const [mappingRulesForGroup, usersForGroup, clientsForGroup] = await Promise.all([
+                paginateAll((page) => client().searchMappingRulesForGroup({ groupId: group.groupId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchUsersForGroup({ groupId: group.groupId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchClientsForGroup({ groupId: group.groupId, page }, NO_WAIT)),
+            ]);
+            for (const m of mappingRulesForGroup)
+                groupMappingRule.add(`${group.groupId}::${m.mappingRuleId}`);
+            for (const u of usersForGroup)
+                groupUser.add(`${group.groupId}::${u.username}`);
+            for (const c of clientsForGroup)
+                groupClient.add(`${group.groupId}::${c.clientId}`);
+            tick();
+        }),
+        ...tenants.map(async (tenant) => {
+            const [rolesForTenant, groupIdsForTenant, mappingRulesForTenant] = await Promise.all([
+                paginateAll((page) => client().searchRolesForTenant({ tenantId: tenant.tenantId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchGroupIdsForTenant({ tenantId: tenant.tenantId, page }, NO_WAIT)),
+                paginateAll((page) => client().searchMappingRulesForTenant({ tenantId: tenant.tenantId, page }, NO_WAIT)),
+            ]);
+            for (const r of rolesForTenant)
+                tenantRole.add(`${tenant.tenantId}::${r.roleId}`);
+            for (const g of groupIdsForTenant)
+                tenantGroup.add(`${tenant.tenantId}::${g.groupId}`);
+            for (const m of mappingRulesForTenant)
+                tenantMappingRule.add(`${tenant.tenantId}::${m.mappingRuleId}`);
+            tick();
+        }),
+    ]);
+    return {
+        roleGroup,
+        roleMappingRule,
+        groupMappingRule,
+        tenantRole,
+        tenantGroup,
+        groupUser,
+        groupClient,
+        roleUser,
+        roleClient,
+        tenantMappingRule,
+    };
+}
+/**
+ * Fetches the complete current cluster state in one pass: every tenant, role,
+ * group, mapping rule and authorization, plus every relationship pair between
+ * them. Relationship membership is queried for every *current* entity (not just
+ * ones named in the desired spec) - this is what makes cascading deletes possible
+ * in prune mode: an entity about to be pruned still has its stale links surfaced
+ * here, so diff.ts can schedule the unassign/delete-authorization actions that
+ * must run before the entity itself is deleted.
+ *
+ * `onProgress`, if given, is called as each of the two fetch phases (entity
+ * lists, then per-entity relationship lookups) makes progress - purely for
+ * caller-side UX (e.g. a CLI progress indicator); this function itself never
+ * renders anything.
+ */
+export async function fetchCurrentState(onProgress) {
+    let entitiesCompleted = 0;
+    const entityTick = () => onProgress?.({ phase: "entities", completed: ++entitiesCompleted, total: 5 });
+    const [tenants, roles, groups, mappingRules, authorizations] = await Promise.all([
+        listAllTenants().then((r) => {
+            entityTick();
+            return r;
+        }),
+        listAllRoles().then((r) => {
+            entityTick();
+            return r;
+        }),
+        listAllGroups().then((r) => {
+            entityTick();
+            return r;
+        }),
+        listAllMappingRules().then((r) => {
+            entityTick();
+            return r;
+        }),
+        listAllAuthorizations().then((r) => {
+            entityTick();
+            return r;
+        }),
+    ]);
+    const relationships = await fetchRelationships(roles, groups, tenants, (completed, total) => onProgress?.({ phase: "relationships", completed, total }));
+    return { tenants, roles, groups, mappingRules, authorizations, relationships };
+}
+//# sourceMappingURL=list-all.js.map

package/dist/camunda/list-all.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-all.js","sourceRoot":"","sources":["../../src/camunda/list-all.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAYjD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAEjC,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,KAAK,UAAU,WAAW,CACxB,SAA2G;IAE3G,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACnB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;QACpC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAsB;QACnC,YAAY,EAAE,CAAC,CAAC,YAA4B;QAC5C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,eAAe,EAAE,CAAC,CAAC,eAAmC;KACvD,CAAC,CAAC,CAAC;AACR,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAmB,EACnB,MAAqB,EACrB,OAAuB,EACvB,UAAuD;IAEvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAEpD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,CAAC,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3F,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3F,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBACjG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC1F,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;aAC7F,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,aAAa;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,KAAK,MAAM,CAAC,IAAI,mBAAmB;gBAAE,eAAe,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAC/F,KAAK,MAAM,CAAC,IAAI,YAAY;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,CAAC,IAAI,cAAc;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,CAAC,oBAAoB,EAAE,aAAa,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC/E,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9F,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;aACjG,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,oBAAoB;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACnG,KAAK,MAAM,CAAC,IAAI,aAAa;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChF,KAAK,MAAM,CAAC,IAAI,eAAe;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpF,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;QACF,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9B,MAAM,CAAC,cAAc,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACnF,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBAClG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBACrG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;aAC1G,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,cAAc;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,KAAK,MAAM,CAAC,IAAI,iBAAiB;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,IAAI,qBAAqB;gBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YACvG,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,eAAe;QACf,gBAAgB;QAChB,UAAU;QACV,WAAW;QACX,SAAS;QACT,WAAW;QACX,QAAQ;QACR,UAAU;QACV,iBAAiB;KAClB,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAgD;IACtF,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/E,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1B,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACzB,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,qBAAqB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACjC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAC1F,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAC3D,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AACjF,CAAC"}

package/dist/camunda/ops.js

@@ -0,0 +1,63 @@
+import { getClient, toResult } from "./client.js";
+const client = () => getClient();
+export const tenantOps = {
+    create: (tenantId, name, description) => toResult(() => client().createTenant({ tenantId, name, description })),
+    update: (tenantId, name, description) => toResult(() => client().updateTenant({ tenantId, name, description })),
+    delete: (tenantId) => toResult(() => client().deleteTenant({ tenantId })),
+    assignRole: (tenantId, roleId) => toResult(() => client().assignRoleToTenant({ tenantId, roleId })),
+    unassignRole: (tenantId, roleId) => toResult(() => client().unassignRoleFromTenant({ tenantId, roleId })),
+    assignGroup: (tenantId, groupId) => toResult(() => client().assignGroupToTenant({ tenantId, groupId })),
+    unassignGroup: (tenantId, groupId) => toResult(() => client().unassignGroupFromTenant({ tenantId, groupId })),
+    assignMappingRule: (tenantId, mappingRuleId) => toResult(() => client().assignMappingRuleToTenant({ tenantId, mappingRuleId })),
+    unassignMappingRule: (tenantId, mappingRuleId) => toResult(() => client().unassignMappingRuleFromTenant({ tenantId, mappingRuleId })),
+};
+export const roleOps = {
+    create: (roleId, name, description) => toResult(() => client().createRole({ roleId, name, description })),
+    update: (roleId, name, description) => toResult(() => client().updateRole({ roleId, name, description })),
+    delete: (roleId) => toResult(() => client().deleteRole({ roleId })),
+    assignGroup: (roleId, groupId) => toResult(() => client().assignRoleToGroup({ roleId, groupId })),
+    unassignGroup: (roleId, groupId) => toResult(() => client().unassignRoleFromGroup({ roleId, groupId })),
+    assignMappingRule: (roleId, mappingRuleId) => toResult(() => client().assignRoleToMappingRule({ roleId, mappingRuleId })),
+    unassignMappingRule: (roleId, mappingRuleId) => toResult(() => client().unassignRoleFromMappingRule({ roleId, mappingRuleId })),
+    assignUser: (roleId, username) => toResult(() => client().assignRoleToUser({ roleId, username })),
+    unassignUser: (roleId, username) => toResult(() => client().unassignRoleFromUser({ roleId, username })),
+    assignClient: (roleId, clientId) => toResult(() => client().assignRoleToClient({ roleId, clientId })),
+    unassignClient: (roleId, clientId) => toResult(() => client().unassignRoleFromClient({ roleId, clientId })),
+};
+export const groupOps = {
+    create: (groupId, name, description) => toResult(() => client().createGroup({ groupId, name, description })),
+    update: (groupId, name, description) => toResult(() => client().updateGroup({ groupId, name, description })),
+    delete: (groupId) => toResult(() => client().deleteGroup({ groupId })),
+    assignMappingRule: (groupId, mappingRuleId) => toResult(() => client().assignMappingRuleToGroup({ groupId, mappingRuleId })),
+    unassignMappingRule: (groupId, mappingRuleId) => toResult(() => client().unassignMappingRuleFromGroup({ groupId, mappingRuleId })),
+    assignUser: (groupId, username) => toResult(() => client().assignUserToGroup({ groupId, username })),
+    unassignUser: (groupId, username) => toResult(() => client().unassignUserFromGroup({ groupId, username })),
+    assignClient: (groupId, clientId) => toResult(() => client().assignClientToGroup({ groupId, clientId })),
+    unassignClient: (groupId, clientId) => toResult(() => client().unassignClientFromGroup({ groupId, clientId })),
+};
+export const mappingRuleOps = {
+    create: (mappingRuleId, claimName, claimValue, name) => toResult(() => client().createMappingRule({ mappingRuleId, claimName, claimValue, name })),
+    update: (mappingRuleId, claimName, claimValue, name) => toResult(() => client().updateMappingRule({ mappingRuleId, claimName, claimValue, name })),
+    delete: (mappingRuleId) => toResult(() => client().deleteMappingRule({ mappingRuleId })),
+};
+export const authorizationOps = {
+    create: (auth) => toResult(() => client().createAuthorization({
+        ownerId: auth.ownerId,
+        ownerType: auth.ownerType,
+        resourceId: auth.resourceId,
+        resourceType: auth.resourceType,
+        permissionTypes: auth.permissions,
+    })),
+    // updateAuthorization is a full replace, never a partial patch - always send the
+    // complete desired shape.
+    update: (authorizationKey, auth) => toResult(() => client().updateAuthorization({
+        authorizationKey,
+        ownerId: auth.ownerId,
+        ownerType: auth.ownerType,
+        resourceId: auth.resourceId,
+        resourceType: auth.resourceType,
+        permissionTypes: auth.permissions,
+    })),
+    delete: (authorizationKey) => toResult(() => client().deleteAuthorization({ authorizationKey })),
+};
+//# sourceMappingURL=ops.js.map

package/dist/camunda/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../../src/camunda/ops.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACzF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,QAAgB,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACzF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAC,QAAgB,EAA4B,EAAE,CACrD,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,UAAU,EAAE,CAAC,QAAgB,EAAE,MAAc,EAA4B,EAAE,CACzE,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,QAAgB,EAAE,MAAc,EAA4B,EAAE,CAC3E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,WAAW,EAAE,CAAC,QAAgB,EAAE,OAAe,EAA4B,EAAE,CAC3E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,aAAa,EAAE,CAAC,QAAgB,EAAE,OAAe,EAA4B,EAAE,CAC7E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,iBAAiB,EAAE,CAAC,QAAgB,EAAE,aAAqB,EAA4B,EAAE,CACvF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IACjF,mBAAmB,EAAE,CAAC,QAAgB,EAAE,aAAqB,EAA4B,EAAE,CACzF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACvF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,MAAc,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACvF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,MAAc,EAA4B,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrG,WAAW,EAAE,CAAC,MAAc,EAAE,OAAe,EAA4B,EAAE,CACzE,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,aAAa,EAAE,CAAC,MAAc,EAAE,OAAe,EAA4B,EAAE,CAC3E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,iBAAiB,EAAE,CAAC,MAAc,EAAE,aAAqB,EAA4B,EAAE,CACrF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7E,mBAAmB,EAAE,CAAC,MAAc,EAAE,aAAqB,EAA4B,EAAE,CACvF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACjF,UAAU,EAAE,CAAC,MAAc,EAAE,QAAgB,EAA4B,EAAE,CACzE,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,YAAY,EAAE,CAAC,MAAc,EAAE,QAAgB,EAA4B,EAAE,CAC3E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,YAAY,EAAE,CAAC,MAAc,EAAE,QAAgB,EAA4B,EAAE,CAC3E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,cAAc,EAAE,CAAC,MAAc,EAAE,QAAgB,EAA4B,EAAE,CAC7E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CACxE,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM,EAAE,CAAC,OAAe,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACxF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,OAAe,EAAE,IAAY,EAAE,WAAoB,EAA4B,EAAE,CACxF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,OAAe,EAA4B,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxG,iBAAiB,EAAE,CAAC,OAAe,EAAE,aAAqB,EAA4B,EAAE,CACtF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/E,mBAAmB,EAAE,CAAC,OAAe,EAAE,aAAqB,EAA4B,EAAE,CACxF,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IACnF,UAAU,EAAE,CAAC,OAAe,EAAE,QAAgB,EAA4B,EAAE,CAC1E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,OAAe,EAAE,QAAgB,EAA4B,EAAE,CAC5E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvE,YAAY,EAAE,CAAC,OAAe,EAAE,QAAgB,EAA4B,EAAE,CAC5E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,cAAc,EAAE,CAAC,OAAe,EAAE,QAAgB,EAA4B,EAAE,CAC9E,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC1E,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,CAAC,aAAqB,EAAE,SAAiB,EAAE,UAAkB,EAAE,IAAY,EAA4B,EAAE,CAC/G,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,aAAqB,EAAE,SAAiB,EAAE,UAAkB,EAAE,IAAY,EAA4B,EAAE,CAC/G,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,aAAqB,EAA4B,EAAE,CAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;CAChE,CAAC;AAUF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,CAAC,IAAwB,EAA4B,EAAE,CAC7D,QAAQ,CAAC,GAAG,EAAE,CACZ,MAAM,EAAE,CAAC,mBAAmB,CAAC;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,eAAe,EAAE,IAAI,CAAC,WAAW;KAClC,CAAC,CACH;IACH,iFAAiF;IACjF,0BAA0B;IAC1B,MAAM,EAAE,CAAC,gBAAwB,EAAE,IAAwB,EAA4B,EAAE,CACvF,QAAQ,CAAC,GAAG,EAAE,CACZ,MAAM,EAAE,CAAC,mBAAmB,CAAC;QAC3B,gBAAgB;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,eAAe,EAAE,IAAI,CAAC,WAAW;KAClC,CAAC,CACH;IACH,MAAM,EAAE,CAAC,gBAAwB,EAA4B,EAAE,CAC7D,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;CACrE,CAAC"}

package/dist/cli.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { createInterface } from "node:readline/promises";
+import { Command } from "commander";
+import { loadSpec, SpecValidationError } from "./spec/load.js";
+import { fetchCurrentState } from "./camunda/list-all.js";
+import { buildPlan } from "./reconcile/diff.js";
+import { applyPlan } from "./reconcile/apply.js";
+import { formatApplyResult, formatPlan } from "./reconcile/format.js";
+import { createProgressReporter } from "./progress.js";
+// Load ./.env into process.env (if present) so CAMUNDA_* vars work without the
+// operator having to `export` each line by hand. Silently ignored when there's
+// no .env file - real env vars (e.g. injected by CI) still take precedence
+// wherever they're already set, since loadEnvFile does not override existing vars.
+try {
+    process.loadEnvFile();
+}
+catch (err) {
+    if (err.code !== "ENOENT")
+        throw err;
+}
+function reportError(err) {
+    const message = err instanceof SpecValidationError || err instanceof Error ? err.message : String(err);
+    console.error(message);
+    const cause = err instanceof Error ? err.cause : undefined;
+    if (cause) {
+        console.error(`Caused by: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    if (message === "fetch failed") {
+        console.error("Hint: check that CAMUNDA_REST_ADDRESS/CAMUNDA_OAUTH_URL/CAMUNDA_CLIENT_ID/CAMUNDA_CLIENT_SECRET are set (via .env or the environment) and reachable.");
+    }
+}
+async function fetchCurrentStateWithProgress() {
+    const progress = createProgressReporter();
+    try {
+        const current = await fetchCurrentState((e) => {
+            progress.update(e.phase === "entities"
+                ? `Fetching entities… (${e.completed}/${e.total})`
+                : `Resolving relationships… (${e.completed}/${e.total})`);
+        });
+        progress.stop(`Fetched current cluster state: ${current.tenants.length} tenants, ${current.roles.length} roles, ${current.groups.length} groups, ${current.mappingRules.length} mapping rules, ${current.authorizations.length} authorizations.`);
+        return current;
+    }
+    finally {
+        progress.stop();
+    }
+}
+const program = new Command();
+program.name("camunda-idac").description("Identity-as-code reconciler for Camunda 8 (tenants, roles, groups, mapping rules, authorizations)");
+program
+    .command("validate")
+    .description("validate the spec's schema and referential integrity - no network access")
+    .argument("<spec>", "path to the YAML spec file")
+    .action(async (specPath) => {
+    try {
+        await loadSpec(specPath);
+        console.log("Spec is valid.");
+    }
+    catch (err) {
+        reportError(err);
+        process.exitCode = 1;
+    }
+});
+program
+    .command("plan")
+    .description("show what would change against the live cluster, without applying anything")
+    .argument("<spec>", "path to the YAML spec file")
+    .option("--prune", "also compute deletions for anything not in the spec", false)
+    .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
+    .action(async (specPath, opts) => {
+    try {
+        const spec = await loadSpec(specPath);
+        const current = await fetchCurrentStateWithProgress();
+        const mode = opts.prune ? "prune" : "additive";
+        const plan = buildPlan(spec, current, mode);
+        console.log(formatPlan(plan, { showProtected: opts.showProtected }));
+        // Mirrors `terraform plan -detailed-exitcode`: 0 = no drift, 1 = drift found (or
+        // an unresolved mapping-rule claim conflict, which needs a spec change either way).
+        process.exitCode = plan.actions.length > 0 || plan.conflicts.length > 0 ? 1 : 0;
+    }
+    catch (err) {
+        reportError(err);
+        process.exitCode = 1;
+    }
+});
+program
+    .command("apply")
+    .description("apply the spec to the live cluster")
+    .argument("<spec>", "path to the YAML spec file")
+    .option("--prune", "also delete anything not in the spec", false)
+    .option("--yes", "skip the interactive confirmation prompt", false)
+    .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
+    .action(async (specPath, opts) => {
+    try {
+        const spec = await loadSpec(specPath);
+        const current = await fetchCurrentStateWithProgress();
+        const mode = opts.prune ? "prune" : "additive";
+        const plan = buildPlan(spec, current, mode);
+        console.log(formatPlan(plan, { showProtected: opts.showProtected }));
+        if (plan.actions.length === 0) {
+            process.exitCode = plan.conflicts.length > 0 ? 1 : 0;
+            return;
+        }
+        if (!opts.yes) {
+            if (!process.stdin.isTTY) {
+                console.error("\nRefusing to apply without --yes in a non-interactive shell.");
+                process.exitCode = 1;
+                return;
+            }
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            const suffix = mode === "prune" ? " (including deletions)" : "";
+            const answer = await rl.question(`\nApply ${plan.actions.length} action(s)${suffix}? [y/N] `);
+            rl.close();
+            if (!/^y(es)?$/i.test(answer.trim())) {
+                console.log("Aborted.");
+                return;
+            }
+        }
+        const applyProgress = createProgressReporter();
+        let result;
+        try {
+            result = await applyPlan(plan, (e) => {
+                if (e.type === "start") {
+                    applyProgress.update(`[${e.index + 1}/${e.total}] ${e.action.description}`);
+                }
+            });
+        }
+        finally {
+            applyProgress.stop();
+        }
+        console.log("");
+        console.log(formatApplyResult(result, { showProtected: opts.showProtected }));
+        process.exitCode = result.failed.length > 0 || plan.conflicts.length > 0 ? 1 : 0;
+    }
+    catch (err) {
+        reportError(err);
+        process.exitCode = 1;
+    }
+});
+await program.parseAsync(process.argv);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAa,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,QAAQ,CAAC,MAAM,CACb,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG;gBAClD,CAAC,CAAC,6BAA6B,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,kCAAkC,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,YAAY,CAAC,MAAM,mBAAmB,OAAO,CAAC,cAAc,CAAC,MAAM,kBAAkB,CACnO,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,WAAW,CAAC,mGAAmG,CAAC,CAAC;AAE9I,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0EAA0E,CAAC;KACvF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4EAA4E,CAAC;KACzF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAgD,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACrE,iFAAiF;QACjF,oFAAoF;QACpF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAA8D,EAAE,EAAE;IACjG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,UAAU,CAAC,CAAC;YAC9F,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/colors.js

@@ -0,0 +1,19 @@
+/**
+ * Minimal ANSI color helpers for CLI output. Disabled automatically when
+ * stdout isn't a TTY (piped/redirected output, CI logs) or when `NO_COLOR`
+ * is set, per https://no-color.org - checked per call (not cached at import)
+ * so it always reflects the current stream.
+ */
+function colorEnabled() {
+    return process.stdout.isTTY === true && !process.env.NO_COLOR;
+}
+function wrap(code, text) {
+    return colorEnabled() ? `\x1b[${code}m${text}\x1b[0m` : text;
+}
+export const red = (text) => wrap("31", text);
+export const green = (text) => wrap("32", text);
+export const yellow = (text) => wrap("33", text);
+export const cyan = (text) => wrap("36", text);
+export const dim = (text) => wrap("2", text);
+export const bold = (text) => wrap("1", text);
+//# sourceMappingURL=colors.js.map

package/dist/colors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.js","sourceRoot":"","sources":["../src/colors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAChE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY;IACtC,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC"}