camunda-cloud-idac 1.0.0 → 1.1.0-beta.1

package/README.md

@@ -90,6 +90,83 @@ some principals are granted access by username/client ID rather than by an
 IdP group claim. These aren't declared entities elsewhere in the spec, so
 there's no referential-integrity check on them (any string is accepted).
 
+## Environment files
+
+The single `<spec>` argument to `validate`/`plan`/`apply` can be either a
+flat spec (above) or an **environment file** that composes several spec
+fragments into one, for organizations that run the same identity model
+across multiple environments/clusters with per-cluster differences:
+
+```yaml
+# specs/e0.yaml
+include:
+  - base.yaml
+  - procapps/leistung.yaml
+  - procapps/workflow.yaml
+  # a procapp fragment can be left out here if this cluster doesn't need it
+
+values:
+  ENV_SUFFIX: E0
+  KUMUL_CLIENT_ID: kumul
+```
+
+A file is treated as an environment file purely because it has a top-level
+`include` key (flat specs never do, since `RawSpec` is `.strict()` and has
+no such field, so detection can't collide with the existing format).
+`include` paths resolve relative to the environment file's own directory.
+See `test/fixtures/compose/` for a complete worked example (base + 3
+procapp fragments + a full and a partial environment file).
+
+**Fragments** are plain YAML files shaped like a spec, but looser: only
+each entity's ID field (`tenantId`/`roleId`/`groupId`/`mappingRuleId`) is
+required - every other field is optional, since one fragment may only be
+contributing a *piece* of an entity that another fragment (or a shared
+`base.yaml`) already declares in full. This is what lets a role like
+`process-owner` span every procapp without every procapp fragment knowing
+about the others: `base.yaml` declares `process-owner`'s `name`, and each
+`procapps/<name>.yaml` fragment separately contributes its own group to
+`process-owner.groups`.
+
+When multiple fragments mention the same entity ID:
+
+- **Array fields** (`groups`, `mappingRules`, `users`, `clients`, `roles`)
+  are **unioned** (deduplicated, first-seen order).
+- **Scalar fields** (`name`, `description`, `claimName`, `claimValue`) must
+  not disagree - two fragments giving the same ID a different value for the
+  same scalar field is a composition error naming both files and values.
+- `authorizations` have no ID field and are simply concatenated; the
+  existing schema already tolerates exact duplicate authorization tuples
+  and flags genuine permission conflicts, so no special merging is needed.
+
+Only the fully merged, ID-deduplicated result is validated against the same
+unmodified `Spec` schema used for flat specs - so every existing guarantee
+(referential integrity, no duplicate IDs, authorization-tuple conflicts)
+still applies to the assembled spec exactly as it does today. If no
+fragment ever provides a required field (e.g. `name`), that surfaces as the
+same "Required" error you'd get from an incomplete flat spec.
+
+`include` is exactly one level deep - a fragment listed under `include` may
+not itself have a top-level `include` key (nested composition isn't
+supported, and produces a clear error if attempted).
+
+**`${VAR}` substitution**: each fragment's raw text is scanned for
+`${NAME}` placeholders before it's parsed as YAML, substituted from the
+environment file's `values` map. Any placeholder left unresolved after
+substitution (a typo, or a `values` map missing an entry) is a hard error
+naming the fragment file and the unresolved name(s) - it never silently
+passes through as a literal string. A flat spec (no `include` key) is never
+scanned for placeholders, so a literal `${...}`-looking value in a flat
+spec is passed through untouched.
+
+**Prune caveat**: omitting a procapp fragment from an environment's
+`include` is, to the reconciler, indistinguishable from "this was
+intentionally removed." If that procapp's tenant/group/mapping rules still
+exist on the target cluster (e.g. it was deployed there before, or under a
+different environment file), a later `apply --prune` run against that
+cluster will delete them - same as removing any other entity from a flat
+spec. Make sure `include` lists match what should actually exist on each
+cluster before pruning.
+
 ## Known limitations
 
 - Direct **tenant**-to-user/client assignments aren't modeled by the spec

package/dist/spec/compose.js

@@ -0,0 +1,219 @@
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { parse as parseYaml, YAMLParseError } from "yaml";
+import { z } from "zod";
+import { OwnerType, PermissionType, ResourceType } from "./schema.js";
+import { formatZodError, SpecValidationError } from "./errors.js";
+export const EnvironmentFile = z
+    .object({
+    include: z.array(z.string().min(1)).min(1),
+    values: z.record(z.string(), z.string()).default({}),
+})
+    .strict();
+export function isEnvironmentFile(parsed) {
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && Object.hasOwn(parsed, "include");
+}
+const PLACEHOLDER_PATTERN = /\$\{([^}]+)\}/g;
+export function substituteVariables(text, values) {
+    return text.replace(PLACEHOLDER_PATTERN, (match, name) => (Object.hasOwn(values, name) ? values[name] : match));
+}
+export function findUnresolvedPlaceholders(text) {
+    const found = new Set();
+    for (const match of text.matchAll(PLACEHOLDER_PATTERN)) {
+        found.add(match[1]);
+    }
+    return [...found];
+}
+// Fragment schemas mirror schema.ts's entities, but only the ID field is required -
+// every other field (including `name`, required on the final Spec) is optional,
+// since a fragment may only be contributing a piece of an entity that another
+// fragment (or base.yaml) already fully declares. mergeEntitiesById() below unions
+// array fields and rejects conflicting scalar fields across fragments; only the
+// fully merged result is validated against the real, unmodified `Spec` schema in
+// load.ts, which is what actually enforces that every entity ends up complete.
+const MappingRuleFragment = z
+    .object({
+    mappingRuleId: z.string().min(1),
+    claimName: z.string().min(1).optional(),
+    claimValue: z.string().min(1).optional(),
+    name: z.string().optional(),
+})
+    .strict();
+const GroupFragment = z
+    .object({
+    groupId: z.string().min(1),
+    name: z.string().min(1).optional(),
+    description: z.string().optional(),
+    mappingRules: z.array(z.string()).default([]),
+    users: z.array(z.string()).default([]),
+    clients: z.array(z.string()).default([]),
+})
+    .strict();
+const RoleFragment = z
+    .object({
+    roleId: z.string().min(1),
+    name: z.string().min(1).optional(),
+    description: z.string().optional(),
+    mappingRules: z.array(z.string()).default([]),
+    groups: z.array(z.string()).default([]),
+    users: z.array(z.string()).default([]),
+    clients: z.array(z.string()).default([]),
+})
+    .strict();
+const TenantFragment = z
+    .object({
+    tenantId: z.string().min(1),
+    name: z.string().min(1).optional(),
+    description: z.string().optional(),
+    roles: z.array(z.string()).default([]),
+    groups: z.array(z.string()).default([]),
+    mappingRules: z.array(z.string()).default([]),
+})
+    .strict();
+const AuthorizationFragment = z
+    .object({
+    ownerType: OwnerType,
+    ownerId: z.string().min(1),
+    resourceType: ResourceType,
+    resourceId: z.string().min(1),
+    permissions: z.array(PermissionType).min(1),
+})
+    .strict();
+const FragmentSpec = z
+    .object({
+    tenants: z.array(TenantFragment).default([]),
+    roles: z.array(RoleFragment).default([]),
+    groups: z.array(GroupFragment).default([]),
+    mappingRules: z.array(MappingRuleFragment).default([]),
+    authorizations: z.array(AuthorizationFragment).default([]),
+})
+    .strict();
+// Merges entities sharing the same ID across fragments: array fields are unioned
+// (deduped, first-seen order), scalar fields must agree everywhere they're set -
+// two fragments giving the same ID a different value for the same scalar field is
+// a real authoring conflict, not something a union could resolve.
+function mergeEntitiesById(entries, config, entityLabel) {
+    const order = [];
+    const merged = new Map();
+    const scalarSources = new Map();
+    for (const { filePath, entity } of entries) {
+        const id = entity[config.idField];
+        if (!merged.has(id)) {
+            merged.set(id, { [config.idField]: id });
+            scalarSources.set(id, new Map());
+            order.push(id);
+        }
+        const target = merged.get(id);
+        const sources = scalarSources.get(id);
+        for (const field of config.scalarFields) {
+            const value = entity[field];
+            if (value === undefined)
+                continue;
+            const existing = sources.get(field);
+            if (existing && existing.value !== value) {
+                throw new Error(`${entityLabel} "${id}" has conflicting "${field}": "${existing.value}" (${existing.filePath}) vs. "${value}" (${filePath})`);
+            }
+            if (!existing) {
+                sources.set(field, { value: value, filePath });
+                target[field] = value;
+            }
+        }
+        for (const field of config.arrayFields) {
+            const values = entity[field] ?? [];
+            const union = [...(target[field] ?? [])];
+            for (const v of values) {
+                if (!union.includes(v))
+                    union.push(v);
+            }
+            target[field] = union;
+        }
+    }
+    return order.map((id) => merged.get(id));
+}
+async function loadFragment(fragmentPath, values) {
+    let raw;
+    try {
+        raw = await readFile(fragmentPath, "utf-8");
+    }
+    catch (err) {
+        throw new Error(`Could not read fragment "${fragmentPath}": ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const substituted = substituteVariables(raw, values);
+    const unresolved = findUnresolvedPlaceholders(substituted);
+    if (unresolved.length > 0) {
+        throw new Error(`Fragment "${fragmentPath}" has unresolved placeholder(s): ${unresolved.map((n) => `\${${n}}`).join(", ")}`);
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(substituted);
+    }
+    catch (err) {
+        if (err instanceof YAMLParseError) {
+            throw new Error(`Fragment "${fragmentPath}" is not valid YAML: ${err.message}`);
+        }
+        throw err;
+    }
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && Object.hasOwn(parsed, "include")) {
+        throw new Error(`Fragment "${fragmentPath}" has a top-level "include" key - nested composition isn't supported, "include" may only appear in the top-level environment file`);
+    }
+    const result = FragmentSpec.safeParse(parsed);
+    if (!result.success) {
+        throw new Error(`Fragment "${fragmentPath}" is invalid:\n${formatZodError(result.error).map((i) => `  - ${i}`).join("\n")}`);
+    }
+    return result.data;
+}
+export function mergeFragments(fragments) {
+    const asEntries = (key) => fragments.flatMap((f) => f.data[key].map((entity) => ({ filePath: f.filePath, entity })));
+    return {
+        tenants: mergeEntitiesById(asEntries("tenants"), {
+            idField: "tenantId",
+            scalarFields: ["name", "description"],
+            arrayFields: ["roles", "groups", "mappingRules"],
+        }, "Tenant"),
+        roles: mergeEntitiesById(asEntries("roles"), {
+            idField: "roleId",
+            scalarFields: ["name", "description"],
+            arrayFields: ["mappingRules", "groups", "users", "clients"],
+        }, "Role"),
+        groups: mergeEntitiesById(asEntries("groups"), {
+            idField: "groupId",
+            scalarFields: ["name", "description"],
+            arrayFields: ["mappingRules", "users", "clients"],
+        }, "Group"),
+        mappingRules: mergeEntitiesById(asEntries("mappingRules"), {
+            idField: "mappingRuleId",
+            scalarFields: ["claimName", "claimValue", "name"],
+            arrayFields: [],
+        }, "Mapping rule"),
+        authorizations: fragments.flatMap((f) => f.data.authorizations),
+    };
+}
+export async function composeSpec(envFilePath, envFile) {
+    const baseDir = dirname(envFilePath);
+    const seen = new Set();
+    const resolvedPaths = [];
+    for (const includePath of envFile.include) {
+        const resolved = resolve(baseDir, includePath);
+        if (seen.has(resolved)) {
+            throw new SpecValidationError(envFilePath, [`Duplicate include entry resolves to the same file: "${resolved}"`]);
+        }
+        seen.add(resolved);
+        resolvedPaths.push(resolved);
+    }
+    const fragments = [];
+    for (const fragmentPath of resolvedPaths) {
+        try {
+            fragments.push({ filePath: fragmentPath, data: await loadFragment(fragmentPath, envFile.values) });
+        }
+        catch (err) {
+            throw new SpecValidationError(envFilePath, [err instanceof Error ? err.message : String(err)]);
+        }
+    }
+    try {
+        return mergeFragments(fragments);
+    }
+    catch (err) {
+        throw new SpecValidationError(envFilePath, [err instanceof Error ? err.message : String(err)]);
+    }
+}
+//# sourceMappingURL=compose.js.map

package/dist/spec/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/spec/compose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrH,CAAC;AAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAE7C,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAA8B;IAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,gFAAgF;AAChF,8EAA8E;AAC9E,mFAAmF;AACnF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAE/E,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,SAAS,EAAE,SAAS;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC;KACD,MAAM,EAAE,CAAC;AASZ,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,kEAAkE;AAClE,SAAS,iBAAiB,CACxB,OAAqE,EACrE,MAAmB,EACnB,WAAmB;IAEnB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4D,CAAC;IAE1F,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAW,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACzC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAEvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,KAAK,EAAE,sBAAsB,KAAK,OAAO,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,QAAQ,UAAU,KAAK,MAAM,QAAQ,GAAG,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,MAAM,GAAI,MAAM,CAAC,KAAK,CAA0B,IAAI,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAE,MAAM,CAAC,KAAK,CAA0B,IAAI,EAAE,CAAC,CAAC,CAAC;YACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,YAAoB,EAAE,MAA8B;IAC9E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,aAAa,YAAY,oCAAoC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,aAAa,YAAY,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CACb,aAAa,YAAY,mIAAmI,CAC7J,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,aAAa,YAAY,kBAAkB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAA8D;IAO3F,MAAM,SAAS,GAAG,CAAC,GAA2B,EAAE,EAAE,CAChD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAA+B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3H,OAAO;QACL,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;YAC/C,OAAO,EAAE,UAAU;YACnB,YAAY,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC;SACjD,EAAE,QAAQ,CAAC;QACZ,KAAK,EAAE,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;YAC3C,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;YACrC,WAAW,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;SAC5D,EAAE,MAAM,CAAC;QACV,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC7C,OAAO,EAAE,SAAS;YAClB,YAAY,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;YACrC,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC;SAClD,EAAE,OAAO,CAAC;QACX,YAAY,EAAE,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE;YACzD,OAAO,EAAE,eAAe;YACxB,YAAY,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC;YACjD,WAAW,EAAE,EAAE;SAChB,EAAE,cAAc,CAAC;QAClB,cAAc,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,OAAwB;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,CAAC,uDAAuD,QAAQ,GAAG,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAwD,EAAE,CAAC;IAC1E,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/spec/errors.js

@@ -0,0 +1,17 @@
+export class SpecValidationError extends Error {
+    filePath;
+    issues;
+    constructor(filePath, issues) {
+        super(`Invalid spec at ${filePath}:\n${issues.map((i) => `  - ${i}`).join("\n")}`);
+        this.filePath = filePath;
+        this.issues = issues;
+        this.name = "SpecValidationError";
+    }
+}
+export function formatZodError(error) {
+    return error.issues.map((issue) => {
+        const path = issue.path.join(".");
+        return path ? `${path}: ${issue.message}` : issue.message;
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/spec/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/spec/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAgB;QAEhC,KAAK,CAAC,mBAAmB,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAHnE,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;QAGhC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAe;IAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/spec/load.js

@@ -1,22 +1,9 @@
 import { readFile } from "node:fs/promises";
 import { parse as parseYaml, YAMLParseError } from "yaml";
 import { Spec } from "./schema.js";
-export class SpecValidationError extends Error {
-    filePath;
-    issues;
-    constructor(filePath, issues) {
-        super(`Invalid spec at ${filePath}:\n${issues.map((i) => `  - ${i}`).join("\n")}`);
-        this.filePath = filePath;
-        this.issues = issues;
-        this.name = "SpecValidationError";
-    }
-}
-function formatZodError(error) {
-    return error.issues.map((issue) => {
-        const path = issue.path.join(".");
-        return path ? `${path}: ${issue.message}` : issue.message;
-    });
-}
+import { composeSpec, EnvironmentFile, isEnvironmentFile } from "./compose.js";
+import { formatZodError, SpecValidationError } from "./errors.js";
+export { SpecValidationError } from "./errors.js";
 export async function loadSpec(filePath) {
     let raw;
     try {
@@ -37,7 +24,15 @@ export async function loadSpec(filePath) {
         }
         throw err;
     }
-    const result = Spec.safeParse(parsed);
+    let assembled = parsed;
+    if (isEnvironmentFile(parsed)) {
+        const envResult = EnvironmentFile.safeParse(parsed);
+        if (!envResult.success) {
+            throw new SpecValidationError(filePath, formatZodError(envResult.error));
+        }
+        assembled = await composeSpec(filePath, envResult.data);
+    }
+    const result = Spec.safeParse(assembled);
     if (!result.success) {
         throw new SpecValidationError(filePath, formatZodError(result.error));
     }

package/dist/spec/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/spec/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAgB;QAEhC,KAAK,CAAC,mBAAmB,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAHnE,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;QAGhC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE;YACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/spec/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE;YACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,SAAS,GAAY,MAAM,CAAC;IAChC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camunda-cloud-idac",
-  "version": "1.0.0",
+  "version": "1.1.0-beta.1",
   "description": "Identity-as-code reconciler for Camunda 8 (tenants, roles, groups, mapping rules, authorizations)",
   "type": "module",
   "license": "MIT",