camunda-cloud-idac 1.0.0

package/dist/reconcile/protect.js

@@ -0,0 +1,78 @@
+export const PROTECTED_ROLE_ID = "admin";
+export const PROTECTED_TENANT_ID = "<default>";
+/**
+ * The client this tool itself authenticates as (from CAMUNDA_CLIENT_ID, the same
+ * variable createCamundaClientLoose() reads). Its assignment to the admin role is
+ * protected from removal so a full reset can never lock the tool itself out.
+ * Deliberately NOT self-healing (per explicit product decision): if this client
+ * isn't already assigned to the admin role, this tool will not assign it - it
+ * only guards an existing assignment from being pruned away.
+ */
+function getGuardianClientId() {
+    return process.env.CAMUNDA_CLIENT_ID;
+}
+/**
+ * Unconditional safety filter, applied after diffing regardless of spec content.
+ * This is deliberately NOT a "skip if the spec doesn't mention admin" heuristic
+ * inside diff.ts: if the spec never mentions the admin role at all, the raw diff
+ * would otherwise queue every one of its authorizations for deletion in prune
+ * mode (they're simply "not in spec" = "extra"). Keeping the guard here, as a
+ * pure post-filter over the already-computed action list, means it can't be
+ * bypassed by any particular shape of spec and is the one place to audit to
+ * trust the invariant holds.
+ *
+ * Current invariants (narrowed by explicit product decision - the "admin" group,
+ * if one exists, is no longer specially protected; only the "admin" role is):
+ *  1. The "admin" role itself is never deleted.
+ *  2. The "admin" role's authorizations are fully hands-off: never created,
+ *     updated, or deleted by this tool - not merely protected from deletion.
+ *  3. This tool's own client (CAMUNDA_CLIENT_ID) never loses its assignment to
+ *     the admin role, so a full reset can't lock the tool out of the cluster it
+ *     just reset. Every other role<->client pair (including other clients
+ *     assigned to the admin role) is unaffected by this rule.
+ *  4. The `<default>` system tenant is never deleted (defense in depth - the API
+ *     already rejects this server-side).
+ *  5. The "admin" role never loses its assignment to the `<default>` tenant, so
+ *     a full `--prune` reset can never leave the admin role without access to
+ *     the default tenant. Every other tenant<->role pair (including the admin
+ *     role's assignment to any other tenant) is unaffected by this rule.
+ *
+ * Only entity-delete/authorization-mutation/the two guarded unassign edges
+ * (unassign-role-client, unassign-tenant-role) are ever blocked. Every other
+ * unassign-* action - including removing other roles/members from the admin
+ * role, or removing a non-guardian client from it - passes through untouched.
+ */
+export function applyProtections(actions) {
+    const warnings = [];
+    const guardianClientId = getGuardianClientId();
+    const kept = actions.filter((action) => {
+        const block = (reason) => {
+            warnings.push(`BLOCKED (${reason}): ${action.description}`);
+            return false;
+        };
+        const target = action.target;
+        if (target.kind === "delete-role" && target.roleId === PROTECTED_ROLE_ID) {
+            return block(`the "${PROTECTED_ROLE_ID}" role must never be deleted`);
+        }
+        if (target.kind === "delete-tenant" && target.tenantId === PROTECTED_TENANT_ID) {
+            return block(`the ${PROTECTED_TENANT_ID} system tenant must never be deleted`);
+        }
+        if (target.kind === "authorization" && target.ownerType === "ROLE" && target.ownerId === PROTECTED_ROLE_ID) {
+            return block(`authorizations of the "${PROTECTED_ROLE_ID}" role must never be created, updated, or deleted`);
+        }
+        if (target.kind === "unassign-role-client" &&
+            target.roleId === PROTECTED_ROLE_ID &&
+            guardianClientId !== undefined &&
+            target.clientId === guardianClientId) {
+            return block(`this tool's own client ("${guardianClientId}") must keep the "${PROTECTED_ROLE_ID}" role, or a full reset would lock the tool out`);
+        }
+        if (target.kind === "unassign-tenant-role" &&
+            target.tenantId === PROTECTED_TENANT_ID &&
+            target.roleId === PROTECTED_ROLE_ID) {
+            return block(`the "${PROTECTED_ROLE_ID}" role must never be unassigned from the ${PROTECTED_TENANT_ID} tenant`);
+        }
+        return true;
+    });
+    return { actions: kept, warnings };
+}
+//# sourceMappingURL=protect.js.map

package/dist/reconcile/protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/reconcile/protect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;YAC/B,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,QAAQ,iBAAiB,8BAA8B,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,OAAO,mBAAmB,sCAAsC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,0BAA0B,iBAAiB,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,MAAM,KAAK,iBAAiB;YACnC,gBAAgB,KAAK,SAAS;YAC9B,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EACpC,CAAC;YACD,OAAO,KAAK,CACV,4BAA4B,gBAAgB,qBAAqB,iBAAiB,iDAAiD,CACpI,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;YACvC,MAAM,CAAC,MAAM,KAAK,iBAAiB,EACnC,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,iBAAiB,4CAA4C,mBAAmB,SAAS,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/dist/reconcile/types.js

@@ -0,0 +1,18 @@
+export const DESTRUCTIVE_KINDS = new Set([
+    "delete-tenant",
+    "delete-role",
+    "delete-group",
+    "delete-mapping-rule",
+    "delete-authorization",
+    "unassign-role-mapping-rule",
+    "unassign-role-group",
+    "unassign-group-mapping-rule",
+    "unassign-group-user",
+    "unassign-group-client",
+    "unassign-role-user",
+    "unassign-role-client",
+    "unassign-tenant-role",
+    "unassign-tenant-group",
+    "unassign-tenant-mapping-rule",
+]);
+//# sourceMappingURL=types.js.map

package/dist/reconcile/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/reconcile/types.ts"],"names":[],"mappings":"AAiGA,MAAM,CAAC,MAAM,iBAAiB,GAA4B,IAAI,GAAG,CAAa;IAC5E,eAAe;IACf,aAAa;IACb,cAAc;IACd,qBAAqB;IACrB,sBAAsB;IACtB,4BAA4B;IAC5B,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;IACrB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,uBAAuB;IACvB,8BAA8B;CAC/B,CAAC,CAAC"}

package/dist/spec/load.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { parse as parseYaml, YAMLParseError } from "yaml";
+import { Spec } from "./schema.js";
+export class SpecValidationError extends Error {
+    filePath;
+    issues;
+    constructor(filePath, issues) {
+        super(`Invalid spec at ${filePath}:\n${issues.map((i) => `  - ${i}`).join("\n")}`);
+        this.filePath = filePath;
+        this.issues = issues;
+        this.name = "SpecValidationError";
+    }
+}
+function formatZodError(error) {
+    return error.issues.map((issue) => {
+        const path = issue.path.join(".");
+        return path ? `${path}: ${issue.message}` : issue.message;
+    });
+}
+export async function loadSpec(filePath) {
+    let raw;
+    try {
+        raw = await readFile(filePath, "utf-8");
+    }
+    catch (err) {
+        throw new SpecValidationError(filePath, [
+            err instanceof Error ? err.message : `Could not read file: ${String(err)}`,
+        ]);
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        if (err instanceof YAMLParseError) {
+            throw new SpecValidationError(filePath, [err.message]);
+        }
+        throw err;
+    }
+    const result = Spec.safeParse(parsed);
+    if (!result.success) {
+        throw new SpecValidationError(filePath, formatZodError(result.error));
+    }
+    return result.data;
+}
+//# sourceMappingURL=load.js.map

package/dist/spec/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/spec/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGnC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAgB;QAEhC,KAAK,CAAC,mBAAmB,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAHnE,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAU;QAGhC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAe;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE;YACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/spec/schema.js

@@ -0,0 +1,274 @@
+import { z } from "zod";
+// Copied verbatim from node_modules/@camunda8/orchestration-cluster-api's shipped
+// .d.ts (OwnerTypeEnum / ResourceTypeEnum / PermissionTypeEnum). Re-check these
+// against the installed package whenever the pinned SDK version in package.json
+// changes - a drifted enum here would silently accept specs the live API rejects.
+export const OwnerType = z.enum(["USER", "CLIENT", "ROLE", "GROUP", "MAPPING_RULE", "UNSPECIFIED"]);
+export const ResourceType = z.enum([
+    "AUDIT_LOG",
+    "AUTHORIZATION",
+    "BATCH",
+    "CLUSTER_VARIABLE",
+    "COMPONENT",
+    "DECISION_DEFINITION",
+    "DECISION_REQUIREMENTS_DEFINITION",
+    "DOCUMENT",
+    "EXPRESSION",
+    "GLOBAL_LISTENER",
+    "GROUP",
+    "MAPPING_RULE",
+    "MESSAGE",
+    "PROCESS_DEFINITION",
+    "RESOURCE",
+    "ROLE",
+    "SYSTEM",
+    "TENANT",
+    "USER",
+    "USER_TASK",
+]);
+export const PermissionType = z.enum([
+    "ACCESS",
+    "CANCEL_PROCESS_INSTANCE",
+    "CLAIM",
+    "CLAIM_USER_TASK",
+    "COMPLETE",
+    "COMPLETE_USER_TASK",
+    "CREATE",
+    "CREATE_BATCH_OPERATION_CANCEL_PROCESS_INSTANCE",
+    "CREATE_BATCH_OPERATION_DELETE_DECISION_DEFINITION",
+    "CREATE_BATCH_OPERATION_DELETE_DECISION_INSTANCE",
+    "CREATE_BATCH_OPERATION_DELETE_PROCESS_DEFINITION",
+    "CREATE_BATCH_OPERATION_DELETE_PROCESS_INSTANCE",
+    "CREATE_BATCH_OPERATION_MIGRATE_PROCESS_INSTANCE",
+    "CREATE_BATCH_OPERATION_MODIFY_PROCESS_INSTANCE",
+    "CREATE_BATCH_OPERATION_RESOLVE_INCIDENT",
+    "CREATE_DECISION_INSTANCE",
+    "CREATE_PROCESS_INSTANCE",
+    "CREATE_TASK_LISTENER",
+    "DELETE",
+    "DELETE_DECISION_INSTANCE",
+    "DELETE_DRD",
+    "DELETE_FORM",
+    "DELETE_PROCESS",
+    "DELETE_PROCESS_INSTANCE",
+    "DELETE_RESOURCE",
+    "DELETE_TASK_LISTENER",
+    "EVALUATE",
+    "MODIFY_PROCESS_INSTANCE",
+    "READ",
+    "READ_DECISION_DEFINITION",
+    "READ_DECISION_INSTANCE",
+    "READ_JOB_METRIC",
+    "READ_PROCESS_DEFINITION",
+    "READ_PROCESS_INSTANCE",
+    "READ_USAGE_METRIC",
+    "READ_USER_TASK",
+    "READ_TASK_LISTENER",
+    "UPDATE",
+    "UPDATE_PROCESS_INSTANCE",
+    "UPDATE_USER_TASK",
+    "UPDATE_TASK_LISTENER",
+]);
+// Entities that can own an authorization and are also declared as first-class
+// entities in this spec (used by the referential-integrity check below).
+const OWNER_TYPES_WITH_DECLARED_ENTITIES = new Set(["ROLE", "GROUP", "MAPPING_RULE"]);
+// .strict() on every object below is deliberate, not incidental: zod's default
+// z.object() silently drops unrecognized keys instead of rejecting them, which
+// would let a typo (e.g. `mappingRuleId: [...]` instead of `mappingRules: [...]`
+// on a group) parse "successfully" while silently doing nothing - exactly the
+// class of error this tool uses zod to prevent in the first place.
+const MappingRuleSpec = z
+    .object({
+    mappingRuleId: z.string().min(1),
+    claimName: z.string().min(1),
+    claimValue: z.string().min(1),
+    name: z.string().optional(),
+})
+    .strict();
+const GroupSpec = z
+    .object({
+    groupId: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().optional(),
+    mappingRules: z.array(z.string()).default([]),
+    // Direct membership, not modeled via mapping rules/OIDC claims. Usernames and
+    // client IDs aren't declared entities elsewhere in this spec (unlike
+    // roles/groups/mappingRules), so there's no referential-integrity check for
+    // these - any string is accepted, matching how authorization owners of type
+    // USER/CLIENT are handled.
+    users: z.array(z.string()).default([]),
+    clients: z.array(z.string()).default([]),
+})
+    .strict();
+const RoleSpec = z
+    .object({
+    roleId: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().optional(),
+    mappingRules: z.array(z.string()).default([]),
+    groups: z.array(z.string()).default([]),
+    // Direct membership - not modeled via mapping rules/OIDC claims, no
+    // referential-integrity check (same rationale as GroupSpec.users/clients above).
+    users: z.array(z.string()).default([]),
+    clients: z.array(z.string()).default([]),
+})
+    .strict();
+const TenantSpec = z
+    .object({
+    tenantId: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().optional(),
+    roles: z.array(z.string()).default([]),
+    groups: z.array(z.string()).default([]),
+    mappingRules: z.array(z.string()).default([]),
+})
+    .strict();
+const AuthorizationSpec = z
+    .object({
+    ownerType: OwnerType,
+    ownerId: z.string().min(1),
+    resourceType: ResourceType,
+    resourceId: z.string().min(1),
+    permissions: z.array(PermissionType).min(1),
+})
+    .strict();
+const RawSpec = z
+    .object({
+    tenants: z.array(TenantSpec).default([]),
+    roles: z.array(RoleSpec).default([]),
+    groups: z.array(GroupSpec).default([]),
+    mappingRules: z.array(MappingRuleSpec).default([]),
+    authorizations: z.array(AuthorizationSpec).default([]),
+})
+    .strict();
+function findDuplicates(ids) {
+    const seen = new Set();
+    const dupes = new Set();
+    for (const id of ids) {
+        if (seen.has(id))
+            dupes.add(id);
+        seen.add(id);
+    }
+    return [...dupes];
+}
+export const Spec = RawSpec.superRefine((spec, ctx) => {
+    const mappingRuleIds = new Set(spec.mappingRules.map((m) => m.mappingRuleId));
+    const groupIds = new Set(spec.groups.map((g) => g.groupId));
+    const roleIds = new Set(spec.roles.map((r) => r.roleId));
+    // Rule 7: no duplicate IDs within each entity array.
+    for (const [label, ids] of [
+        ["tenants[].tenantId", spec.tenants.map((t) => t.tenantId)],
+        ["roles[].roleId", spec.roles.map((r) => r.roleId)],
+        ["groups[].groupId", spec.groups.map((g) => g.groupId)],
+        ["mappingRules[].mappingRuleId", spec.mappingRules.map((m) => m.mappingRuleId)],
+    ]) {
+        for (const dupe of findDuplicates(ids)) {
+            ctx.addIssue({
+                code: "custom",
+                path: [label],
+                message: `Duplicate ${label} value: "${dupe}"`,
+            });
+        }
+    }
+    // Rules 1-3: role/group references to mapping rules and groups.
+    spec.roles.forEach((role, i) => {
+        role.mappingRules.forEach((id, j) => {
+            if (!mappingRuleIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["roles", i, "mappingRules", j],
+                    message: `roles[${i}] ("${role.roleId}") references unknown mappingRuleId "${id}"`,
+                });
+            }
+        });
+        role.groups.forEach((id, j) => {
+            if (!groupIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["roles", i, "groups", j],
+                    message: `roles[${i}] ("${role.roleId}") references unknown groupId "${id}"`,
+                });
+            }
+        });
+    });
+    spec.groups.forEach((group, i) => {
+        group.mappingRules.forEach((id, j) => {
+            if (!mappingRuleIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["groups", i, "mappingRules", j],
+                    message: `groups[${i}] ("${group.groupId}") references unknown mappingRuleId "${id}"`,
+                });
+            }
+        });
+    });
+    // Rules 4-5: tenant references to roles and groups.
+    spec.tenants.forEach((tenant, i) => {
+        tenant.roles.forEach((id, j) => {
+            if (!roleIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["tenants", i, "roles", j],
+                    message: `tenants[${i}] ("${tenant.tenantId}") references unknown roleId "${id}"`,
+                });
+            }
+        });
+        tenant.groups.forEach((id, j) => {
+            if (!groupIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["tenants", i, "groups", j],
+                    message: `tenants[${i}] ("${tenant.tenantId}") references unknown groupId "${id}"`,
+                });
+            }
+        });
+        tenant.mappingRules.forEach((id, j) => {
+            if (!mappingRuleIds.has(id)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["tenants", i, "mappingRules", j],
+                    message: `tenants[${i}] ("${tenant.tenantId}") references unknown mappingRuleId "${id}"`,
+                });
+            }
+        });
+    });
+    // Rule 6: authorization owner must exist among declared entities, when the
+    // owner type corresponds to a declared entity type in this spec.
+    const idsByOwnerType = {
+        ROLE: roleIds,
+        GROUP: groupIds,
+        MAPPING_RULE: mappingRuleIds,
+    };
+    spec.authorizations.forEach((auth, i) => {
+        if (OWNER_TYPES_WITH_DECLARED_ENTITIES.has(auth.ownerType)) {
+            const ids = idsByOwnerType[auth.ownerType];
+            if (!ids.has(auth.ownerId)) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["authorizations", i, "ownerId"],
+                    message: `authorizations[${i}] references unknown ${auth.ownerType} ownerId "${auth.ownerId}"`,
+                });
+            }
+        }
+    });
+    // Rule 8: no two authorization entries with the same tuple but different permissions.
+    const tupleToPermissions = new Map();
+    spec.authorizations.forEach((auth, i) => {
+        const key = `${auth.ownerType}::${auth.ownerId}::${auth.resourceType}::${auth.resourceId}`;
+        const existing = tupleToPermissions.get(key);
+        if (!existing) {
+            tupleToPermissions.set(key, { index: i, permissions: auth.permissions });
+            return;
+        }
+        const sameSet = existing.permissions.length === auth.permissions.length &&
+            new Set(existing.permissions).size === new Set([...existing.permissions, ...auth.permissions]).size;
+        if (!sameSet) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["authorizations", i],
+                message: `authorizations[${i}] duplicates the tuple (${auth.ownerType}, ${auth.ownerId}, ${auth.resourceType}, ${auth.resourceId}) already declared at authorizations[${existing.index}] with different permissions`,
+            });
+        }
+    });
+});
+//# sourceMappingURL=schema.js.map

package/dist/spec/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/spec/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAElF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,WAAW;IACX,eAAe;IACf,OAAO;IACP,kBAAkB;IAClB,WAAW;IACX,qBAAqB;IACrB,kCAAkC;IAClC,UAAU;IACV,YAAY;IACZ,iBAAiB;IACjB,OAAO;IACP,cAAc;IACd,SAAS;IACT,oBAAoB;IACpB,UAAU;IACV,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,QAAQ;IACR,yBAAyB;IACzB,OAAO;IACP,iBAAiB;IACjB,UAAU;IACV,oBAAoB;IACpB,QAAQ;IACR,gDAAgD;IAChD,mDAAmD;IACnD,iDAAiD;IACjD,kDAAkD;IAClD,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAChD,yCAAyC;IACzC,0BAA0B;IAC1B,yBAAyB;IACzB,sBAAsB;IACtB,QAAQ;IACR,0BAA0B;IAC1B,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,yBAAyB;IACzB,iBAAiB;IACjB,sBAAsB;IACtB,UAAU;IACV,yBAAyB;IACzB,MAAM;IACN,0BAA0B;IAC1B,wBAAwB;IACxB,iBAAiB;IACjB,yBAAyB;IACzB,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,QAAQ;IACR,yBAAyB;IACzB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAY,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AAEjG,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,mEAAmE;AAEnE,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,8EAA8E;IAC9E,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,2BAA2B;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,oEAAoE;IACpE,iFAAiF;IACjF,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,SAAS,EAAE,SAAS;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzD,qDAAqD;IACrD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI;QACzB,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3D,CAAC,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC,8BAA8B,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;KACvE,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC;gBACb,OAAO,EAAE,aAAa,KAAK,YAAY,IAAI,GAAG;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;oBACrC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,CAAC,MAAM,wCAAwC,EAAE,GAAG;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,CAAC,MAAM,kCAAkC,EAAE,GAAG;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACnC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;oBACtC,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,OAAO,wCAAwC,EAAE,GAAG;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;oBAChC,OAAO,EAAE,WAAW,CAAC,OAAO,MAAM,CAAC,QAAQ,iCAAiC,EAAE,GAAG;iBAClF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACjC,OAAO,EAAE,WAAW,CAAC,OAAO,MAAM,CAAC,QAAQ,kCAAkC,EAAE,GAAG;iBACnF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;oBACvC,OAAO,EAAE,WAAW,CAAC,OAAO,MAAM,CAAC,QAAQ,wCAAwC,EAAE,GAAG;iBACzF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,cAAc,GAAgC;QAClD,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,cAAc;KAC7B,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,SAAS,CAAC;oBACtC,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,OAAO,GAAG;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA4D,CAAC;IAC/F,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GACX,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,WAAW,CAAC,MAAM;YACvD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACtG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAC3B,OAAO,EAAE,kBAAkB,CAAC,2BAA2B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,wCAAwC,QAAQ,CAAC,KAAK,8BAA8B;aACrN,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "camunda-cloud-idac",
+  "version": "1.0.0",
+  "description": "Identity-as-code reconciler for Camunda 8 (tenants, roles, groups, mapping rules, authorizations)",
+  "type": "module",
+  "license": "MIT",
+  "author": "Jan Rohwer",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/janhuddel/camunda-cloud-idac.git"
+  },
+  "homepage": "https://github.com/janhuddel/camunda-cloud-idac#readme",
+  "bugs": {
+    "url": "https://github.com/janhuddel/camunda-cloud-idac/issues"
+  },
+  "keywords": [
+    "camunda",
+    "camunda-8",
+    "zeebe",
+    "identity-as-code",
+    "iac",
+    "cli"
+  ],
+  "bin": {
+    "camunda-idac": "./dist/cli.js",
+    "cci": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
+    "test": "vitest run",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build"
+  },
+  "dependencies": {
+    "@camunda8/orchestration-cluster-api": "9.1.5",
+    "commander": "^12.1.0",
+    "yaml": "^2.6.1",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "node": ">=20.6.0"
+  }
+}