camunda-cloud-idac 1.2.0 → 1.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +14 -10
  2. package/dist/cli.js +3 -3
  3. package/dist/cli.js.map +1 -1
  4. package/dist/reconcile/format.js +1 -1
  5. package/dist/reconcile/protect.js +27 -7
  6. package/dist/reconcile/protect.js.map +1 -1
  7. package/package.json +1 -1
package/README.md CHANGED
@@ -14,8 +14,11 @@ against a live cluster, updates entities in place, and supports pruning
14
14
  point for all of this, applied unconditionally after diffing regardless of
15
15
  spec content):
16
16
 
17
- - The `admin` role is never deleted.
18
- - The `admin` role's authorizations are fully hands-off: never created,
17
+ - Camunda's [default roles](https://docs.camunda.io/docs/components/concepts/access-control/authorizations/#default-roles)
18
+ (`admin`, `app-integrations`, `connectors`, `readonly-admin`, `rpa`,
19
+ `task-worker`) are never deleted. The cluster recreates any missing default
20
+ role on every startup, so deleting one would only cause permanent drift.
21
+ - The default roles' authorizations are fully hands-off: never created,
19
22
  updated, or deleted by this tool at all - not merely protected from
20
23
  deletion.
21
24
  - This tool's own client (`CAMUNDA_CLIENT_ID`) never loses its assignment to
@@ -32,10 +35,11 @@ spec content):
32
35
 
33
36
  The `admin` *group* (if one exists) has **no special protection** - it's
34
37
  reconciled like any other group, including deletion under `--prune`. Adding
35
- or removing members (users/clients/groups/mapping rules) on the `admin`
36
- role is always fine and unaffected by any of the above; only deleting the
37
- role itself, mutating its authorizations, or unassigning the tool's own
38
- client from it are guarded.
38
+ or removing members (users/clients/groups/mapping rules/tenants) on any
39
+ default role is always fine and unaffected by any of the above (e.g. you can
40
+ declare `connectors` in your spec just to assign clients to it); only
41
+ deleting the role itself, mutating its authorizations, or the two
42
+ `admin`-specific edges above are guarded.
39
43
 
40
44
  ## Installation
41
45
 
@@ -59,7 +63,7 @@ camunda-idac ping # check cluster connectivity - no spec n
59
63
  camunda-idac export > spec.yaml # snapshot the live cluster as a spec YAML - reverse of render, no spec needed
60
64
  camunda-idac plan spec.yaml [--prune] [--show-protected]
61
65
  camunda-idac apply spec.yaml [--prune] [--yes] [--no-audit-log] [--show-protected]
62
- camunda-idac drop-all [--yes] [--no-audit-log] # delete everything except the admin/<default> guard rail - no spec needed
66
+ camunda-idac drop-all [--yes] [--no-audit-log] # delete everything except the default-role/<default> guard rail - no spec needed
63
67
  camunda-idac --version
64
68
 
65
69
  # cci is an alias for camunda-idac
@@ -110,7 +114,7 @@ required on a non-interactive shell (CI), same as `apply`.
110
114
 
111
115
  The same **Hard safety guarantee** described above applies unchanged -
112
116
  `drop-all` goes through the identical `applyProtections()` post-filter, so
113
- the `admin` role, its authorizations, this tool's own client's `admin`
117
+ the default roles, their authorizations, this tool's own client's `admin`
114
118
  assignment, and the `<default>` tenant are never touched. Protected/blocked
115
119
  actions are always shown (no `--show-protected` flag needed).
116
120
 
@@ -141,7 +145,7 @@ npx tsx src/cli.ts ping # check cluster connectivity - no
141
145
  npx tsx src/cli.ts export # print the live cluster's current state as a spec YAML - reverse of render
142
146
  npx tsx src/cli.ts plan spec.yaml [--prune] [--show-protected] # dry-run diff; exit 1 if there's drift or a mapping-rule claim conflict (CI-friendly)
143
147
  npx tsx src/cli.ts apply spec.yaml [--prune] [--yes] [--no-audit-log] [--show-protected]
144
- npx tsx src/cli.ts drop-all [--yes] [--no-audit-log] # delete everything except the admin/<default> guard rail - no spec needed
148
+ npx tsx src/cli.ts drop-all [--yes] [--no-audit-log] # delete everything except the default-role/<default> guard rail - no spec needed
145
149
  ```
146
150
 
147
151
  `plan`/`apply` also exit 1 (with no drift at all) when a spec's mapping rule
@@ -274,7 +278,7 @@ npm test # vitest - schema, diff, protect (safety-critical), order
274
278
  ```
275
279
 
276
280
  `test/reconcile/protect.test.ts` and `test/reconcile/diff.test.ts` are the
277
- load-bearing suites: they cover the admin/default protection invariant and
281
+ load-bearing suites: they cover the default-role/`<default>` protection invariant and
278
282
  the cascading-delete ordering directly.
279
283
 
280
284
  No integration test suite against a live cluster yet - run the commands
package/dist/cli.js CHANGED
@@ -119,7 +119,7 @@ program
119
119
  .description("show what would change against the live cluster, without applying anything")
120
120
  .argument("<spec>", "path to the YAML spec file")
121
121
  .option("--prune", "also compute deletions for anything not in the spec", false)
122
- .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
122
+ .option("--show-protected", "also list actions blocked by the default-role/<default> safety guard", false)
123
123
  .action(async (specPath, opts) => {
124
124
  try {
125
125
  const spec = await loadSpec(specPath);
@@ -142,7 +142,7 @@ program
142
142
  .argument("<spec>", "path to the YAML spec file")
143
143
  .option("--prune", "also delete anything not in the spec", false)
144
144
  .option("--yes", "skip the interactive confirmation prompt", false)
145
- .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
145
+ .option("--show-protected", "also list actions blocked by the default-role/<default> safety guard", false)
146
146
  .option("--no-audit-log", "skip writing an audit log file to ./auditlog/")
147
147
  .action(async (specPath, opts) => {
148
148
  try {
@@ -203,7 +203,7 @@ program
203
203
  });
204
204
  program
205
205
  .command("drop-all")
206
- .description("delete every tenant, role, group, mapping rule, and authorization from the cluster (except the admin/<default> safety guard) - no spec needed")
206
+ .description("delete every tenant, role, group, mapping rule, and authorization from the cluster (except the default-role/<default> safety guard) - no spec needed")
207
207
  .option("--yes", "skip the interactive confirmation prompt", false)
208
208
  .option("--no-audit-log", "skip writing an audit log file to ./auditlog/")
209
209
  .action(async (opts) => {
package/dist/cli.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAa,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,QAAQ,CAAC,MAAM,CACb,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG;gBAClD,CAAC,CAAC,6BAA6B,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,kCAAkC,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,YAAY,CAAC,MAAM,mBAAmB,OAAO,CAAC,cAAc,CAAC,MAAM,kBAAkB,CACnO,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAE/F,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,cAAc,CAAC;KACpB,WAAW,CAAC,mGAAmG,CAAC;KAChH,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;AAEnE,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0EAA0E,CAAC;KACvF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gGAAgG,CAAC;KAC7G,QAAQ,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6GAA6G,CAAC;KAC1H,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gFAAgF,CAAC;KAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/H,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4EAA4E,CAAC;KACzF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAgD,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACrE,iFAAiF;QACjF,oFAAoF;QACpF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAiF,EAAE,EAAE;IACpH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,UAAU,CAAC,CAAC;YAC9F,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAE9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7H,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,+IAA+I,CAAC;KAC5J,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjI,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;QAE5G,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;gBAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;gBAC9B,CAAC,CAAC,0BAA0B,KAAK,yBAAyB;gBAC1D,CAAC,CAAC,4FAA4F,CAAC;YACjG,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClI,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAa,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,QAAQ,CAAC,MAAM,CACb,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG;gBAClD,CAAC,CAAC,6BAA6B,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,kCAAkC,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,YAAY,CAAC,MAAM,mBAAmB,OAAO,CAAC,cAAc,CAAC,MAAM,kBAAkB,CACnO,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAE/F,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,cAAc,CAAC;KACpB,WAAW,CAAC,mGAAmG,CAAC;KAChH,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;AAEnE,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0EAA0E,CAAC;KACvF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gGAAgG,CAAC;KAC7G,QAAQ,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6GAA6G,CAAC;KAC1H,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gFAAgF,CAAC;KAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/H,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4EAA4E,CAAC;KACzF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,sEAAsE,EAAE,KAAK,CAAC;KACzG,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAgD,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACrE,iFAAiF;QACjF,oFAAoF;QACpF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,sEAAsE,EAAE,KAAK,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAiF,EAAE,EAAE;IACpH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,UAAU,CAAC,CAAC;YAC9F,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAE9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7H,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,sJAAsJ,CAAC;KACnK,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjI,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;QAE5G,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;gBAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;gBAC9B,CAAC,CAAC,0BAA0B,KAAK,yBAAyB;gBAC1D,CAAC,CAAC,4FAA4F,CAAC;YACjG,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClI,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
package/dist/reconcile/format.js CHANGED
@@ -30,7 +30,7 @@ function colorFor(action) {
30
30
  /** Shared renderer used by both `plan` and the pre-confirmation display in `apply`,
31
31
  * so what `apply` is about to do is guaranteed to match what `plan` reported.
32
32
  *
33
- * Protection warnings (admin role/authorizations/guardian client blocked from a
33
+ * Protection warnings (default roles/authorizations/guardian client blocked from a
34
34
  * would-be deletion, the <default> tenant, etc.) are structural and permanent -
35
35
  * they'll fire on every single prune run for as long as those invariants exist,
36
36
  * so they're noise once you already know the policy. Hidden by default; pass
package/dist/reconcile/protect.js CHANGED
@@ -1,5 +1,22 @@
1
1
  export const PROTECTED_ROLE_ID = "admin";
2
2
  export const PROTECTED_TENANT_ID = "<default>";
3
+ /**
4
+ * Camunda's predefined roles (see
5
+ * https://docs.camunda.io/docs/components/concepts/access-control/authorizations/#default-roles).
6
+ * The Orchestration Cluster recreates any of these that are missing on every
7
+ * startup, together with their default authorizations - so deleting them (or
8
+ * their authorizations) here would only produce permanent drift that reappears
9
+ * after the next cluster restart. Re-check this list against the docs when
10
+ * upgrading the Camunda version this tool targets.
11
+ */
12
+ export const DEFAULT_ROLE_IDS = new Set([
13
+ PROTECTED_ROLE_ID,
14
+ "app-integrations",
15
+ "connectors",
16
+ "readonly-admin",
17
+ "rpa",
18
+ "task-worker",
19
+ ]);
3
20
  /**
4
21
  * The client this tool itself authenticates as (from CAMUNDA_CLIENT_ID, the same
5
22
  * variable createCamundaClientLoose() reads). Its assignment to the admin role is
@@ -22,10 +39,13 @@ function getGuardianClientId() {
22
39
  * trust the invariant holds.
23
40
  *
24
41
  * Current invariants (narrowed by explicit product decision - the "admin" group,
25
- * if one exists, is no longer specially protected; only the "admin" role is):
26
- * 1. The "admin" role itself is never deleted.
27
- * 2. The "admin" role's authorizations are fully hands-off: never created,
42
+ * if one exists, is no longer specially protected; only the default roles are):
43
+ * 1. No Camunda default role (DEFAULT_ROLE_IDS, including "admin") is ever
44
+ * deleted.
45
+ * 2. The default roles' authorizations are fully hands-off: never created,
28
46
  * updated, or deleted by this tool - not merely protected from deletion.
47
+ * Their memberships (users/clients/groups/mapping rules/tenants) are
48
+ * reconciled like any other role's, apart from rules 3 and 5.
29
49
  * 3. This tool's own client (CAMUNDA_CLIENT_ID) never loses its assignment to
30
50
  * the admin role, so a full reset can't lock the tool out of the cluster it
31
51
  * just reset. Every other role<->client pair (including other clients
@@ -51,14 +71,14 @@ export function applyProtections(actions) {
51
71
  return false;
52
72
  };
53
73
  const target = action.target;
54
- if (target.kind === "delete-role" && target.roleId === PROTECTED_ROLE_ID) {
55
- return block(`the "${PROTECTED_ROLE_ID}" role must never be deleted`);
74
+ if (target.kind === "delete-role" && DEFAULT_ROLE_IDS.has(target.roleId)) {
75
+ return block(`the "${target.roleId}" role is a Camunda default role (recreated on every cluster start) and must never be deleted`);
56
76
  }
57
77
  if (target.kind === "delete-tenant" && target.tenantId === PROTECTED_TENANT_ID) {
58
78
  return block(`the ${PROTECTED_TENANT_ID} system tenant must never be deleted`);
59
79
  }
60
- if (target.kind === "authorization" && target.ownerType === "ROLE" && target.ownerId === PROTECTED_ROLE_ID) {
61
- return block(`authorizations of the "${PROTECTED_ROLE_ID}" role must never be created, updated, or deleted`);
80
+ if (target.kind === "authorization" && target.ownerType === "ROLE" && DEFAULT_ROLE_IDS.has(target.ownerId)) {
81
+ return block(`authorizations of the "${target.ownerId}" role (a Camunda default role) must never be created, updated, or deleted`);
62
82
  }
63
83
  if (target.kind === "unassign-role-client" &&
64
84
  target.roleId === PROTECTED_ROLE_ID &&
package/dist/reconcile/protect.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/reconcile/protect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;YAC/B,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,QAAQ,iBAAiB,8BAA8B,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,OAAO,mBAAmB,sCAAsC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,0BAA0B,iBAAiB,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,MAAM,KAAK,iBAAiB;YACnC,gBAAgB,KAAK,SAAS;YAC9B,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EACpC,CAAC;YACD,OAAO,KAAK,CACV,4BAA4B,gBAAgB,qBAAqB,iBAAiB,iDAAiD,CACpI,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;YACvC,MAAM,CAAC,MAAM,KAAK,iBAAiB,EACnC,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,iBAAiB,4CAA4C,mBAAmB,SAAS,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}
1
+ {"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/reconcile/protect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,iBAAiB;IACjB,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;YAC/B,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CACV,QAAQ,MAAM,CAAC,MAAM,+FAA+F,CACrH,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,OAAO,mBAAmB,sCAAsC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3G,OAAO,KAAK,CACV,0BAA0B,MAAM,CAAC,OAAO,4EAA4E,CACrH,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,MAAM,KAAK,iBAAiB;YACnC,gBAAgB,KAAK,SAAS;YAC9B,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EACpC,CAAC;YACD,OAAO,KAAK,CACV,4BAA4B,gBAAgB,qBAAqB,iBAAiB,iDAAiD,CACpI,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;YACvC,MAAM,CAAC,MAAM,KAAK,iBAAiB,EACnC,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,iBAAiB,4CAA4C,mBAAmB,SAAS,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "camunda-cloud-idac",
3
- "version": "1.2.0",
3
+ "version": "1.2.1",
4
4
  "description": "Identity-as-code reconciler for Camunda 8 (tenants, roles, groups, mapping rules, authorizations)",
5
5
  "type": "module",
6
6
  "license": "MIT",