camunda-cloud-idac 1.2.0 → 1.3.0-beta.1

package/README.md

@@ -14,8 +14,11 @@ against a live cluster, updates entities in place, and supports pruning
 point for all of this, applied unconditionally after diffing regardless of
 spec content):
 
-- The `admin` role is never deleted.
-- The `admin` role's authorizations are fully hands-off: never created,
+- Camunda's [default roles](https://docs.camunda.io/docs/components/concepts/access-control/authorizations/#default-roles)
+  (`admin`, `app-integrations`, `connectors`, `readonly-admin`, `rpa`,
+  `task-worker`) are never deleted. The cluster recreates any missing default
+  role on every startup, so deleting one would only cause permanent drift.
+- The default roles' authorizations are fully hands-off: never created,
   updated, or deleted by this tool at all - not merely protected from
   deletion.
 - This tool's own client (`CAMUNDA_CLIENT_ID`) never loses its assignment to
@@ -32,10 +35,11 @@ spec content):
 
 The `admin` *group* (if one exists) has **no special protection** - it's
 reconciled like any other group, including deletion under `--prune`. Adding
-or removing members (users/clients/groups/mapping rules) on the `admin`
-role is always fine and unaffected by any of the above; only deleting the
-role itself, mutating its authorizations, or unassigning the tool's own
-client from it are guarded.
+or removing members (users/clients/groups/mapping rules/tenants) on any
+default role is always fine and unaffected by any of the above (e.g. you can
+declare `connectors` in your spec just to assign clients to it); only
+deleting the role itself, mutating its authorizations, or the two
+`admin`-specific edges above are guarded.
 
 ## Installation
 
@@ -55,11 +59,11 @@ Or install globally and use the `camunda-idac` (or shorter `cci`) command:
 npm install -g camunda-cloud-idac
 
 camunda-idac validate spec.yaml
-camunda-idac ping                       # check cluster connectivity - no spec needed
+camunda-idac ping                       # check cluster connectivity and this client's permissions - no spec needed
 camunda-idac export > spec.yaml         # snapshot the live cluster as a spec YAML - reverse of render, no spec needed
 camunda-idac plan spec.yaml [--prune] [--show-protected]
 camunda-idac apply spec.yaml [--prune] [--yes] [--no-audit-log] [--show-protected]
-camunda-idac drop-all [--yes] [--no-audit-log]  # delete everything except the admin/<default> guard rail - no spec needed
+camunda-idac drop-all [--yes] [--no-audit-log]  # delete everything except the default-role/<default> guard rail - no spec needed
 camunda-idac --version
 
 # cci is an alias for camunda-idac
@@ -73,6 +77,26 @@ confirmation; it refuses to run without `--yes` on a non-interactive shell
 `--show-protected` (on `plan`/`apply`) also lists actions that the **Hard
 safety guarantee** above blocked, instead of silently omitting them.
 
+## Required permissions
+
+The client this tool authenticates as (`CAMUNDA_CLIENT_ID`) needs to manage
+authorizations, roles, groups, tenants and mapping rules. The simplest way is
+to assign it to the `admin` role. Camunda's search endpoints don't reject a
+caller without READ permission - they silently return a filtered (often
+empty) result - so without a check a misconfigured client would see an
+"empty" cluster and only fail on the first write. Therefore `plan`/`export`
+(READ) and `apply`/`drop-all` (CREATE/READ/UPDATE/DELETE) run a preflight
+check first and abort before reading any state if permissions are missing.
+`ping` reports the same check (exit 1 if even READ is missing, a warning if
+the client is read-only).
+
+The check accepts membership in the `admin` role, or wildcard
+(`resourceId: "*"`) authorizations on `AUTHORIZATION`, `ROLE`, `GROUP`,
+`TENANT` and `MAPPING_RULE` owned by the client itself or by one of its
+roles/groups (as reported by `/v2/authentication/me`). Authorizations owned
+by a mapping rule aren't considered. For such setups, or clusters with
+authorizations disabled, pass `--no-permission-check`.
+
 ## export
 
 ```sh
@@ -110,7 +134,7 @@ required on a non-interactive shell (CI), same as `apply`.
 
 The same **Hard safety guarantee** described above applies unchanged -
 `drop-all` goes through the identical `applyProtections()` post-filter, so
-the `admin` role, its authorizations, this tool's own client's `admin`
+the default roles, their authorizations, this tool's own client's `admin`
 assignment, and the `<default>` tenant are never touched. Protected/blocked
 actions are always shown (no `--show-protected` flag needed).
 
@@ -137,11 +161,11 @@ cp .env.example .env   # fill in CAMUNDA_* connection details, then export them
 
 npx tsx src/cli.ts validate spec.yaml          # schema + referential integrity only, no network
 npx tsx src/cli.ts render spec.yaml            # print the fully resolved spec as YAML, no network
-npx tsx src/cli.ts ping                        # check cluster connectivity - no spec needed
+npx tsx src/cli.ts ping                        # check cluster connectivity and this client's permissions - no spec needed
 npx tsx src/cli.ts export                      # print the live cluster's current state as a spec YAML - reverse of render
 npx tsx src/cli.ts plan spec.yaml [--prune] [--show-protected]   # dry-run diff; exit 1 if there's drift or a mapping-rule claim conflict (CI-friendly)
 npx tsx src/cli.ts apply spec.yaml [--prune] [--yes] [--no-audit-log] [--show-protected]
-npx tsx src/cli.ts drop-all [--yes] [--no-audit-log]  # delete everything except the admin/<default> guard rail - no spec needed
+npx tsx src/cli.ts drop-all [--yes] [--no-audit-log]  # delete everything except the default-role/<default> guard rail - no spec needed
 ```
 
 `plan`/`apply` also exit 1 (with no drift at all) when a spec's mapping rule
@@ -274,7 +298,7 @@ npm test            # vitest - schema, diff, protect (safety-critical), order
 ```
 
 `test/reconcile/protect.test.ts` and `test/reconcile/diff.test.ts` are the
-load-bearing suites: they cover the admin/default protection invariant and
+load-bearing suites: they cover the default-role/`<default>` protection invariant and
 the cascading-delete ordering directly.
 
 No integration test suite against a live cluster yet - run the commands

package/dist/camunda/access.js

@@ -0,0 +1,70 @@
+import { getClient } from "./client.js";
+import { listAllAuthorizations } from "./list-all.js";
+import { getGuardianClientId, PROTECTED_ROLE_ID } from "../reconcile/protect.js";
+const MANAGED_RESOURCE_TYPES = ["AUTHORIZATION", "ROLE", "GROUP", "TENANT", "MAPPING_RULE"];
+const REQUIRED_PERMISSIONS = {
+    read: ["READ"],
+    write: ["CREATE", "READ", "UPDATE", "DELETE"],
+};
+/**
+ * Pure evaluation of whether the caller may manage every entity type this tool
+ * reconciles. Membership in the admin role is accepted outright; otherwise the
+ * caller's effective permissions are derived from the given (visible)
+ * authorizations owned by the client itself or by one of its roles/groups, and
+ * only wildcard (`resourceId: "*"`) grants count, since the tool touches every
+ * entity of a type. Authorizations owned by a MAPPING_RULE are not considered -
+ * `/authentication/me` doesn't say which mapping rules matched.
+ */
+export function evaluateAccess(identity, authorizations, clientId, level) {
+    if (identity.roles.includes(PROTECTED_ROLE_ID))
+        return { ok: true, via: "admin-role" };
+    const roles = new Set(identity.roles);
+    const groups = new Set(identity.groups);
+    const granted = new Set();
+    for (const a of authorizations) {
+        if (a.resourceId !== "*")
+            continue;
+        const ownsIt = (a.ownerType === "CLIENT" && clientId !== undefined && a.ownerId === clientId) ||
+            (a.ownerType === "ROLE" && roles.has(a.ownerId)) ||
+            (a.ownerType === "GROUP" && groups.has(a.ownerId));
+        if (!ownsIt)
+            continue;
+        for (const p of a.permissionTypes)
+            granted.add(`${a.resourceType}:${p}`);
+    }
+    const missing = MANAGED_RESOURCE_TYPES.flatMap((r) => REQUIRED_PERMISSIONS[level].map((p) => `${r}:${p}`)).filter((key) => !granted.has(key));
+    return missing.length === 0 ? { ok: true, via: "authorizations" } : { ok: false, missing };
+}
+export class InsufficientPermissionsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InsufficientPermissionsError";
+    }
+}
+export function formatMissingAccess(identity, clientId, missing) {
+    const who = clientId ? `Client '${clientId}'` : "The configured client";
+    const roles = identity.roles.length > 0 ? identity.roles.join(", ") : "<none>";
+    return [
+        `${who} lacks the permissions required to manage identity entities (missing: ${missing.join(", ")}).`,
+        `Assign it to the '${PROTECTED_ROLE_ID}' role or grant these permissions on resourceId '*', then rerun.`,
+        `Roles seen for this client: ${roles}. (Use --no-permission-check to bypass this check.)`,
+    ].join("\n");
+}
+/** Reads the caller's identity and, only if it isn't in the admin role, the
+ * authorizations it can see - the inputs `evaluateAccess` needs. */
+export async function fetchAccessInputs() {
+    const me = await getClient().getAuthentication();
+    const identity = { roles: me.roles ?? [], groups: me.groups ?? [] };
+    const authorizations = identity.roles.includes(PROTECTED_ROLE_ID) ? [] : await listAllAuthorizations().catch(() => []);
+    return { identity, authorizations };
+}
+/** Preflight for plan/export ("read") and apply/drop-all ("write"): throws
+ * `InsufficientPermissionsError` before any cluster state is read or changed. */
+export async function checkAccess(level) {
+    const { identity, authorizations } = await fetchAccessInputs();
+    const clientId = getGuardianClientId();
+    const result = evaluateAccess(identity, authorizations, clientId, level);
+    if (!result.ok)
+        throw new InsufficientPermissionsError(formatMissingAccess(identity, clientId, result.missing));
+}
+//# sourceMappingURL=access.js.map

package/dist/camunda/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/camunda/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAsBjF,MAAM,sBAAsB,GAA4B,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAErH,MAAM,oBAAoB,GAAmD;IAC3E,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;CAC9C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,cAA8C,EAC9C,QAA4B,EAC5B,KAAkB;IAElB,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IAEvF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG;YAAE,SAAS;QACnC,MAAM,MAAM,GACV,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAC/G,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAC3B,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAkB,EAAE,QAA4B,EAAE,OAA0B;IAC9G,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,QAAQ,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/E,OAAO;QACL,GAAG,GAAG,yEAAyE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACrG,qBAAqB,iBAAiB,kEAAkE;QACxG,+BAA+B,KAAK,qDAAqD;KAC1F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,iBAAiB,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAC9E,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACvH,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAkB;IAClD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAClH,CAAC"}

package/dist/cli.js

@@ -7,6 +7,8 @@ import { stringify as stringifyYaml } from "yaml";
 import { loadSpec, SpecValidationError } from "./spec/load.js";
 import { EMPTY_SPEC } from "./spec/schema.js";
 import { checkConnection } from "./camunda/client.js";
+import { checkAccess, evaluateAccess, fetchAccessInputs, formatMissingAccess } from "./camunda/access.js";
+import { getGuardianClientId } from "./reconcile/protect.js";
 import { fetchCurrentState } from "./camunda/list-all.js";
 import { buildPlan } from "./reconcile/diff.js";
 import { stateToSpec } from "./reconcile/export.js";
@@ -52,6 +54,9 @@ async function fetchCurrentStateWithProgress() {
     }
 }
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+// Commander's "--no-*" form: sets opts.permissionCheck = false when passed.
+const SKIP_CHECK_FLAG = "--no-permission-check";
+const SKIP_CHECK_DESCRIPTION = "skip the preflight check that this tool's client has the permissions it needs (e.g. for clusters with authorizations disabled)";
 const program = new Command();
 program
     .name("camunda-idac")
@@ -88,8 +93,11 @@ program
 program
     .command("export")
     .description("read the live cluster's current state and print it as a YAML spec - the reverse of `render`, no spec needed")
-    .action(async () => {
+    .option(SKIP_CHECK_FLAG, SKIP_CHECK_DESCRIPTION)
+    .action(async (opts) => {
     try {
+        if (opts.permissionCheck)
+            await checkAccess("read");
         const current = await fetchCurrentStateWithProgress();
         const spec = stateToSpec(current);
         console.log(stringifyYaml(spec));
@@ -112,6 +120,30 @@ program
     else {
         reportError(result.error);
         process.exitCode = 1;
+        return;
+    }
+    try {
+        const { identity, authorizations } = await fetchAccessInputs();
+        const clientId = getGuardianClientId();
+        console.log(`Roles: ${identity.roles.length > 0 ? identity.roles.join(", ") : "<none>"}.`);
+        const write = evaluateAccess(identity, authorizations, clientId, "write");
+        if (write.ok) {
+            console.log(`Permissions: OK (${write.via === "admin-role" ? "admin role" : "via authorizations"}).`);
+            return;
+        }
+        const read = evaluateAccess(identity, authorizations, clientId, "read");
+        if (read.ok) {
+            console.error(`Warning: read-only access - plan/export work, apply/drop-all will be refused.`);
+            console.error(formatMissingAccess(identity, clientId, write.missing));
+        }
+        else {
+            console.error(formatMissingAccess(identity, clientId, read.missing));
+            process.exitCode = 1;
+        }
+    }
+    catch (err) {
+        reportError(err);
+        process.exitCode = 1;
     }
 });
 program
@@ -119,10 +151,13 @@ program
     .description("show what would change against the live cluster, without applying anything")
     .argument("<spec>", "path to the YAML spec file")
     .option("--prune", "also compute deletions for anything not in the spec", false)
-    .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
+    .option("--show-protected", "also list actions blocked by the default-role/<default> safety guard", false)
+    .option(SKIP_CHECK_FLAG, SKIP_CHECK_DESCRIPTION)
     .action(async (specPath, opts) => {
     try {
         const spec = await loadSpec(specPath);
+        if (opts.permissionCheck)
+            await checkAccess("read");
         const current = await fetchCurrentStateWithProgress();
         const mode = opts.prune ? "prune" : "additive";
         const plan = buildPlan(spec, current, mode);
@@ -142,11 +177,14 @@ program
     .argument("<spec>", "path to the YAML spec file")
     .option("--prune", "also delete anything not in the spec", false)
     .option("--yes", "skip the interactive confirmation prompt", false)
-    .option("--show-protected", "also list actions blocked by the admin/default safety guard", false)
+    .option("--show-protected", "also list actions blocked by the default-role/<default> safety guard", false)
     .option("--no-audit-log", "skip writing an audit log file to ./auditlog/")
+    .option(SKIP_CHECK_FLAG, SKIP_CHECK_DESCRIPTION)
     .action(async (specPath, opts) => {
     try {
         const spec = await loadSpec(specPath);
+        if (opts.permissionCheck)
+            await checkAccess("write");
         const current = await fetchCurrentStateWithProgress();
         const mode = opts.prune ? "prune" : "additive";
         const plan = buildPlan(spec, current, mode);
@@ -203,11 +241,14 @@ program
 });
 program
     .command("drop-all")
-    .description("delete every tenant, role, group, mapping rule, and authorization from the cluster (except the admin/<default> safety guard) - no spec needed")
+    .description("delete every tenant, role, group, mapping rule, and authorization from the cluster (except the default-role/<default> safety guard) - no spec needed")
     .option("--yes", "skip the interactive confirmation prompt", false)
     .option("--no-audit-log", "skip writing an audit log file to ./auditlog/")
+    .option(SKIP_CHECK_FLAG, SKIP_CHECK_DESCRIPTION)
     .action(async (opts) => {
     try {
+        if (opts.permissionCheck)
+            await checkAccess("write");
         const cluster = await gatherClusterInfo();
         const current = await fetchCurrentStateWithProgress();
         const plan = buildPlan(EMPTY_SPEC, current, "prune");

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAa,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,QAAQ,CAAC,MAAM,CACb,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG;gBAClD,CAAC,CAAC,6BAA6B,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,kCAAkC,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,YAAY,CAAC,MAAM,mBAAmB,OAAO,CAAC,cAAc,CAAC,MAAM,kBAAkB,CACnO,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAE/F,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,cAAc,CAAC;KACpB,WAAW,CAAC,mGAAmG,CAAC;KAChH,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;AAEnE,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0EAA0E,CAAC;KACvF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gGAAgG,CAAC;KAC7G,QAAQ,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6GAA6G,CAAC;KAC1H,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gFAAgF,CAAC;KAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/H,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4EAA4E,CAAC;KACzF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAgD,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACrE,iFAAiF;QACjF,oFAAoF;QACpF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,6DAA6D,EAAE,KAAK,CAAC;KAChG,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAAiF,EAAE,EAAE;IACpH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,UAAU,CAAC,CAAC;YAC9F,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAE9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7H,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,+IAA+I,CAAC;KAC5J,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjI,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;QAE5G,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;gBAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;gBAC9B,CAAC,CAAC,0BAA0B,KAAK,yBAAyB;gBAC1D,CAAC,CAAC,4FAA4F,CAAC;YACjG,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClI,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAa,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,mFAAmF;AACnF,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,OAAO,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,cAAc,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,sJAAsJ,CACvJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B;IAC1C,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,QAAQ,CAAC,MAAM,CACb,CAAC,CAAC,KAAK,KAAK,UAAU;gBACpB,CAAC,CAAC,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG;gBAClD,CAAC,CAAC,6BAA6B,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,GAAG,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,kCAAkC,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,YAAY,CAAC,MAAM,mBAAmB,OAAO,CAAC,cAAc,CAAC,MAAM,kBAAkB,CACnO,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAE/F,CAAC;AAEF,4EAA4E;AAC5E,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,sBAAsB,GAC1B,gIAAgI,CAAC;AAEnI,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,OAAO;KACJ,IAAI,CAAC,cAAc,CAAC;KACpB,WAAW,CAAC,mGAAmG,CAAC;KAChH,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;AAEnE,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0EAA0E,CAAC;KACvF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gGAAgG,CAAC;KAC7G,QAAQ,CAAC,QAAQ,EAAE,gDAAgD,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,6GAA6G,CAAC;KAC1H,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,IAAkC,EAAE,EAAE;IACnD,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gFAAgF,CAAC;KAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,SAAS,IAAI,WAAW,GAAG,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/H,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;YAC/F,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4EAA4E,CAAC;KACzF,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,qDAAqD,EAAE,KAAK,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,sEAAsE,EAAE,KAAK,CAAC;KACzG,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAA0E,EAAE,EAAE;IAC7G,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACrE,iFAAiF;QACjF,oFAAoF;QACpF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oCAAoC,CAAC;KACjD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAChD,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;KAChE,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,kBAAkB,EAAE,sEAAsE,EAAE,KAAK,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,IAA2G,EAAE,EAAE;IAC9I,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,UAAU,CAAC,CAAC;YAC9F,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAE9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7H,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,sJAAsJ,CAAC;KACnK,MAAM,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC;KAClE,MAAM,CAAC,gBAAgB,EAAE,+CAA+C,CAAC;KACzE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;KAC/C,MAAM,CAAC,KAAK,EAAE,IAAmE,EAAE,EAAE;IACpF,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,6BAA6B,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjI,OAAO,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;QAE5G,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;gBAClF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS;gBAC9B,CAAC,CAAC,0BAA0B,KAAK,yBAAyB;gBAC1D,CAAC,CAAC,4FAA4F,CAAC;YACjG,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACvB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClI,OAAO,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/reconcile/format.js

@@ -30,7 +30,7 @@ function colorFor(action) {
 /** Shared renderer used by both `plan` and the pre-confirmation display in `apply`,
  * so what `apply` is about to do is guaranteed to match what `plan` reported.
  *
- * Protection warnings (admin role/authorizations/guardian client blocked from a
+ * Protection warnings (default roles/authorizations/guardian client blocked from a
  * would-be deletion, the <default> tenant, etc.) are structural and permanent -
  * they'll fire on every single prune run for as long as those invariants exist,
  * so they're noise once you already know the policy. Hidden by default; pass

package/dist/reconcile/protect.js

@@ -1,5 +1,22 @@
 export const PROTECTED_ROLE_ID = "admin";
 export const PROTECTED_TENANT_ID = "<default>";
+/**
+ * Camunda's predefined roles (see
+ * https://docs.camunda.io/docs/components/concepts/access-control/authorizations/#default-roles).
+ * The Orchestration Cluster recreates any of these that are missing on every
+ * startup, together with their default authorizations - so deleting them (or
+ * their authorizations) here would only produce permanent drift that reappears
+ * after the next cluster restart. Re-check this list against the docs when
+ * upgrading the Camunda version this tool targets.
+ */
+export const DEFAULT_ROLE_IDS = new Set([
+    PROTECTED_ROLE_ID,
+    "app-integrations",
+    "connectors",
+    "readonly-admin",
+    "rpa",
+    "task-worker",
+]);
 /**
  * The client this tool itself authenticates as (from CAMUNDA_CLIENT_ID, the same
  * variable createCamundaClientLoose() reads). Its assignment to the admin role is
@@ -8,7 +25,7 @@ export const PROTECTED_TENANT_ID = "<default>";
  * isn't already assigned to the admin role, this tool will not assign it - it
  * only guards an existing assignment from being pruned away.
  */
-function getGuardianClientId() {
+export function getGuardianClientId() {
     return process.env.CAMUNDA_CLIENT_ID;
 }
 /**
@@ -22,10 +39,13 @@ function getGuardianClientId() {
  * trust the invariant holds.
  *
  * Current invariants (narrowed by explicit product decision - the "admin" group,
- * if one exists, is no longer specially protected; only the "admin" role is):
- *  1. The "admin" role itself is never deleted.
- *  2. The "admin" role's authorizations are fully hands-off: never created,
+ * if one exists, is no longer specially protected; only the default roles are):
+ *  1. No Camunda default role (DEFAULT_ROLE_IDS, including "admin") is ever
+ *     deleted.
+ *  2. The default roles' authorizations are fully hands-off: never created,
  *     updated, or deleted by this tool - not merely protected from deletion.
+ *     Their memberships (users/clients/groups/mapping rules/tenants) are
+ *     reconciled like any other role's, apart from rules 3 and 5.
  *  3. This tool's own client (CAMUNDA_CLIENT_ID) never loses its assignment to
  *     the admin role, so a full reset can't lock the tool out of the cluster it
  *     just reset. Every other role<->client pair (including other clients
@@ -51,14 +71,14 @@ export function applyProtections(actions) {
             return false;
         };
         const target = action.target;
-        if (target.kind === "delete-role" && target.roleId === PROTECTED_ROLE_ID) {
-            return block(`the "${PROTECTED_ROLE_ID}" role must never be deleted`);
+        if (target.kind === "delete-role" && DEFAULT_ROLE_IDS.has(target.roleId)) {
+            return block(`the "${target.roleId}" role is a Camunda default role (recreated on every cluster start) and must never be deleted`);
         }
         if (target.kind === "delete-tenant" && target.tenantId === PROTECTED_TENANT_ID) {
             return block(`the ${PROTECTED_TENANT_ID} system tenant must never be deleted`);
         }
-        if (target.kind === "authorization" && target.ownerType === "ROLE" && target.ownerId === PROTECTED_ROLE_ID) {
-            return block(`authorizations of the "${PROTECTED_ROLE_ID}" role must never be created, updated, or deleted`);
+        if (target.kind === "authorization" && target.ownerType === "ROLE" && DEFAULT_ROLE_IDS.has(target.ownerId)) {
+            return block(`authorizations of the "${target.ownerId}" role (a Camunda default role) must never be created, updated, or deleted`);
         }
         if (target.kind === "unassign-role-client" &&
             target.roleId === PROTECTED_ROLE_ID &&

package/dist/reconcile/protect.js.map

@@ -1 +1 @@
-{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/reconcile/protect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;YAC/B,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC,QAAQ,iBAAiB,8BAA8B,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,OAAO,mBAAmB,sCAAsC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,0BAA0B,iBAAiB,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,MAAM,KAAK,iBAAiB;YACnC,gBAAgB,KAAK,SAAS;YAC9B,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EACpC,CAAC;YACD,OAAO,KAAK,CACV,4BAA4B,gBAAgB,qBAAqB,iBAAiB,iDAAiD,CACpI,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;YACvC,MAAM,CAAC,MAAM,KAAK,iBAAiB,EACnC,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,iBAAiB,4CAA4C,mBAAmB,SAAS,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"protect.js","sourceRoot":"","sources":["../../src/reconcile/protect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,iBAAiB;IACjB,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE;YAC/B,QAAQ,CAAC,IAAI,CAAC,YAAY,MAAM,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CACV,QAAQ,MAAM,CAAC,MAAM,+FAA+F,CACrH,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,OAAO,mBAAmB,sCAAsC,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3G,OAAO,KAAK,CACV,0BAA0B,MAAM,CAAC,OAAO,4EAA4E,CACrH,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,MAAM,KAAK,iBAAiB;YACnC,gBAAgB,KAAK,SAAS;YAC9B,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EACpC,CAAC;YACD,OAAO,KAAK,CACV,4BAA4B,gBAAgB,qBAAqB,iBAAiB,iDAAiD,CACpI,CAAC;QACJ,CAAC;QAED,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB;YACtC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;YACvC,MAAM,CAAC,MAAM,KAAK,iBAAiB,EACnC,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,iBAAiB,4CAA4C,mBAAmB,SAAS,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "camunda-cloud-idac",
-  "version": "1.2.0",
+  "version": "1.3.0-beta.1",
   "description": "Identity-as-code reconciler for Camunda 8 (tenants, roles, groups, mapping rules, authorizations)",
   "type": "module",
   "license": "MIT",