zitadel-mcp-server 1.0.0

package/build/tools/roles.js

@@ -0,0 +1,203 @@
+/**
+ * Role & grant management tools (5 tools)
+ * Project roles and user grants via Zitadel Management API v1
+ */
+import { z } from 'zod';
+import { textResponse, errorResponse, zitadelId } from '../types/tools.js';
+import { logger } from '../utils/logger.js';
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+export const ROLE_TOOLS = [
+    {
+        name: 'zitadel_list_project_roles',
+        description: 'List all roles defined in a Zitadel project (e.g., "admin", "app:finance").',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID (uses default project if omitted)' },
+            },
+        },
+        _meta: { readOnly: true, domain: 'roles' },
+        annotations: { title: 'List Project Roles', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_create_project_role',
+        description: 'Create a new role in a Zitadel project. Use key format "app:{slug}" for app-specific access roles.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID (uses default project if omitted)' },
+                roleKey: { type: 'string', description: 'Role key (e.g., "admin", "app:finance", "app:timesheets")' },
+                displayName: { type: 'string', description: 'Human-readable role name' },
+                group: { type: 'string', description: 'Optional role group for organization' },
+            },
+            required: ['roleKey', 'displayName'],
+        },
+        _meta: { readOnly: false, domain: 'roles' },
+        annotations: { title: 'Create Project Role', readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_list_user_grants',
+        description: 'List role grants for a specific user, showing which roles they have been assigned.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The user ID to list grants for' },
+                projectId: { type: 'string', description: 'Filter by project ID (uses default project if omitted)' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: true, domain: 'roles' },
+        annotations: { title: 'List User Grants', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_create_user_grant',
+        description: 'Assign roles to a user by creating a grant. Validates that the roles exist in the project before granting.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The user ID to grant roles to' },
+                roleKeys: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Array of role keys to assign (e.g., ["admin", "app:finance"])',
+                },
+                projectId: { type: 'string', description: 'The project ID (uses default project if omitted)' },
+            },
+            required: ['userId', 'roleKeys'],
+        },
+        _meta: { readOnly: false, domain: 'roles' },
+        annotations: { title: 'Create User Grant', readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    {
+        name: 'zitadel_remove_user_grant',
+        description: 'Remove a role grant from a user by grant ID.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The user ID' },
+                grantId: { type: 'string', description: 'The grant ID to remove' },
+            },
+            required: ['userId', 'grantId'],
+        },
+        _meta: { readOnly: false, domain: 'roles' },
+        annotations: { title: 'Remove User Grant', readOnlyHint: false, destructiveHint: true, idempotentHint: true },
+    },
+];
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function resolveProjectId(params, ctx) {
+    const projectId = params['projectId'] || ctx.config.projectId;
+    if (!projectId) {
+        throw new Error('projectId is required — either pass it as a parameter or set ZITADEL_PROJECT_ID');
+    }
+    return projectId;
+}
+async function getProjectRoleKeys(projectId, ctx) {
+    const response = await ctx.client.request(`/management/v1/projects/${projectId}/roles/_search`, {
+        method: 'POST',
+        body: JSON.stringify({ query: { offset: '0', limit: 100 } }),
+    });
+    return (response.result || []).map(r => r.key);
+}
+function formatGrant(g) {
+    const roles = g.roleKeys.join(', ');
+    const state = g.state?.replace('USER_GRANT_STATE_', '') || 'UNKNOWN';
+    return `- Grant ${g.id}: [${roles}] (${state}) Project: ${g.projectId}`;
+}
+// ─── Handlers ────────────────────────────────────────────────────────────────
+const listProjectRolesHandler = async (params, ctx) => {
+    const projectId = resolveProjectId(params, ctx);
+    const response = await ctx.client.request(`/management/v1/projects/${projectId}/roles/_search`, {
+        method: 'POST',
+        body: JSON.stringify({ query: { offset: '0', limit: 100 } }),
+    });
+    const roles = response.result || [];
+    if (roles.length === 0) {
+        return textResponse(`No roles found in project ${projectId}.`);
+    }
+    const lines = roles.map(r => {
+        const group = r.group ? ` (group: ${r.group})` : '';
+        return `- ${r.key}: ${r.displayName}${group}`;
+    });
+    return textResponse(`Found ${roles.length} role(s) in project ${projectId}:\n\n${lines.join('\n')}`);
+};
+const createProjectRoleHandler = async (params, ctx) => {
+    const input = z.object({
+        roleKey: z.string().min(1),
+        displayName: z.string().min(1),
+        group: z.string().optional(),
+    }).parse(params);
+    const projectId = resolveProjectId(params, ctx);
+    logger.info('Creating project role', { projectId, roleKey: input.roleKey });
+    await ctx.client.request(`/management/v1/projects/${projectId}/roles`, {
+        method: 'POST',
+        body: JSON.stringify({
+            roleKey: input.roleKey,
+            displayName: input.displayName,
+            group: input.group,
+        }),
+    });
+    return textResponse(`Role created: ${input.roleKey} (${input.displayName}) in project ${projectId}`);
+};
+const listUserGrantsHandler = async (params, ctx) => {
+    const { userId } = z.object({ userId: zitadelId('userId') }).parse(params);
+    const projectId = params['projectId'] || ctx.config.projectId;
+    const queries = [{ userIdQuery: { userId } }];
+    if (projectId) {
+        queries.push({ projectIdQuery: { projectId } });
+    }
+    const response = await ctx.client.request('/management/v1/users/grants/_search', {
+        method: 'POST',
+        body: JSON.stringify({
+            query: { offset: '0', limit: 100 },
+            queries,
+        }),
+    });
+    const grants = response.result || [];
+    if (grants.length === 0) {
+        return textResponse(`No grants found for user ${userId}.`);
+    }
+    const lines = grants.map(formatGrant);
+    return textResponse(`Found ${grants.length} grant(s) for user ${userId}:\n\n${lines.join('\n')}`);
+};
+const createUserGrantHandler = async (params, ctx) => {
+    const input = z.object({
+        userId: zitadelId('userId'),
+        roleKeys: z.array(z.string().min(1)).min(1),
+    }).parse(params);
+    const projectId = resolveProjectId(params, ctx);
+    // Validate that roles exist before granting
+    const existingRoles = await getProjectRoleKeys(projectId, ctx);
+    const missingRoles = input.roleKeys.filter(r => !existingRoles.includes(r));
+    if (missingRoles.length > 0) {
+        return errorResponse(`Cannot grant access: role(s) not found in project ${projectId}: ${missingRoles.join(', ')}\n` +
+            `Available roles: ${existingRoles.join(', ') || 'none'}\n\n` +
+            `Create the missing roles first with zitadel_create_project_role.`);
+    }
+    logger.info('Creating user grant', { userId: input.userId, roleKeys: input.roleKeys, projectId });
+    const response = await ctx.client.request(`/management/v1/users/${input.userId}/grants`, {
+        method: 'POST',
+        body: JSON.stringify({ projectId, roleKeys: input.roleKeys }),
+    });
+    return textResponse(`Grant created successfully.\n` +
+        `Grant ID: ${response.userGrantId}\n` +
+        `User: ${input.userId}\n` +
+        `Roles: ${input.roleKeys.join(', ')}\n` +
+        `Project: ${projectId}`);
+};
+const removeUserGrantHandler = async (params, ctx) => {
+    const input = z.object({
+        userId: zitadelId('userId'),
+        grantId: zitadelId('grantId'),
+    }).parse(params);
+    await ctx.client.request(`/management/v1/users/${input.userId}/grants/${input.grantId}`, { method: 'DELETE' });
+    return textResponse(`Grant ${input.grantId} removed from user ${input.userId}.`);
+};
+// ─── Export ──────────────────────────────────────────────────────────────────
+export const ROLE_HANDLERS = {
+    zitadel_list_project_roles: listProjectRolesHandler,
+    zitadel_create_project_role: createProjectRoleHandler,
+    zitadel_list_user_grants: listUserGrantsHandler,
+    zitadel_create_user_grant: createUserGrantHandler,
+    zitadel_remove_user_grant: removeUserGrantHandler,
+};
+//# sourceMappingURL=roles.js.map

package/build/tools/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/tools/roles.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,UAAU,GAAqB;IAC1C;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,6EAA6E;QAC1F,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;aAC/F;SACF;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1C,WAAW,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KAC/G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,oGAAoG;QACjH,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;gBAC9F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2DAA2D,EAAE;gBACrG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;gBACxE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;aAC/E;YACD,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;SACrC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACjH;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,oFAAoF;QACjG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gCAAgC,EAAE;gBACzE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wDAAwD,EAAE;aACrG;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1C,WAAW,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KAC7G;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,4GAA4G;QACzH,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;gBACxE,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,+DAA+D;iBAC7E;gBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;aAC/F;YACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;SACjC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KAChH;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,8CAA8C;QAC3D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE;gBACtD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE;aACnE;YACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;SAChC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;KAC9G;CACF,CAAC;AAEF,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,MAA+B,EAAE,GAAuC;IAChG,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAY,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,GAAoF;IACvI,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,2BAA2B,SAAS,gBAAgB,EACpD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;KAC7D,CACF,CAAC;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,CAAY;IAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IACrE,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC,SAAS,EAAE,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAEhF,MAAM,uBAAuB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,2BAA2B,SAAS,gBAAgB,EACpD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;KAC7D,CACF,CAAC;IAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,6BAA6B,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,SAAS,KAAK,CAAC,MAAM,uBAAuB,SAAS,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAClE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhD,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5E,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACtB,2BAA2B,SAAS,QAAQ,EAC5C;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;KACH,CACF,CAAC;IAEF,OAAO,YAAY,CAAC,iBAAiB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,gBAAgB,SAAS,EAAE,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAY,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;IAE1E,MAAM,OAAO,GAAc,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,qCAAqC,EACrC;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAClC,OAAO;SACR,CAAC;KACH,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,YAAY,CAAC,SAAS,MAAM,CAAC,MAAM,sBAAsB,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpG,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhD,4CAA4C;IAC5C,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,aAAa,CAClB,qDAAqD,SAAS,KAAK,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9F,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM;YAC5D,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAElG,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,wBAAwB,KAAK,CAAC,MAAM,SAAS,EAC7C;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KAC9D,CACF,CAAC;IAEF,OAAO,YAAY,CACjB,+BAA+B;QAC/B,aAAa,QAAQ,CAAC,WAAW,IAAI;QACrC,SAAS,KAAK,CAAC,MAAM,IAAI;QACzB,UAAU,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACvC,YAAY,SAAS,EAAE,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;KAC9B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACtB,wBAAwB,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,EAC9D,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;IAEF,OAAO,YAAY,CAAC,SAAS,KAAK,CAAC,OAAO,sBAAsB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,0BAA0B,EAAE,uBAAuB;IACnD,2BAA2B,EAAE,wBAAwB;IACrD,wBAAwB,EAAE,qBAAqB;IAC/C,yBAAyB,EAAE,sBAAsB;IACjD,yBAAyB,EAAE,sBAAsB;CAClD,CAAC"}

package/build/tools/service-accounts.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Service account (machine user) tools (3 tools)
+ * Create machine users and manage their keys via Management API v1
+ */
+import type { ToolDefinition, ToolHandler } from '../types/tools.js';
+export declare const SERVICE_ACCOUNT_TOOLS: ToolDefinition[];
+export declare const SERVICE_ACCOUNT_HANDLERS: Record<string, ToolHandler>;

package/build/tools/service-accounts.js

@@ -0,0 +1,122 @@
+/**
+ * Service account (machine user) tools (3 tools)
+ * Create machine users and manage their keys via Management API v1
+ */
+import { z } from 'zod';
+import { textResponse, zitadelId } from '../types/tools.js';
+import { logger } from '../utils/logger.js';
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+export const SERVICE_ACCOUNT_TOOLS = [
+    {
+        name: 'zitadel_create_service_user',
+        description: 'Create a new service account (machine user) for API access. Service accounts authenticate via JWT keys, not passwords.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userName: { type: 'string', description: 'Unique username for the service account' },
+                name: { type: 'string', description: 'Display name' },
+                description: { type: 'string', description: 'Optional description of what this service account is used for' },
+                accessTokenType: {
+                    type: 'string',
+                    enum: ['ACCESS_TOKEN_TYPE_BEARER', 'ACCESS_TOKEN_TYPE_JWT'],
+                    description: 'Token type (default: ACCESS_TOKEN_TYPE_BEARER)',
+                },
+            },
+            required: ['userName', 'name'],
+        },
+        _meta: { readOnly: false, domain: 'service-accounts' },
+        annotations: { title: 'Create Service User', readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    {
+        name: 'zitadel_create_service_user_key',
+        description: 'Generate a new key pair for a service account. The private key is returned ONLY at creation time — save it immediately.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The service account user ID' },
+                expirationDate: { type: 'string', description: 'Optional expiration date (ISO 8601 format)' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: false, domain: 'service-accounts' },
+        annotations: { title: 'Create Service User Key', readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    {
+        name: 'zitadel_list_service_user_keys',
+        description: 'List existing keys for a service account. Shows key metadata only (not private keys).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The service account user ID' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: true, domain: 'service-accounts' },
+        annotations: { title: 'List Service User Keys', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+];
+// ─── Handlers ────────────────────────────────────────────────────────────────
+const createServiceUserHandler = async (params, ctx) => {
+    const input = z.object({
+        userName: z.string().min(1),
+        name: z.string().min(1),
+        description: z.string().optional(),
+        accessTokenType: z.string().default('ACCESS_TOKEN_TYPE_BEARER'),
+    }).parse(params);
+    logger.info('Creating service user', { userName: input.userName });
+    const response = await ctx.client.request('/management/v1/users/machine', {
+        method: 'POST',
+        body: JSON.stringify({
+            userName: input.userName,
+            name: input.name,
+            description: input.description || '',
+            accessTokenType: input.accessTokenType,
+        }),
+    });
+    return textResponse(`Service account created successfully.\n` +
+        `User ID: ${response.userId}\n` +
+        `Username: ${input.userName}\n` +
+        `Name: ${input.name}\n\n` +
+        `Next step: Generate a key with zitadel_create_service_user_key using this User ID.`);
+};
+const createServiceUserKeyHandler = async (params, ctx) => {
+    const input = z.object({
+        userId: zitadelId('userId'),
+        expirationDate: z.string().optional(),
+    }).parse(params);
+    logger.info('Creating service user key', { userId: input.userId });
+    const body = { type: 'KEY_TYPE_JSON' };
+    if (input.expirationDate) {
+        body['expirationDate'] = input.expirationDate;
+    }
+    const response = await ctx.client.request(`/management/v1/users/${input.userId}/keys`, { method: 'POST', body: JSON.stringify(body) });
+    return textResponse(`Service account key created.\n` +
+        `Key ID: ${response.keyId}\n\n` +
+        `=== KEY DETAILS (save immediately — cannot be retrieved again) ===\n` +
+        `${response.keyDetails}\n` +
+        `=================================================================\n\n` +
+        `Use this key to configure ZITADEL_SERVICE_ACCOUNT_KEY_ID and ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY.`);
+};
+const listServiceUserKeysHandler = async (params, ctx) => {
+    const { userId } = z.object({ userId: zitadelId('userId') }).parse(params);
+    const response = await ctx.client.request(`/management/v1/users/${userId}/keys/_search`, {
+        method: 'POST',
+        body: JSON.stringify({ query: { offset: '0', limit: 100 } }),
+    });
+    const keys = response.result || [];
+    if (keys.length === 0) {
+        return textResponse(`No keys found for service account ${userId}.`);
+    }
+    const lines = keys.map(k => {
+        const expiry = k.expirationDate || 'never';
+        return `- Key ${k.id}: type=${k.type}, expires=${expiry}, created=${k.details?.creationDate || 'N/A'}`;
+    });
+    return textResponse(`Found ${keys.length} key(s) for service account ${userId}:\n\n${lines.join('\n')}`);
+};
+// ─── Export ──────────────────────────────────────────────────────────────────
+export const SERVICE_ACCOUNT_HANDLERS = {
+    zitadel_create_service_user: createServiceUserHandler,
+    zitadel_create_service_user_key: createServiceUserKeyHandler,
+    zitadel_list_service_user_keys: listServiceUserKeysHandler,
+};
+//# sourceMappingURL=service-accounts.js.map

package/build/tools/service-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-accounts.js","sourceRoot":"","sources":["../../src/tools/service-accounts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,wHAAwH;QACrI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACpF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;gBACrD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;gBAC7G,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;oBAC3D,WAAW,EAAE,gDAAgD;iBAC9D;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;SAC/B;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACtD,WAAW,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KAClH;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EAAE,yHAAyH;QACtI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE;gBACtE,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE;aAC9F;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACtD,WAAW,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KACtH;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,WAAW,EAAE,uFAAuF;QACpG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE;aACvE;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACrD,WAAW,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACnH;CACF,CAAC;AAEF,gFAAgF;AAEhF,MAAM,wBAAwB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAClE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;KAChE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,8BAA8B,EAC9B;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC;KACH,CACF,CAAC;IAEF,OAAO,YAAY,CACjB,yCAAyC;QACzC,YAAY,QAAQ,CAAC,MAAM,IAAI;QAC/B,aAAa,KAAK,CAAC,QAAQ,IAAI;QAC/B,SAAS,KAAK,CAAC,IAAI,MAAM;QACzB,oFAAoF,CACrF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACrE,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnE,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IAChD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,wBAAwB,KAAK,CAAC,MAAM,OAAO,EAC3C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IAEF,OAAO,YAAY,CACjB,gCAAgC;QAChC,WAAW,QAAQ,CAAC,KAAK,MAAM;QAC/B,sEAAsE;QACtE,GAAG,QAAQ,CAAC,UAAU,IAAI;QAC1B,uEAAuE;QACvE,mGAAmG,CACpG,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CACvC,wBAAwB,MAAM,eAAe,EAC7C;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;KAC7D,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC;QAC3C,OAAO,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,aAAa,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,YAAY,IAAI,KAAK,EAAE,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,SAAS,IAAI,CAAC,MAAM,+BAA+B,MAAM,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3G,CAAC,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAgC;IACnE,2BAA2B,EAAE,wBAAwB;IACrD,+BAA+B,EAAE,2BAA2B;IAC5D,8BAA8B,EAAE,0BAA0B;CAC3D,CAAC"}

package/build/tools/users.d.ts

@@ -0,0 +1,7 @@
+/**
+ * User management tools (5 tools)
+ * CRUD operations for human users via Zitadel v2 API
+ */
+import type { ToolDefinition, ToolHandler } from '../types/tools.js';
+export declare const USER_TOOLS: ToolDefinition[];
+export declare const USER_HANDLERS: Record<string, ToolHandler>;

package/build/tools/users.js

@@ -0,0 +1,183 @@
+/**
+ * User management tools (5 tools)
+ * CRUD operations for human users via Zitadel v2 API
+ */
+import { z } from 'zod';
+import { textResponse, zitadelId } from '../types/tools.js';
+import { logger } from '../utils/logger.js';
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+export const USER_TOOLS = [
+    {
+        name: 'zitadel_list_users',
+        description: 'List or search users in the Zitadel instance. Returns user details including name, email, status, and login names.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                query: {
+                    type: 'string',
+                    description: 'Optional search query to filter users by email, name, or username',
+                },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum number of users to return (default: 50)',
+                },
+            },
+        },
+        _meta: { readOnly: true, domain: 'users' },
+        annotations: { title: 'List Users', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_get_user',
+        description: 'Get detailed information about a specific user by their user ID.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The Zitadel user ID' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: true, domain: 'users' },
+        annotations: { title: 'Get User', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_create_user',
+        description: 'Create a new human user in Zitadel. An invitation email will be sent automatically so the user can set their password.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                email: { type: 'string', description: 'Email address for the new user' },
+                firstName: { type: 'string', description: 'First name' },
+                lastName: { type: 'string', description: 'Last name' },
+            },
+            required: ['email', 'firstName', 'lastName'],
+        },
+        _meta: { readOnly: false, domain: 'users' },
+        annotations: { title: 'Create User', readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    {
+        name: 'zitadel_deactivate_user',
+        description: 'Deactivate a user account. The user will no longer be able to log in.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The Zitadel user ID to deactivate' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: false, domain: 'users' },
+        annotations: { title: 'Deactivate User', readOnlyHint: false, destructiveHint: true, idempotentHint: true },
+    },
+    {
+        name: 'zitadel_reactivate_user',
+        description: 'Reactivate a previously deactivated user account.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                userId: { type: 'string', description: 'The Zitadel user ID to reactivate' },
+            },
+            required: ['userId'],
+        },
+        _meta: { readOnly: false, domain: 'users' },
+        annotations: { title: 'Reactivate User', readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+    },
+];
+// ─── Handlers ────────────────────────────────────────────────────────────────
+function formatUser(u) {
+    const name = u.human?.profile
+        ? `${u.human.profile.givenName} ${u.human.profile.familyName}`.trim()
+        : u.username;
+    const email = u.human?.email?.email || 'N/A';
+    const state = u.state.replace('USER_STATE_', '');
+    return `- ${name} (${email}) [${state}] ID: ${u.userId}`;
+}
+const listUsersHandler = async (params, ctx) => {
+    const input = z.object({
+        query: z.string().optional(),
+        limit: z.number().min(1).max(500).default(50),
+    }).parse(params);
+    const queries = [];
+    if (input.query) {
+        queries.push({
+            emailQuery: { emailAddress: input.query, method: 'TEXT_QUERY_METHOD_CONTAINS_IGNORE_CASE' },
+        });
+    }
+    const response = await ctx.client.request('/v2/users', {
+        method: 'POST',
+        body: JSON.stringify({
+            query: { offset: '0', limit: input.limit },
+            ...(queries.length > 0 ? { queries } : {}),
+        }),
+    });
+    const users = response.result || [];
+    if (users.length === 0) {
+        return textResponse('No users found.');
+    }
+    const total = response.details?.totalResult || users.length;
+    const lines = users.map(formatUser);
+    return textResponse(`Found ${total} user(s):\n\n${lines.join('\n')}`);
+};
+const getUserHandler = async (params, ctx) => {
+    const { userId } = z.object({ userId: zitadelId('userId') }).parse(params);
+    const response = await ctx.client.request(`/v2/users/${userId}`);
+    // v2 GET returns user fields directly (not nested under .user)
+    const u = response;
+    const name = u.human?.profile
+        ? `${u.human.profile.givenName} ${u.human.profile.familyName}`.trim()
+        : u.username;
+    const lines = [
+        `User: ${name}`,
+        `ID: ${u.userId}`,
+        `Email: ${u.human?.email?.email || 'N/A'}`,
+        `Email Verified: ${u.human?.email?.isEmailVerified ?? 'N/A'}`,
+        `State: ${u.state.replace('USER_STATE_', '')}`,
+        `Username: ${u.username}`,
+        `Login Names: ${(u.loginNames || []).join(', ')}`,
+        `Created: ${u.details?.creationDate || 'N/A'}`,
+    ];
+    return textResponse(lines.join('\n'));
+};
+const createUserHandler = async (params, ctx) => {
+    const input = z.object({
+        email: z.string().email(),
+        firstName: z.string().min(1),
+        lastName: z.string().min(1),
+    }).parse(params);
+    logger.info('Creating user', { email: input.email });
+    const response = await ctx.client.request('/v2/users/human', {
+        method: 'POST',
+        body: JSON.stringify({
+            profile: {
+                givenName: input.firstName,
+                familyName: input.lastName,
+            },
+            email: {
+                email: input.email,
+                isVerified: false,
+            },
+        }),
+    });
+    return textResponse(`User created successfully.\n` +
+        `User ID: ${response.userId}\n` +
+        `Email: ${input.email}\n` +
+        `Name: ${input.firstName} ${input.lastName}\n\n` +
+        `An invitation email has been sent to ${input.email} to complete registration.`);
+};
+const deactivateUserHandler = async (params, ctx) => {
+    const { userId } = z.object({ userId: zitadelId('userId') }).parse(params);
+    await ctx.client.request(`/v2/users/${userId}/deactivate`, { method: 'POST' });
+    return textResponse(`User ${userId} has been deactivated.`);
+};
+const reactivateUserHandler = async (params, ctx) => {
+    const { userId } = z.object({ userId: zitadelId('userId') }).parse(params);
+    await ctx.client.request(`/v2/users/${userId}/reactivate`, { method: 'POST' });
+    return textResponse(`User ${userId} has been reactivated.`);
+};
+// ─── Export ──────────────────────────────────────────────────────────────────
+export const USER_HANDLERS = {
+    zitadel_list_users: listUsersHandler,
+    zitadel_get_user: getUserHandler,
+    zitadel_create_user: createUserHandler,
+    zitadel_deactivate_user: deactivateUserHandler,
+    zitadel_reactivate_user: reactivateUserHandler,
+};
+//# sourceMappingURL=users.js.map

package/build/tools/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/tools/users.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAiB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,UAAU,GAAqB;IAC1C;QACE,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,oHAAoH;QACjI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,mEAAmE;iBACjF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iDAAiD;iBAC/D;aACF;SACF;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1C,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACvG;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,kEAAkE;QAC/E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;aAC/D;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAC1C,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KACrG;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,wHAAwH;QACrI,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gCAAgC,EAAE;gBACxE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE;aACvD;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC;SAC7C;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;KAC1G;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,uEAAuE;QACpF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;aAC7E;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;KAC5G;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,mDAAmD;QAChE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;aAC7E;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KAC7G;CACF,CAAC;AAEF,gFAAgF;AAEhF,SAAS,UAAU,CAAC,CAAqB;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO;QAC3B,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE;QACrE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,gBAAgB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC;YACX,UAAU,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAoB,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,YAAY,CAAC,SAAS,KAAK,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAqB,aAAa,MAAM,EAAE,CAAC,CAAC;IAErF,+DAA+D;IAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO;QAC3B,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE;QACrE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEf,MAAM,KAAK,GAAG;QACZ,SAAS,IAAI,EAAE;QACf,OAAO,CAAC,CAAC,MAAM,EAAE;QACjB,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE;QAC1C,mBAAmB,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,IAAI,KAAK,EAAE;QAC7D,UAAU,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE;QAC9C,aAAa,CAAC,CAAC,QAAQ,EAAE;QACzB,gBAAgB,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,YAAY,CAAC,CAAC,OAAO,EAAE,YAAY,IAAI,KAAK,EAAE;KAC/C,CAAC;IAEF,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAqB,iBAAiB,EAAE;QAC/E,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE;gBACP,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ;aAC3B;YACD,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK;aAClB;SACF,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,YAAY,CACjB,8BAA8B;QAC9B,YAAY,QAAQ,CAAC,MAAM,IAAI;QAC/B,UAAU,KAAK,CAAC,KAAK,IAAI;QACzB,SAAS,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,MAAM;QAChD,wCAAwC,KAAK,CAAC,KAAK,4BAA4B,CAChF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,MAAM,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC,QAAQ,MAAM,wBAAwB,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3E,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,MAAM,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC,QAAQ,MAAM,wBAAwB,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,aAAa,GAAgC;IACxD,kBAAkB,EAAE,gBAAgB;IACpC,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,iBAAiB;IACtC,uBAAuB,EAAE,qBAAqB;IAC9C,uBAAuB,EAAE,qBAAqB;CAC/C,CAAC"}

package/build/tools/utility.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Utility tools (1 tool)
+ * Helper tools for developer workflow
+ */
+import type { ToolDefinition, ToolHandler } from '../types/tools.js';
+export declare const UTILITY_TOOLS: ToolDefinition[];
+export declare const UTILITY_HANDLERS: Record<string, ToolHandler>;

package/build/tools/utility.js

@@ -0,0 +1,51 @@
+/**
+ * Utility tools (1 tool)
+ * Helper tools for developer workflow
+ */
+import { z } from 'zod';
+import { textResponse, zitadelId } from '../types/tools.js';
+// ─── Tool Definitions ───────────────────────────────────────────────────────
+export const UTILITY_TOOLS = [
+    {
+        name: 'zitadel_get_auth_config',
+        description: 'Get the environment variables needed for a new application\'s .env.local file. Fetches the app details and formats them as ready-to-paste configuration.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                projectId: { type: 'string', description: 'The project ID' },
+                appId: { type: 'string', description: 'The application ID' },
+            },
+            required: ['projectId', 'appId'],
+        },
+        _meta: { readOnly: true, domain: 'utility' },
+        annotations: { title: 'Get Auth Config', readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+];
+// ─── Handlers ────────────────────────────────────────────────────────────────
+const getAuthConfigHandler = async (params, ctx) => {
+    const input = z.object({
+        projectId: zitadelId('projectId'),
+        appId: zitadelId('appId'),
+    }).parse(params);
+    const app = await ctx.client.request(`/management/v1/projects/${input.projectId}/apps/${input.appId}`);
+    const clientId = app.oidcConfig?.clientId || 'UNKNOWN';
+    const config = ctx.client.getConfig();
+    const envVars = [
+        `# Zitadel OIDC Configuration for "${app.name}"`,
+        `# Generated by zitadel-mcp-server`,
+        ``,
+        `AUTH_ZITADEL_ISSUER=${config.issuer}`,
+        `AUTH_ZITADEL_CLIENT_ID=${clientId}`,
+        ``,
+        `# Additional context (for reference)`,
+        `# ZITADEL_PROJECT_ID=${input.projectId}`,
+        `# ZITADEL_ORG_ID=${config.orgId}`,
+        `# ZITADEL_APP_ID=${input.appId}`,
+    ];
+    return textResponse(envVars.join('\n'));
+};
+// ─── Export ──────────────────────────────────────────────────────────────────
+export const UTILITY_HANDLERS = {
+    zitadel_get_auth_config: getAuthConfigHandler,
+};
+//# sourceMappingURL=utility.js.map

package/build/tools/utility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utility.js","sourceRoot":"","sources":["../../src/tools/utility.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG5D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAqB;IAC7C;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,0JAA0J;QACvK,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;gBAC5D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;aAC7D;YACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;SACjC;QACD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE;QAC5C,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE;KAC5G;CACF,CAAC;AAEF,gFAAgF;AAEhF,MAAM,oBAAoB,GAAgB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC;QACjC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAClC,2BAA2B,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,KAAK,EAAE,CACjE,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAG;QACd,qCAAqC,GAAG,CAAC,IAAI,GAAG;QAChD,mCAAmC;QACnC,EAAE;QACF,uBAAuB,MAAM,CAAC,MAAM,EAAE;QACtC,0BAA0B,QAAQ,EAAE;QACpC,EAAE;QACF,sCAAsC;QACtC,wBAAwB,KAAK,CAAC,SAAS,EAAE;QACzC,oBAAoB,MAAM,CAAC,KAAK,EAAE;QAClC,oBAAoB,KAAK,CAAC,KAAK,EAAE;KAClC,CAAC;IAEF,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAgC;IAC3D,uBAAuB,EAAE,oBAAoB;CAC9C,CAAC"}