From f69a6ed4f316aeaa1b1375f71d3d67efb18d5a92 Mon Sep 17 00:00:00 2001
From: Elio Bischof
Date: Wed, 8 Oct 2025 10:27:02 +0200
Subject: [PATCH] chore: rehaul DevX (#10571)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
# Which Problems Are Solved
Replaces Turbo by Nx and lays the foundation for the next CI
improvements. It enables using Nx Cloud to speed the up the pipelines
that affect any node package.
It streamlines the dev experience for frontend and backend developers by
providing the following commands:
| Task | Command | Notes |
|------|---------|--------|
| **Production** | `nx run PROJECT:prod` | Production server |
| **Develop** | `nx run PROJECT:dev` | Hot reloading development server
|
| **Test** | `nx run PROJECT:test` | Run all tests |
| **Lint** | `nx run PROJECT:lint` | Check code style |
| **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues |
The following values can be used for PROJECT:
- @zitadel/zitadel (root commands)
- @zitadel/api,
- @zitadel/login,
- @zitadel/console,
- @zitadel/docs,
- @zitadel/client
- @zitadel/proto
The project names and folders are streamlined:
| Old Folder | New Folder |
| --- | --- |
| ./e2e | ./tests/functional-ui |
| ./load-test | ./benchmark |
| ./build/zitadel | ./apps/api |
| ./console | ./apps/console (postponed so the PR is reviewable) |
Also, all references to the TypeScript repo are removed so we can
archive it.
# How the Problems Are Solved
- Ran `npx nx@latest init`
- Replaced all turbo.json by project.json and fixed the target configs
- Removed Turbo dependency
- All JavaScript related code affected by a PRs changes is
quality-checked using the `nx affected` command
- We move PR checks that are runnable using Nx into the `check`
workflow. For workflows where we don't use Nx, yet, we restore
previously built dependency artifacts from Nx.
- We only use a single and easy to understand dev container
- The CONTRIBUTING.md is streamlined
- The setup with a generated client pat is orchestrated with Nx
- Everything related to the TypeScript repo is updated or removed. A
**Deploy with Vercel** button is added to the docs and the
CONTRIBUTING.md.
# Additional Changes
- NPM package names have a consistent pattern.
- Docker bake is removed. The login container is built and released like
the core container.
- The integration tests build the login container before running, so
they don't rely on the login container action anymore. This fixes
consistently failing checks on PRs from forks.
- The docs build in GitHub actions is removed, as we already build on
Vercel.
# Additional Context
- Internal discussion:
https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169
- Workflow dispatch test:
https://github.com/zitadel/zitadel/actions/runs/17760122959
---------
Co-authored-by: Florian Forster
Co-authored-by: Tim Möhlmann
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
.devcontainer/.env.db | 3 +
.devcontainer/base/Dockerfile | 20 -
.devcontainer/base/Dockerfile.dockerignore | 2 -
.../commands/login-integration.post-attach.sh | 39 -
.../login-integration.update-content.sh | 18 -
.../commands/turbo-lint-unit.post-attach.sh | 30 -
.../turbo-lint-unit.update-content.sh | 12 -
.devcontainer/base/devcontainer.json | 29 -
.devcontainer/base/docker-compose.yaml | 198 -
.devcontainer/compose.sh | 6 +
.devcontainer/devcontainer.json | 57 +
.devcontainer/docker-compose.yaml | 88 +
.../login-integration/devcontainer.json | 26 -
.../login-integration/docker-compose.yaml | 35 -
.devcontainer/login-subtree/devcontainer.json | 22 -
.devcontainer/project.json | 14 +
.../turbo-lint-unit/devcontainer.json | 20 -
.dockerignore | 31 -
.github/instructions/nx.instructions.md | 47 +
.github/workflows/build.yml | 145 -
.github/workflows/ci.yml | 67 +
.github/workflows/codeql.yml | 14 +-
.github/workflows/compile.yml | 89 -
.github/workflows/console.yml | 54 -
.github/workflows/container.yml | 173 -
.github/workflows/core-integration-test.yml | 100 -
.github/workflows/core-unit-test.yml | 73 -
.github/workflows/core.yml | 81 -
.github/workflows/docs.yml | 61 -
.github/workflows/e2e.yml | 64 -
.github/workflows/lint.yml | 93 -
.github/workflows/lint_test_build.yml | 98 +
.github/workflows/login-container.yml | 69 -
.github/workflows/login-integration-test.yml | 58 -
.github/workflows/pack.yml | 177 +
.github/workflows/release.yml | 79 +-
.github/workflows/version.yml | 13 +-
.gitignore | 24 +-
.golangci.yaml | 10 +-
CONTRIBUTING.md | 677 +-
LICENSING.md | 5 +-
Makefile | 196 -
README.md | 12 +-
apps/api/.env | 5 +
apps/api/.env.prod.test-functional-ui | 5 +
apps/api/.env.test-integration | 3 +
apps/api/.env.test-integration-run-api | 5 +
apps/api/Dockerfile | 34 +
{build/zitadel => apps/api}/entrypoint.sh | 0
apps/api/prod-default.yaml | 25 +
apps/api/project.json | 470 ++
.../api/test-functional-ui.yaml | 3 -
.../api/test-integration-api.yaml | 30 +-
apps/login/.env | 5 +
apps/login/.env.prod | 1 +
apps/login/.env.test | 6 -
apps/login/.env.test-integration | 2 +
apps/login/.env.test-integration-run-login | 4 +
apps/login/.github/ISSUE_TEMPLATE/bug.yaml | 63 -
apps/login/.github/ISSUE_TEMPLATE/config.yml | 4 -
apps/login/.github/ISSUE_TEMPLATE/docs.yaml | 30 -
.../.github/ISSUE_TEMPLATE/improvement.yaml | 54 -
.../.github/ISSUE_TEMPLATE/proposal.yaml | 54 -
apps/login/.github/custom-i18n.png | Bin 85028 -> 0 bytes
apps/login/.github/dependabot.example.yml | 21 -
apps/login/.github/pull_request_template.md | 13 -
apps/login/.github/workflows/close_pr.yml | 39 -
apps/login/.github/workflows/issues.yml | 41 -
apps/login/.github/workflows/release.yml | 32 -
apps/login/.github/workflows/test.yml | 67 -
apps/login/.gitignore | 1 -
apps/login/CODE_OF_CONDUCT.md | 128 -
apps/login/CONTRIBUTING.md | 218 -
apps/login/Dockerfile | 37 +-
apps/login/Dockerfile.dockerignore | 22 -
apps/login/cypress.config.ts | 10 +-
apps/login/docker-bake-release.hcl | 3 -
apps/login/docker-bake.hcl | 25 -
.../{core-mock => api-mock}/Dockerfile | 4 +-
.../zitadel.settings.v2.SettingsService.json | 0
.../mocked-services.cfg | 0
apps/login/integration/api-mock/project.json | 19 +
apps/login/integration/support/e2e.ts | 2 +-
apps/login/next-env-vars.d.ts | 3 +
apps/login/next.config.mjs | 3 +-
apps/login/package.json | 36 +-
apps/login/project.json | 156 +
apps/login/scripts/entrypoint.sh | 21 +-
apps/login/tsconfig.json | 10 +-
apps/login/turbo.json | 57 -
apps/login/vercel.json | 4 +
.../database/events_testing/events_test.go | 18 +-
.../id_provider_instance_test.go | 16 +-
.../database/events_testing/instance_test.go | 22 +-
{load-test => benchmark}/.babelrc | 0
{load-test => benchmark}/.gitignore | 0
{load-test => benchmark}/.prettierrc | 0
{load-test => benchmark}/Makefile | 0
{load-test => benchmark}/README.md | 6 +-
{load-test => benchmark}/package-lock.json | 0
{load-test => benchmark}/package.json | 5 +-
{load-test => benchmark}/src/app.ts | 0
{load-test => benchmark}/src/config.ts | 0
{load-test => benchmark}/src/login_ui.ts | 0
{load-test => benchmark}/src/membership.ts | 0
{load-test => benchmark}/src/metadata.ts | 0
{load-test => benchmark}/src/oidc.ts | 0
{load-test => benchmark}/src/org.ts | 0
{load-test => benchmark}/src/project.ts | 0
{load-test => benchmark}/src/session.ts | 0
{load-test => benchmark}/src/url.ts | 0
.../src/use_cases/human_password_login.ts | 0
.../src/use_cases/introspection.ts | 0
.../machine_client_credentials_login.ts | 0
.../use_cases/machine_jwt_profile_grant.ts | 0
.../machine_jwt_profile_grant_single_user.ts | 0
.../src/use_cases/machine_pat_login.ts | 0
.../src/use_cases/manipulate_user.ts | 0
.../src/use_cases/session/add_session.ts | 0
.../src/use_cases/session/oidc_session.ts | 0
.../src/use_cases/session/otp_session.ts | 0
.../src/use_cases/session/password_session.ts | 0
.../src/use_cases/user_info.ts | 0
.../src/use_cases/users_by_metadata_key.ts | 0
.../src/use_cases/users_by_metadata_value.ts | 0
.../use_cases/verify_all_user_grants_exist.ts | 0
{load-test => benchmark}/src/user.ts | 0
{load-test => benchmark}/src/user_grant.ts | 0
{load-test => benchmark}/tsconfig.json | 0
{load-test => benchmark}/webpack.config.js | 0
build/login/Dockerfile | 55 -
build/login/Dockerfile.dockerignore | 38 -
build/zitadel/Dockerfile | 33 -
build/zitadel/Dockerfile.dockerignore | 3 -
cmd/setup/integration_test/setup_test.go | 18 +-
console/.env.dev | 1 +
console/README.md | 100 +-
console/package.json | 19 +-
console/project.json | 56 +
console/turbo.json | 24 -
docker-bake.hcl | 11 -
docs/README.md | 71 +-
.../self-hosting/deploy/docker-compose.yaml | 2 +-
docs/package.json | 25 +-
docs/project.json | 75 +
docs/turbo.json | 45 -
docs/vercel.json | 2 +
e2e/README.md | 12 -
.../host.docker.internal/docker-compose.yaml | 35 -
e2e/config/host.docker.internal/zitadel.yaml | 70 -
e2e/config/localhost/docker-compose.yaml | 44 -
e2e/docker-compose.yaml | 10 -
e2e/package.json | 33 -
e2e/turbo.json | 25 -
...ons_allow_public_org_registrations_test.go | 2 +-
.../restrictions_allowed_languages_test.go | 4 +-
.../group/v2/integration_test/query_test.go | 24 +-
.../integration_test/limits_block_test.go | 14 +-
.../user/v2/integration_test/user_test.go | 8 +-
.../user/v2beta/integration_test/user_test.go | 8 +-
.../service_provider_config_expected.json | 2 +-
...er_config_expected_resource_type_user.json | 2 +-
...ovider_config_expected_resource_types.json | 2 +-
...vice_provider_config_expected_schemas.json | 2 +-
..._provider_config_expected_user_schema.json | 2 +-
.../api/ui/login/static/resources/generate.go | 4 +-
internal/integration/config/client.yaml | 2 +-
.../integration/config/docker-compose.yaml | 32 -
internal/integration/config/postgres.yaml | 14 -
internal/integration/config/steps.yaml | 13 -
internal/integration/instance.go | 2 +-
nx.json | 54 +
package.json | 12 +-
packages/zitadel-client/.gitignore | 2 -
packages/zitadel-client/package.json | 10 +-
packages/zitadel-client/project.json | 43 +
packages/zitadel-client/turbo.json | 9 -
packages/zitadel-proto/.npmignore | 4 +-
packages/zitadel-proto/package.json | 3 +-
packages/zitadel-proto/project.json | 17 +
packages/zitadel-proto/turbo.json | 16 -
pnpm-lock.yaml | 5950 ++++++++++-------
pnpm-workspace.yaml | 17 +-
project.json | 42 +
tests/functional-ui/.env | 4 +
tests/functional-ui/.env.open | 1 +
{e2e => tests/functional-ui}/.gitignore | 0
{e2e => tests/functional-ui}/.prettierignore | 1 +
{e2e => tests/functional-ui}/.prettierrc.json | 0
.../functional-ui}/cypress.config.ts | 27 +-
.../functional-ui}/cypress/.gitignore | 0
.../e2e/applications/applications.cy.ts | 0
.../cypress/e2e/events/events.cy.ts | 0
.../cypress/e2e/humans/humans.cy.ts | 0
.../functional-ui}/cypress/e2e/i18n/api.cy.ts | 0
.../e2e/instance/settings/notifications.cy.ts | 0
.../instance/settings/secret-generator.cy.ts | 0
.../cypress/e2e/machines/machines.cy.ts | 0
.../e2e/organization/organizations.cy.ts | 0
.../cypress/e2e/permissions/permissions.cy.ts | 0
.../cypress/e2e/projects/projects.cy.ts | 0
.../settings/external-links-settings.cy.ts | 0
.../cypress/e2e/settings/features.cy.ts | 0
.../cypress/e2e/settings/login-policy.cy.ts | 0
.../cypress/e2e/settings/oidc-settings.cy.ts | 0
.../e2e/settings/password-complexity.cy.ts | 0
.../e2e/settings/private-labeling.cy.ts | 0
.../cypress/fixtures/example.json | 0
.../functional-ui}/cypress/fixtures/logo.png | Bin
.../cypress/support/api/apiauth.ts | 0
.../cypress/support/api/ensure.ts | 0
.../support/api/external-links-settings.ts | 0
.../cypress/support/api/features.ts | 0
.../cypress/support/api/grants.ts | 0
.../cypress/support/api/instances.ts | 0
.../cypress/support/api/members.ts | 0
.../cypress/support/api/oidc-settings.ts | 0
.../cypress/support/api/orgs.ts | 0
.../cypress/support/api/policies.ts | 0
.../cypress/support/api/projects.ts | 0
.../cypress/support/api/quota.ts | 0
.../cypress/support/api/search.ts | 0
.../functional-ui}/cypress/support/api/sms.ts | 0
.../cypress/support/api/smtp.ts | 0
.../cypress/support/api/types.ts | 0
.../cypress/support/api/users.ts | 0
.../cypress/support/commands.ts | 0
.../functional-ui}/cypress/support/e2e.ts | 0
.../cypress/support/login/authenticate.ts | 0
.../cypress/support/login/users.ts | 0
.../functional-ui}/cypress/support/types.ts | 0
.../functional-ui}/cypress/tsconfig.json | 0
tests/functional-ui/package.json | 20 +
tests/functional-ui/project.json | 56 +
{e2e => tests/functional-ui}/tsconfig.json | 0
turbo.json | 54 -
236 files changed, 5708 insertions(+), 6549 deletions(-)
create mode 100644 .devcontainer/.env.db
delete mode 100644 .devcontainer/base/Dockerfile
delete mode 100644 .devcontainer/base/Dockerfile.dockerignore
delete mode 100755 .devcontainer/base/commands/login-integration.post-attach.sh
delete mode 100755 .devcontainer/base/commands/login-integration.update-content.sh
delete mode 100755 .devcontainer/base/commands/turbo-lint-unit.post-attach.sh
delete mode 100755 .devcontainer/base/commands/turbo-lint-unit.update-content.sh
delete mode 100644 .devcontainer/base/devcontainer.json
delete mode 100644 .devcontainer/base/docker-compose.yaml
create mode 100755 .devcontainer/compose.sh
create mode 100644 .devcontainer/devcontainer.json
create mode 100644 .devcontainer/docker-compose.yaml
delete mode 100644 .devcontainer/login-integration/devcontainer.json
delete mode 100644 .devcontainer/login-integration/docker-compose.yaml
delete mode 100644 .devcontainer/login-subtree/devcontainer.json
create mode 100644 .devcontainer/project.json
delete mode 100644 .devcontainer/turbo-lint-unit/devcontainer.json
delete mode 100644 .dockerignore
create mode 100644 .github/instructions/nx.instructions.md
delete mode 100644 .github/workflows/build.yml
create mode 100644 .github/workflows/ci.yml
delete mode 100644 .github/workflows/compile.yml
delete mode 100644 .github/workflows/console.yml
delete mode 100644 .github/workflows/container.yml
delete mode 100644 .github/workflows/core-integration-test.yml
delete mode 100644 .github/workflows/core-unit-test.yml
delete mode 100644 .github/workflows/core.yml
delete mode 100644 .github/workflows/docs.yml
delete mode 100644 .github/workflows/e2e.yml
delete mode 100644 .github/workflows/lint.yml
create mode 100644 .github/workflows/lint_test_build.yml
delete mode 100644 .github/workflows/login-container.yml
delete mode 100644 .github/workflows/login-integration-test.yml
create mode 100644 .github/workflows/pack.yml
delete mode 100644 Makefile
create mode 100644 apps/api/.env
create mode 100644 apps/api/.env.prod.test-functional-ui
create mode 100644 apps/api/.env.test-integration
create mode 100644 apps/api/.env.test-integration-run-api
create mode 100644 apps/api/Dockerfile
rename {build/zitadel => apps/api}/entrypoint.sh (100%)
create mode 100644 apps/api/prod-default.yaml
create mode 100644 apps/api/project.json
rename e2e/config/localhost/zitadel.yaml => apps/api/test-functional-ui.yaml (95%)
rename internal/integration/config/zitadel.yaml => apps/api/test-integration-api.yaml (90%)
create mode 100644 apps/login/.env
create mode 100644 apps/login/.env.prod
delete mode 100644 apps/login/.env.test
create mode 100644 apps/login/.env.test-integration
create mode 100644 apps/login/.env.test-integration-run-login
delete mode 100644 apps/login/.github/ISSUE_TEMPLATE/bug.yaml
delete mode 100644 apps/login/.github/ISSUE_TEMPLATE/config.yml
delete mode 100644 apps/login/.github/ISSUE_TEMPLATE/docs.yaml
delete mode 100644 apps/login/.github/ISSUE_TEMPLATE/improvement.yaml
delete mode 100644 apps/login/.github/ISSUE_TEMPLATE/proposal.yaml
delete mode 100644 apps/login/.github/custom-i18n.png
delete mode 100644 apps/login/.github/dependabot.example.yml
delete mode 100644 apps/login/.github/pull_request_template.md
delete mode 100644 apps/login/.github/workflows/close_pr.yml
delete mode 100644 apps/login/.github/workflows/issues.yml
delete mode 100644 apps/login/.github/workflows/release.yml
delete mode 100644 apps/login/.github/workflows/test.yml
delete mode 100644 apps/login/CODE_OF_CONDUCT.md
delete mode 100644 apps/login/CONTRIBUTING.md
delete mode 100644 apps/login/Dockerfile.dockerignore
delete mode 100644 apps/login/docker-bake-release.hcl
delete mode 100644 apps/login/docker-bake.hcl
rename apps/login/integration/{core-mock => api-mock}/Dockerfile (86%)
rename apps/login/integration/{core-mock => api-mock}/initial-stubs/zitadel.settings.v2.SettingsService.json (100%)
rename apps/login/integration/{core-mock => api-mock}/mocked-services.cfg (100%)
create mode 100644 apps/login/integration/api-mock/project.json
create mode 100644 apps/login/project.json
delete mode 100644 apps/login/turbo.json
create mode 100644 apps/login/vercel.json
rename {load-test => benchmark}/.babelrc (100%)
rename {load-test => benchmark}/.gitignore (100%)
rename {load-test => benchmark}/.prettierrc (100%)
rename {load-test => benchmark}/Makefile (100%)
rename {load-test => benchmark}/README.md (96%)
rename {load-test => benchmark}/package-lock.json (100%)
rename {load-test => benchmark}/package.json (90%)
rename {load-test => benchmark}/src/app.ts (100%)
rename {load-test => benchmark}/src/config.ts (100%)
rename {load-test => benchmark}/src/login_ui.ts (100%)
rename {load-test => benchmark}/src/membership.ts (100%)
rename {load-test => benchmark}/src/metadata.ts (100%)
rename {load-test => benchmark}/src/oidc.ts (100%)
rename {load-test => benchmark}/src/org.ts (100%)
rename {load-test => benchmark}/src/project.ts (100%)
rename {load-test => benchmark}/src/session.ts (100%)
rename {load-test => benchmark}/src/url.ts (100%)
rename {load-test => benchmark}/src/use_cases/human_password_login.ts (100%)
rename {load-test => benchmark}/src/use_cases/introspection.ts (100%)
rename {load-test => benchmark}/src/use_cases/machine_client_credentials_login.ts (100%)
rename {load-test => benchmark}/src/use_cases/machine_jwt_profile_grant.ts (100%)
rename {load-test => benchmark}/src/use_cases/machine_jwt_profile_grant_single_user.ts (100%)
rename {load-test => benchmark}/src/use_cases/machine_pat_login.ts (100%)
rename {load-test => benchmark}/src/use_cases/manipulate_user.ts (100%)
rename {load-test => benchmark}/src/use_cases/session/add_session.ts (100%)
rename {load-test => benchmark}/src/use_cases/session/oidc_session.ts (100%)
rename {load-test => benchmark}/src/use_cases/session/otp_session.ts (100%)
rename {load-test => benchmark}/src/use_cases/session/password_session.ts (100%)
rename {load-test => benchmark}/src/use_cases/user_info.ts (100%)
rename {load-test => benchmark}/src/use_cases/users_by_metadata_key.ts (100%)
rename {load-test => benchmark}/src/use_cases/users_by_metadata_value.ts (100%)
rename {load-test => benchmark}/src/use_cases/verify_all_user_grants_exist.ts (100%)
rename {load-test => benchmark}/src/user.ts (100%)
rename {load-test => benchmark}/src/user_grant.ts (100%)
rename {load-test => benchmark}/tsconfig.json (100%)
rename {load-test => benchmark}/webpack.config.js (100%)
delete mode 100644 build/login/Dockerfile
delete mode 100644 build/login/Dockerfile.dockerignore
delete mode 100644 build/zitadel/Dockerfile
delete mode 100644 build/zitadel/Dockerfile.dockerignore
create mode 100644 console/.env.dev
create mode 100644 console/project.json
delete mode 100644 console/turbo.json
delete mode 100644 docker-bake.hcl
create mode 100644 docs/project.json
delete mode 100644 docs/turbo.json
delete mode 100644 e2e/README.md
delete mode 100644 e2e/config/host.docker.internal/docker-compose.yaml
delete mode 100644 e2e/config/host.docker.internal/zitadel.yaml
delete mode 100644 e2e/config/localhost/docker-compose.yaml
delete mode 100644 e2e/docker-compose.yaml
delete mode 100644 e2e/package.json
delete mode 100644 e2e/turbo.json
delete mode 100644 internal/integration/config/docker-compose.yaml
delete mode 100644 internal/integration/config/postgres.yaml
delete mode 100644 internal/integration/config/steps.yaml
create mode 100644 nx.json
create mode 100644 packages/zitadel-client/project.json
delete mode 100644 packages/zitadel-client/turbo.json
create mode 100644 packages/zitadel-proto/project.json
delete mode 100644 packages/zitadel-proto/turbo.json
create mode 100644 project.json
create mode 100644 tests/functional-ui/.env
create mode 100644 tests/functional-ui/.env.open
rename {e2e => tests/functional-ui}/.gitignore (100%)
rename {e2e => tests/functional-ui}/.prettierignore (92%)
rename {e2e => tests/functional-ui}/.prettierrc.json (100%)
rename {e2e => tests/functional-ui}/cypress.config.ts (89%)
rename {e2e => tests/functional-ui}/cypress/.gitignore (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/applications/applications.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/events/events.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/humans/humans.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/i18n/api.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/instance/settings/notifications.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/instance/settings/secret-generator.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/machines/machines.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/organization/organizations.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/permissions/permissions.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/projects/projects.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/external-links-settings.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/features.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/login-policy.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/oidc-settings.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/password-complexity.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/e2e/settings/private-labeling.cy.ts (100%)
rename {e2e => tests/functional-ui}/cypress/fixtures/example.json (100%)
rename {e2e => tests/functional-ui}/cypress/fixtures/logo.png (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/apiauth.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/ensure.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/external-links-settings.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/features.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/grants.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/instances.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/members.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/oidc-settings.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/orgs.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/policies.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/projects.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/quota.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/search.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/sms.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/smtp.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/types.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/api/users.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/commands.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/e2e.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/login/authenticate.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/login/users.ts (100%)
rename {e2e => tests/functional-ui}/cypress/support/types.ts (100%)
rename {e2e => tests/functional-ui}/cypress/tsconfig.json (100%)
create mode 100644 tests/functional-ui/package.json
create mode 100644 tests/functional-ui/project.json
rename {e2e => tests/functional-ui}/tsconfig.json (100%)
delete mode 100644 turbo.json
diff --git a/.devcontainer/.env.db b/.devcontainer/.env.db
new file mode 100644
index 00000000000..1cd8d648b4f
--- /dev/null
+++ b/.devcontainer/.env.db
@@ -0,0 +1,3 @@
+PGUSER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_HOST_AUTH_METHOD=trust
diff --git a/.devcontainer/base/Dockerfile b/.devcontainer/base/Dockerfile
deleted file mode 100644
index 8b5a83cbccd..00000000000
--- a/.devcontainer/base/Dockerfile
+++ /dev/null
@@ -1,20 +0,0 @@
-FROM mcr.microsoft.com/devcontainers/typescript-node:20-bookworm
-
-ENV SHELL=/bin/bash \
- DEBIAN_FRONTEND=noninteractive \
- LANG=C.UTF-8 \
- LC_ALL=C.UTF-8 \
- CI=1 \
- PNPM_HOME=/home/node/.local/share/pnpm \
- PATH=/home/node/.local/share/pnpm:$PATH
-
-RUN apt-get update && \
- apt-get --no-install-recommends install -y \
- # Cypress dependencies
- libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libnss3 libxss1 libasound2 libxtst6 xauth xvfb && \
- apt-get clean && \
- corepack enable && COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack prepare pnpm@10.13.1 --activate
-
-COPY --chown=node:node commands /commands
-
-USER node
diff --git a/.devcontainer/base/Dockerfile.dockerignore b/.devcontainer/base/Dockerfile.dockerignore
deleted file mode 100644
index c363133e099..00000000000
--- a/.devcontainer/base/Dockerfile.dockerignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*
-!commands
\ No newline at end of file
diff --git a/.devcontainer/base/commands/login-integration.post-attach.sh b/.devcontainer/base/commands/login-integration.post-attach.sh
deleted file mode 100755
index 5badbc8bc1b..00000000000
--- a/.devcontainer/base/commands/login-integration.post-attach.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" == "true" ]; then
- set -e
-fi
-
-echo
-echo
-echo
-echo -e "THANKS FOR CONTRIBUTING TO ZITADEL 🚀"
-echo
-echo "Your dev container is configured for fixing login integration tests."
-echo "The login is running in a separate container with the same configuration."
-echo "It calls the mock-zitadel container which provides a mocked Zitadel gRPC API."
-echo
-echo "Also the test suite is configured correctly."
-echo "For example, run a single test file:"
-echo "pnpm cypress run --spec integration/integration/login.cy.ts"
-echo
-echo "You can also run the test interactively."
-echo "However, this is only possible from outside the dev container."
-echo "On your host machine, run:"
-echo "cd apps/login"
-echo "pnpm cypress open"
-echo
-echo "If you want to change the login code, you can replace the login container by a hot reloading dev server."
-echo "docker stop login-integration"
-echo "pnpm turbo dev"
-echo "Navigate to the page you want to fix, for example:"
-echo "http://localhost:3001/ui/v2/login/verify?userId=221394658884845598&code=abc"
-echo "Change some code and reload the page for instant feedback."
-echo
-echo "When you are done, make sure all integration tests pass:"
-echo "pnpm cypress run"
-echo
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" != "true" ]; then
- exit 0
-fi
diff --git a/.devcontainer/base/commands/login-integration.update-content.sh b/.devcontainer/base/commands/login-integration.update-content.sh
deleted file mode 100755
index 80493bc624f..00000000000
--- a/.devcontainer/base/commands/login-integration.update-content.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" == "true" ]; then
- echo "Running in fail-on-errors mode"
- set -e
-fi
-
-pnpm install --frozen-lockfile \
- --filter @zitadel/login \
- --filter @zitadel/client \
- --filter @zitadel/proto \
- --filter zitadel-monorepo
-pnpm cypress install
-pnpm test:integration:login
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" != "true" ]; then
- exit 0
-fi
diff --git a/.devcontainer/base/commands/turbo-lint-unit.post-attach.sh b/.devcontainer/base/commands/turbo-lint-unit.post-attach.sh
deleted file mode 100755
index 925183df619..00000000000
--- a/.devcontainer/base/commands/turbo-lint-unit.post-attach.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" == "true" ]; then
- set -e
-fi
-
-echo
-echo
-echo
-echo -e "THANKS FOR CONTRIBUTING TO ZITADEL 🚀"
-echo
-echo "Your dev container is configured for fixing linting and unit tests."
-echo "No other services are running alongside this container."
-echo
-echo "To fix all auto-fixable linting errors, run:"
-echo "pnpm turbo lint:fix"
-echo
-echo "To watch console linting errors, run:"
-echo "pnpm turbo watch lint --filter console"
-echo
-echo "To watch @zitadel/client unit test failures, run:"
-echo "pnpm turbo watch test:unit --filter @zitadel/client"
-echo
-echo "To watch @zitadel/login relevant unit tests and linting failures, run:"
-echo "pnpm turbo watch lint test:unit --filter @zitadel/login..."
-echo
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" != "true" ]; then
- exit 0
-fi
diff --git a/.devcontainer/base/commands/turbo-lint-unit.update-content.sh b/.devcontainer/base/commands/turbo-lint-unit.update-content.sh
deleted file mode 100755
index 5aae2270d4b..00000000000
--- a/.devcontainer/base/commands/turbo-lint-unit.update-content.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" == "true" ]; then
- set -e
-fi
-
-pnpm install --frozen-lockfile --recursive
-pnpm turbo lint test:unit
-
-if [ "$FAIL_COMMANDS_ON_ERRORS" != "true" ]; then
- exit 0
-fi
diff --git a/.devcontainer/base/devcontainer.json b/.devcontainer/base/devcontainer.json
deleted file mode 100644
index 1154cb183c8..00000000000
--- a/.devcontainer/base/devcontainer.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
- "$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
- "name": "Base: Build and Run the Components you need",
- "dockerComposeFile": "docker-compose.yaml",
- "service": "devcontainer",
- "runServices": [
- "devContainer",
- "db"
- ],
- "workspaceFolder": "/workspaces",
- "remoteEnv": {
- "DISPLAY": ""
- },
- "forwardPorts": [
- 3000,
- 3001,
- 4200,
- 8080
- ],
- "onCreateCommand": "pnpm install --frozen-lockfile --recursive --prefer-offline",
- "features": {
- "ghcr.io/devcontainers/features/go:1": {
- "version": "1.24"
- },
- "ghcr.io/guiyomh/features/golangci-lint:0": {},
- "ghcr.io/jungaretti/features/make:1": {},
- "ghcr.io/devcontainers/features/docker-outside-of-docker": {}
- }
-}
\ No newline at end of file
diff --git a/.devcontainer/base/docker-compose.yaml b/.devcontainer/base/docker-compose.yaml
deleted file mode 100644
index 71791ebc6a4..00000000000
--- a/.devcontainer/base/docker-compose.yaml
+++ /dev/null
@@ -1,198 +0,0 @@
-services:
-
- devcontainer:
- container_name: devcontainer
- build:
- context: ../base
- volumes:
- - ../../:/workspaces:cached
- command: sleep infinity
- working_dir: /workspaces
- environment:
- ZITADEL_DATABASE_POSTGRES_HOST: db
- ZITADEL_EXTERNALSECURE: false
-
- db:
- container_name: db
- image: postgres:17.0-alpine3.19
- restart: unless-stopped
- volumes:
- - postgres-data:/var/lib/postgresql/data
- environment:
- PGUSER: postgres
- POSTGRES_PASSWORD: postgres
- healthcheck:
- test: [ "CMD-SHELL", "pg_isready" ]
- interval: "10s"
- timeout: "30s"
- retries: 5
- start_period: "20s"
- ports:
- - "5432:5432"
-
- zitadel:
- container_name: zitadel
- image: "${ZITADEL_TAG:-ghcr.io/zitadel/zitadel:latest}"
- command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --config /zitadel.yaml --steps /zitadel.yaml'
- volumes:
- - ../../apps/login/acceptance/pat:/pat:delegated
- - ../../apps/login/acceptance/zitadel.yaml:/zitadel.yaml:cached
- network_mode: service:devcontainer
- healthcheck:
- test:
- - CMD
- - /app/zitadel
- - ready
- - --config
- - /zitadel.yaml
- depends_on:
- db:
- condition: "service_healthy"
-
- configure-login:
- container_name: configure-login
- restart: no
- build:
- context: ../../apps/login/acceptance/setup
- dockerfile: ../go-command.Dockerfile
- entrypoint: "./setup.sh"
- network_mode: service:devcontainer
- environment:
- PAT_FILE: /pat/zitadel-admin-sa.pat
- ZITADEL_API_URL: http://localhost:8080
- WRITE_ENVIRONMENT_FILE: /login-env/.env.test.local
- SINK_EMAIL_INTERNAL_URL: http://sink:3333/email
- SINK_SMS_INTERNAL_URL: http://sink:3333/sms
- SINK_NOTIFICATION_URL: http://sink:3333/notification
- LOGIN_BASE_URL: http://localhost:3000/ui/v2/login/
- ZITADEL_API_DOMAIN: localhost
- ZITADEL_ADMIN_USER: zitadel-admin@zitadel.localhost
- volumes:
- - ../../apps/login/acceptance/pat:/pat:cached # Read the PAT file from zitadels setup
- - ../../apps/login:/login-env:delegated # Write the environment variables file for the login
- depends_on:
- zitadel:
- condition: "service_healthy"
-
- login-acceptance:
- container_name: login
- image: "${LOGIN_TAG:-ghcr.io/zitadel/zitadel-login:latest}"
- network_mode: service:devcontainer
- volumes:
- - ../../apps/login/.env.test.local:/env-files/.env:cached
- depends_on:
- configure-login:
- condition: service_completed_successfully
-
- mock-notifications:
- container_name: mock-notifications
- build:
- context: ../../apps/login/acceptance/sink
- dockerfile: ../go-command.Dockerfile
- args:
- - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
- environment:
- PORT: '3333'
- command:
- - -port
- - '3333'
- - -email
- - '/email'
- - -sms
- - '/sms'
- - -notification
- - '/notification'
- ports:
- - "3333:3333"
- depends_on:
- configure-login:
- condition: "service_completed_successfully"
-
- mock-oidcrp:
- container_name: mock-oidcrp
- build:
- context: ../../apps/login/acceptance/oidcrp
- dockerfile: ../go-command.Dockerfile
- args:
- - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
- network_mode: service:devcontainer
- environment:
- API_URL: 'http://localhost:8080'
- API_DOMAIN: 'localhost'
- PAT_FILE: '/pat/zitadel-admin-sa.pat'
- LOGIN_URL: 'http://localhost:3000/ui/v2/login'
- ISSUER: 'http://localhost:8000'
- HOST: 'localhost'
- PORT: '8000'
- SCOPES: 'openid profile email'
- volumes:
- - ../../apps/login/acceptance/pat:/pat:cached
- depends_on:
- configure-login:
- condition: "service_completed_successfully"
-
- # mock-oidcop:
- # container_name: mock-oidcop
- # build:
- # context: ../../apps/login/acceptance/idp/oidc
- # dockerfile: ../../go-command.Dockerfile
- # args:
- # - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
- # network_mode: service:devcontainer
- # environment:
- # API_URL: 'http://localhost:8080'
- # API_DOMAIN: 'localhost'
- # PAT_FILE: '/pat/zitadel-admin-sa.pat'
- # SCHEMA: 'http'
- # HOST: 'localhost'
- # PORT: "8004"
- # volumes:
- # - "../apps/login/packages/acceptance/pat:/pat:cached"
- # depends_on:
- # configure-login:
- # condition: "service_completed_successfully"
-
- mock-samlsp:
- container_name: mock-samlsp
- build:
- context: ../../apps/login/acceptance/samlsp
- dockerfile: ../go-command.Dockerfile
- args:
- - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
- network_mode: service:devcontainer
- environment:
- API_URL: 'http://localhost:8080'
- API_DOMAIN: 'localhost'
- PAT_FILE: '/pat/zitadel-admin-sa.pat'
- LOGIN_URL: 'http://localhost:3000/ui/v2/login'
- IDP_URL: 'http://localhost:8080/saml/v2/metadata'
- HOST: 'http://localhost:8001'
- PORT: '8001'
- volumes:
- - "../apps/login/packages/acceptance/pat:/pat:cached"
- depends_on:
- configure-login:
- condition: "service_completed_successfully"
- # mock-samlidp:
- # container_name: mock-samlidp
- # build:
- # context: ../../apps/login/acceptance/idp/saml
- # dockerfile: ../../go-command.Dockerfile
- # args:
- # - LOGIN_TEST_ACCEPTANCE_GOLANG_TAG=${LOGIN_TEST_ACCEPTANCE_GOLANG_TAG:-golang:1.24-alpine}
- # network_mode: service:devcontainer
- # environment:
- # API_URL: 'http://localhost:8080'
- # API_DOMAIN: 'localhost'
- # PAT_FILE: '/pat/zitadel-admin-sa.pat'
- # SCHEMA: 'http'
- # HOST: 'localhost'
- # PORT: "8003"
- # volumes:
- # - "../apps/login/packages/acceptance/pat:/pat"
- # depends_on:
- # configure-login:
- # condition: "service_completed_successfully"
-
-volumes:
- postgres-data:
diff --git a/.devcontainer/compose.sh b/.devcontainer/compose.sh
new file mode 100755
index 00000000000..0a8c2ed9ae1
--- /dev/null
+++ b/.devcontainer/compose.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+# This script is used to run Docker Compose commands with the appropriate compose project set.
+# This makes sure the commands don't break on different workspace_root folder names.
+export DEVCONTAINER_LOCAL_WORKSPACE_ROOT=${DEVCONTAINER_LOCAL_WORKSPACE_ROOT:-${NX_WORKSPACE_ROOT:-zitadel}}
+docker compose -p ${DEVCONTAINER_LOCAL_WORKSPACE_ROOT##*/}_devcontainer "$@"
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 00000000000..9ac80d39d6a
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,57 @@
+{
+ "$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
+ "name": "Zitadel Devcontainer",
+ "dockerComposeFile": "docker-compose.yaml",
+ "service": "devcontainer",
+ "runServices": [
+ "devcontainer"
+ ],
+ "workspaceFolder": "/workspaces/zitadel",
+ "forwardPorts": [
+ 3000,
+ 4200,
+ 8080,
+ 3100
+ ],
+ "portsAttributes": {
+ "3000": {
+ "label": "Login",
+ "onAutoForward": "notify"
+ },
+ "4200": {
+ "label": "Console",
+ "onAutoForward": "notify"
+ },
+ "8080": {
+ "label": "API",
+ "onAutoForward": "notify"
+ },
+ "3100": {
+ "label": "Docs",
+ "onAutoForward": "notify"
+ }
+ },
+ "features": {
+ "ghcr.io/devcontainers/features/go:1": {
+ "version": "1.24"
+ },
+ "ghcr.io/devcontainers/features/docker-outside-of-docker": {},
+ "ghcr.io/schlich/devcontainer-features/cypress:1": {
+ "version": "14"
+ }
+ },
+ "containerEnv": {
+ "DEVCONTAINER_LOCAL_WORKSPACE_ROOT": "${localWorkspaceFolder}"
+ },
+ "customizations": {
+ "vscode": {
+ "extensions": [
+ "golang.Go",
+ "Angular.ng-template",
+ "dbaeumer.vscode-eslint",
+ "esbenp.prettier-vscode",
+ "nrwl.angular-console"
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/.devcontainer/docker-compose.yaml b/.devcontainer/docker-compose.yaml
new file mode 100644
index 00000000000..1f4e313d486
--- /dev/null
+++ b/.devcontainer/docker-compose.yaml
@@ -0,0 +1,88 @@
+services:
+
+ devcontainer:
+ image: mcr.microsoft.com/devcontainers/typescript-node:22-bookworm
+ volumes:
+ - ../:/workspaces/zitadel:cached
+ command: sleep infinity
+ working_dir: /workspaces/zitadel
+ environment:
+ SHELL: /bin/bash
+ DEBIAN_FRONTEND: noninteractive
+ LANG: C.UTF-8
+ LC_ALL: C.UTF-8
+ COREPACK_ENABLE_DOWNLOAD_PROMPT: 0
+ DEVCONTAINER_DB_HOST: db
+ DEVCONTAINER_API_HOST: api
+ DEVCONTAINER_LOGIN_HOST: login
+ DEVCONTAINER_LOGIN_API_MOCK_HOST: login-api-mock
+ DEVCONTAINER_DB_API_INTEGRATION_HOST: db-api-integration
+ DEVCONTAINER_DB_FUNCTIONAL_UI_HOST: db-functional-ui
+ ports:
+ - "8080:8080"
+ - "3000:3000"
+ - "4200:4200"
+
+ db:
+ image: postgres:17
+ restart: unless-stopped
+ env_file:
+ - ./.env.db
+ volumes:
+ - db-data-dev:/var/lib/postgresql/data
+ healthcheck:
+ test: [ "CMD-SHELL", "pg_isready", "-U", "postgres" ]
+ interval: "10s"
+ timeout: "30s"
+ retries: 5
+ start_period: "20s"
+ ports:
+ - 5432:5432
+
+ db-api-integration:
+ image: 'postgres:17'
+ env_file:
+ - ./.env.db
+ environment:
+ PGPORT: 5433
+ command: postgres -c shared_preload_libraries=pg_stat_statements -c pg_stat_statements.track=all -c shared_buffers=1GB -c work_mem=16MB -c effective_io_concurrency=100 -c wal_level=minimal -c archive_mode=off -c max_wal_senders=0
+ healthcheck:
+ test: [ "CMD-SHELL", "pg_isready", "-U", "postgres" ]
+ interval: '10s'
+ timeout: '30s'
+ retries: 5
+ start_period: '20s'
+ ports:
+ - 5433:5433
+
+ cache-api-integration:
+ image: 'redis:8'
+ ports:
+ - 6379:6379
+
+ db-functional-ui:
+ image: 'postgres:17'
+ env_file:
+ - ./.env.db
+ environment:
+ PGPORT: 5434
+ healthcheck:
+ test: [ "CMD-SHELL", "pg_isready", "-U", "postgres" ]
+ interval: '10s'
+ timeout: '30s'
+ retries: 5
+ start_period: '20s'
+ ports:
+ - "5434:5434"
+
+ login-api-mock:
+ build:
+ context: ../apps/login/integration/api-mock
+ additional_contexts:
+ zitadel-protos: ../proto
+ ports:
+ - 22220:22220
+ - 22222:22222
+
+volumes:
+ db-data-dev:
diff --git a/.devcontainer/login-integration/devcontainer.json b/.devcontainer/login-integration/devcontainer.json
deleted file mode 100644
index 27f9b260030..00000000000
--- a/.devcontainer/login-integration/devcontainer.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
- "name": "Login Integration",
- "dockerComposeFile": [
- "./docker-compose.yaml"
- ],
- "service": "login-integration-dev",
- "runServices": [
- "login-integration"
- ],
- "workspaceFolder": "/workspaces/apps/login",
- "forwardPorts": [
- 22220,
- 22222,
- 3001
- ],
- "remoteEnv": {
- "FAIL_COMMANDS_ON_ERRORS": "${localEnv:FAIL_COMMANDS_ON_ERRORS}",
- "DISPLAY": ""
- },
- "updateContentCommand": "/commands/login-integration.update-content.sh",
- "postAttachCommand": "/commands/login-integration.post-attach.sh",
- "features": {
- "ghcr.io/devcontainers/features/docker-outside-of-docker": {}
- }
-}
diff --git a/.devcontainer/login-integration/docker-compose.yaml b/.devcontainer/login-integration/docker-compose.yaml
deleted file mode 100644
index c750be8aea7..00000000000
--- a/.devcontainer/login-integration/docker-compose.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-services:
- login-integration-dev:
- extends:
- file: ../base/docker-compose.yaml
- service: devcontainer
- container_name: login-integration-dev
- env_file: ../../apps/login/.env.test
- environment:
- CORE_MOCK_STUBS_URL: http://localhost:22220/v1/stubs
- LOGIN_BASE_URL: http://localhost:3001/ui/v2/login
- CYPRESS_CACHE_FOLDER: /workspaces/.artifacts/cypress
- network_mode: service:mock-zitadel
- depends_on:
- login-integration:
- condition: service_healthy
-
- login-integration:
- container_name: login-integration
- image: "${LOGIN_TAG:-ghcr.io/zitadel/zitadel-login:latest}"
- build:
- context: ../..
- dockerfile: build/login/Dockerfile
- env_file: ../../apps/login/.env.test
- network_mode: service:mock-zitadel
-
- mock-zitadel:
- container_name: mock-zitadel
- build:
- context: ../../apps/login/integration/core-mock
- additional_contexts:
- - zitadel-protos=../../proto
- ports:
- - 22220:22220
- - 22222:22222
- - 3001:3001
diff --git a/.devcontainer/login-subtree/devcontainer.json b/.devcontainer/login-subtree/devcontainer.json
deleted file mode 100644
index 000ed9f2626..00000000000
--- a/.devcontainer/login-subtree/devcontainer.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
- "$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.base.schema.json",
- "image": "mcr.microsoft.com/devcontainers/typescript-node:20-bookworm",
- "name": "Login Subtree Container - Use the Login As If You Would Have Forked the Mirror Repo",
- "workspaceFolder": "/login",
- "workspaceMount": "source=${localWorkspaceFolder}/apps/login,target=/login,type=bind,consistency=cached",
- "mounts": [],
- "forwardPorts": [
- 22220,
- 22222,
- 3000,
- 3001
- ],
- "features": {
- "ghcr.io/devcontainers/features/go:1": {
- "version": "1.24"
- },
- "ghcr.io/guiyomh/features/golangci-lint:0": {},
- "ghcr.io/jungaretti/features/make:1": {},
- "ghcr.io/devcontainers/features/docker-outside-of-docker": {}
- }
-}
\ No newline at end of file
diff --git a/.devcontainer/project.json b/.devcontainer/project.json
new file mode 100644
index 00000000000..8b43310ebb0
--- /dev/null
+++ b/.devcontainer/project.json
@@ -0,0 +1,14 @@
+{
+ "$schema": "../node_modules/nx/schemas/project-schema.json",
+ "name": "@zitadel/devcontainer",
+ "targets": {
+ "compose": {
+ "description": "Runs arbitrary Docker Compose commands with dev container support. All running services are manageable and addressable from in- and outside the dev container. The services are defined in .devcontainer/docker-compose.yaml.",
+ "executor": "nx:run-commands",
+ "options": {
+ "cwd": "{projectRoot}",
+ "command": "./compose.sh"
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/.devcontainer/turbo-lint-unit/devcontainer.json b/.devcontainer/turbo-lint-unit/devcontainer.json
deleted file mode 100644
index 29f8ffe60dc..00000000000
--- a/.devcontainer/turbo-lint-unit/devcontainer.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
- "$schema": "https://raw.githubusercontent.com/devcontainers/spec/refs/heads/main/schemas/devContainer.schema.json",
- "name": "Turbo Lint and Unit Tests",
- "dockerComposeFile": [
- "../base/docker-compose.yaml"
- ],
- "service": "devcontainer",
- "runServices": [
- "devcontainer"
- ],
- "workspaceFolder": "/workspaces",
- "forwardPorts": [
- 3001
- ],
- "remoteEnv": {
- "FAIL_COMMANDS_ON_ERRORS": "${localEnv:FAIL_COMMANDS_ON_ERRORS}"
- },
- "updateContentCommand": "/commands/turbo-lint-unit.update-content.sh",
- "postAttachCommand": "/commands/turbo-lint-unit.post-attach.sh"
-}
\ No newline at end of file
diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
index a4462d60d7c..00000000000
--- a/.dockerignore
+++ /dev/null
@@ -1,31 +0,0 @@
-
-# .git
-.codecov
-.github
-.gitignore
-.dockerignore
-**/Dockerfile
-**/node_modules
-**/.pnpm-store
-**/.turbo
-**/.next
-/console/src/app/proto/generated/
-/console/.angular
-/console/tmp/
-.releaserc.js
-changelog.config.js
-CONTRIBUTING.md
-LICENSE
-README.md
-SECURITY.md
-**/Dockerfile
-**/*.Dockerfile
-pkg/grpc/*/*.pb.*
-pkg/grpc/*/*.swagger.json
-**/.artifacts
-console/.angular
-console/node_modules
-console/src/app/proto/generated/
-console/tmp/
-build/*.Dockerfile
-
diff --git a/.github/instructions/nx.instructions.md b/.github/instructions/nx.instructions.md
new file mode 100644
index 00000000000..b6b3c5e00d7
--- /dev/null
+++ b/.github/instructions/nx.instructions.md
@@ -0,0 +1,47 @@
+---
+applyTo: '**'
+---
+
+// This file is automatically generated by Nx Console
+
+You are in an nx workspace using Nx 21.6.1 and pnpm as the package manager.
+
+You have access to the Nx MCP server and the tools it provides. Use them. Follow these guidelines in order to best help the user:
+
+# General Guidelines
+- When answering questions, use the nx_workspace tool first to gain an understanding of the workspace architecture
+- For questions around nx configuration, best practices or if you're unsure, use the nx_docs tool to get relevant, up-to-date docs!! Always use this instead of assuming things about nx configuration
+- If the user needs help with an Nx configuration or project graph error, use the 'nx_workspace' tool to get any errors
+- To help answer questions about the workspace structure or simply help with demonstrating how tasks depend on each other, use the 'nx_visualize_graph' tool
+
+# Generation Guidelines
+If the user wants to generate something, use the following flow:
+
+- learn about the nx workspace and any specifics the user needs by using the 'nx_workspace' tool and the 'nx_project_details' tool if applicable
+- get the available generators using the 'nx_generators' tool
+- decide which generator to use. If no generators seem relevant, check the 'nx_available_plugins' tool to see if the user could install a plugin to help them
+- get generator details using the 'nx_generator_schema' tool
+- you may use the 'nx_docs' tool to learn more about a specific generator or technology if you're unsure
+- decide which options to provide in order to best complete the user's request. Don't make any assumptions and keep the options minimalistic
+- open the generator UI using the 'nx_open_generate_ui' tool
+- wait for the user to finish the generator
+- read the generator log file using the 'nx_read_generator_log' tool
+- use the information provided in the log file to answer the user's question or continue with what they were doing
+
+# Running Tasks Guidelines
+If the user wants help with tasks or commands (which include keywords like "test", "build", "lint", or other similar actions), use the following flow:
+- Use the 'nx_current_running_tasks_details' tool to get the list of tasks (this can include tasks that were completed, stopped or failed).
+- If there are any tasks, ask the user if they would like help with a specific task then use the 'nx_current_running_task_output' tool to get the terminal output for that task/command
+- Use the terminal output from 'nx_current_running_task_output' to see what's wrong and help the user fix their problem. Use the appropriate tools if necessary
+- If the user would like to rerun the task or command, always use `nx run ` to rerun in the terminal. This will ensure that the task will run in the nx context and will be run the same way it originally executed
+- If the task was marked as "continuous" do not offer to rerun the task. This task is already running and the user can see the output in the terminal. You can use 'nx_current_running_task_output' to get the output of the task to verify the output.
+
+
+# CI Error Guidelines
+If the user wants help with fixing an error in their CI pipeline, use the following flow:
+- Retrieve the list of current CI Pipeline Executions (CIPEs) using the 'nx_cloud_cipe_details' tool
+- If there are any errors, use the 'nx_cloud_fix_cipe_failure' tool to retrieve the logs for a specific task
+- Use the task logs to see what's wrong and help the user fix their problem. Use the appropriate tools if necessary
+- Make sure that the problem is fixed by running the task that you passed into the 'nx_cloud_fix_cipe_failure' tool
+
+
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index be08fb03a83..00000000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,145 +0,0 @@
-name: ZITADEL CI/CD
-
-on:
- push:
- tags-ignore:
- - "*"
- branches:
- - "main"
- pull_request:
- workflow_dispatch:
-
-concurrency:
- group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
- cancel-in-progress: true
-
-permissions:
- contents: write
- packages: write
- issues: write
- pull-requests: write
- actions: write
-
-jobs:
- core:
- uses: ./.github/workflows/core.yml
- with:
- node_version: "20"
- buf_version: "latest"
-
- console:
- uses: ./.github/workflows/console.yml
- with:
- node_version: "20"
-
- docs:
- uses: ./.github/workflows/docs.yml
- with:
- node_version: "20"
- buf_version: "latest"
-
- version:
- uses: ./.github/workflows/version.yml
- with:
- semantic_version: "23.0.7"
- dry_run: true
-
- compile:
- needs: [core, console, version]
- uses: ./.github/workflows/compile.yml
- with:
- core_cache_key: ${{ needs.core.outputs.cache_key }}
- console_cache_key: ${{ needs.console.outputs.cache_key }}
- core_cache_path: ${{ needs.core.outputs.cache_path }}
- console_cache_path: ${{ needs.console.outputs.cache_path }}
- version: ${{ needs.version.outputs.version }}
- node_version: "20"
-
- core-unit-test:
- needs: core
- uses: ./.github/workflows/core-unit-test.yml
- with:
- core_cache_key: ${{ needs.core.outputs.cache_key }}
- core_cache_path: ${{ needs.core.outputs.cache_path }}
- secrets:
- CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
- core-integration-test:
- needs: core
- uses: ./.github/workflows/core-integration-test.yml
- with:
- core_cache_key: ${{ needs.core.outputs.cache_key }}
- core_cache_path: ${{ needs.core.outputs.cache_path }}
- secrets:
- CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
- lint:
- needs: [core, console]
- uses: ./.github/workflows/lint.yml
- with:
- node_version: "18"
- buf_version: "latest"
- go_lint_version: "latest"
- core_cache_key: ${{ needs.core.outputs.cache_key }}
- core_cache_path: ${{ needs.core.outputs.cache_path }}
-
- container:
- needs: [compile]
- uses: ./.github/workflows/container.yml
- secrets: inherit
- permissions:
- packages: write
- if: ${{ github.event_name == 'workflow_dispatch' }}
- with:
- build_image_name: "ghcr.io/zitadel/zitadel-build"
-
- login-container:
- uses: ./.github/workflows/login-container.yml
- permissions:
- packages: write
- id-token: write
- with:
- login_build_image_name: "ghcr.io/zitadel/zitadel-login-build"
- node_version: "20"
-
- login-integration-test:
- uses: ./.github/workflows/login-integration-test.yml
- needs: [login-container]
- with:
- login_build_image: ${{ needs.login-container.outputs.login_build_image }}
-
- e2e:
- uses: ./.github/workflows/e2e.yml
- needs: [compile]
-
- release:
- uses: ./.github/workflows/release.yml
- permissions:
- packages: write
- contents: write
- issues: write
- pull-requests: write
- needs:
- [
- version,
- core-unit-test,
- core-integration-test,
- lint,
- container,
- login-container,
- login-integration-test,
- e2e,
- ]
- if: ${{ github.event_name == 'workflow_dispatch' }}
- secrets:
- GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
- APP_ID: ${{ secrets.APP_ID }}
- APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
- with:
- build_image_name: ${{ needs.container.outputs.build_image }}
- semantic_version: "23.0.7"
- image_name: "ghcr.io/zitadel/zitadel"
- google_image_name: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
- build_image_name_login: ${{ needs.login-container.outputs.login_build_image }}
- image_name_login: "ghcr.io/zitadel/zitadel-login"
- google_image_name_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000000..2e7846f9098
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,67 @@
+name: CI
+
+on:
+ push:
+ tags-ignore:
+ - "*"
+ branches:
+ - "main"
+ pull_request:
+ workflow_dispatch:
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: write
+ packages: write
+ issues: write
+ pull-requests: write
+ actions: write
+
+jobs:
+ lint_test_build:
+ uses: ./.github/workflows/lint_test_build.yml
+ with:
+ node_version: "22"
+ secrets:
+ CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+ NX_CLOUD_ACCESS_TOKEN_READONLY: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
+
+ pack:
+ uses: ./.github/workflows/pack.yml
+ secrets:
+ GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+ permissions:
+ packages: write
+ if: ${{ github.event_name == 'workflow_dispatch' }}
+ with:
+ node_version: "22"
+ semantic_version: "23.0.7"
+ image_name_github_api: "ghcr.io/zitadel/zitadel"
+ image_name_google_api: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
+ image_name_github_login: "ghcr.io/zitadel/zitadel-login"
+ image_name_google_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
+
+ release:
+ uses: ./.github/workflows/release.yml
+ permissions:
+ packages: write
+ contents: write
+ issues: write
+ pull-requests: write
+ needs:
+ - lint_test_build
+ - pack
+ if: ${{ github.event_name == 'workflow_dispatch' }}
+ secrets:
+ GCR_JSON_KEY_BASE64: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+ APP_ID: ${{ secrets.APP_ID }}
+ APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+ with:
+ semantic_version: "23.0.7"
+ image_name_github_api: "ghcr.io/zitadel/zitadel"
+ image_name_google_api: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel"
+ image_name_github_login: "ghcr.io/zitadel/zitadel-login"
+ image_name_google_login: "europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7a997b47f6e..3be436bcc01 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,21 +25,21 @@ jobs:
matrix:
language: [go,javascript]
steps:
- - name: Checkout repository
+ - name: Checkout Repository
uses: actions/checkout@v4
- if: matrix.language == 'go'
name: Install Go
uses: actions/setup-go@v5
with:
go-version-file: go.mod
-
- # node to install sass for go
- - if: matrix.language == 'go'
- uses: actions/setup-node@v4
- if: matrix.language == 'go'
+ name: Set up pnpm
+ uses: pnpm/action-setup@v4
+ - name: Generate gRPC Stubs and Static Assets
+ if: matrix.language == 'go'
run: |
- npm install -g sass
- make core_build
+ pnpm install --frozen-lockfile
+ pnpm nx run-many --nxBail --projects @zitadel/api --targets generate-stubs generate-statik generate-assets
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
diff --git a/.github/workflows/compile.yml b/.github/workflows/compile.yml
deleted file mode 100644
index 0c36624a46f..00000000000
--- a/.github/workflows/compile.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: Compile
-
-on:
- workflow_call:
- inputs:
- core_cache_key:
- required: true
- type: string
- core_cache_path:
- required: true
- type: string
- console_cache_key:
- required: true
- type: string
- console_cache_path:
- required: true
- type: string
- version:
- required: true
- type: string
- node_version:
- required: true
- type: string
-
-jobs:
- executable:
- runs-on: ubuntu-latest
- strategy:
- fail-fast: false
- matrix:
- goos: [linux, darwin, windows]
- goarch: [amd64, arm64]
-
- steps:
- - uses: actions/checkout@v4
- - uses: actions/cache/restore@v4
- timeout-minutes: 1
- name: restore console
- with:
- path: ${{ inputs.console_cache_path }}
- key: ${{ inputs.console_cache_key }}
- fail-on-cache-miss: true
- - uses: actions/cache/restore@v4
- timeout-minutes: 1
- name: restore core
- with:
- path: ${{ inputs.core_cache_path }}
- key: ${{ inputs.core_cache_key }}
- fail-on-cache-miss: true
- - uses: actions/setup-go@v5
- with:
- go-version-file: "go.mod"
- - name: compile
- timeout-minutes: 5
- run: |
- GOOS="${{matrix.goos}}" \
- GOARCH="${{matrix.goarch}}" \
- VERSION="${{ inputs.version }}" \
- COMMIT_SHA="${{ github.sha }}" \
- make compile_pipeline
- - name: create folder
- run: |
- mkdir zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
- mv zitadel zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
- cp LICENSE zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
- cp README.md zitadel-${{ matrix.goos }}-${{ matrix.goarch }}/
- tar -czvf zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
- - uses: actions/upload-artifact@v4
- with:
- name: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}
- path: zitadel-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
-
- checksums:
- runs-on: ubuntu-latest
- needs: [executable]
- steps:
- - uses: actions/download-artifact@v4
- with:
- path: executables
- pattern: 'zitadel-*-*'
- - name: move files one folder up
- run: mv */*.tar.gz . && find . -type d -empty -delete
- working-directory: executables
- - run: sha256sum * > checksums.txt
- working-directory: executables
- - uses: actions/upload-artifact@v4
- with:
- name: checksums.txt
- path: executables/checksums.txt
diff --git a/.github/workflows/console.yml b/.github/workflows/console.yml
deleted file mode 100644
index 8cb1227a1a8..00000000000
--- a/.github/workflows/console.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Build console
-
-on:
- workflow_call:
- inputs:
- node_version:
- required: true
- type: string
- outputs:
- cache_key:
- value: ${{ jobs.build.outputs.cache_key }}
- cache_path:
- value: ${{ jobs.build.outputs.cache_path }}
-
-env:
- cache_path: console/dist/console
-
-jobs:
- build:
- outputs:
- cache_key: ${{ steps.cache.outputs.cache-primary-key }}
- cache_path: ${{ env.cache_path }}
- runs-on:
- group: zitadel-public
- steps:
- - uses: actions/checkout@v4
- - uses: actions/cache/restore@v4
- timeout-minutes: 1
- continue-on-error: true
- id: cache
- with:
- key: console-${{ hashFiles('console', 'proto', '!console/dist') }}
- restore-keys: |
- console-
- path: ${{ env.cache_path }}
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: pnpm/action-setup@v4
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/setup-node@v4
- with:
- node-version: ${{ inputs.node_version }}
- cache: "pnpm"
- cache-dependency-path: pnpm-lock.yaml
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Install dependencies
- run: pnpm install --frozen-lockfile
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Build console with Turbo
- run: pnpm turbo build --filter=./console
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/cache/save@v4
- with:
- path: ${{ env.cache_path }}
- key: ${{ steps.cache.outputs.cache-primary-key }}
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
deleted file mode 100644
index ec6bbe58847..00000000000
--- a/.github/workflows/container.yml
+++ /dev/null
@@ -1,173 +0,0 @@
-name: Container
-
-on:
- workflow_call:
- inputs:
- build_image_name:
- required: true
- type: string
- outputs:
- build_image:
- value: '${{ inputs.build_image_name }}:${{ github.sha }}'
-
-permissions:
- packages: write
-
-env:
- default_labels: |
- org.opencontainers.image.documentation=https://zitadel.com/docs
- org.opencontainers.image.vendor=CAOS AG
-
-jobs:
- build:
- name: zitadel
- runs-on: ubuntu-latest
- strategy:
- fail-fast: false
- matrix:
- arch: [amd64,arm64]
- steps:
- -
- uses: actions/checkout@v4
- -
- name: Scratch meta
- id: scratch-meta
- uses: docker/metadata-action@v5
- with:
- images: ${{ inputs.build_image_name }}
- labels: ${{ env.default_labels}}
- tags: |
- type=sha,prefix=,suffix=,format=long
- -
- name: Debug meta
- id: debug-meta
- uses: docker/metadata-action@v5
- with:
- images: ${{ inputs.build_image_name }}
- labels: ${{ env.default_labels}}
- tags: |
- type=sha,prefix=,suffix=-debug,format=long
- -
- name: Set up QEMU
- uses: docker/setup-qemu-action@v3
- -
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- -
- name: Login to Docker registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
- -
- uses: actions/download-artifact@v4
- with:
- path: .artifacts
- name: zitadel-linux-${{ matrix.arch }}
- -
- name: Unpack executable
- run: |
- tar -xvf .artifacts/zitadel-linux-${{ matrix.arch }}.tar.gz
- mv zitadel-linux-${{ matrix.arch }}/zitadel ./zitadel
- -
- name: Debug
- id: build-debug
- uses: docker/build-push-action@v6
- timeout-minutes: 5
- with:
- context: .
- cache-from: type=gha
- cache-to: type=gha,mode=max
- file: build/zitadel/Dockerfile
- target: artifact
- platforms: linux/${{ matrix.arch }}
- push: true
- labels: ${{ steps.debug-meta.outputs.labels }}
- outputs: type=image,name=${{ inputs.build_image_name }},push-by-digest=true,name-canonical=true,push=true
- -
- name: Scratch
- id: build-scratch
- uses: docker/build-push-action@v6
- timeout-minutes: 3
- with:
- context: .
- cache-from: type=gha
- cache-to: type=gha,mode=max
- file: build/zitadel/Dockerfile
- target: final
- platforms: linux/${{ matrix.arch }}
- push: true
- labels: ${{ steps.scratch-meta.outputs.labels }}
- outputs: type=image,name=${{ inputs.build_image_name }},push-by-digest=true,name-canonical=true,push=true
- -
- name: Export debug digest
- run: |
- mkdir -p /tmp/digests/debug
- digest="${{ steps.build-debug.outputs.digest }}"
- touch "/tmp/digests/debug/${digest#sha256:}"
- -
- name: Export scratch digest
- run: |
- mkdir -p /tmp/digests/scratch
- digest="${{ steps.build-scratch.outputs.digest }}"
- touch "/tmp/digests/scratch/${digest#sha256:}"
- -
- name: Upload digest
- uses: actions/upload-artifact@v4
- with:
- name: digests-${{ matrix.arch }}
- path: /tmp/digests
- if-no-files-found: error
- retention-days: 1
-
- merge:
- runs-on: ubuntu-latest
- needs:
- - build
- strategy:
- fail-fast: false
- matrix:
- image: [scratch, debug]
- include:
- - image: scratch
- suffix: ''
- - image: debug
- suffix: '-debug'
- steps:
- -
- name: Download digests
- uses: actions/download-artifact@v4
- with:
- pattern: digests-*
- path: /tmp/digests
- merge-multiple: true
- -
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- -
- name: Login to Docker registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
- -
- name: Docker meta
- id: build-meta
- uses: docker/metadata-action@v5
- with:
- images: '${{ inputs.build_image_name }}'
- tags: |
- type=sha,prefix=,suffix=${{ matrix.suffix }},format=long
- -
- name: Create build manifest list and push
- working-directory: /tmp/digests/${{ matrix.image }}
- run: |
- docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< '${{ steps.build-meta.outputs.json }}') \
- $(printf '${{ inputs.build_image_name }}@sha256:%s ' *)
- -
- name: Inspect build image
- run: |
- docker buildx imagetools inspect ${{ inputs.build_image_name }}:${{ github.sha }}${{ matrix.suffix }}
-
diff --git a/.github/workflows/core-integration-test.yml b/.github/workflows/core-integration-test.yml
deleted file mode 100644
index be6ad0d3d0d..00000000000
--- a/.github/workflows/core-integration-test.yml
+++ /dev/null
@@ -1,100 +0,0 @@
-name: Integration test core
-
-on:
- workflow_call:
- inputs:
- core_cache_key:
- required: true
- type: string
- core_cache_path:
- required: true
- type: string
- secrets:
- CODECOV_TOKEN:
- required: true
-
-jobs:
- postgres:
- runs-on:
- group: zitadel-public
- services:
- postgres:
- image: postgres:17
- ports:
- - 5432:5432
- env:
- POSTGRES_USER: zitadel
- PGUSER: zitadel
- POSTGRES_DB: zitadel
- POSTGRES_HOST_AUTH_METHOD: trust
- options: >-
- --health-cmd pg_isready
- --health-interval 10s
- --health-timeout 5s
- --health-retries 5
- --health-start-period 10s
- cache:
- image: redis:latest
- ports:
- - 6379:6379
- steps:
- -
- uses: actions/checkout@v4
- -
- uses: actions/setup-go@v5
- with:
- go-version-file: 'go.mod'
- -
- uses: actions/cache/restore@v4
- timeout-minutes: 1
- name: restore core
- id: restore-core
- with:
- path: ${{ inputs.core_cache_path }}
- key: ${{ inputs.core_cache_key }}
- fail-on-cache-miss: true
- -
- id: go-cache-path
- name: set cache path
- run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
- -
- uses: actions/cache/restore@v4
- id: cache
- timeout-minutes: 1
- continue-on-error: true
- name: restore previous results
- with:
- key: integration-test-postgres-${{ inputs.core_cache_key }}
- restore-keys: |
- integration-test-postgres-core-
- path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
- -
- name: test
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- env:
- ZITADEL_MASTERKEY: MasterkeyNeedsToHave32Characters
- run: make core_integration_test
- -
- name: upload server logs
- if: always()
- uses: actions/upload-artifact@v4
- with:
- name: integration-test-server-logs
- path: |
- tmp/zitadel.log
- tmp/race.log.*
- -
- name: publish coverage
- uses: codecov/codecov-action@v4.3.0
- with:
- file: profile.cov
- name: core-integration-tests-postgres
- flags: core-integration-tests-postgres
- token: ${{ secrets.CODECOV_TOKEN }}
- -
- uses: actions/cache/save@v4
- name: cache results
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- with:
- key: integration-test-postgres-${{ inputs.core_cache_key }}
- path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
diff --git a/.github/workflows/core-unit-test.yml b/.github/workflows/core-unit-test.yml
deleted file mode 100644
index 9fb5f572c7a..00000000000
--- a/.github/workflows/core-unit-test.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: Unit test core
-
-on:
- workflow_call:
- inputs:
- core_cache_key:
- required: true
- type: string
- core_cache_path:
- required: true
- type: string
- crdb_version:
- required: false
- type: string
- secrets:
- CODECOV_TOKEN:
- required: true
-
-jobs:
- test:
- runs-on:
- group: zitadel-public
- steps:
- -
- uses: actions/checkout@v3
- -
- uses: actions/setup-go@v5
- with:
- go-version-file: 'go.mod'
- -
- uses: actions/cache/restore@v4
- timeout-minutes: 1
- name: restore core
- id: restore-core
- with:
- path: ${{ inputs.core_cache_path }}
- key: ${{ inputs.core_cache_key }}
- fail-on-cache-miss: true
- -
- id: go-cache-path
- name: set cache path
- run: echo "GO_CACHE_PATH=$(go env GOCACHE)" >> $GITHUB_OUTPUT
- -
- uses: actions/cache/restore@v4
- id: cache
- timeout-minutes: 1
- continue-on-error: true
- name: restore previous results
- with:
- key: unit-test-${{ inputs.core_cache_key }}
- restore-keys: |
- unit-test-core-
- path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
- -
- name: test
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- run: make core_unit_test
- -
- name: publish coverage
- uses: codecov/codecov-action@v4.3.0
- with:
- file: profile.cov
- name: core-unit-tests
- flags: core-unit-tests
- token: ${{ secrets.CODECOV_TOKEN }}
- -
- uses: actions/cache/save@v4
- name: cache results
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- with:
- key: unit-test-${{ inputs.core_cache_key }}
- path: ${{ steps.go-cache-path.outputs.GO_CACHE_PATH }}
-
\ No newline at end of file
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
deleted file mode 100644
index 940da35f0d3..00000000000
--- a/.github/workflows/core.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: Build core
-
-on:
- workflow_call:
- inputs:
- buf_version:
- required: true
- type: string
- node_version:
- required: true
- type: string
- outputs:
- cache_key:
- value: ${{ jobs.build.outputs.cache_key }}
- cache_path:
- value: ${{ jobs.build.outputs.cache_path }}
-
-env:
- cache_path: |
- internal/statik/statik.go
- internal/notification/statik/statik.go
- internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css*
- internal/api/ui/login/statik/statik.go
- internal/api/assets/authz.go
- internal/api/assets/router.go
- openapi/v2
- pkg/grpc/**/*.pb.*
- pkg/grpc/**/*.connect.go
-
-jobs:
- build:
- runs-on:
- group: zitadel-public
- outputs:
- cache_key: ${{ steps.cache.outputs.cache-primary-key }}
- cache_path: ${{ env.cache_path }}
- steps:
- -
- uses: actions/checkout@v4
- -
- uses: actions/cache/restore@v4
- timeout-minutes: 1
- continue-on-error: true
- id: cache
- with:
- key: core-${{ hashFiles( 'go.*', 'openapi', 'cmd', 'pkg/grpc/**/*.go', 'proto', 'internal', 'backend') }}
- restore-keys: |
- core-
- path: ${{ env.cache_path }}
- -
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: bufbuild/buf-setup-action@v1
- with:
- github_token: ${{ github.token }}
- version: ${{ inputs.buf_version }}
-
- -
- # node to install sass
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/setup-node@v4
- with:
- node-version: ${{ inputs.node_version }}
- -
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- run: npm install -g sass
-
- -
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/setup-go@v5
- with:
- go-version-file: 'go.mod'
- -
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- run: make core_build
- -
- if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/cache/save@v4
- with:
- key: ${{ steps.cache.outputs.cache-primary-key }}
- path: ${{ env.cache_path }}
-
\ No newline at end of file
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
deleted file mode 100644
index 2f0ac3d7af9..00000000000
--- a/.github/workflows/docs.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Build docs
-
-on:
- workflow_call:
- inputs:
- node_version:
- required: true
- type: string
- buf_version:
- required: true
- type: string
- outputs:
- cache_key:
- value: ${{ jobs.build.outputs.cache_key }}
- cache_path:
- value: ${{ jobs.build.outputs.cache_path }}
-
-env:
- cache_path: docs/build
-
-jobs:
- build:
- outputs:
- cache_key: ${{ steps.cache.outputs.cache-primary-key }}
- cache_path: ${{ env.cache_path }}
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
- - uses: actions/cache/restore@v4
- timeout-minutes: 1
- continue-on-error: true
- id: cache
- with:
- key: docs-${{ hashFiles('docs', 'proto', '!docs/build', '!docs/node_modules', '!docs/protoc-gen-connect-openapi') }}
- restore-keys: |
- docs-
- path: ${{ env.cache_path }}
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: bufbuild/buf-setup-action@v1
- with:
- github_token: ${{ github.token }}
- version: ${{ inputs.buf_version }}
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: pnpm/action-setup@v4
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/setup-node@v4
- with:
- node-version: ${{ inputs.node_version }}
- cache: "pnpm"
- cache-dependency-path: pnpm-lock.yaml
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Install dependencies
- run: pnpm install
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Build docs with Turbo
- run: pnpm turbo build --filter=./docs
- - if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- uses: actions/cache/save@v4
- with:
- path: ${{ env.cache_path }}
- key: ${{ steps.cache.outputs.cache-primary-key }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
deleted file mode 100644
index caa7a8c07f7..00000000000
--- a/.github/workflows/e2e.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: "ZITADEL e2e Tests"
-
-on:
- workflow_call:
-
-jobs:
- test:
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- browser: [firefox, chrome]
- runs-on:
- group: zitadel-public
- steps:
- - name: Checkout Repository
- uses: actions/checkout@v4
- - uses: actions/download-artifact@v4
- with:
- path: .artifacts
- name: zitadel-linux-amd64
- - name: Unpack executable
- run: |
- tar -xvf .artifacts/zitadel-linux-amd64.tar.gz
- mv zitadel-linux-amd64/zitadel ./zitadel
- - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- - uses: pnpm/action-setup@v4
- - uses: actions/setup-node@v4
- with:
- node-version: 20
- cache: "pnpm"
- cache-dependency-path: pnpm-lock.yaml
- - name: Install dependencies
- run: pnpm install
- - name: Install Cypress binary
- run: cd ./e2e && pnpm exec cypress install
- - name: Start DB and ZITADEL
- run: |
- cd ./e2e
- ZITADEL_IMAGE=zitadel:local docker compose up --detach --wait
- - name: Cypress run
- uses: cypress-io/github-action@v6
- env:
- CYPRESS_BASE_URL: http://localhost:8080/ui/console
- CYPRESS_WEBHOOK_HANDLER_HOST: host.docker.internal
- CYPRESS_DATABASE_CONNECTION_URL: "postgresql://root@localhost:26257/zitadel"
- CYPRESS_BACKEND_URL: http://localhost:8080
- with:
- working-directory: e2e
- browser: ${{ matrix.browser }}
- config-file: cypress.config.ts
- install: false
- - uses: actions/upload-artifact@v4
- if: always()
- with:
- name: production-tests-${{ matrix.browser }}
- path: |
- e2e/cypress/screenshots
- e2e/cypress/videos
- e2e/cypress/results
- retention-days: 30
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
deleted file mode 100644
index 7eb0a44672e..00000000000
--- a/.github/workflows/lint.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-name: Lint
-
-on:
- workflow_call:
- inputs:
- node_version:
- required: true
- type: string
- buf_version:
- required: true
- type: string
- go_lint_version:
- required: true
- type: string
- core_cache_key:
- required: true
- type: string
- core_cache_path:
- required: true
- type: string
-
-jobs:
- lint-skip:
- name: lint skip
- runs-on: ubuntu-latest
- if: ${{ github.event_name != 'pull_request' }}
- steps:
- - name: Lint skip
- run: |
- echo "Linting outside of pull requests is skipped"
-
- api:
- name: api
- runs-on: ubuntu-latest
- continue-on-error: true
- if: ${{ github.event_name == 'pull_request' }}
- steps:
- - uses: actions/checkout@v4
- - uses: bufbuild/buf-setup-action@v1
- with:
- version: ${{ inputs.buf_version }}
- github_token: ${{ secrets.GITHUB_TOKEN }}
- - name: lint
- uses: bufbuild/buf-lint-action@v1
- - uses: bufbuild/buf-breaking-action@v1
- with:
- against: "https://github.com/${{ github.repository }}.git#branch=${{ github.base_ref }}"
-
- turbo-lint-unit:
- if: ${{ github.event_name == 'pull_request' }}
- name: turbo-lint-unit
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: actions/checkout@v4
- - name: Install Dev Container CLI
- run: npm install -g @devcontainers/cli@0.80.0
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- - name: Lint and Unit Test All JavaScript Code
- run: npm run devcontainer:lint-unit
- - name: Fix Failures
- if: failure()
- run: |
- echo "Reproduce this check locally:"
- echo "npm run devcontainer:lint-unit"
- echo "If you have pnpm installed, most linting errors can be fixed automatically:"
- echo "pnpm turbo lint:fix"
- echo "In other cases, you can open the dev container called \"Turbo Lint and Unit Tests\"."
- echo "You will have the same environment as the pipeline check as well as some guidance on how to fix the errors."
-
- core:
- name: core
- runs-on: ubuntu-latest
- if: ${{ github.event_name == 'pull_request' }}
- steps:
- - name: Checkout
- uses: actions/checkout@v4
- - uses: actions/setup-go@v5
- with:
- go-version-file: "go.mod"
- - uses: actions/cache/restore@v4
- timeout-minutes: 1
- name: restore core
- with:
- path: ${{ inputs.core_cache_path }}
- key: ${{ inputs.core_cache_key }}
- fail-on-cache-miss: true
- - uses: golangci/golangci-lint-action@v8
- with:
- version: ${{ inputs.go_lint_version }}
- github-token: ${{ github.token }}
- only-new-issues: true
diff --git a/.github/workflows/lint_test_build.yml b/.github/workflows/lint_test_build.yml
new file mode 100644
index 00000000000..66b21aacce9
--- /dev/null
+++ b/.github/workflows/lint_test_build.yml
@@ -0,0 +1,98 @@
+name: Lint Test Build
+
+on:
+ workflow_call:
+ inputs:
+ node_version:
+ required: true
+ type: string
+ secrets:
+ CODECOV_TOKEN:
+ required: true
+ NX_CLOUD_ACCESS_TOKEN_READONLY:
+ required: true
+
+jobs:
+ lint_test_build:
+ name: Lint, Test and Build
+ runs-on: depot-ubuntu-22.04-16
+ environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+ filter: tree:0
+ - name: Fetch main branch
+ run: git fetch origin main:main
+ - name: Set up Go
+ uses: actions/setup-go@v5
+ with:
+ go-version-file: 'go.mod'
+ - name: Set up pnpm
+ uses: pnpm/action-setup@v4
+ with:
+ run_install: false
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: ${{ inputs.node_version }}
+ cache: "pnpm"
+ - name: Set up Docker
+ uses: docker/setup-docker-action@v4
+ with:
+ version: v28.3.2
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ with:
+ version: v0.28.0
+ - name: Set up Docker Compose
+ uses: docker/setup-compose-action@v1
+ with:
+ version: v2.38.2
+ - name: Install dependencies
+ run: pnpm install --frozen-lockfile
+ - name: Install Cypress binary
+ run: pnpm cypress install
+ working-directory: apps/login
+ - name: Set SHAs for nx affected commands
+ uses: nrwl/nx-set-shas@v4
+ - name: Lint, Test and Build
+ env:
+ NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+ run: pnpm nx affected --nxBail --targets lint test build --exclude @zitadel/docs
+ - name: Suggest Pipeline Fix By Nx Cloud AI
+ if: failure() || cancelled()
+ env:
+ NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+ run: pnpm nx fix-ci
+ - name: Publish API Unit Test Coverage
+ uses: codecov/codecov-action@v4.3.0
+ with:
+ file: profile.api.test-unit.cov
+ name: api-test-unit
+ flags: api-test-unit
+ token: ${{ secrets.CODECOV_TOKEN }}
+ - name: Publish API Integration Test Coverage
+ uses: codecov/codecov-action@v4.3.0
+ with:
+ file: profile.api.test-integration.cov
+ name: api-test-integration
+ flags: api-test-integration
+ token: ${{ secrets.CODECOV_TOKEN }}
+ - name: Upload API Integration Test Race Logs
+ if: failure() || cancelled()
+ uses: actions/upload-artifact@v4
+ with:
+ name: api-integration-test-race-logs
+ path: |
+ .artifacts/api-test-integration/race.log.*
+ - name: Upload Functional UI Test Artifacts
+ uses: actions/upload-artifact@v4
+ if: failure() || cancelled()
+ with:
+ name: functional-ui-tests
+ path: |
+ tests/functional-ui/cypress/screenshots
+ tests/functional-ui/cypress/videos
+ tests/functional-ui/cypress/results
diff --git a/.github/workflows/login-container.yml b/.github/workflows/login-container.yml
deleted file mode 100644
index 50bd3b5516e..00000000000
--- a/.github/workflows/login-container.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: Login Container
-
-on:
- workflow_call:
- inputs:
- login_build_image_name:
- description: 'The image repository name of the standalone login image'
- type: string
- required: true
- node_version:
- required: true
- type: string
- outputs:
- login_build_image:
- description: 'The full image tag of the standalone login image'
- value: ${{ inputs.login_build_image_name }}:${{ github.sha }}
-
-permissions:
- packages: write
-
-env:
- default_labels: |
- org.opencontainers.image.documentation=https://zitadel.com/docs
- org.opencontainers.image.vendor=CAOS AG
- org.opencontainers.image.licenses=MIT
-
-jobs:
- login-container:
- name: Build Login Container
- runs-on: ubuntu-latest
- permissions:
- packages: write
- outputs:
- login_build_image: ${{ steps.short-sha.outputs.login_build_image }}
- steps:
- - uses: actions/checkout@v4
- - name: Login meta
- id: login-meta
- uses: docker/metadata-action@v5
- with:
- images: ${{ inputs.login_build_image_name }}
- labels: ${{ env.default_labels}}
- annotations: |
- manifest:org.opencontainers.image.licenses=MIT
- tags: |
- type=sha,prefix=,format=long
- - name: Login to Docker registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
- - name: Set up Docker Buildx
- id: setup-buildx
- uses: docker/setup-buildx-action@v3
- - name: Bake login multi-arch
- uses: docker/bake-action@v6
- env:
- NODE_VERSION: ${{ inputs.node_version }}
- with:
- source: .
- push: true
- provenance: true
- targets: login-standalone
- files: |
- ./apps/login/docker-bake.hcl
- ${{ github.event_name == 'workflow_dispatch' && './apps/login/docker-bake-release.hcl' || '' }}
- ./docker-bake.hcl
- cwd://${{ steps.login-meta.outputs.bake-file }}
diff --git a/.github/workflows/login-integration-test.yml b/.github/workflows/login-integration-test.yml
deleted file mode 100644
index 5aea6d8f7a4..00000000000
--- a/.github/workflows/login-integration-test.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-name: Integration test core
-
-on:
- workflow_call:
- inputs:
- login_build_image:
- required: true
- type: string
-
-permissions:
- packages: write
-
-jobs:
- login-integration-test:
- name: login-integration-test
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: actions/checkout@v4
- - name: Install Dev Container CLI
- run: npm install -g @devcontainers/cli@0.80.0
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
- - name: Pull Login Build Image
- run: docker compose --file .devcontainer/login-integration/docker-compose.yaml pull
- env:
- LOGIN_TAG: ${{ inputs.login_build_image }}
- - name: Run Integration Tests against the Login and a Mocked Zitadel API
- run: npm run devcontainer:integration:login
- env:
- LOGIN_TAG: ${{ inputs.login_build_image }}
- DOCKER_BUILDKIT: 1
- - name: Fix Failures
- if: failure()
- run: |
- echo "Reproduce this check locally:"
- echo "LOGIN_TAG=${{ inputs.login_build_image }} npm run devcontainer:integration:login"
- echo "To fix the failures, open the dev container called \"Login Integration Tests\"."
- echo "You will have the same environment as the pipeline check as well as some guidance on how to fix the errors."
- - name: Show Compose Status
- if: failure()
- run: docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml ps
- - name: Print Config
- if: failure()
- run: COMPOSE_BAKE=1 docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml config login-integration
- env:
- LOGIN_TAG: ${{ inputs.login_build_image }}
- - name: Show Container Logs
- if: failure()
- run: docker compose --file .devcontainer/base/docker-compose.yaml --file .devcontainer/login-integration/docker-compose.yaml logs --timestamps --no-color --tail 100 login-integration
- - name: Inspect All Failed Containers
- if: failure()
- run: |
- docker ps -a --filter "status=exited" --filter "status=created" --format "table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Image}}"
- for container in $(docker ps -a --filter "status=exited" --filter "status=created" -q); do
- echo "Inspecting container $container"
- docker inspect $container || true
- done
diff --git a/.github/workflows/pack.yml b/.github/workflows/pack.yml
new file mode 100644
index 00000000000..aa6ac9805fe
--- /dev/null
+++ b/.github/workflows/pack.yml
@@ -0,0 +1,177 @@
+name: Package und Publish Archives and Images
+
+on:
+ workflow_call:
+ inputs:
+ node_version:
+ required: true
+ type: string
+ image_name_github_api:
+ required: true
+ type: string
+ image_name_github_login:
+ required: true
+ type: string
+ image_name_google_api:
+ required: true
+ type: string
+ image_name_google_login:
+ required: true
+ type: string
+ semantic_version:
+ required: false
+ type: string
+ secrets:
+ GCR_JSON_KEY_BASE64:
+ description: 'base64 endcrypted key to connect to Google'
+ required: true
+
+permissions:
+ packages: write
+
+env:
+ default_labels: |
+ org.opencontainers.image.documentation=https://zitadel.com/docs
+ org.opencontainers.image.vendor=ZITADEL
+
+jobs:
+ version:
+ uses: ./.github/workflows/version.yml
+ with:
+ semantic_version: ${{ inputs.semantic_version }}
+ dry_run: true
+
+ pack:
+ runs-on:
+ group: zitadel-public
+ environment: ${{ github.ref_protected == 'true' && 'Protected' || null }}
+ needs: version
+ steps:
+ - name: Checkout Repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+ filter: tree:0
+ - name: Set up Go
+ uses: actions/setup-go@v5
+ with:
+ go-version-file: 'go.mod'
+ - name: Set up pnpm
+ uses: pnpm/action-setup@v4
+ with:
+ run_install: false
+ - name: Set up Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: ${{ inputs.node_version }}
+ cache: "pnpm"
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ with:
+ version: v0.28.0
+ - name: Install dependencies
+ run: pnpm install --frozen-lockfile
+ - name: Pack API and Login
+ env:
+ ZITADEL_VERSION: ${{ needs.version.outputs.version }}
+ NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+ run: pnpm nx run --nxBail pack
+ - name: Suggest Pipeline Fix By Nx Cloud AI
+ if: always()
+ env:
+ NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN || secrets.NX_CLOUD_ACCESS_TOKEN_READONLY }}
+ run: pnpm nx fix-ci
+ - name: Upload all platform archives
+ uses: actions/upload-artifact@v4
+ with:
+ name: zitadel-archives
+ path: .artifacts/pack
+ - name: Set up QEMU
+ uses: docker/setup-qemu-action@v3
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ - name: Login to Docker registry
+ uses: docker/login-action@v3
+ with:
+ registry: ghcr.io
+ username: ${{ github.actor }}
+ password: ${{ secrets.GITHUB_TOKEN }}
+ - name: Login to Google Artifact Registry
+ uses: docker/login-action@v3
+ with:
+ registry: europe-docker.pkg.dev
+ username: _json_key_base64
+ password: ${{ secrets.GCR_JSON_KEY_BASE64 }}
+ - name: Generate Standard Tags and Labels from the GitHub Context for the API Scratch Container Image
+ id: scratch-meta
+ uses: docker/metadata-action@v5
+ with:
+ images: |
+ ${{ inputs.image_name_github_api }}
+ ${{ inputs.image_name_google_api }}
+ labels: ${{ env.default_labels}}
+ tags: |
+ type=sha,prefix=,suffix=,format=long
+ - name: Build and Push the SHA-tagged API Scratch Container Image
+ id: build-scratch
+ uses: docker/build-push-action@v6
+ timeout-minutes: 3
+ with:
+ context: .
+ cache-from: type=gha
+ cache-to: type=gha,mode=max
+ file: apps/api/Dockerfile
+ target: final
+ platforms: linux/amd64,linux/arm64
+ push: true
+ labels: ${{ steps.scratch-meta.outputs.labels }}
+ tags: ${{ steps.scratch-meta.outputs.tags }}
+ - name: Generate Standard Tags and Labels from the GitHub Context for the API Debug Container Image
+ id: debug-meta
+ uses: docker/metadata-action@v5
+ with:
+ images: |
+ ${{ inputs.image_name_github_api }}
+ ${{ inputs.image_name_google_api }}
+ labels: ${{ env.default_labels}}
+ tags: |
+ type=sha,prefix=,suffix=-debug,format=long
+ - name: Build and Push the SHA-tagged API Debug Container Image
+ id: build-debug
+ uses: docker/build-push-action@v6
+ timeout-minutes: 5
+ with:
+ context: .
+ cache-from: type=gha
+ cache-to: type=gha,mode=max
+ file: apps/api/Dockerfile
+ target: builder
+ platforms: linux/amd64,linux/arm64
+ push: true
+ labels: ${{ steps.debug-meta.outputs.labels }}
+ tags: ${{ steps.debug-meta.outputs.tags }}
+ outputs: type=image,name=${{ inputs.image_name_github_api }},name-canonical=true
+ - name: Generate Standard Tags and Labels from the GitHub Context for the Login Container Image
+ id: login-meta
+ uses: docker/metadata-action@v5
+ with:
+ images: |
+ ${{ inputs.image_name_github_login }}
+ ${{ inputs.image_name_google_login }}
+ labels: |
+ org.opencontainers.image.licenses=MIT
+ ${{ env.default_labels}}
+ tags: |
+ type=sha,prefix=,suffix=,format=long
+ - name: Build and Push the SHA-tagged Login Container Image
+ id: build-login
+ uses: docker/build-push-action@v6
+ timeout-minutes: 3
+ with:
+ context: apps/login
+ cache-from: type=gha
+ cache-to: type=gha,mode=max
+ platforms: linux/amd64,linux/arm64
+ push: true
+ labels: ${{ steps.login-meta.outputs.labels }}
+ tags: ${{ steps.login-meta.outputs.tags }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bfbc3d6934f..ccc3764cc8f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,22 +6,16 @@ on:
semantic_version:
required: true
type: string
- build_image_name:
+ image_name_github_api:
required: true
type: string
- image_name:
+ image_name_google_api:
required: true
type: string
- google_image_name:
+ image_name_github_login:
required: true
type: string
- build_image_name_login:
- required: true
- type: string
- image_name_login:
- required: true
- type: string
- google_image_name_login:
+ image_name_google_login:
required: true
type: string
secrets:
@@ -47,7 +41,8 @@ jobs:
# https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28#create-a-release--parameters
publish:
runs-on: ubuntu-22.04
- needs: [ version ]
+ needs: version
+ if: needs.version.outputs.published == 'true'
steps:
- id: get_release
uses: cardinalby/git-get-release-action@v1
@@ -72,6 +67,7 @@ jobs:
docker:
runs-on: ubuntu-22.04
needs: [ version ]
+ if: needs.version.outputs.published == 'true'
steps:
-
name: Set up QEMU
@@ -97,38 +93,38 @@ jobs:
name: Publish ${{ needs.version.outputs.version }}
run: |
docker buildx imagetools create \
- --tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }} \
- ${{ inputs.build_image_name }}
+ --tag ${{ inputs.image_name_github_api }}:${{ needs.version.outputs.version }} \
+ ${{ inputs.image_name_github_api }}:${{ github.sha }}
docker buildx imagetools create \
- --tag ${{ inputs.image_name }}:${{ needs.version.outputs.version }}-debug \
- ${{ inputs.build_image_name }}-debug
+ --tag ${{ inputs.image_name_github_api }}:${{ needs.version.outputs.version }}-debug \
+ ${{ inputs.image_name_github_api }}:${{ github.sha }}-debug
docker buildx imagetools create \
- --tag ${{ inputs.google_image_name }}:${{ needs.version.outputs.version }} \
- ${{ inputs.build_image_name }}
+ --tag ${{ inputs.image_name_google_api }}:${{ needs.version.outputs.version }} \
+ ${{ inputs.image_name_google_api }}:${{ github.sha }}
docker buildx imagetools create \
- --tag ${{ inputs.image_name_login }}:${{ needs.version.outputs.version }} \
- ${{ inputs.build_image_name_login }}
+ --tag ${{ inputs.image_name_github_login }}:${{ needs.version.outputs.version }} \
+ ${{ inputs.image_name_github_login }}:${{ github.sha }}
docker buildx imagetools create \
- --tag ${{ inputs.google_image_name_login }}:${{ needs.version.outputs.version }} \
- ${{ inputs.build_image_name_login }}
+ --tag ${{ inputs.image_name_google_login }}:${{ needs.version.outputs.version }} \
+ ${{ inputs.image_name_google_login }}:${{ github.sha }}
-
name: Publish latest
if: ${{ github.ref_name == 'next' }}
run: |
docker buildx imagetools create \
- --tag ${{ inputs.image_name }}:latest \
- ${{ inputs.build_image_name }}
+ --tag ${{ inputs.image_name_github_api }}:latest \
+ ${{ inputs.image_name_github_api }}:${{ github.sha }}
docker buildx imagetools create \
- --tag ${{ inputs.image_name }}:latest-debug \
- ${{ inputs.build_image_name }}-debug
+ --tag ${{ inputs.image_name_github_api }}:latest-debug \
+ ${{ inputs.image_name_github_api }}:${{ github.sha }}-debug
docker buildx imagetools create \
- --tag ${{ inputs.image_name_login }}:latest \
- ${{ inputs.build_image_name_login }}
+ --tag ${{ inputs.image_name_github_login }}:latest \
+ ${{ inputs.image_name_github_login }}:${{ github.sha }}
homebrew-tap:
runs-on: ubuntu-22.04
needs: version
- if: ${{ github.ref_name == 'next' }}
+ if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
continue-on-error: true
steps:
- name: generate token
@@ -148,7 +144,7 @@ jobs:
helm-chart:
runs-on: ubuntu-22.04
needs: version
- if: ${{ github.ref_name == 'next' }}
+ if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
continue-on-error: true
steps:
- name: generate token
@@ -168,7 +164,7 @@ jobs:
npm-packages:
runs-on: ubuntu-latest
needs: version
- if: ${{ github.ref_name == 'next' }}
+ if: needs.version.outputs.published == 'true' && github.ref_name == 'next'
continue-on-error: true
steps:
- name: Checkout code
@@ -194,26 +190,3 @@ jobs:
version: ${{ needs.version.outputs.version }}
cwd: packages
createGithubReleases: false
-
- login-repo:
- runs-on: ubuntu-latest
- needs: version
- if: ${{ github.ref_name == 'next' }}
- continue-on-error: true
- steps:
- - name: Checkout code
- uses: actions/checkout@v4
- - name: Push Subtree
- run: make login_push LOGIN_REMOTE_BRANCH=mirror-zitadel-repo
- - name: Create Pull Request
- uses: peter-evans/create-pull-request@v7
- with:
- token: ${{ secrets.GITHUB_TOKEN }}
- commit-message: 'chore: mirror zitadel repo'
- branch: mirror-zitadel-repo
- title: 'chore: mirror zitadel repo'
- body: 'This PR updates the login repository with the latest changes from the zitadel repository.'
- base: main
- reviewers: |
- @peintnermax
- @eliobischof
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 063f6956a52..7b442ad1812 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -11,12 +11,12 @@ on:
type: boolean
outputs:
version:
- value: ${{ jobs.generate.outputs.version }}
+ value: ${{ jobs.semantic.outputs.version }}
published:
- value: ${{jobs.generate.outputs.published }}
+ value: ${{jobs.semantic.outputs.published }}
jobs:
- generate:
+ semantic:
runs-on: ubuntu-22.04
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -25,16 +25,17 @@ jobs:
published: ${{ steps.semantic.outputs.new_release_published }}
steps:
-
- name: Source checkout
+ name: Checkout Repository
uses: actions/checkout@v4
-
+ name: Download Artifacts
uses: actions/download-artifact@v4
if: ${{ !inputs.dry_run }}
with:
path: .artifacts
pattern: "{checksums.txt,zitadel-*}"
-
- name: Semantic Release
+ name: Run Semantic Release
uses: cycjimmy/semantic-release-action@v4
id: semantic
env:
@@ -46,7 +47,7 @@ jobs:
@semantic-release/exec@6.0.3
@semantic-release/github@10.0.2
-
- name: output
+ name: Output Version For Dependent Workflows
id: output
run:
if [[ ! -z "${{ steps.semantic.outputs.new_release_version }}" ]]; then echo "VERSION=v${{ steps.semantic.outputs.new_release_version }}" >> "$GITHUB_OUTPUT"; else echo "VERSION=${{ github.sha }}" >> "$GITHUB_OUTPUT";fi
diff --git a/.gitignore b/.gitignore
index 4c3c877a187..bbfeccbd32c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,7 +11,7 @@
# Coverage
coverage.txt
-profile.cov
+profile*.cov
# Output of the go coverage tool, specifically when used with LiteIDE
*.out
@@ -24,9 +24,9 @@ sandbox.go
# IDE
.idea
-.vscode
.DS_STORE
.run
+.vscode
# credential
google-credentials
@@ -47,7 +47,6 @@ cmd/zitadel/zitadel
/zitadel
# buildfolders and generated files
-tmp/
console/src/app/proto/generated/
**.pb.go
!pkg/grpc/protoc/v2/options.pb.go
@@ -79,21 +78,22 @@ build/local/*.env
/zitadel
node_modules/
.kreya
+login-client.pat
+admin.pat
+.env.*local
go.work
go.work.sum
# Local Netlify folder
.netlify
-load-test/node_modules
-load-test/pnpm-debug.log
-load-test/dist
-load-test/output/*
+dist
.vercel
-# Turbo
-.turbo/
-**/.turbo/
-
# PNPM
-.pnpm-store
\ No newline at end of file
+.pnpm-store
+
+# Nx
+.nx/cache
+.nx/workspace-data
+.cursor/rules/nx-rules.mdc
diff --git a/.golangci.yaml b/.golangci.yaml
index cde08dcf41d..59cf2d3922d 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -99,6 +99,7 @@ linters:
- .github
- .keys
- .vscode
+ - .devcontainer
- build
- deploy
- guides
@@ -113,12 +114,13 @@ linters:
- packages
- console
- docs
- - load-test
+ - benchmark
+ - tests
issues:
max-issues-per-linter: 0
max-same-issues: 0
- new-from-rev: main
+ new-from-rev: origin/main
formatters:
enable:
- gci
@@ -138,6 +140,7 @@ formatters:
- .github
- .keys
- .vscode
+ - .devcontainer
- build
- deploy
- guides
@@ -152,4 +155,5 @@ formatters:
- packages
- console
- docs
- - load-test
+ - benchmark
+ - tests
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6a20ca31d29..2d7b82d3e4a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,5 +1,78 @@
# Contributing to Zitadel
+Zitadel is an open-source identity and access management platform built with a modern tech stack including Go (API), Next.js/React (Login), Angular (Console), and Docusaurus (Docs) - all orchestrated through an Nx monorepo with pnpm for efficient development workflows.
+
+## Quick Start
+
+1. Clone the repository: `git clone https://github.com/zitadel/zitadel` or [open it in a local Dev Container](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/zitadel/zitadel) or [create a GitHub Codespace](https://codespaces.new/zitadel/zitadel)
+2. If you cloned the repository to your local machine, install the required development dependencies
+ - [Node.js v22.x](https://nodejs.org/en/download/) - Required for UI development and to run development commands `pnpm nx ...`
+ - [Go 1.24.x](https://go.dev/doc/install) - Required for API development
+ - [Docker](https://docs.docker.com/engine/install/) - Required for supporting services like the development database and for tests.
+ - [Cypress runtime dependencies](https://docs.cypress.io/guides/continuous-integration/introduction#Dependencies) - Required for Browser UI tests
+
+ WSL2 on Windows 10 users (click to expand)
+
+ For Cypress tests on WSL2, you may need to configure X11 forwarding. Following suggestions [here](https://stackoverflow.com/questions/62641553/setup-cypress-on-wsl-ubuntu-for-windows-10) and [here](https://github.com/microsoft/WSL/issues/4106). Use at your own risk.
+
+ 1. Install `VcXsrv Windows X Server`
+ 2. Set shortcut target to `"C:\Program Files\VcXsrv\xlaunch.exe" -ac`
+ 3. In WSL2: `export DISPLAY=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}'):0`
+ 4. Disable access control when starting XLaunch
+
+3. Use [Corepack](https://pnpm.io/installation#using-corepack) to make sure you have [pnpm](https://pnpm.io/) installed in the correct version: `corepack enable`.
+4. Install node module dependencies: `pnpm install`
+5. Generate code `pnpm nx run-many --target generate`
+6. Optionally, install the following VSCode plugins:
+ - [Go](https://marketplace.visualstudio.com/items?itemName=golang.Go) - For API development. Use golangci-lint v2 as linter.
+ - [Angular Language Service](https://marketplace.visualstudio.com/items?itemName=Angular.ng-template) - For Console development
+ - [ESLint](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) - Code linting
+ - [Prettier](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) - Code formatting
+ - [Nx Console](https://marketplace.visualstudio.com/items?itemName=nrwl.angular-console) - Nx task runner tooling
+
+Jump to the dedicated sections for developing a specific project:
+
+- [Contributing to the API](#contribute-to-api)
+- [Contributing to the Login](#contribute-to-login)
+- [Contributing to the Console](#contribute-to-console)
+- [Contributing to the Docs](#contribute-to-docs)
+- [Contributing translations](#contribute-translations)
+
+## Development Commands Cheat Sheet
+
+This repository contains multiple interconnected projects.
+You can build and start any project with Nx commands.
+
+| Task | Command | Notes | Details |
+| ----------------------------- | ------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Production** | `pnpm nx run PROJECT:prod` | Production server | |
+| **Develop** | `pnpm nx run PROJECT:dev` | Development server | |
+| **Generate** | `pnpm nx run PROJECT:generate` | Generate .gitignored files | |
+| **Generate Go Files** | `pnpm nx run @zitadel/api:generate-go` | Regenerate checked-in files | This is needed to generate files using [Stringer](https://pkg.go.dev/golang.org/x/tools/cmd/stringer), [Enumer](https://github.com/dmarkham/enumer) or [gomock](https://github.com/uber-go/mock) |
+| **Test - Unit** | `pnpm nx run PROJECT:test-unit` | Run unit tests | |
+| **Test - Integration** | `pnpm nx run PROJECT:test-integration` | Run integration tests | Learn mnore about how to [debug API integration tests](#run-api-integration-tests) |
+| **Test - Integration Stop** | `pnpm nx run PROJECT:test-integration-stop` | Stop integration containers | |
+| **Test - Functional UI** | `pnpm nx run @zitadel/functional-ui:test` | Run functional UI tests | Learn more about how to [develop the Console and opening the interactive Test Suite](#pass-console-quality-checks) |
+| **Test - Functional UI Stop** | `pnpm nx run @zitadel/functional-ui:stop` | Run functional UI containers | |
+| **Test** | `pnpm nx run PROJECT:test` | Run all tests | |
+| **Lint** | `pnpm nx run PROJECT:lint` | Check code style | |
+| **Lint Fix** | `pnpm nx run PROJECT:lint-fix` | Auto-fix style issues | |
+
+Replace `PROJECT` with one of the following:
+
+- `@zitadel/zitadel` (you can omit this root level project when using `pnpm nx run`, like `pnpm nx run db`)
+- `@zitadel/api`
+- `@zitadel/login`
+- `@zitadel/console`
+- `@zitadel/docs`
+- `@zitadel/client`
+- `@zitadel/proto`
+
+Instead of the project names, you can also use their directory names for `PROJECT`, like `pnpm nx run login:dev`.
+Alternatively, you can use the infix-notation, like `pnpm nx dev @zitadel/login` or `pnpm nx dev login`.
+To stream all logs instead of opening the interactive terminal, disable the TUI with `pnpm nx --tui false ...`.
+If a command is stuck because a process is already running, stop the Nx daemon and try again: `pnpm nx daemon --stop`.
+
## Introduction
Thank you for your interest in contributing! As you might know there is more than code to contribute. You can find all information needed to start contributing here.
@@ -31,9 +104,10 @@ Follow [@zitadel](https://twitter.com/zitadel) on twitter
[Contribute](#how-to-contribute)
-- [Contribute code](#contribute)
-- If you found a mistake on our [docs page](https://zitadel.com/docs) or something is missing please read [the docs section](contribute-docs)
-- [Translate](#contribute-internationalization) and improve texts
+- [Contribute API code](#contribute-to-api)
+- [Contribute frontend code](#contribute-to-frontend)
+- If you found a mistake on our [Docs page](https://zitadel.com/docs) or something is missing please read [the Docs section](#contribute-to-docs)
+- [Translate](#contribute-translations) and improve texts
## How to contribute
@@ -49,14 +123,14 @@ Go through the following checklist before you submit the final pull request:
The code consists of the following parts:
-| name | description | language | where to find | Development Guide |
-| --------------- | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | -------------------------------------------------- |
-| backend | Service that serves the grpc(-web) and RESTful API | [go](https://go.dev) | [API implementation](./internal/api/grpc) | [Contribute to Backend](contribute-backend) |
-| API definitions | Specifications of the API | [Protobuf](https://developers.google.com/protocol-buffers) | [./proto/zitadel](./proto/zitadel) | [Contribute to Backend](contribute-backend) |
-| console | Frontend the user interacts with after log in | [Angular](https://angular.io), [Typescript](https://www.typescriptlang.org) | [./console](./console) | [Contribute to Frontend](contribute-frontend) |
-| login | Modern authentication UI built with Next.js | [Next.js](https://nextjs.org), [React](https://reactjs.org), [TypeScript](https://www.typescriptlang.org) | [./login](./login) | [Contribute to Frontend](contribute-frontend) |
-| docs | Project documentation made with docusaurus | [Docusaurus](https://docusaurus.io/) | [./docs](./docs) | [Contribute to Frontend](contribute-frontend) |
-| translations | Internationalization files for default languages | [YAML](https://yaml.org/) | [./console](./console) and [./internal](./internal) | [Contribute Translations](contribute-translations) |
+| name | description | language | where to find | Development Guide |
+| ------------------ | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | --------------------------------------------------- |
+| API implementation | Service that serves the grpc(-web) and RESTful API | [go](https://go.dev) | [API implementation](./internal/api/grpc) | [Contribute to API](#contribute-to-api) |
+| API definitions | Specifications of the API | [Protobuf](https://developers.google.com/protocol-buffers) | [./proto/zitadel](./proto/zitadel) | [Contribute to API](#contribute-to-api) |
+| Console | Frontend the user interacts with after log in | [Angular](https://angular.io), [Typescript](https://www.typescriptlang.org) | [./console](./console) | [Contribute to Frontend](#contribute-to-frontend) |
+| Login | Modern authentication UI built with Next.js | [Next.js](https://nextjs.org), [React](https://reactjs.org), [TypeScript](https://www.typescriptlang.org) | [./apps/login](./apps/login) | [Contribute to Frontend](#contribute-to-frontend) |
+| Docs | Project documentation made with docusaurus | [Docusaurus](https://docusaurus.io/) | [./docs](./docs) | [Contribute to Frontend](#contribute-to-frontend) |
+| translations | Internationalization files for default languages | YAML | [./console](./console) and [./internal](./internal) | [Contribute Translations](#contribute-translations) |
Please follow the guides to validate and test the code before you contribute.
@@ -67,7 +141,7 @@ Please follow the guides to validate and test the code before you contribute.
`git checkout -b my-fix-branch main`
-3. Make your changes following the [guidelines](#contribute) in this guide. Make sure that all tests pass.
+3. Make your changes following the [guidelines](#how-to-contribute) in this guide. Make sure that all tests pass.
4. Commit the changes on the new branch
@@ -149,80 +223,91 @@ The API is designed to be used by different clients, such as web applications, m
Therefore, the API is designed to be easy to use, consistent, and reliable.
Please check out the dedicated [API guidelines](./API_DESIGN.md) page when contributing to the API.
-## Contribute Backend Code
+## Contribute to API
+To start developing, make sure you followed the [quick start](#quick-start) steps.
+### Develop the API
-### Backend Requirements
-
-By executing the commands from this section, you run everything you need to develop the Zitadel backend locally.
-
-> [!INFO]
-> Some [dev containers are available](dev-containers) for remote development with docker and pipeline debugging in isolated environments.
-> If you don't want to use one of the dev containers, you can develop the backend components directly on your local machine.
-> To do so, proceed with installing the necessary dependencies.
-
-Using [Docker Compose](https://docs.docker.com/compose/), you run a [PostgreSQL](https://www.postgresql.org/download/) container on your local machine.
-With [make](https://www.gnu.org/software/make/), you build a debuggable Zitadel binary and run it using [delve](https://github.com/go-delve/delve).
-Then, you test your changes via the console your binary is serving at http://localhost:8080 and by verifying the database.
-Once you are happy with your changes, you run end-to-end tests and tear everything down.
-
-Zitadel uses [golangci-lint v2](https://golangci-lint.run) for code quality checks. Please use [this configuration](.golangci.yaml) when running `golangci-lint`. We recommend setting golangci-lint as the linter in your IDE.
-
-The commands in this section are tested against the following software versions:
-
-- [Docker version 20.10.17](https://docs.docker.com/engine/install/)
-- [Go version 1.22](https://go.dev/doc/install)
-- [Delve 1.9.1](https://github.com/go-delve/delve/tree/v1.9.1/Documentation/installation)
-
-### Build and Run Zitadel
-
-Make some changes to the source code, then run the database locally.
+Optionally build the Console
```bash
-# You just need the db service to develop the backend against.
-docker compose --file ./e2e/docker-compose.yaml up --detach db
+pnpm nx run @zitadel/api:build-console
```
-Build the binary. This takes a few minutes, but you can speed up rebuilds.
+Optionally start the Login in another terminal
```bash
-make compile
+pnpm nx run @zitadel/login:prod
```
-> Note: With this command, several steps are executed.
-> For speeding up rebuilds, you can reexecute only specific steps you think are necessary based on your changes.
-> Generating gRPC stubs: `make core_api`
-> Running unit tests: `make core_unit_test`
-> Generating the console: `make console_build console_move`
-> Build the binary: `make compile`
+Run the local development database.
-You can now run and debug the binary in .artifacts/zitadel/zitadel using your favourite IDE, for example GoLand.
-You can test if Zitadel does what you expect by using the UI at http://localhost:8080/ui/console.
-Also, you can verify the data by running `psql "host=localhost dbname=zitadel sslmode=disable"` and running SQL queries.
+```bash
+pnpm nx db
+```
-### Run Local Unit Tests
+Start a debug session in your IDE.
+For example, in VSCode, you can use a `launch.json` configuration like this.
+
+```json
+ {
+ "name": "Debug Zitadel API",
+ "type": "go",
+ "request": "launch",
+ "mode": "debug",
+ "env": {
+ "ZITADEL_DATABASE_POSTGRES_HOST": "${env:DEVCONTAINER_DB_HOST}"
+ },
+ "program": "main.go",
+ "args": [
+ "start-from-init",
+ "--config",
+ "${workspaceFolder}/apps/api/prod-default.yaml",
+ "--steps",
+ "${workspaceFolder}/apps/api/prod-default.yaml",
+ "--masterkey",
+ "MasterkeyNeedsToHave32Characters"
+ ]
+ }
+```
+
+If you have built the Console and started the Login, visit http://localhost:8080/ui/console?login_hint=zitadel-admin@zitadel.localhost and enter `Password1!` to log in.
+
+Call the API using the generated [](./admin.pat) with [grpcurl](https://github.com/fullstorydev/grpcurl) or [grpcui](https://github.com/fullstorydev/grpcui), for example:
+
+```bash
+grpcurl -plaintext -H "Authorization: Bearer $(cat admin.pat)" localhost:8080 zitadel.user.v2.UserService.ListUsers
+```
+
+To connect to the database and explore Zitadel data, run `psql "host=${DEVCONTAINER_DB_HOST:-localhost} dbname=zitadel sslmode=disable"`.
+
+### Run API Unit Tests
To test the code without dependencies, run the unit tests:
```bash
-make core_unit_test
+pnpm nx run @zitadel/api:test-unit
```
-### Run Local Integration Tests
+### Run API Integration Tests
-Integration tests are run as gRPC clients against a running Zitadel server binary.
-The server binary is typically [build with coverage enabled](https://go.dev/doc/build-cover).
-It is also possible to run a Zitadel sever in a debugger and run the integrations tests like that. In order to run the server, a database is required.
-
-In order to prepare the local system, the following will bring up the database, builds a coverage binary, initializes the database and starts the sever.
+API tests are run as gRPC clients against a running Zitadel server binary.
+The server binary is [built with coverage enabled](https://go.dev/doc/build-cover).
```bash
-make core_integration_db_up core_integration_server_start
+pnpm nx run @zitadel/api:test-integration
```
-When this job is finished, you can run individual package integration tests through your IDE or command-line. The actual integration test clients reside in the `integration_test` subdirectory of the package they aim to test. Integration test files use the `integration` build tag, in order to be excluded from regular unit tests.
-Because of the server-client split, Go is usually unaware of changes in server code and tends to cache test results. Pass `-count 1` to disable test caching.
+To develop and run the test cases from within your IDE or by the command line, start only the API.
+The actual integration test clients reside in the `integration_test` subdirectory of the package they aim to test.
+Integration test files use the `integration` build tag, in order to be excluded from regular unit tests.
+Because of the server-client split, Go is usually unaware of changes in server code and tends to cache test results.
+Pass `-count 1` to disable test caching.
+
+```bash
+pnpm nx run @zitadel/api:test-integration-run-api
+```
Example command to run a single package integration test:
@@ -233,258 +318,270 @@ go test -count 1 -tags integration ./internal/api/grpc/management/integration_te
To run all available integration tests:
```bash
-make core_integration_test_packages
+go test -count 1 -tags integration -parallel 1 $(go list -tags integration ./... | grep -e \"integration_test\" -e \"events_testing\")
```
-When you change any Zitadel server code, be sure to rebuild and restart the server before the next test run.
+It is also possible to run the API in a debugger and run the integrations tests against it.
+In order to run the server, a database with correctly set up data is required.
+When starting the debugger, make sure the Zitadel binary starts with `start-from-init --config=./apps/api/test-integration-api.yaml --steps=./apps/api/test-integration-api.yaml --masterkey=MasterkeyNeedsToHave32Characters"`
+
+To cleanup after testing (deletes the ephemeral database!):
```bash
-make core_integration_server_stop core_integration_server_start
+pnpm nx run @zitadel/devcontainer:compose down db-api-integration cache-api-integration
```
-To cleanup after testing (deletes the database!):
+### Run Functional UI Tests
+
+To test the whole system, including the Console UI and the Login UI, run the Functional UI tests.
```bash
-make core_integration_server_stop core_integration_db_down
-```
-
-The test binary has the race detector enabled. `core_core_integration_server_stop` checks for any race logs reported by Go and will print them along with a `66` exit code when found. Note that the actual race condition may have happened anywhere during the server lifetime, including start, stop or serving gRPC requests during tests.
-
-### Run Local End-to-End Tests
-
-To test the whole system, including the console UI and the login UI, run the E2E tests.
-
-```bash
-# Build the production docker image
-export Zitadel_IMAGE=zitadel:local GOOS=linux
-make docker_image
-
-# If you made changes in the e2e directory, make sure you reformat the files
-pnpm turbo lint:fix --filter=e2e
+# If you made changes in the tests/functional-ui directory, make sure you reformat the files
+pnpm nx run @zitadel/functional-ui:lint-fix
# Run the tests
-docker compose --file ./e2e/docker-compose.yaml run --service-ports e2e
-```
-
-When you are happy with your changes, you can cleanup your environment.
-
-```bash
-# Stop and remove the docker containers for zitadel and the database
-docker compose --file ./e2e/docker-compose.yaml down
-```
-
-### Run Local End-to-End Tests Against Your Dev Server Console
-
-If you also make [changes to the console](#console), you can run the test suite against your locally built backend code and frontend server.
-
-```bash
-# Install dependencies (from repository root)
-pnpm install
-
-# Run the tests interactively
-pnpm run open:golangangular
-
-# Run the tests non-interactively
-pnpm run e2e:golangangular
-```
-
-When you are happy with your changes, you can cleanup your environment.
-
-```bash
-# Stop and remove the docker containers for zitadel and the database
-docker compose --file ./e2e/docker-compose.yaml down
+pnpm nx run @zitadel/functional-ui:test
```
## Contribute Frontend Code
-This repository uses **pnpm** as package manager and **Turbo** for build orchestration.
-All frontend packages are managed as a monorepo with shared dependencies and optimized builds:
+This repository uses **pnpm** as package manager and **Nx** for build orchestration.
-- [apps/login](contribute-login) (depends on packages/zitadel-client and packages/zitadel-proto)
-- apps/login/integration
-- apps/login/acceptance
-- [console](contribute-console) (depends on packages/zitadel-client)
-- packages/zitadel-client
-- packages/zitadel-proto
-- [docs](contribute-docs)
+### Project Overview
-### Frontend Development Requirements
+Choose your contribution area:
-The frontend components are run in a [Node](https://nodejs.org/en/about/) environment and are managed using the pnpm package manager and the Turborepo orchestrator.
+- **[Login App](#contribute-to-login)** (Next.js/React) - Modern authentication flows
+- **[Console](#contribute-to-console)** (Angular) - Admin dashboard and user management
+- **[Docs](#contribute-to-docs)** (Docusaurus) - Project documentation
+- **[Client Packages](#client-packages)** - Shared libraries for API communication
-> [!INFO]
-> Some [dev containers are available](dev-containers) for remote development with docker and pipeline debugging in isolated environments.
-> If you don't want to use one of the dev containers, you can develop the frontend components directly on your local machine.
-> To do so, proceed with installing the necessary dependencies.
+### Project Dependencies
-We use **pnpm** as package manager and **Turbo** for build orchestration. Use angular-eslint/Prettier for linting/formatting.
-VSCode users, check out [this ESLint extension](https://marketplace.visualstudio.com/items?itemName=dbaeumer.vscode-eslint) and [this Prettier extension](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) to fix lint and formatting issues during development.
-
-The commands in this section are tested against the following software versions:
-
-- [Docker version 20.10.17](https://docs.docker.com/engine/install/)
-- [Node version v20.x](https://nodejs.org/en/download/)
-- [pnpm version 9.x](https://pnpm.io/installation)
-
-To run tests with Cypress, ensure you have installed the required [Cypress runtime dependencies](https://docs.cypress.io/guides/continuous-integration/introduction#Dependencies)
-
-
- Note for WSL2 on Windows 10
- Following the suggestions here subsequently here may need to XLaunch and configure your DISPLAY variable. Use at your own risk.
-
-1. Install `VcXsrv Windows X Server`
-2. Set the target of your shortcut to `"C:\Program Files\VcXsrv\xlaunch.exe" -ac`
-3. In WSL2 run `export DISPLAY=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}'):0` to set your DISPLAY variable
-4. When starting XLaunch, make sure to disable access control
-
-
-### Contribute to Login
-
-The Login UI is a Next.js application that provides the user interface for authentication flows.
-It's located in the `apps/login` directory and uses pnpm and Turbo for development.
-
-To start developing the login, make sure your system has the [required system dependencies](frontend-dev-requirements) installed.
-
-#### Development Setup
-
-```bash
-# Start from the root of the repository
-# Start the database and Zitadel backend
-docker compose --file ./apps/login/acceptance/docker-compose.yaml up --detach zitadel
-
-# Install dependencies
-pnpm install
-
-# Option 1: Run login development server with Turbo (recommended)
-pnpm turbo dev --filter=@zitadel/login
-
-# Option 2: Build and serve login (production build)
-pnpm turbo build --filter=@zitadel/login
-cd ./login && pnpm start
+```
+apps/login → packages/zitadel-client → packages/zitadel-proto
+console → packages/zitadel-client → packages/zitadel-proto
+docs → (independent)
```
-The login UI is available at http://localhost:3000.
+**Nx handles this automatically** - when you change `zitadel-proto`, Nx rebuilds dependent projects.
+
+### Contribute to Login
+
+The Login UI is a Next.js application that provides the user interface for authentication flows.
+It is MIT-licensed, so you are free to change and deploy it as you like.
+It's located in the `apps/login` directory and uses pnpm and Nx for development.
+Get familiar with the [Login ui docs](https://zitadel.com/docs/guides/integrate/login-ui).
+
+To start developing, make sure you followed the [quick start](#quick-start) steps.
+
+#### Develop the Login against a local API
+
+Run the local development database.
+
+```bash
+pnpm nx db
+```
+
+In another terminal, start the API
+
+```bash
+pnpm nx run @zitadel/api:prod
+```
+
+In another terminal, start the Login development server
+
+```bash
+pnpm nx run @zitadel/login:dev
+```
+
+Visit http://localhost:8080/ui/console?login_hint=zitadel-admin@zitadel.localhost and enter `Password1!` to log in.
+
+Make some changes to the source code and see how the browser is automatically updated.
+
+#### Develop against a Cloud instance
+
+If you don't want to build and run a local API, you can just run the Login development server and point it to a cloud instance.
+
+1. Create a personal access token and point your instance to your local Login, [as described in the Docs](https://zitadel.com/docs/self-hosting/manage/login-client).
+2. Save the following file to `apps/login/.env.dev.local`
+
+```env
+ZITADEL_API_URL=https://[your-cloud-instance-domain]
+ZITADEL_SERVICE_USER_TOKEN=[personal access token for an IAM Login Client]
+```
+
+3. Start the development server.
+
+```bash
+pnpm nx run @zitadel/login:dev
+```
+
+Visit http://localhost:8080/ui/console?login_hint=zitadel-admin@zitadel.localhost and enter `Password1!` to log in.
#### Login Architecture
-The login application consists of multiple packages:
+The Login application consists of multiple packages:
- `@zitadel/login` - Main Next.js application
- `@zitadel/client` - TypeScript client library for Zitadel APIs
- `@zitadel/proto` - Protocol buffer definitions and generated code
-The build process uses Turbo to orchestrate dependencies:
+The build process uses Nx and pnpm to orchestrate dependencies:
-1. Proto generation (`@zitadel/proto#generate`)
-2. Client library build (`@zitadel/client#build`)
-3. Login application build (`@zitadel/login#build`)
+#### Pass Login Quality Checks
-#### Pass Quality Checks
-
-Reproduce the pipelines linting and testing for the login.
+Reproduce the pipeline quality checks for the code you changed.
```bash
-pnpm turbo quality --filter=./apps/login/* --filter=./packages/*
+# Run Login-related linting builds and unit tests
+pnpm nx run-many --projects @zitadel/login @zitadel/client @zitadel/proto --targets lint build test
```
-Fix the [quality checks](troubleshoot-frontend), add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
+Fix the quality checks, add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
-### Contribute to Console
+#### Deploy
-To start developing the console, make sure your system has the [required system dependencies](frontend-dev-requirements) installed.
-Then, you need to decide which Zitadel instance you would like to target.
-- The easiest starting point is to [configure your environment](console-dev-existing-zitadel) to use a [Zitadel cloud](https://zitadel.com) instance.
-- Alternatively, you can [start a local Zitadel instance from scratch and develop against it](console-dev-local-zitadel).
+- [](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fzitadel%2Fzitadel&env=ZITADEL_API_URL,ZITADEL_SERVICE_USER_ID,ZITADEL_SERVICE_USER_TOKEN&root-directory=apps/login&envDescription=Setup%20a%20service%20account%20with%20IAM_LOGIN_CLIENT%20membership%20on%20your%20instance%20and%20provide%20its%20id%20and%20personal%20access%20token.&project-name=zitadel-login&repository-name=zitadel-login)
+- Build and deploy with Docker: `pnpm nx run @zitadel/login:build && docker build -t my-zitadel-login apps/login`
+- Build and deploy with NodeJS: `pnpm nx run @zitadel/login:prod`
-#### Develop against an already running Zitadel instance
+### Contribute to Console
-By default, `pnpm dev --filter=console` targets a Zitadel API running at http://localhost:8080.
-To change this, export the link to your environment.json in your environment variables.
+To learn more about the Console, go to the Consoles [README.md](./console/README.md).
+
+To start developing, make sure you followed the [quick start](#quick-start) steps.
+
+#### Develop the Console against a local API
+
+Run the local development database.
```bash
-export ENVIRONMENT_JSON_URL=https://my-cloud-instance-abcdef.us1.zitadel.cloud/ui/console/assets/environment.json
+pnpm nx db
```
-Proceed [with configuring your console redirect URIs](console-redirect).
-
-#### Develop against a local Zitadel instance from scratch
-
-By executing the commands from this section, you run everything you need to develop the console locally.
-Using [Docker Compose](https://docs.docker.com/compose/), you run [PostgreSQL](https://www.postgresql.org/download/) and the [latest release of Zitadel](https://github.com/zitadel/zitadel/releases/latest) on your local machine.
-You use the Zitadel container as backend for your console.
-
-Run the database and the latest backend locally.
+In another terminal, start the API
```bash
-# Start from the root of the repository
-# You just need the db and the zitadel services to develop the console against.
-docker compose --file ./e2e/docker-compose.yaml up --detach zitadel
+pnpm nx run @zitadel/api:prod
```
-When Zitadel accepts traffic, navigate to http://localhost:8080/ui/console/projects?login_hint=zitadel-admin@zitadel.localhost and log in with _Password1!_.
-
-Proceed [with configuring your console redirect URIs](console-redirect).
-
-#### Configure Console redirect URI
-
-To allow console access via http://localhost:4200, you have to configure the Zitadel backend.
-
-1. Navigate to /ui/console/projects in your target Zitadel instance.
-3. Select the _Zitadel_ project.
-4. Select the _Console_ application.
-5. Select _Redirect Settings_
-6. Add _http://localhost:4200/auth/callback_ to the _Redirect URIs_
-7. Add _http://localhost:4200/signedout_ to the _Post Logout URIs_
-8. Select the _Save_ button
-
-#### Develop
-
-Run the local console development server.
+In another terminal, start the Login
```bash
-# Install dependencies (from repository root)
-pnpm install
-
-# Option 1: Run console development server with live reloading and dependency rebuilds
-pnpm turbo dev --filter=console
-
-# Option 2: Build and serve console (production build)
-pnpm turbo build --filter=console
-pnpm turbo serve --filter=console
+pnpm nx run @zitadel/login:prod
```
-Navigate to http://localhost:4200/.
+Allow the API [to redirect to your dev server](#configure-console-dev-server-redirects).
+
+In another terminal, start the Console development server
+
+```bash
+pnpm nx run @zitadel/console:dev
+```
+
+Visit http://localhost:4200/?login_hint=zitadel-admin@zitadel.localhost and enter `Password1!` to log in.
+
Make some changes to the source code and see how the browser is automatically updated.
-#### Pass Quality Checks
+#### Develop against a Cloud instance
-Reproduce the pipelines linting and testing for the console.
+If you don't want to build and run a local API, you can just run the console development server and point it to a cloud instance.
-```bash
-pnpm turbo quality --filter=console --filter=e2e
+Save the following file to console/.env.local
+
+```env
+ENVIRONMENT_JSON_URL=https://[your-cloud-instance-domain]/ui/console/assets/environment.json
```
-Fix the [quality checks](troubleshoot-frontend), add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
+Start the development server.
-### Contribute to Docs
+```bash
+pnpm nx run @zitadel/console:dev
+```
-Project documentation is made with Docusaurus and is located under [./docs](./docs). The documentation uses **pnpm** and **Turbo** for development and build processes.
+Allow the API [to redirect to your dev server](#configure-console-dev-server-redirects).
+
+Visit http://localhost:4200/?login_hint=zitadel-admin@zitadel.localhost and enter `Password1!` to log in.
+
+#### Configure Console Dev Server Redirects
+
+To allow Console access via http://localhost:4200, you have to configure the Zitadel API.
+
+1. Navigate to http://localhost:8080/ui/console/projects.
+2. Select the _ZITADEL_ project.
+3. Select the _Console_ application.
+4. Select _Redirect Settings_
+5. Add _http://localhost:4200/auth/callback_ to the _Redirect URIs_
+6. Add _http://localhost:4200/signedout_ to the _Post Logout URIs_
+7. Select the _Save_ button
+
+#### Pass Console Quality Checks
+
+Run the quality checks for the code you changed.
+
+```bash
+# Run console-related linting builds and unit tests
+pnpm nx run-many --projects @zitadel/console @zitadel/client @zitadel/proto @zitadel/functional-ui --targets lint build test
+```
+
+Run functional UI tests against a locally built API and a dev server Console.
+
+Allow the API [to redirect to your dev server](#configure-console-dev-server-redirects).
+Alternatively, create the file `tests/functional-ui/.env.open.local` with the following content:
+
+```conf
+CYPRESS_BASE_URL=http://localhost:8080/ui/console
+```
+
+```bash
+# Run the API and the Console dev server
+# Beware this doesn't work from within a dev container.
+pnpm nx run @zitadel/functional-ui:open
+```
+
+Or run all tests to completion.
+
+```bash
+# Run the tests
+pnpm nx run @zitadel/functional-ui:test
+```
+
+Fix the quality checks, add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
+
+### Contribute to Client Packages
+
+To start developing, make sure you followed the [quick start](#quick-start) steps.
+
+**`@zitadel/proto`**: Protocol buffer definitions and generated TypeScript/JavaScript clients.
+
+```bash
+pnpm nx run @zitadel/proto:generate # Regenerate after proto changes
+```
+
+**`@zitadel/client`**: High-level TypeScript client library with utilities for API interaction.
+
+```bash
+pnpm nx run @zitadel/client:build # Build after changes
+```
+
+### Contribute to Docs
+
+Project documentation is made with Docusaurus and is located under [./docs](./docs). The documentation uses **pnpm** and **Nx** for development and build processes.
+
+To start developing, make sure you followed the [quick start](#quick-start) steps.
#### Local Development
```bash
-# Install dependencies (from repository root)
-pnpm install
+# Start development server (recommended)
+pnpm nx run @zitadel/docs:dev
-# Option 1: Run docs development server with Turbo (recommended)
-pnpm turbo dev --filter=zitadel-docs
-
-# Option 2: Build and serve docs (production build)
-pnpm turbo build --filter=zitadel-docs
-cd ./docs && pnpm serve
+# Or start production server
+pnpm nx run @zitadel/docs:prod
```
-The docs build process automatically:
+The Docs build process automatically:
1. Downloads required protoc plugins
2. Generates gRPC documentation from proto files
@@ -519,87 +616,15 @@ Scope can be left empty (omit the brackets) or refer to the top navigation secti
#### Pass Quality Checks
-Reproduce the pipelines linting checks for the docs.
+Verify the Docs build correctly.
```bash
-pnpm turbo quality --filter=docs
+pnpm nx run @zitadel/docs:build
```
-Fix the [quality checks](troubleshoot-frontend), add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
+Fix the quality checks, add new checks that cover your changes and mark your pull request as ready for review when the pipeline checks pass.
-### Troubleshoot Frontend Quality Checks
-
-To debug and fix failing tasks, execute them individually using the `--filter` flag.
-
-We recommend to use [one of the dev containers](dev-containers) to reproduce pipeline issues.
-
-```bash
-# to reproduce linting error in the console:
-pnpm lint --filter=console
-# To fix them:
-pnpm lint:fix --filter=console
-```
-
-More tasks that are runnable on-demand.
-Some tasks have variants like `pnpm test:e2e:angulargolang`,
-others support arguments and flags like `pnpm test:integration run --spec apps/login/integration/integration/login.cy.ts`.
-For the turbo commands, check your options with `pnpm turbo --help`
-
-| Command | Description | Example |
-| ------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pnpm turbo run generate` | Generate stubs from Proto files | Generate API docs: `pnpm turbo run generate --filter zitadel-docs` |
-| `pnpm turbo build` | Build runnable JavaScript code | Regenerate the proto stubs and build the @zitadel/client package: `pnpm turbo build --filter @zitadel/client` |
-| `pnpm turbo quality` | Reproduce the pipeline quality checks | Run login-related quality checks `pnpm turbo quality --filter './apps/login/*' --filter './packages/*'` |
-| `pnpm turbo lint` | Check linting issues | Check login-related linting issues for differences with main `pnpm turbo lint --filter=[main...HEAD] --filter .'/apps/login/**/*' --filter './packages/*'` |
-| `pnpm turbo lint:fix` | Fix linting issues | Fix console-relevant linting issues `pnpm turbo lint:fix --filter console --filter './packages/*' --filter zitadel-e2e` |
-| `pnpm turbo test:unit` | Run unit tests. Rerun on file changes | Run unit tests in all packages in and watch for file changes `pnpm turbo watch test:unit` |
-| `pnpm turbo test:e2e` | Run the Cypress CLI for console e2e tests | Test interactively against the console in a local dev server and Zitadel in a container: `pnpm turbo test:e2e:angular open` |
-| `pnpm turbo down` | Remove containers and volumes | Shut down containers from the integration test setup `pnpm turbo down` |
-| `pnpm turbo clean` | Remove downloaded dependencies and other generated files | Remove generated docs `pnpm turbo clean --filter zitadel-docs` |
-
-## >Developing Zitadel with Dev Containers
-
-You can use dev containers if you'd like to make sure you have the same development environment like the corresponding GitHub PR checks use.
-The following dev containers are available:
-
-- **.devcontainer/base/devcontainer.json**: Contains everything you need to run whatever you want.
-- **.devcontainer/turbo-lint-unit/devcontainer.json**: Runs a dev container that executes frontent linting and unit tests and then exits. This is useful to reproduce the corresponding GitHub PR check.
-- **.devcontainer/turbo-lint-unit-debug/devcontainer.json**: Runs a dev container that executes frontent linting and unit tests in watch mode. You can fix the errors right away and have immediate feedback.
-- **.devcontainer/login-integration/devcontainer.json**: Runs a dev container that executes login integration tests and then exits. This is useful to reproduce the corresponding GitHub PR check.
-- **.devcontainer/login-integration-debug/devcontainer.json**: Runs a dev container that spins up the login in a hot-reloading dev server and executes login integration tests interactively. You can fix the errors right away and have immediate feedback.
-
-You can also run the GitHub PR checks locally in dev containers without having to connect to a dev container.
-
-
-The following pnpm commands use the [devcontainer CLI](https://github.com/devcontainers/cli/) and exit when the checks are done.
-The minimal system requirements are having Docker and the devcontainers CLI installed.
-If you don't have the node_modules installed already, you need to install the devcontainers CLI manually. Run `npm i -g @devcontainers/cli@0.80.0`. Alternatively, the [official Microsoft VS Code extension for Dev Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) offers a command `Dev Containers: Install devcontainer CLI`
-
-
-```bash
-npm run devcontainer:lint-unit
-npm run devcontainer:integration:login
-```
-
-If you don't have NPM installed, copy and execute the scripts from the package.json directly.
-
-To connect to a dev container to have full IDE support, follow the instructions provided by your code editor/IDE to initiate the dev container.
-This typically involves opening the "Command Palette" or similar functionality and searching for commands related to "Dev Containers" or "Remote Containers".
-The quick start guide for VS Code can found [here](https://code.visualstudio.com/docs/devcontainers/containers#_quick-start-open-an-existing-folder-in-a-container)
-
-For example, to build and run the Zitadel binary in a dev container, connect your IDE to the dev container described in .devcontainer/base/devcontainer.json.
-Run the following commands inside the container to start Zitadel.
-
-```bash
-make compile && ./zitadel start-from-init --masterkey MasterkeyNeedsToHave32Characters --tlsMode disabled
-```
-
-Zitadel serves traffic as soon as you can see the following log line:
-
-`INFO[0001] server is listening on [::]:8080`
-
-
-## Contribute Translations
+## Contribute Translations
Zitadel loads translations from four files:
@@ -684,10 +709,10 @@ There are a few general labels that don't belong to a specific category.
The category shows which part of Zitadel is affected.
- **category: backend**: The backend includes the APIs, event store, command and query side. This is developed in golang.
-- **category: ci**: ci is all about continues integration and pipelines.
+- **category: ci**: ci is all about continuous integration and pipelines.
- **category: design**: All about the ux/ui of Zitadel
- **category: docs**: Adjustments or new documentations, this can be found in the docs folder.
-- **category: frontend**: The frontend concerns on the one hand the Zitadel management console (Angular) and on the other hand the login (gohtml)
+- **category: frontend**: The frontend concerns on the one hand the Zitadel management Console (Angular) and on the other hand the Login (gohtml)
- **category: infra**: Infrastructure does include many different parts. E.g Terraform-provider, docker, metrics, etc.
- **category: translation**: Everything concerning translations or new languages
diff --git a/LICENSING.md b/LICENSING.md
index ca4717afa5c..875b6cbea59 100644
--- a/LICENSING.md
+++ b/LICENSING.md
@@ -22,8 +22,9 @@ proto/
The following files and directories, including their subdirectories, are licensed under the [MIT License](https://opensource.org/license/mit/):
```
-login/
-clients/
+apps/login/
+packages/zitadel-client/
+packages/zitadel-proto/
```
## Community Contributions
diff --git a/Makefile b/Makefile
deleted file mode 100644
index dfc3ff74abb..00000000000
--- a/Makefile
+++ /dev/null
@@ -1,196 +0,0 @@
-go_bin := "$$(go env GOPATH)/bin"
-gen_authopt_path := "$(go_bin)/protoc-gen-authoption"
-gen_zitadel_path := "$(go_bin)/protoc-gen-zitadel"
-
-now := $(shell date '+%Y-%m-%dT%T%z' | sed -E 's/.([0-9]{2})([0-9]{2})$$/-\1:\2/')
-VERSION ?= development-$(now)
-COMMIT_SHA ?= $(shell git rev-parse HEAD)
-ZITADEL_IMAGE ?= zitadel:local
-
-GOCOVERDIR = tmp/coverage
-ZITADEL_MASTERKEY ?= MasterkeyNeedsToHave32Characters
-
-export GOCOVERDIR ZITADEL_MASTERKEY
-
-LOGIN_REMOTE_NAME := login
-LOGIN_REMOTE_URL ?= https://github.com/zitadel/typescript.git
-LOGIN_REMOTE_BRANCH ?= main
-
-.PHONY: compile
-compile: core_build console_build compile_pipeline
-
-.PHONY: docker_image
-docker_image:
- @if [ ! -f ./zitadel ]; then \
- echo "Compiling zitadel binary"; \
- $(MAKE) compile; \
- else \
- echo "Reusing precompiled zitadel binary"; \
- fi
- DOCKER_BUILDKIT=1 docker build -f build/zitadel/Dockerfile -t $(ZITADEL_IMAGE) .
-
-.PHONY: compile_pipeline
-compile_pipeline: console_move
- CGO_ENABLED=0 go build -o zitadel -v -ldflags="-s -w -X 'github.com/zitadel/zitadel/cmd/build.commit=$(COMMIT_SHA)' -X 'github.com/zitadel/zitadel/cmd/build.date=$(now)' -X 'github.com/zitadel/zitadel/cmd/build.version=$(VERSION)' "
- chmod +x zitadel
-
-.PHONY: core_dependencies
-core_dependencies:
- go mod download
-
-.PHONY: core_static
-core_static:
- go install github.com/rakyll/statik@v0.1.7
- go generate internal/api/ui/login/static/resources/generate.go
- go generate internal/api/ui/login/statik/generate.go
- go generate internal/notification/statik/generate.go
- go generate internal/statik/generate.go
-
-.PHONY: core_generate_all
-core_generate_all:
- go install github.com/dmarkham/enumer@v1.5.11 # https://pkg.go.dev/github.com/dmarkham/enumer?tab=versions
- go install github.com/rakyll/statik@v0.1.7 # https://pkg.go.dev/github.com/rakyll/statik?tab=versions
- go install go.uber.org/mock/mockgen@v0.4.0 # https://pkg.go.dev/go.uber.org/mock/mockgen?tab=versions
- go install golang.org/x/tools/cmd/stringer@v0.36.0 # https://pkg.go.dev/golang.org/x/tools/cmd/stringer?tab=versions
- go generate ./...
-
-.PHONY: core_assets
-core_assets:
- mkdir -p docs/apis/assets
- go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md
-
-.PHONY: core_api_generator
-core_api_generator:
-ifeq (,$(wildcard $(gen_authopt_path)))
- go install internal/protoc/protoc-gen-authoption/main.go \
- && mv $$(go env GOPATH)/bin/main $(gen_authopt_path)
-endif
-ifeq (,$(wildcard $(gen_zitadel_path)))
- go install internal/protoc/protoc-gen-zitadel/main.go \
- && mv $$(go env GOPATH)/bin/main $(gen_zitadel_path)
-endif
-
-.PHONY: core_grpc_dependencies
-core_grpc_dependencies:
- go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.35.1 # https://pkg.go.dev/google.golang.org/protobuf/cmd/protoc-gen-go?tab=versions
- go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1 # https://pkg.go.dev/google.golang.org/grpc/cmd/protoc-gen-go-grpc?tab=versions
- go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.22.0 # https://pkg.go.dev/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway?tab=versions
- go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@v2.22.0 # https://pkg.go.dev/github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2?tab=versions
- go install github.com/envoyproxy/protoc-gen-validate@v1.1.0 # https://pkg.go.dev/github.com/envoyproxy/protoc-gen-validate?tab=versions
- go install github.com/bufbuild/buf/cmd/buf@v1.45.0 # https://pkg.go.dev/github.com/bufbuild/buf/cmd/buf?tab=versions
- go install connectrpc.com/connect/cmd/protoc-gen-connect-go@v1.18.1 # https://pkg.go.dev/connectrpc.com/connect/cmd/protoc-gen-connect-go?tab=versions
-
-.PHONY: core_api
-core_api: core_api_generator core_grpc_dependencies
- buf generate
- mkdir -p pkg/grpc
- cp -r .artifacts/grpc/github.com/zitadel/zitadel/pkg/grpc/** pkg/grpc/
- mkdir -p openapi/v2/zitadel
- cp -r .artifacts/grpc/zitadel/ openapi/v2/zitadel
-
-.PHONY: core_build
-core_build: core_dependencies core_api core_static core_assets
-
-.PHONY: console_move
-console_move:
- cp -r console/dist/console/* internal/api/ui/console/static
-
-.PHONY: console_dependencies
-console_dependencies:
- npx pnpm install --frozen-lockfile --filter=console...
-
-.PHONY: console_build
-console_build: console_dependencies
- npx pnpm turbo build --filter=./console
-
-.PHONY: clean
-clean:
- $(RM) -r .artifacts/grpc
- $(RM) $(gen_authopt_path)
- $(RM) $(gen_zitadel_path)
- $(RM) -r tmp/
-
-.PHONY: core_unit_test
-core_unit_test:
- go test -race -coverprofile=profile.cov -coverpkg=./internal/... ./...
-
-.PHONY: core_integration_db_up
-core_integration_db_up:
- docker compose -f internal/integration/config/docker-compose.yaml up --pull always --wait cache postgres
-
-.PHONY: core_integration_db_down
-core_integration_db_down:
- docker compose -f internal/integration/config/docker-compose.yaml down -v
-
-.PHONY: core_integration_setup
-core_integration_setup:
- go build -cover -race -tags integration -o zitadel.test main.go
- mkdir -p $${GOCOVERDIR}
- GORACE="halt_on_error=1" ./zitadel.test init --config internal/integration/config/zitadel.yaml --config internal/integration/config/postgres.yaml
- GORACE="halt_on_error=1" ./zitadel.test setup --masterkeyFromEnv --init-projections --config internal/integration/config/zitadel.yaml --config internal/integration/config/postgres.yaml --steps internal/integration/config/steps.yaml
-
-.PHONY: core_integration_server_start
-core_integration_server_start: core_integration_setup
- GORACE="log_path=tmp/race.log" \
- ./zitadel.test start --masterkeyFromEnv --config internal/integration/config/zitadel.yaml --config internal/integration/config/postgres.yaml \
- > tmp/zitadel.log 2>&1 \
- & printf $$! > tmp/zitadel.pid
-
-.PHONY: core_integration_test_packages
-core_integration_test_packages:
- go test -race -count 1 -tags integration -timeout 60m -parallel 1 $$(go list -tags integration ./... | grep -e "integration_test" -e "events_testing")
-
-.PHONY: core_integration_server_stop
-core_integration_server_stop:
- pid=$$(cat tmp/zitadel.pid); \
- $(RM) tmp/zitadel.pid; \
- kill $$pid; \
- if [ -s tmp/race.log.$$pid ]; then \
- cat tmp/race.log.$$pid; \
- exit 66; \
- fi
-
-.PHONY: core_integration_reports
-core_integration_reports:
- go tool covdata textfmt -i=tmp/coverage -pkg=github.com/zitadel/zitadel/internal/...,github.com/zitadel/zitadel/cmd/...,github.com/zitadel/zitadel/backend/... -o profile.cov
-
-.PHONY: core_integration_test
-core_integration_test: core_integration_server_start core_integration_test_packages core_integration_server_stop core_integration_reports
-
-.PHONY: console_lint
-console_lint:
- npx pnpm turbo lint --filter=./console
-
-.PHONY: core_lint
-core_lint:
- golangci-lint run \
- --timeout 10m \
- --config ./.golangci.yaml \
- --out-format=github-actions \
- --concurrency=$$(getconf _NPROCESSORS_ONLN)
-
-.PHONY: login_pull
-login_pull: login_ensure_remote
- @echo "Pulling changes from the 'apps/login' subtree on remote $(LOGIN_REMOTE_NAME) branch $(LOGIN_REMOTE_BRANCH)"
- git fetch $(LOGIN_REMOTE_NAME) $(LOGIN_REMOTE_BRANCH)
- git merge -s ours --allow-unrelated-histories $(LOGIN_REMOTE_NAME)/$(LOGIN_REMOTE_BRANCH) -m "Synthetic merge to align histories"
- git push
-
-.PHONY: login_push
-login_push: login_ensure_remote
- @echo "Pushing changes to the 'apps/login' subtree on remote $(LOGIN_REMOTE_NAME) branch $(LOGIN_REMOTE_BRANCH)"
- git subtree split --prefix=apps/login -b login-sync-tmp
- git checkout login-sync-tmp
- git fetch $(LOGIN_REMOTE_NAME) main
- git merge -s ours --allow-unrelated-histories $(LOGIN_REMOTE_NAME)/main -m "Synthetic merge to align histories"
- git push $(LOGIN_REMOTE_NAME) login-sync-tmp:$(LOGIN_REMOTE_BRANCH)
- git checkout -
- git branch -D login-sync-tmp
-
-login_ensure_remote:
- @if ! git remote get-url $(LOGIN_REMOTE_NAME) > /dev/null 2>&1; then \
- echo "Adding remote $(LOGIN_REMOTE_NAME)"; \
- git remote add $(LOGIN_REMOTE_NAME) $(LOGIN_REMOTE_URL); \
- else \
- echo "Remote $(LOGIN_REMOTE_NAME) already exists."; \
- fi
diff --git a/README.md b/README.md
index 2d933176c24..6bc74d8c08b 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,8 @@
+
+
@@ -117,14 +119,14 @@ Authentication
- Username / Password
- Multifactor authentication with OTP, U2F, Email OTP, SMS OTP
- [LDAP](https://zitadel.com/docs/guides/integrate/identity-providers/ldap)
-- [External enterprise identity providers and social logins](https://zitadel.com/docs/guides/integrate/identity-providers/introduction)
+- [External enterprise identity providers and social logins](https://zitadel.com/docs/guides/integrate/identity-providers/introduction)
- [Device authorization](https://zitadel.com/docs/guides/solution-scenarios/device-authorization)
- [OpenID Connect certified](https://openid.net/certification/#OPs) => [OIDC Endpoints](https://zitadel.com/docs/apis/openidoauth/endpoints)
- [SAML 2.0](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html) => [SAML Endpoints](https://zitadel.com/docs/apis/saml/endpoints)
- [Custom sessions](https://zitadel.com/docs/guides/integrate/login-ui/username-password) if you need to go beyond OIDC or SAML
- [Machine-to-machine](https://zitadel.com/docs/guides/integrate/service-users/authenticate-service-users) with JWT profile, Personal Access Tokens (PAT), and Client Credentials
- [Token exchange and impersonation](https://zitadel.com/docs/guides/integrate/token-exchange)
-- [Beta: Hosted Login V2](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta) our new login version 2.0
+- [Beta: Hosted Login V2](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta) our new Login version 2.0
Multi-Tenancy
@@ -142,7 +144,7 @@ Integration
- [Examples and SDKs](https://zitadel.com/docs/sdk-examples/introduction)
- [Audit Log and SOC/SIEM](https://zitadel.com/docs/guides/integrate/external-audit-log)
- [User registration and onboarding](https://zitadel.com/docs/guides/integrate/onboarding)
-- [Hosted and custom login user interface](https://zitadel.com/docs/guides/integrate/login/login-users)
+- [Hosted and custom Login user interface](https://zitadel.com/docs/guides/integrate/login/login-users)
Self-Service
- [Self-registration](https://zitadel.com/docs/concepts/features/selfservice#registration) including verification
@@ -179,7 +181,7 @@ Secure a React Application using OpenID Connect Authorization Code with PKCE
### Login with Passkeys
-Use our login widget to allow easy and secure access to your applications and enjoy all the benefits of Passkeys (FIDO 2 / WebAuthN):
+Use our Login widget to allow easy and secure access to your applications and enjoy all the benefits of Passkeys (FIDO 2 / WebAuthN):
[](https://www.youtube.com/watch?v=cZjHQYurSjw&list=PLTDa7jTlOyRLdABgD2zL0LGM7rx5GZ1IR&index=2 "Passkeys")
@@ -191,7 +193,7 @@ Use [Console](https://zitadel.com/docs/guides/manage/console/overview) or our [A
### Login V2
-Check out our new Login V2 version in our [typescript repository](https://github.com/zitadel/typescript) or in our [documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)
+Check out our new Login V2 version in our [documentation](https://zitadel.com/docs/guides/integrate/login/hosted-login#hosted-login-version-2-beta)

## Security
diff --git a/apps/api/.env b/apps/api/.env
new file mode 100644
index 00000000000..e2719c55198
--- /dev/null
+++ b/apps/api/.env
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5432
+ZITADEL_PORT=8080
+ZITADEL_EXTERNALPORT=8080
+API_AWAIT_DB_SERVICE=db
\ No newline at end of file
diff --git a/apps/api/.env.prod.test-functional-ui b/apps/api/.env.prod.test-functional-ui
new file mode 100644
index 00000000000..02acf24582c
--- /dev/null
+++ b/apps/api/.env.prod.test-functional-ui
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_FUNCTIONAL_UI_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5434
+ZITADEL_PORT=8083
+ZITADEL_EXTERNALPORT=8083
+API_AWAIT_DB_SERVICE=db-functional-ui
\ No newline at end of file
diff --git a/apps/api/.env.test-integration b/apps/api/.env.test-integration
new file mode 100644
index 00000000000..d861c8eacdb
--- /dev/null
+++ b/apps/api/.env.test-integration
@@ -0,0 +1,3 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_INTEGRATION_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5433
+ZITADEL_API_URL=http://localhost:8082
diff --git a/apps/api/.env.test-integration-run-api b/apps/api/.env.test-integration-run-api
new file mode 100644
index 00000000000..cebcc8e9e5e
--- /dev/null
+++ b/apps/api/.env.test-integration-run-api
@@ -0,0 +1,5 @@
+ZITADEL_DATABASE_POSTGRES_HOST=${DEVCONTAINER_DB_API_INTEGRATION_HOST:-localhost}
+ZITADEL_DATABASE_POSTGRES_PORT=5433
+ZITADEL_PORT=8082
+ZITADEL_EXTERNALPORT=8082
+API_AWAIT_DB_SERVICE=db-api-integration
diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile
new file mode 100644
index 00000000000..92964b83fb0
--- /dev/null
+++ b/apps/api/Dockerfile
@@ -0,0 +1,34 @@
+# Builder stage: Sets up the environment, installs dependencies, copies the Zitadel binary, and configures permissions for the application.
+# This stage produces a runnable image that can be used for debugging.
+FROM debian:latest AS builder
+ARG TARGETPLATFORM
+
+RUN apt-get update && apt-get install ca-certificates -y
+
+COPY apps/api/entrypoint.sh /app/entrypoint.sh
+COPY ./.artifacts/bin/${TARGETPLATFORM}/zitadel /app/zitadel
+
+RUN useradd -s "" --home / zitadel && \
+ chown zitadel /app/zitadel && \
+ chmod +x /app/zitadel && \
+ chown zitadel /app/entrypoint.sh && \
+ chmod +x /app/entrypoint.sh
+
+WORKDIR /app
+ENV PATH="/app:${PATH}"
+
+USER zitadel
+ENTRYPOINT ["/app/entrypoint.sh"]
+
+# Final stage: Creates a minimal container image with just the Zitadel binary and necessary files
+FROM scratch AS final
+
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/ssl/certs /etc/ssl/certs
+COPY --from=builder /app/zitadel /app/zitadel
+
+HEALTHCHECK NONE
+EXPOSE 8080
+
+USER zitadel
+ENTRYPOINT ["/app/zitadel"]
diff --git a/build/zitadel/entrypoint.sh b/apps/api/entrypoint.sh
similarity index 100%
rename from build/zitadel/entrypoint.sh
rename to apps/api/entrypoint.sh
diff --git a/apps/api/prod-default.yaml b/apps/api/prod-default.yaml
new file mode 100644
index 00000000000..7a332fbeb25
--- /dev/null
+++ b/apps/api/prod-default.yaml
@@ -0,0 +1,25 @@
+ExternalSecure: false
+TLS.Enabled: false
+Database.Postgres:
+ Database: zitadel
+ MaxOpenConns: 20
+ MaxIdleConns: 20
+ ConnMaxLifetime: 60m
+ ConnMaxIdleTime: 10m
+FirstInstance:
+ LoginClientPatPath: login-client.pat
+ PatPath: admin.pat
+ InstanceName: ZITADEL
+ DefaultLanguage: en
+ Org:
+ LoginClient:
+ Machine:
+ Username: login-client
+ Name: Automatically Initialized IAM Login Client
+ Pat.ExpirationDate: 2099-01-01T00:00:00Z
+ Machine:
+ Machine:
+ Username: admin
+ Name: Automatically Initialized IAM admin Client
+ Pat.ExpirationDate: 2099-01-01T00:00:00Z
+DefaultInstance.Features.LoginV2.BaseURI: http://localhost:3000/ui/v2/login
diff --git a/apps/api/project.json b/apps/api/project.json
new file mode 100644
index 00000000000..deb962cbb1c
--- /dev/null
+++ b/apps/api/project.json
@@ -0,0 +1,470 @@
+{
+ "$schema": "../../node_modules/nx/schemas/project-schema.json",
+ "name": "@zitadel/api",
+ "projectType": "application",
+ "namedInputs": {
+ "sources": [
+ "{workspaceRoot}/cmd/**/*.go",
+ "{workspaceRoot}/internal/**/*.go",
+ "{workspaceRoot}/proto/**/*.go",
+ "{workspaceRoot}/pkg/**/*.go",
+ "{workspaceRoot}/main.go"
+ ],
+ "runtime": [
+ "sources",
+ "{workspaceRoot}/go*",
+ "!{workspaceRoot}/internal/integration/**/*",
+ "!{workspaceRoot}/**/*_test.go",
+ "!{workspaceRoot}/**/integration_test/**/*"
+ ],
+ "pack": [
+ { "env": "VERSION" },
+ "runtime"
+ ]
+ },
+ "targets": {
+ "prod": {
+ "description": "Runs the Go-based API backend in production mode",
+ "continuous": true,
+ "dependsOn": [
+ "build"
+ ],
+ "executor": "nx:run-commands",
+ "options": {
+ "parallel": false,
+ "commands": [
+ "timeout 300 bash -c 'until nx run @zitadel/devcontainer:compose exec ${API_AWAIT_DB_SERVICE} pg_isready -U postgres -h localhost; do echo \"Awaiting DB\"; sleep 2; done' || (echo \"Database readiness check timed out after 5 minutes\" && exit 1)",
+ "./.artifacts/bin/$(go env GOOS)/$(go env GOARCH)/${ZITADEL_BINARY:-zitadel.local} start-from-init --config ${API_CONFIG_FILE} --steps ${API_CONFIG_FILE} --masterkey MasterkeyNeedsToHave32Characters"
+ ]
+ },
+ "defaultConfiguration": "default",
+ "configurations": {
+ "default": {
+ "env": {
+ "API_CONFIG_FILE": "{projectRoot}/prod-default.yaml"
+ }
+ },
+ "test-integration-api": {
+ "env": {
+ "API_CONFIG_FILE": "{projectRoot}/test-integration-api.yaml"
+ }
+ },
+ "test-functional-ui": {
+ "env": {
+ "API_CONFIG_FILE": "{projectRoot}/test-functional-ui.yaml"
+ }
+ }
+ }
+ },
+ "build": {
+ "description": "Compiles the Go-based API backend into an executable binary.",
+ "dependsOn": [
+ "generate",
+ "build-console"
+ ],
+ "command": "bash -c 'CGO_ENABLED=0 go build -o .artifacts/bin/$(go env GOOS)/$(go env GOARCH)/zitadel.local -v -ldflags=\"-s -w\"'",
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" },
+ "runtime"
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/bin/*/*/zitadel.local"
+ ]
+ },
+ "generate": {
+ "description": "Generates the code needed to start a full-featured API: gRPC and OpenAPI stubs, static files for the embedded login v1, asset routes and documentation.",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ]
+ },
+ "lint-install":{
+ "description": "Installs golangci-lint binary for linting. Using go install is not recommended in the official docs, because this can produce non-deterministic results.",
+ "cache": true,
+ "command": "curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b .artifacts/bin/$(go env GOOS)/$(go env GOARCH) v2.5.0",
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/bin/*/*/golangci-lint"
+ ]
+ },
+ "lint": {
+ "description": "Lints the Go code with golangci-lint using the configuration in .golangci.yaml",
+ "dependsOn": [
+ "lint-install",
+ "generate-stubs",
+ "generate-assets"
+ ],
+ "command": "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" golangci-lint run --timeout 15m --config ./.golangci.yaml --verbose",
+ "cache": true,
+ "inputs": [
+ "sources",
+ "{workspaceRoot}/.golangci.yaml"
+ ]
+ },
+ "test": {
+ "description": "Runs all tests (unit and integration)",
+ "dependsOn": [
+ "test-unit",
+ "test-integration"
+ ]
+ },
+ "test-unit": {
+ "description": "Runs the unit tests with coverage",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "go test -race -coverprofile=profile.api.test-unit.cov -coverpkg=./internal/... ./...",
+ "inputs": [
+ "sources",
+ "{workspaceRoot}/go*"
+ ],
+ "outputs": [
+ "{workspaceRoot}/profile.api.test-unit.cov"
+ ]
+ },
+ "test-integration-build": {
+ "description": "Builds the test binary for integration tests.",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "go build -cover -race -tags integration -o .artifacts/bin/$(go env GOOS)/$(go env GOARCH)/zitadel.test main.go",
+ "cache": true,
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" },
+ "sources",
+ "{workspaceRoot}/internal/integration/**",
+ "{workspaceRoot}/go*"
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/bin/*/*/zitadel.test"
+ ]
+ },
+ "test-integration-run-db": {
+ "description": "Runs the database and cache for integration tests.",
+ "continuous": true,
+ "command": "nx run @zitadel/devcontainer:compose up --force-recreate --renew-anon-volumes db-api-integration cache-api-integration"
+ },
+ "test-integration-run-api": {
+ "description": "Runs the API server for the integration tests.",
+ "continuous": true,
+ "dependsOn": [
+ "test-integration-build"
+ ],
+ "executor": "nx:run-commands",
+ "options": {
+ "env": {
+ "ZITADEL_BINARY": "zitadel.test",
+ "GOCOVERDIR": "{workspaceRoot}/.artifacts/api-test-integration/coverage",
+ "GORACE": "log_path=.artifacts/api-test-integration/race.log"
+ },
+ "parallel": false,
+ "commands": [
+ "rm -rf .artifacts/api-test-integration",
+ "mkdir -p ${GOCOVERDIR}",
+ "nx run @zitadel/api:prod:test-integration-api --excludeTaskDependencies"
+ ]
+ }
+ },
+ "test-integration": {
+ "description": "Runs the integration tests sequentially with coverage and race condition detection. Go test caching is disabled, because the tests run against an out-of-process API.",
+ "dependsOn": [
+ "test-integration-run-db",
+ "test-integration-run-api"
+ ],
+ "executor": "nx:run-commands",
+ "options": {
+ "parallel": false,
+ "env": {
+ "GOCOVERDIR": "{workspaceRoot}/.artifacts/api-test-integration/coverage"
+ },
+ "commands": [
+ "wait-on --verbose --interval 2000 --simultaneous 1 --timeout 30m \"${ZITADEL_API_URL}/debug/ready\"",
+ "bash -c 'go test -race -count 1 -tags integration -timeout 60m -parallel 1 $(go list -tags integration ./... | grep -e \"integration_test\" -e \"events_testing\")'",
+ "go tool covdata textfmt -i=$GOCOVERDIR -pkg=github.com/zitadel/zitadel/internal/...,github.com/zitadel/zitadel/cmd/...,github.com/zitadel/zitadel/backend/... -o profile.api.test-integration.cov",
+ "nx run @zitadel/api:test-integration-stop"
+ ]
+ },
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" },
+ "sources",
+ "{workspaceRoot}/internal/integration/**",
+ "{workspaceRoot}/go*"
+ ],
+ "outputs": [
+ "{workspaceRoot}/profile.api.test-integration.cov"
+ ]
+ },
+ "test-integration-stop": {
+ "description": "Stops the database and cache containers used for integration tests.",
+ "command": "nx run @zitadel/devcontainer:compose down --volumes db-api-integration cache-api-integration"
+ },
+ "build-console": {
+ "description": "Builds the Console and copies its static files to the API.",
+ "dependsOn": [
+ "@zitadel/console:build"
+ ],
+ "command": "cp -r console/dist/console/* internal/api/ui/console/static",
+ "cache": true,
+ "outputs": [
+ "{workspaceRoot}/internal/api/ui/console/static"
+ ]
+ },
+ "generate-install": {
+ "description": "Installs the binaries needed for generating code. We avoid using go tools so the dev tool dependencies don't interfere with the prod dependencies.",
+ "executor": "nx:run-commands",
+ "options": {
+ "commands": [
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/dmarkham/enumer@v1.5.11",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install go.uber.org/mock/mockgen@v0.4.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install golang.org/x/tools/cmd/stringer@v0.36.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/rakyll/statik@v0.1.7",
+
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/bufbuild/buf/cmd/buf@v1.45.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.35.1",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.22.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@v2.22.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install github.com/envoyproxy/protoc-gen-validate@v1.1.0",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install connectrpc.com/connect/cmd/protoc-gen-connect-go@v1.18.1",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.35.1",
+
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install ./internal/protoc/protoc-gen-authoption",
+ "GOBIN=${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH) go install ./internal/protoc/protoc-gen-zitadel"
+ ]
+ },
+ "cache": true,
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" },
+ "{workspaceRoot}/internal/protoc/protoc-gen-authoption/**/*",
+ "{workspaceRoot}/internal/protoc/protoc-gen-zitadel/**/*"
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/bin/*/*/enumer",
+ "{workspaceRoot}/.artifacts/bin/*/*/mockgen",
+ "{workspaceRoot}/.artifacts/bin/*/*/stringer",
+ "{workspaceRoot}/.artifacts/bin/*/*/statik",
+
+ "{workspaceRoot}/.artifacts/bin/*/*/buf",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-go",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-go-grpc",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-grpc-gateway",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-openapiv2",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-validate",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-connect-go",
+
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-authoption",
+ "{workspaceRoot}/.artifacts/bin/*/*/protoc-gen-zitadel"
+ ]
+ },
+ "generate-stubs": {
+ "description": "Generates the gRPC and OpenAPI stubs from the proto files.",
+ "dependsOn": [
+ "generate-install"
+ ],
+ "executor": "nx:run-commands",
+ "options": {
+ "parallel": false,
+ "commands": [
+ "bash -c 'PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" buf generate'",
+ "mkdir -p pkg/grpc openapi/v2/zitadel",
+ "cp -r .artifacts/grpc/github.com/zitadel/zitadel/pkg/grpc/** pkg/grpc/",
+ "cp -r .artifacts/grpc/zitadel/ openapi/v2/zitadel"
+ ]
+ },
+ "cache": true,
+ "inputs": [
+ "{workspaceRoot}/proto/**/*",
+ "{workspaceRoot}/buf.gen.yaml",
+ "{workspaceRoot}/buf.yaml"
+ ],
+ "outputs": [
+ "{workspaceRoot}/pkg/grpc/**/*",
+ "{workspaceRoot}/openapi/v2/zitadel/**/*"
+ ]
+ },
+ "generate-statik": {
+ "description": "Generates statik files for embedding static resources",
+ "dependsOn": [
+ "generate-install"
+ ],
+ "executor": "nx:run-commands",
+ "options": {
+ "commands": [
+ "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/api/ui/login/static/resources/generate.go",
+ "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/api/ui/login/statik/generate.go",
+ "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/notification/statik/generate.go",
+ "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate internal/statik/generate.go"
+ ]
+ },
+ "cache": true,
+ "inputs": [
+ { "runtime": "go env GOOS" },
+ { "runtime": "go env GOARCH" },
+ "{workspaceRoot}/internal/statik/generate.go",
+ "{workspaceRoot}/internal/notification/statik/generate.go",
+ "{workspaceRoot}/internal/api/ui/login/static/resources/generate.go",
+ "{workspaceRoot}/internal/api/ui/login/statik/generate.go"
+ ],
+ "outputs": [
+ "{workspaceRoot}/internal/statik/statik.go",
+ "{workspaceRoot}/internal/notification/statik/statik.go",
+ "{workspaceRoot}/internal/api/ui/login/static/resources/themes/zitadel/css/zitadel.css*",
+ "{workspaceRoot}/internal/api/ui/login/statik/statik.go"
+ ]
+ },
+ "generate-assets": {
+ "description": "Generates asset routes and documentation",
+ "dependsOn": [
+ "generate-install"
+ ],
+ "command": "mkdir -p docs/apis/assets && go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md",
+ "cache": true,
+ "inputs": [
+ "{workspaceRoot}/internal/api/assets/generator/asset_generator.go"
+ ],
+ "outputs": [
+ "{workspaceRoot}/internal/api/assets/authz.go",
+ "{workspaceRoot}/internal/api/assets/router.go",
+ "{workspaceRoot}/docs/apis/assets/assets.md"
+ ]
+ },
+ "generate-go": {
+ "description": "Generates Go using Go native generation tools. This only needs to be run if sources for //go:generate files change, like for Stringer, Enumer, Mockgen etc.",
+ "dependsOn": [
+ "generate-install"
+ ],
+ "command": "PATH=\"${PWD}/.artifacts/bin/$(go env GOOS)/$(go env GOARCH):$PATH\" go generate ./..."
+ },
+ "pack-platform": {
+ "description": "Cross-compiles the binary and packages it for the platform defined by GOOS and GOARCH environment variables. The version is taken from the ZITADEL_VERSION environment variable.",
+ "executor": "nx:run-commands",
+ "options": {
+ "commands": [
+ "mkdir -p .artifacts/pack .artifacts/bin/$GOOS/$GOARCH",
+ "bash -c 'EXT=\"\"; if [ \"$GOOS\" = \"windows\" ]; then EXT=\".exe\"; fi; echo \"Building for $GOOS-$GOARCH...\"; CGO_ENABLED=0 go build -o .artifacts/bin/$GOOS/$GOARCH/zitadel$EXT -v -ldflags=\"-s -w -X github.com/zitadel/zitadel/cmd/build.commit=$(git rev-parse --short HEAD) -X github.com/zitadel/zitadel/cmd/build.date=$(date \"+%Y-%m-%dT%T%z\" | sed -E \"s/.([0-9]{2})([0-9]{2})$/-\\1:\\2/\") -X github.com/zitadel/zitadel/cmd/build.version=${ZITADEL_VERSION}\"'",
+ "bash -c 'EXT=\"\"; if [ \"$GOOS\" = \"windows\" ]; then EXT=\".exe\"; fi; FOLDER=\".artifacts/pack/zitadel-$GOOS-$GOARCH\"; mkdir -p \"$FOLDER\"; cp \".artifacts/bin/$GOOS/$GOARCH/zitadel$EXT\" \"$FOLDER/\"; cp LICENSE \"$FOLDER/\"; cp README.md \"$FOLDER/\"; tar -czvf \"$FOLDER.tar.gz\" \"$FOLDER\"; rm -rf \"$FOLDER\"'"
+ ]
+ }
+ },
+ "pack-darwin-amd64": {
+ "description": "Packages the API for Darwin AMD64 (Intel) architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=darwin GOARCH=amd64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-darwin-amd64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/darwin/amd64/zitadel"
+ ]
+ },
+ "pack-darwin-arm64": {
+ "description": "Packages the API for Darwin ARM64 (Apple Silicon) architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=darwin GOARCH=arm64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-darwin-arm64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/darwin/arm64/zitadel"
+ ]
+ },
+ "pack-linux-amd64": {
+ "description": "Packages the API for Linux AMD64 architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=linux GOARCH=amd64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-linux-amd64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/linux/amd64/zitadel"
+ ]
+ },
+ "pack-linux-arm64": {
+ "description": "Packages the API for Linux ARM64 architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=linux GOARCH=arm64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-linux-arm64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/linux/arm64/zitadel"
+ ]
+ },
+ "pack-windows-amd64": {
+ "description": "Packages the API for Windows AMD64 architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=windows GOARCH=amd64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-windows-amd64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/windows/amd64/zitadel.exe"
+ ]
+ },
+ "pack-windows-arm64": {
+ "description": "Packages the API for Windows ARM64 architecture",
+ "dependsOn": [
+ "generate-stubs",
+ "generate-assets",
+ "generate-statik"
+ ],
+ "command": "GOOS=windows GOARCH=arm64 nx run @zitadel/api:pack-platform",
+ "cache": true,
+ "inputs": [
+ "pack",
+ { "env": "ZITADEL_VERSION" }
+ ],
+ "outputs": [
+ "{workspaceRoot}/.artifacts/pack/zitadel-windows-arm64.tar.gz",
+ "{workspaceRoot}/.artifacts/bin/windows/arm64/zitadel.exe"
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/e2e/config/localhost/zitadel.yaml b/apps/api/test-functional-ui.yaml
similarity index 95%
rename from e2e/config/localhost/zitadel.yaml
rename to apps/api/test-functional-ui.yaml
index 701e7b806bc..9db92d26acb 100644
--- a/e2e/config/localhost/zitadel.yaml
+++ b/apps/api/test-functional-ui.yaml
@@ -1,14 +1,11 @@
Log:
Level: info
-ExternalDomain: localhost
ExternalSecure: false
Database:
postgres:
# This makes the e2e config reusable with an out-of-docker zitadel process and an /etc/hosts entry
- Host: host.docker.internal
- Port: 5432
database: zitadel
MaxOpenConns: 15
MaxIdleConns: 10
diff --git a/internal/integration/config/zitadel.yaml b/apps/api/test-integration-api.yaml
similarity index 90%
rename from internal/integration/config/zitadel.yaml
rename to apps/api/test-integration-api.yaml
index 74956afe658..819d7b90b79 100644
--- a/internal/integration/config/zitadel.yaml
+++ b/apps/api/test-integration-api.yaml
@@ -1,3 +1,26 @@
+Database:
+ Postgres:
+ MaxOpenConns: 20
+ MaxIdleConns: 20
+ MaxConnLifetime: 1h
+ MaxConnIdleTime: 5m
+ Database: zitadel
+FirstInstance:
+ Skip: false
+ PatPath: .artifacts/api-test-integration/admin-pat.txt
+ InstanceName: ZITADEL
+ DefaultLanguage: en
+ Org:
+ Name: ZITADEL
+ Machine:
+ Machine:
+ Username: boss
+ Name: boss
+ Pat:
+ ExpirationDate: 2099-01-01T00:00:00Z
+ Human:
+ PasswordChangeRequired: false
+
Log:
Level: info
@@ -47,11 +70,6 @@ Telemetry:
- "multi-value-1"
- "multi-value-2"
-FirstInstance:
- Org:
- Human:
- PasswordChangeRequired: false
-
LogStore:
Execution:
Stdout:
@@ -107,4 +125,4 @@ OIDC:
DefaultLogoutURLV2: "/logout?post_logout_redirect=" # ZITADEL_OIDC_DEFAULTLOGOUTURLV2
SAML:
- DefaultLoginURLV2: "/login?authRequest=" # ZITADEL_SAML_DEFAULTLOGINURLV2
+ DefaultLoginURLV2: "/login?authRequest=" # ZITADEL_SAML_DEFAULTLOGINURLV2
\ No newline at end of file
diff --git a/apps/login/.env b/apps/login/.env
new file mode 100644
index 00000000000..941bd7206b3
--- /dev/null
+++ b/apps/login/.env
@@ -0,0 +1,5 @@
+NEXT_PUBLIC_BASE_PATH=/ui/v2/login
+EMAIL_VERIFICATION=false
+DEBUG=true
+ZITADEL_API_URL=http://localhost:8080
+ZITADEL_SERVICE_USER_TOKEN_FILE=../../login-client.pat
diff --git a/apps/login/.env.prod b/apps/login/.env.prod
new file mode 100644
index 00000000000..454804b07cf
--- /dev/null
+++ b/apps/login/.env.prod
@@ -0,0 +1 @@
+ZITADEL_SERVICE_USER_TOKEN_FILE=../../../../login-client.pat
diff --git a/apps/login/.env.test b/apps/login/.env.test
deleted file mode 100644
index c0344ebf0fd..00000000000
--- a/apps/login/.env.test
+++ /dev/null
@@ -1,6 +0,0 @@
-ZITADEL_API_URL=http://localhost:22222
-ZITADEL_SERVICE_USER_TOKEN="yolo"
-EMAIL_VERIFICATION=true
-DEBUG=true
-PORT=3001
-NEXT_PUBLIC_BASE_PATH=/ui/v2/login
diff --git a/apps/login/.env.test-integration b/apps/login/.env.test-integration
new file mode 100644
index 00000000000..136bf21f25a
--- /dev/null
+++ b/apps/login/.env.test-integration
@@ -0,0 +1,2 @@
+API_MOCK_STUBS_HOST=${DEVCONTAINER_LOGIN_API_MOCK_HOST:-localhost}
+API_MOCK_STUBS_URL=http://${API_MOCK_STUBS_HOST}:22220/v1/stubs
diff --git a/apps/login/.env.test-integration-run-login b/apps/login/.env.test-integration-run-login
new file mode 100644
index 00000000000..8eb5c685d09
--- /dev/null
+++ b/apps/login/.env.test-integration-run-login
@@ -0,0 +1,4 @@
+ZITADEL_API_URL=http://${DEVCONTAINER_LOGIN_API_MOCK_HOST:-localhost}:22222
+ZITADEL_SERVICE_USER_TOKEN=none
+ZITADEL_SERVICE_USER_TOKEN_FILE=""
+PORT=3001
\ No newline at end of file
diff --git a/apps/login/.github/ISSUE_TEMPLATE/bug.yaml b/apps/login/.github/ISSUE_TEMPLATE/bug.yaml
deleted file mode 100644
index 2764c1a365a..00000000000
--- a/apps/login/.github/ISSUE_TEMPLATE/bug.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: 🐛 Bug Report
-description: "Create a bug report to help us improve ZITADEL Typescript Library."
-title: "[Bug]: "
-labels: ["bug"]
-body:
-- type: markdown
- attributes:
- value: |
- Thanks for taking the time to fill out this bug report!
-- type: checkboxes
- id: preflight
- attributes:
- label: Preflight Checklist
- options:
- - label:
- I could not find a solution in the documentation, the existing issues or discussions
- required: true
- - label:
- I have joined the [ZITADEL chat](https://zitadel.com/chat)
- validations:
- required: true
-- type: input
- id: version
- attributes:
- label: Version
- description: Which version of ZITADEL Typescript Library are you using.
-- type: textarea
- id: impact
- attributes:
- label: Describe the problem caused by this bug
- description: A clear and concise description of the problem you have and what the bug is.
- validations:
- required: true
-- type: textarea
- id: reproduce
- attributes:
- label: To reproduce
- description: Steps to reproduce the behaviour
- placeholder: |
- Steps to reproduce the behavior:
- 1. ...
- validations:
- required: true
-- type: textarea
- id: screenshots
- attributes:
- label: Screenshots
- description: If applicable, add screenshots to help explain your problem.
-- type: textarea
- id: expected
- attributes:
- label: Expected behavior
- description: A clear and concise description of what you expected to happen.
-- type: textarea
- id: config
- attributes:
- label: Relevant Configuration
- description: Add any relevant configurations that could help us. Make sure to redact any sensitive information.
-- type: textarea
- id: additional
- attributes:
- label: Additional Context
- description: Please add any other infos that could be useful.
diff --git a/apps/login/.github/ISSUE_TEMPLATE/config.yml b/apps/login/.github/ISSUE_TEMPLATE/config.yml
deleted file mode 100644
index 7e690b93441..00000000000
--- a/apps/login/.github/ISSUE_TEMPLATE/config.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-blank_issues_enabled: true
-contact_links:
- - name: 💬 ZITADEL Community Chat
- url: https://zitadel.com/chat
diff --git a/apps/login/.github/ISSUE_TEMPLATE/docs.yaml b/apps/login/.github/ISSUE_TEMPLATE/docs.yaml
deleted file mode 100644
index 04c1c0cdb1c..00000000000
--- a/apps/login/.github/ISSUE_TEMPLATE/docs.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: 📄 Documentation
-description: Create an issue for missing or wrong documentation.
-labels: ["docs"]
-body:
- - type: markdown
- attributes:
- value: |
- Thanks for taking the time to fill out this issue.
- - type: checkboxes
- id: preflight
- attributes:
- label: Preflight Checklist
- options:
- - label:
- I could not find a solution in the existing issues, docs, nor discussions
- required: true
- - label:
- I have joined the [ZITADEL chat](https://zitadel.com/chat)
- - type: textarea
- id: docs
- attributes:
- label: Describe the docs your are missing or that are wrong
- placeholder: As a [type of user], I want [some goal] so that [some reason].
- validations:
- required: true
- - type: textarea
- id: additional
- attributes:
- label: Additional Context
- description: Please add any other infos that could be useful.
diff --git a/apps/login/.github/ISSUE_TEMPLATE/improvement.yaml b/apps/login/.github/ISSUE_TEMPLATE/improvement.yaml
deleted file mode 100644
index cfe79d407bd..00000000000
--- a/apps/login/.github/ISSUE_TEMPLATE/improvement.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: 🛠️ Improvement
-description: "Create an new issue for an improvment in ZITADEL"
-labels: ["improvement"]
-body:
- - type: markdown
- attributes:
- value: |
- Thanks for taking the time to fill out this improvement request
- - type: checkboxes
- id: preflight
- attributes:
- label: Preflight Checklist
- options:
- - label:
- I could not find a solution in the existing issues, docs, nor discussions
- required: true
- - label:
- I have joined the [ZITADEL chat](https://zitadel.com/chat)
- - type: textarea
- id: problem
- attributes:
- label: Describe your problem
- description: Please describe your problem this improvement is supposed to solve.
- placeholder: Describe the problem you have
- validations:
- required: true
- - type: textarea
- id: solution
- attributes:
- label: Describe your ideal solution
- description: Which solution do you propose?
- placeholder: As a [type of user], I want [some goal] so that [some reason].
- validations:
- required: true
- - type: input
- id: version
- attributes:
- label: Version
- description: Which version of the typescript library are you using.
- - type: dropdown
- id: environment
- attributes:
- label: Environment
- description: How do you use ZITADEL?
- options:
- - ZITADEL Cloud
- - Self-hosted
- validations:
- required: true
- - type: textarea
- id: additional
- attributes:
- label: Additional Context
- description: Please add any other infos that could be useful.
diff --git a/apps/login/.github/ISSUE_TEMPLATE/proposal.yaml b/apps/login/.github/ISSUE_TEMPLATE/proposal.yaml
deleted file mode 100644
index cd9ff66972b..00000000000
--- a/apps/login/.github/ISSUE_TEMPLATE/proposal.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: 💡 Proposal / Feature request
-description: "Create an issue for a feature request/proposal."
-labels: ["enhancement"]
-body:
- - type: markdown
- attributes:
- value: |
- Thanks for taking the time to fill out this proposal / feature reqeust
- - type: checkboxes
- id: preflight
- attributes:
- label: Preflight Checklist
- options:
- - label:
- I could not find a solution in the existing issues, docs, nor discussions
- required: true
- - label:
- I have joined the [ZITADEL chat](https://zitadel.com/chat)
- - type: textarea
- id: problem
- attributes:
- label: Describe your problem
- description: Please describe your problem this proposal / feature is supposed to solve.
- placeholder: Describe the problem you have.
- validations:
- required: true
- - type: textarea
- id: solution
- attributes:
- label: Describe your ideal solution
- description: Which solution do you propose?
- placeholder: As a [type of user], I want [some goal] so that [some reason].
- validations:
- required: true
- - type: input
- id: version
- attributes:
- label: Version
- description: Which version of the Typescript Library are you using.
- - type: dropdown
- id: environment
- attributes:
- label: Environment
- description: How do you use ZITADEL?
- options:
- - ZITADEL Cloud
- - Self-hosted
- validations:
- required: true
- - type: textarea
- id: additional
- attributes:
- label: Additional Context
- description: Please add any other infos that could be useful.
diff --git a/apps/login/.github/custom-i18n.png b/apps/login/.github/custom-i18n.png
deleted file mode 100644
index 2306e62f8709d5b6f756b773410eca411b3b5c2e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 85028
zcmd42V|b-amnaK`bRw4#KiwH;^$^zq21f-zpZ)1pPh+%+IQ80o7F?2sS
zS40705kHmC{=g0!3G2F;D4zP%<`q;%o*1dG2ZOYp(r#p4WO9GJ9sK4$$l`Xozy~?h
z^)6?_oCgreCoo1L+?&bD$r;9bf`A@^qD4WSdk5%@hQ}a6)xiJqW2~+Q6T6Eg0G|??mq-*#-RMELfW4yy~|OmgEYh;@q?Si!dX?DRl{dh
zAGh;lz3DKw#X;icpS(3GKyZBG%+R4(@)7aH;IhbsY5_+4VLsQ_rqINCfLerx0H>Mc
z=hNG2XO@qWbiRU-1G5+dRl1-MJfak7rzfZPN$1y#gw!8cIej>4cXXN(l`N)dzr;CN
zdy_Qqw|^zv4pW6Sf(kg)+E3|)r)x&U0g`zwN#mRhCqPiQC9hY%t^)~accFp>t)U&h
zlX0+k50_90;}taoJPFhGKefAu-4Xpn9s%F^ZXGjb+K)KtMK3(K2Y)61R3}K7^qh;%
z34@o+SCUP>jc{Zf6QX$~2~;LVqykck2~~nR6!B0pSPxS)GDYHYT9YdG(-_zKYfvNr
zUVhxxUc+lDoW}X+=6HW~J#|k>!{iKR+%p>pEprUvMY)7}3#~QqA%USZ)DS1j#pA<^
zR6qlkMc`9LlEFC85G*F{zYJ9jZoAH`9uj-4>L=k=?v4}1q+<3X#L^FkMk*J_rb^rt
z?x^~1CojKFnJ4o<@&OT>i9l-n!4{mEz`ubzh}$VMwkzKOK>6YVWQf2Jg@0d$74;Cn
zv=0UdU2=<%5D{V@@GsGVLBxHqMW{M%Bg?tCfM5&zNG0Q4Vr}yPAsx3mj1(kUwgpMt
z0oYgkJllOV{>;0*6{jB$uS_o?TLKi`VT$mR!v#p%DB$6s{Xiq&GzLevk3Ay~p5B{*
z%iwbJkUgIMDNHO(b}&@%k6?!0@uO{$WhzEe0n9lhoKgAb#iyRCyb{{;STA9hvM5#u
z@J;`=ZjZ0cj9JU*b*sc($(n}IGw<2}ecpUx?g&(f;;8&bMQgFxxtdvfd_~3m=abhm
zZ&|_-4!0t++t=0VI>um|C3ERh?NcIGNbZ2_KCN1c?%o)~aSd))k#KRf)xsWh4j%2(
zJbq3Ev)hcP>u<^FN!;_?cVB%}?)D;04`?|^-M%}=$YiA_Pi}WJeh(W+gvJ}H&C1Tw
z1y%6%Q>p%?&K$IX9=!Y>qJ51EvOWX}3F-UX8$tkX(8cXdj`!ZXT(eawir`-#3IVGb
z5Yd;63FhrIwRJuVHQ0@})a{-XfO`q%O9TuKqyi!(^spWJVCWpMFv0x>j}(NV0{_wN
zsQ}Xyc$Now3JN8FY7Rl!J-Nx#4E;0kkNur<&_NzjJ0u|xKupXQ9B@cV5k_tl`<2wX
z9|}gKH(rAbTT++>8KyvBpIADM{%8Mjf0^dl^u51L!mE=MsZz`zJ-CWs>`CN0+RiIqH_6+B(#jTJh=Nr)*SciII
zfkpAi{H_(lROJj$rH5|4eq=toAgvUwyj6=@_5x>B=?a+*?U{g0zH9Bh>sjIo5;j&}
zR*wlZmNXVORw?!xmk7QUevVv|T>1n-HexoPu8l6{n#kI6t7@ybb6XnLY{ZE1K8rdF
z5>qwvMl3T!9
zRh?8_EKON^+nBDX{L!f;U#YWkvgY`s*C2eRb5?g+amuh%cyD`e^fG>*y#u|&GblNz
z8rycBci!zlWnbpjd@<|{??&fn?dZ+CZsa}sIKML)^>Mm;oOIIAcXSUpgULsYplFbJ
zoL!#K+|=3gHX*Swn(7Zh&7|yfu609hv36+L8nutM*F9d@e;yfMligp~T-dSQ%GvK6
zdE?R!#UIz3;5!k#ynN6&oIbvqm>p-`xbZ(A)I-$c)N|33r__{3kzHXv%Kw$lvEh~J
zmWnh+Iey@k%b>5U-)Yx)0nYElpT8m3MTw^^_r;9kAfzj?>-R_82kuWwH@*jV5DXxm
z0?rh28Gag21KXW(n2w6IjIWGwiQV1y@(L&#tlLc2P7W3g9j$@uKsm#rgtCkVQQ)pGV6<-1y
z-svdzuzsu*Cm`t
zccj?9VSK2)+6>i&k9}cy(V?MxEB;+x*?zj?*mJGlnR%%@;08|1qUK!btleUQ?vVU#
zzHz?uht-046}8Tdy-okhpi8Ao@yWXuzt3BXW9oGkZW%5bZYxbMZ3c&ywNB%ev5DH=
zJk3W%M_-4Ka
z9|~==24>3>@@-^ot(Hbsa`UZ=3k%o_Rh8l==y$wr%5M6rs5PZ6J^6-z^!C^5d<=4p
zHtOFjUaIk-xu;y?d}_AD#|Sy_jqqq}L~st+?%7S)UDzo(+z1ePR~NSD9SI1B^q4o@1qBA999yu4-&N|C}Wz%Ik5WJ5}sBFCEqML%n%l!yo*v
ztzS3Op7hA!euaBUExEBh!2P592kGtj`6M6lSIi*XIc5f-_MK>_wEHYt1>H9Vg!}2WK-|IP}+Pn(wym3%G;1i{02SQZ`uI)!#DD?7Z4m
zTVqy{nm68w&U?;614AbXM+kjR8GL2Dbl&@SCC`)(N~?GUc`?{o?nISMlQ6v
z>^u!`wuks%-_0*FR~O%u?j1KL_o{F8&z{Hjs+-;q-@U4D^!(hFpVdBW#<}m?ST7RS
z`Jb3hNRNyMDF4XQ=l1b!U=QPB#a)}c_UMDcQ^kJ426=6P1JPmufp@npl2gn^f`TjH
znnfhJ%&j?w=hRpQG57ztW$w7V*yjRyaRo7exH~Eb5t#)EdjL7?4<~hbq~mZuSHU3R
z!S&`pQ})#3dgKswp?Dj;n5I{#X!V~y>jGJ42oeui!>#?iU__W`NSeyZg3x^Cp+Nwk
zI3N(8Ind9@2a5Y&c`;Bb5b%G>!9YMlEkFSO0VDUB{ta=T@h{H5Qt*WDAW)zGP(Gu3
z9@u|E1Bmj#|1!6TLH;*_N-B|E
ze$rpGP|t%&h}i4
zjBajj3~sCpc8+F@%$%H@j7%(yEG+b&5cEzSw$6s`^tMi<|043AbVN*?j2$iPoh|Ha
ziT=_xG_rGX<|QHd%jmztzuIZyZt-tUwod=itU1aWM*RjAE^JW>i>(X>SW?5Y-jVy)0ywz
z^YtHm|9jHNu
zK7ap8%HQ-e)`Ol8XA6LU2!Ke62&%Y)p6Wulqb*|a39OK#q_s|MH&vYT6huYZU`7;#O8nk0hHZrr_{Fe#%~;A{!X2Y+-^T7`Rg-V
zK6n#KRcaF$1457u09c@6{{MFpU@by~gbG{^V{jXXW&(=>A?^OZ5-?B-qDR61or1VO
zOqg|O8r1&=@fRKYf2$0z{(qwn+d#Xwcm$@lVK#HN1ZHRRYG`TfH&Nqc$tyXckdgHZ
zf0IF5jckT`Ai2P;9E13$;ky)oH2+~)x1fXG|IvxKD(FYd`%o0oh@hY<;ij0x#OxvR
z!JcGXbz(9$GRn}s+J6Rz3H!69GT-Uk*lOyU=F=q{XO!Kqwp--*%)Su>@OXgG{k}eS
zPD;8KqP(z~tYKRm*jm0xy?libzm>gMKj?!R`3+A<5z;QQl#tuuH5m^ECdcx3K;uZE
zo4>XQ%+DkfcSZidVq_pj?7ax-3o3&S3y%#beI&Rm2}>?U|GLZ_5c-4r(f!FkC_6$X
z+!qUCC`i7yFD=w=wD^(-8&qr)UwE^Mm?+~u6UsJZw6|)Lx5jQnA?VliNFj8?qft4P
zK5scEkF5KRZ=TI5o?(9!FV|wT-H!Lt)dL~dlbw}VElpLv=MTI7J$wyzoL+`gjHA{y
z-@w2DtBBic=DV$dnGhDdgRQ1NMs~+qqVs;$`wu?O7;9_jo>bYYg
zZCx>aZ_Q*L&tinq9!ov;?P7%DR_x0t$!YLa`vl7Rsa2wUOUsN3J`AW`7i}=KldJKi
z-faHe{TRi0deg5s#qvry!a>-f?ALYA{fu1*bk8*fhfVYCJC}zJj%r9fZ_Hp(-P~dR
z*~Qp%K6ja}9QV{&ov1$ogw)=07Y^BiC_C3f^3;m83fPg6Fn{X#PjMS!pVB|D)1IEe
znM9;2q9Q}d;|JGp|8m?A@euo*g3Afg%LO2C9Et%l6^wjyB3Zb`tH&USBjs2@H(?%i
zBb4$=5%Oez0c^(i(R9@G?zYlKrShRu)~_cn9}gP{8V=7t
zxpGmTkq@L5I%JVYTB@fnAvhuRi+(mAr29
z9|QL1R-*n5bt$et0M2A}x0c_wt+J7j-fc-Pz1mn5=7%J8UhfV?4m)=nAc2}!ep-cn
z@Htc?p;m^ATT3k}M!Z3~`zxmNqpCqhouUJ;X~Dydzrra8q1$Jn+noTx9Y2uRK6FF{
zDqmXI$#@sOoow`%8m{UO5!vyv8i4gWgBiIFT`LTZ5fD)FhcYhc`9~sc&-wt&InwoB
zCD$>)3d|aXE;S8^9b`9bS^-dYJi!OwaN}Z5@fDQKrI|qE5fwZm_$&6oeZYL2g8eTY
z>H@o3RnY1mK^k3+a`|Ri3+F2R_{w2_x~9}@_4+(oEH=)8$?f3)B($wQ1m}GZ`2CM^HzAVC-<*eT-GgFt4jp0&&Ztvn#Uw?2w^=zU8q47UvE-rNV3SF+mHz
z`Htl#KkiK9c1e!dgHh;q@V~w7|Kl#7?hi6t2H8KjK2OA-p=X|{Q*@Wr9u4SEGbPVc
zbl|9EmE+zWghd4ok`!w*Qo=y5P0vmkf|1yGI|@^y0$a8i+S{CnawW7q)uC|N#z-qN
zqA;CkL8pt-O{dyZYI)z%s~oVy&0DL`NEC?ZdU%EDogoUJ||2xDW`7p>(M
z0niVeg7fkEKQ5!?-3!ygw-48QaLpd3nPr*igbcRp3awhgm(*I2r}#I0ePP`8=fkee
zj`so?Yq-(^yCa#HQtB2U17q_5vqi9iN$z~iEze74XwKXw1kdsa7ot2%aC-+vXvQ4g
zptR73t(lPy`>S1oASb7X`=D;IY~n6)VkXvK!Oi0FK-W98tVcWWqHh6(rBP+B39XJh
zDCgTI;S}$>K}JSUA4^qOOW#c~m2C59%88Rrm0_T@s8kqt0ef&?1&A?mp}iilV!jU?
zE{)E>>Ao4!3~3aFJDg0Ta^m0BvQ)IT<}V8i&9Hv8XLaJvVWYhE61-My4BR}i2H(9g
z91Kv17blF(DcaN_ET3#dEkOZ-65K1auWlWn;!7bM^S!sgH
z)O!ovx^^pLzPnxQMofs4mg^K3ra$(wtU#QNtEioLc0SUUQ=xoYu_25)(^#P+)3dCC
zVr@;cJqO}Kjy%HI{pkSQ<3ojSJv$>5ZCOBxl!;hDcZ#f%{9Q3e68Q<*Y+)b$Gd9f_>JHR3xNVz7yei6OhL4a#MLlg
z_z%5sv@>UhuZh^Ax;FVJy!DUm=?7zQhOq>FDUrzbi~dLGTY9L~LH72w%;HrQfUo{I
zqH}WEuWP6Mcl=@UflguS5d9@`$e33hWUmYPPh+eD^|B>O>~A_E9Jg&GmRfWmefbF{}Hdmc+5LUd@iJ*vb@ARyGhbA3Q5HTv55e5VT
z*_L1DW%zc++Wuea=8Yqe`@9z2r-4}RX_>isICMH3k(@`7W94wnkv
zgmSRQ^Gi*3Kgpy*USPLB$h9X!ZTM3wZ$KDhcgSsbdePNc8#R)+@dxfTHyQ;mgu#Zg81n?{vC?E~Y}r-t-imNy
zIR5NH(b(v8AINgY_nibiQ;<)mLGRU$Icv4z+A5CHj<0NEhl7leEqjxkKOE}0-ibPI
z5h|D?0sYQPZaO`bj}VCXGbHbB@rURdIIS31Ja9#+bWG%uei4{cO4d`S*w`4!>bzd?
z0xX-ZVSP6)^a03*w|k+M_&x-fmTdpV0_$B^$Nnz=fvJ6TFR#0X&;h8Y^e#xndNk^V
zy}YFUiN(y0?Rm%c8~a1ja`1=BkJ#^mcaZqb*VLp(79>$`bT`c=!Txy=`#JA4P|2Q@
z4>V2}cjj0zCD70PXkdYQ_8;czh^uF+a6Tq};zEQyHRGwoF#36thoUa?;>iP%c5)
z^rhOHt=uq>bK&3Aa%V4#iS=#EZ7-6|h#!61Te0aczxZm&wksrlM909%ACp7PAwUUgG}Zw=oWZ!69VXJZPy;0G?^6Z*B*3t19$7r0!?5!b+}cX10xDoJtD
zW&>{?noQWdlZT(3t@&QeQ{sWQzhi85@Qyo3Ad+_!Jm077)4a%JNMCr#pa#42mCpKA
zHNQUCWBumG`1w1~;n1p3&_P{Lu0LN>Mw1aL`kIOig^P|0hGiwDX%Z)TG$PTSjFH=r
zyEyF`KglK>{ld5jjx&XP5O2+2VUOqf-5XFO
z?#V(+cRIe11blLera}1!u{6k_f6S8i?c(dM#8rJZS#Ng=JnkxRL>7GRf0bBvQFnce
zI><=cohjqvRs9~YBYRV`jJ*DsFY>GI8QfG6Qf&KKd$3#Mu6F<%Xl~7UK=u1bg>MWR
z+HK={s^|jGS?Ct!T!$AP^Zs{e7?Z3{bT;L@l_DYLCYI&RRJky=>sQT25%kC6N%^=3
zbio%ej@)ONBc#;6>acS76Be}NBrl{9PS%>bn!rBH*zR9W-_u#ft$#?zP+O^0z@Qa4
z&7Mc0GA(}*JWu<);H*pj{l1`+qvC)iaY!EV8kawo(4-d65o555g{Z|BKj774E1&~1
z2%~}vRJ9_um%=jb8F#UopHf0zA;9NkZ#nbHl=78kCq?mTxy`JV^@{G0fhtqJOB6L?
z7?Jbk>>k+H=W-B0%r2`~1U^yTj4S+FP3&g(iyMW3!)S{T&0wMZ8GZg@h-Bcr4+X
zy)Z!;HxlA*$v_A1s;p}KjG>{$F_9i!kJV0h$a$cV0*1W|A?B#SKRL;cOBM{#_xxFkI?K(x(#Xdn81B2M6umA$#9Kf*o-Mm5;m8&
zF)vkr5=u=$f-W`|UqR+`C&j_Uk)JvU4th56__zyg7HFdiMd$AO;iZP`RFM7g-poWv
zY~$}|KP?-%Q>o?rAVdg&$X0<9T=8)2UHhhWd)8L6GN12ok*9v+A&%fR{Uya;BRojFd0LB7{8UX
z@ya;U5jN)%F`)c1^;=;}p#b+@8z0NE?D&~&PM&=jm4VhGNudHC
zJJFJD(l(edp|20Vjj)l(7L%AbcGDX2=RNfGat
zNl^q@LJJ(Be#o;+{RjyVByPB}?HxJ^KH)_Q3bXB@y7S~bCd-w$DYux0BC1tu3wf`6
zV&N{N!X`bnhYB(%bKj2wF>#&*SeJ;_umNnTqw2mVqlIWJUCXXGK#n@7Ky1iWV|&h@+iJ0DzDDky~I6+zg6S-Iq|5N8Q!P
zMJ^+08jQLsYH{U@Dl(#7tn1~Qo(;CA*QpE7p%BV%=nkvP96)RO8$oEUGkC#h|KZ?o
zc^6W=bA!bF;nvn+iWUux!I1ORVA(VnKp&u>H}FGT#87)CF8|_9c&=YDquONmLEpGQ
zEGLc-`v{!@7^
zb9aA;sPjsk{i)Z<^f=ULR7-&BgH(cW0WF_f^d3}v-AeD-o55)ee{Ta1Y8Z1>5TxY;
z>-C=gqi}EP<;6pxxp`D@ttbG2nD~ooqu)|Pwn6AVkvxjAp?4QiG^fULo<(FVf3PlR
zRs4p_lpRo^g`oEV#g||eUY1cw7IzrFNFyBw=y)F2DjV4|*1cSq_RKR5xNmWHzhnE6
zrbMMLhKY|9su|iFWobzVN-WGU16FxZ$GUBzjyQ$nHr={oi!&mwWpZ~Vn&zq~S>!at
z&z*t_C!yv1OWz($!i1Z4Pu-aeBg}F@ofO4kQQ^k7ggu5C5X=&M#OU?YN<=kp0Pid(
z{x$rOvHyiAWbT$6+lhq-1M(*?5^n`Ya3?!lBn_#8SFp+hEA6dN$B}aK7ifBaF9z=D
zZ$igLF&INZ4pS6S@piTB%pT`R1L%EFKRo8gB17o;Y2^DMbacGp_FrK@T)-Fwl3w
zOoo!OjvMPlG03(XC%U
z+*D^`9xj{x6Ct=z!q5uEGd?kx0qK&gHx9L=tyQF>pC(?+hd#NA>IeFm1LH-5n^|
zgqo^rfHDzQqi+>8i-FhWF$GGGlY*RangT
z;N_G^Bzxi_i%H8ExVrXg*XU%QL+Kr_O0CQQj6^?g1vQmf3e?-iVjgVXkOo$qajr_m
zXzTo=kSvi*6-6~~T<9=j!2$cNJ!)5V+`MquvsYSCOL3rsn%9b;A{k6r*A$-N#1@kv
zo&-w8{Rbj!f;hu^6IJgPO`}SuSi#QaxcF$k^UN)NQU*F#h$o9gTfn|#UAs7W{s>BJ
z+lcH3PXUGMEgPz45jiV_tgwWHmE<2gm=NkB`w%jzL=s7Xsj>#{s(w2I8~#J35p9t}
zi?Ah2I13nTX@PJ1++}1$_n&&5G|*YLv!`@N+vASn&SXG8(x0Dsei0IPaUz?igV4N1
zqIGYMWKqjG&z*Tci<0v;Vmq)@gMIaP>#2Xhiz&y(m|qLd=;e=-jy1+&KfO)?JwHn@4KRZD#D_d$NOoDmVnA2n-Q84`xi!Xi-kj5RNoA%F>)AngW!E;c=
z^EqI#eku&b3LQ@Txq}FTZ-MM>bc1&Hh%M{Q=gaAiP6HZVcE?=n7XKAmJZ9$G+oH#B2C%@nOABOSp-3F1
zlX;A50yz@5hvdD6=0{vvW*!GK*$78wikrIQv}{1|TtZ$;!f{=b1}Wn0jQk1|g2J7q
zHW@bQ4MKVz*3PWZz2HL-hBsNZV%0O;oIO!IoPk5aVCWo>sPVPugyC>*b)H`#jj+gN
zavc&(h`}2g#OEO;>x+~!n8i;r7-&b=*48iYc9!y`tpA?IE`)
z4sbW@?y*Xo%k`a&(DBQQuyQg6cy=kJA6_%em|VqgjJXGSr0L>n!o8R_KD@H%*G}mw
ziqS+sKk2RV6rRmdvJjk})+5abu1O0uK*Y2&ND6HGhW!A6>zB#|J*kEAIsIKV8PPDm
zbisn%*tRYDbWds3_xtE9Ok|-oh0M`EJzC~fQ`@;B&wiS2=X^5jPO{12xw9+DA)|aT
zhiDuyEBR{5o(b_AAHR931AHegt$xfHX%QA~z|8j*3(&d*N}V!g2XzV5xL=soX_b@Yps_84Na4tta{*I)eLHA1H~CJAVZ84-FvU8}n6Yq!
zCpe~Z*t%2G=TGm9mf`1S_^=_OLw2;GGnoXlXnjis{Mg3d?zgmSHq%C{BglxTgdo#x
zsEY9`Zk5>*exm@>-wL5ag@_u5Sx7(*3B@th^VB`K&*
zD&FC?KYG;DSLE17UIT{>t{VmAXl4_mUf<1bJ(8WCF#SlwcN0o5zJWD@-yCL;EmNMD
z?*3BBCs_MyE@SiGuLxs9pqP=Td}SzIKKy(+
z!NFjY1F><P+!F0p(p8}Zi!@#fK^WxkEKzcr?!AA#VOk9y^4om@UVBN|7uLmGqrNzTwRkTmcYWNka6St}=fN
z$qQmkE(5XXYHGKhzh|wQgp8*h?u6nO^6bRvklU=Q!LY1)m@g2q3&A2g|2&GA=s89&
zY>QXba=#SOI=BOOzqfCgyG-#KEbQB(?>--M(-%-;N)^aHx6Z|ODEDVHaHoE;Q5$C_
zPNyg-VUhijLh+u0smdDzDg`ouI69Wx1`^*#HWx*$+7XaT5uNCGvQ_q_4ucwI)#!>u
z-OrOcSU`gnhow-2)HQ^bX*_*5fOW?&cphRvCE*15};ZK^dK?ta9z#>{4>jEpVo`bfqA
zmaX(NcuZWa$7ywWky5kqZ~_*r_fI28B~~rkTM|#`#Xh{ceCm35xPJ}XFMmkkj6Cd=
zh)t)O+EDgF^#F){{(+PF+J^6-vz`7<97^o+bJvJJ(7w|Kn>4t1i6s347MUydDEiYM7+ph^{cR;|t_FH*xypB@TE^-arZo46UtGL9&QTrUWo{s)VJB-)ZAtc#Z1mA$
zntK!8BNWukNj^Gt6r#qrwfx~;%Kq@Vf{k`sq&^70{`7vOf$dgeJ4%Zw!B0;OUjAqA>P7=SNq5E*af7Bq!f^)hDn5Bm4Uql%mqoUp}H
z%|(rZzBt4B!lt5pKL&3LCplu6&%WV%rqb$l@S;^;1uSVKJTW?4`M%8fe*NW@qlnne
zY8*&BRAj6M1S-u6E?2v@4#^Ytjlbj{Tf=@lX>W{dd(U^yGud<;^UCV>3r`8Ol6{1Z3Wx`O*flUrI0jDi_CoY^q6Tx;%hh#&hLGr~B(r41GHE
z1I=Pk!EE%wL%c@rSj;z+BO+)Zk2Z4?Xi*+`QDt1pT2}~8G*{%$hBrp6KOYbE_koSk
z;5^Mf2=AeaY_}usw?H`=?kBfAhotMH8vdSY71ekXcu+xfE4EW;datr)%}Xag=oWjC
z<>K`QrP=MdcZB0%f`O@)q(pUx4x0v6YQW-hwx6Y$*&`1r4lt$pN2{4Y9+ndYgDb{P
zfp~6Q(AO0omG852>hj$3Er%2?T8?>5=ZO_Y;=0^q#jby%a?Fza<7gf&(s6!YD1l0~
z{t4HuA7qU!bHkm@q&@p?`&g6#osRiwzhE={-9zUlK>4cqo__F4_YN2+V$Np8B1Ql}KSm9G^8oGi&MGMp2GA(rW2h}-X9
zGJV)|l_~&y8-80(azX%TWa7avow>iSEAM-On%wQB_e!t2M0BZq!M-_7uA_fUAmY~W_-
zM#91#S^}i|O=GQdFAoVUx#@!93QuO)=9BOCm|5khObDHS!-5q^CJ$cvEE?LMox7x6
zP12b>9N#XV9L(VWla^aer5{UzMmPHW4j%f#o(kt&WF>1*rIe?({~q|_P@#8mz=ZVZ
zMDwVk31Z)VG=e+bsuSVEPj9!(maUOoSO~FIepD3_fnKL;3PlP^clXSzJI5yjf@hA3
zvIsfHi!L)Y$7}|;j<3zKqJvZw-NTwM-LR_9!>@+dsTaaV?Z*%mayL0sMYEX46)ONhJgPd=
zH;OyzY`FwhX-AeL#hNrMr)_`8R7YI^%<5Y@8=e!KO0G4AJl?AdszLRgsK)
z>B2q$!&^T!E@5l5?42hnnGeahM4H&;59A@`HYxl7r@KwfN=^#K+HJ3FQ~Pe(&%1VG
zBaZpS0mu}WYBJXY8FIGWGz)xIDFG_XZB!
zz$7$HNbzKFpk*AmJd6$0rsDM&B_f_r~&R
zdZFbNv~7!(znL=iJ^m|owQS2$(jGP^4Ge@<<^9JC507U8No&D{ZEi+L4+_5ZXid5b
z6DFn~X!B#?3m;fta6*s_b+GaQ?79M6^%iT0eB9^Cef>a-H}d1cUPd^wGs+jr;+<1a
z;9uG?N18tfs_z&56%y^#Hd4Ya`l?hqN3TggLtd|eSK>3qM;6T($y75U&j};AyhCK4
zbDK_QeNpH+G4g7#nE_{iC3tMdCwfAhi!U`4^{GL?3^Lmmmb6sjNS_yBa;2F;JMnZj
zDv@O@%4M2yh34+Uow!JcVn(vX;zp15)I|S2s{z(KS1?6LJYQp14Ce6u|lni`(UlV$EMGtbfOL^A+AKQiwW4Z*v)vR-hr3qLCkGv-_zUP=
zYA^-W$RYmn%7UOssr&O+g1>K8_EdIVAcy>rZt!|AoL)t#yP2u-pds^Q7Sle^fG@|_
z6_5g8Vhv2_IPp_I0L;__Bnf_SZ7nihcW2so>q>y?=MgI8T_sE38L~@tKX^6qF
z?nnr7Hgie2YJX==$~1)cPN^z?FZ=B#GHCT0$9P%tOnDd_87}DZHpiOUw9|Fkf{4bD
z5Zpkh=A(j5MMnzLK_;Gu>Eh&_?jk(oqarusumy7$DCJ3C8p1^Ho(u=O2j`}hfmxu8
z%Ks^LK;}BUaAaz>3(PWv8bY^;P`ggLdOMy@^^j`Ml@g
zqZOxeEkHw13$z;xOh*G7V_8+L(AJ*XeOW=wl0ZB>iG$#okuihHRXL$!oFtqhwPTOu
zK?9Y??IX7PQt7(7&5UG|G66LksmE?ANp9hnva@{WYl^XGUKC^@nnNWzCcONpUV(h_
z>9qjhbJbK#rvSw0RFSjXO~C;NHs<2RI-(NFX5->lMOGpx)(O_KZ-
z_&%HwZsC!81WQoJ*t$x}2<*Zxk&|T}<9zYUV0ahfuSUu`ZiJ#FH`e?Vxh>`v=FGC7
z$y>i*-v#YI0&DGS*q|uAV-7uvIY$p^=j=>jpd;3W6m^QGZY1{!G2?*qF%w3|ZVLD5
zr~nbM^Qt<8@#OPqpIhF|Z#F;gCG)C!3g;LKzuZ=$7?KqtC=xp7Ho!nv{OD+=qz`gu
z8?hIy0=W(l@SzqqFx`E~9UO_8>N0`7pbJNHyq22KtJkhe@XwPi6DmXYI_npE)i2qY|;I0h4*Klu%9Cg!ZiCp80cRUektIT1^&r)Uq9Li54jG&-w
z@Keq@sB_VZL5V^x%unmW&yD5`de;(6Xk#7@rQl8h;jX=nSX>l(;&q*T>wXWs#>~(%
zjD%L(?C|o<)kpVem!6=cZdo0}9is|1n$O3?EtK(OOl+Q65<+2FUCUwv1wH>yo_-Hx
zpRwhr^j8-H)XH>TEmrN5N|gbwsip_>npzj7L~u7@#-3Y6-FfylgdDJ9nt9b+WfJTT
znn{9(a4zfpl@{a8UB7Zb-baZ-jQRR=_d)kq
zO7f_J@QM+PoelM`Zz*FW!CBWK&ksHvhI{GUb+~s|NIErYo{a|N)lUuFndmGn=qq1e
zTKsF}7Ltq;N}m+5zD$FkMeng6J9RFhsb+;QorKSgMUIXT&Msg$7Dc@i{8W=Q5NA0cH$BxKAT=4c8iU7(H#(3+OxW
z@A?!^+|E-*2aM25!;B-HfsU-_45y7_%_N9qxD8*xB0D$u=N|}&^~6Pf1aT1b#zkX_
zwv9fn#txXHPBf=2V$5`6)xTM$lx5JqP&k@s2(Ou?xTa8^!3L}mD~=vNY8yZ%Y90E0
zFB?yhM)Lou9kCjZG*HGsXylAp+#nhnE<9yO!Yki6T^-Dqe^BZqYPSUy)DTz{oG%8j
zK(L6c-4Hb4E*2K`dC=43C_IW<)qe7leEiLg6EkT^9KAInc#34+`Te7Ut;obe9$8le
zMN~ziYv9|l*o5to2OHYj;6`-L4G8j<*fRCF;lL3$*SomP)0_HzYI*}%V_EFNBR5LA
ztd{C1r&R9OMa9A*Zp)Ni3X4yxijC%Ur^7j7=nmAB{PJ`mfw)P?>op+$1F+9B$G>dJ
zJgw293G0_~2jZp2$@^n_ad#^??xyRm&E?%?2qbzC5hzDam<|#4ybXY@Vikx8LHIr2
zDKxSj$?{i7&snGc3zkpS?BmbJ^}7gBjNA@Uh+G|7h;g
zV!Cm~1*XUoVEiN9sB2v9LtZ%KOw;)xXSc?lF?K2QB?MIM1?Ypq+Bk?$k2T#>5?m~o
z(PHY&1=yp$8A7N}H;|kwinLgyK$?BAf&WfotFuqMTW6>1|h1COE5PTT0tUKjGYE-
zt+iJN)29QIg%WYha9PO|l!(wU$sEMK-m&d>4s$gOQ_^F>en@7}SPgY`E
zCQNPXm8Tck>Flwhy#O4#zaYhhjnI=+Q~vUS`ZRo#0tzEeLhYAPaha0VgXEG?>y_@%<6DH%T&S=zKGq-5FCQc>phke)g#ToTe6*8a+e#H
zUT``&I0lq7s`7OP3I}eT?m0bIbf|jFT#@O{HNE}WGL)%MUj20}^knp@+1rd3`E+F9
zxNf>C`ZTux$5$f24f8L92R&?v?~cQS17<%aVEwo*&S&$z_WsiboruFi=x~DVhEwS#
zz>~}Um?(HnGP*nYX}tyNA0jNVAgI9fp*XL9dq4!>iTDd`-B&6BsaA%~;SFDY!am(#
zO%D^2Hk1|Qo_5<0?rMjMVuF&x2*xur=yb#x4kfjAbiLy_e$^~-$40&iH0|5%JL#h2
z0smw%^_Ri3!K<8#;n7*^85$Fp<%ydN-RYrRKHaAGw0%;-3iyTa+4uD(?$O1*|KUwx00jN$eOD-u
za6m4YH7Mq&^cS+xYjH>})NMC>h%Oz2ZjXd!0=;5bcj+|!?@d~F0JN|2^o*^+t!C-;
zOiU2aG0#0_l1Pq7#>D}V;+Ylg8Mg^mBfZ`Fvbv}rq7Ftrxzc<(bZk=oW2N!`a$l*#
z|0@&tMg;#4&z66|f1;cHua*BlKt}`mF*%bief8)b_`v8JshUM2AEeZUO#;ytN3y;|
z`Nxu5zmu)gfx8!wZ8R!|8?zypEIDFeuSD;HRe6W<7&3xKveAc=|ZJK!;o#b3PF*S>Y!dGh}D5Z
zM^`}9;F@XS-f!L^7ustAXaN_J8vxxmF39rSdW7%LeNW0^Xxrq-b4^nB%_H(&+G``9
zE?44nt~}UA$h%D@Dre!{$m@e-G0NY5=Kpw&l9xdy05KP7{=@~;49^MYhjlsL?gMQ}
z*+<#4RIWm~E0#XUF5l2+C-X7+nG>>E$&EpXQ!=~rF_~ZbT<7U9VV3(VfG}re?uHt*0xjl(
z?aYx(##?TVLu8FzvP}>WtuNpb>|q@F{iW
z!Eo}idg77z4($u@tsi=gdMS5d`GhBMG7GGXCz1xF#Csti&Wt61q-p00!BZ>%8Pf^h#>w%kklrBD8mH#TvFll
zq51*PKA>-&Y6x9Mckt0^d9mY1|>mhJ{O~tZ%3rMC+Yz{&q5M9JP?0|X$|LIzYbX*J{c4^O+>&n>kMI%}{P;<&*i_nP
zaZA9Z>be7r3)#bm>S4aKo@xm%O=r^ZujRvH)`fL!p;#Xbdh1PybFXD*u|)@Mqm@X7
zB__jb_HCJwZ#<_E@k6I-$;4bX7m9AACPyz(@UY~EoBRFVyn0nAb}}he>WA6kpLlxx
z3QA!2QA5dRag(J`0N80;
z&=Hl<0DKX4LnAI1)aHi5uU1mkrrokc!+yBz-+@PPrsc%%H_x-1Q_s8KX$iq_a%UQI
zhFAcOovpi|?C3S_JVGIWxyfF-3~vC&%cx(j$Y4nH<)s{Pd;q|`fmHbRK!_521E+U8Q;Q?uZ2m{vL5zK4F)`>Pxfob~k@C16{
z)h*Ahgb5F7=04vy0!l={A6*aO{kJ?rv?pd5BLS!jaQ3&UZ_Rd}7BxV>9d*#`e`oIk
zrzRGW#^;`JV>KM8k8RUYX&^)C>YDqUSr>`%%L!K*R-h@*v0;^-yB!v-Qp3k!XP2wU
z*R2dle;~|EA~;%rr+0N3?aCb?8m%XjQ3fgju2#vY(;Kz=jj+^IPgS^%&i$B2)z~9J
zkeoS?a6u>6+WriAp!_XvkKPT|qpx~!bxNMqub*aLW9r;YzC%%OZx#Lxj*8*eY=v1o
z8gQ`}7qIz)))T3xsELXeL@V(ZK0tZ8&GD@S8+pU77zYkwmdZk7jF)Ds=*C~51&Z&ODdBEPm{+uva(
zVVaqs{wa?Zs0?J1n&f+joxu(A5y2`8TvpOGED4Cs2aiE`8~2x1a(ZfQ}0{DU|CeAXzcgiFO2X{LqUeQ@s~X+&EKg&lFSZTdtrK!6>E
zUAih64J4j+V4@m^ilc7u?<}$E9-^3TEg2-2bYo20~j!DUDH|Cwu0|+SiT7!eyL<=J55zwJcwKbIX
zqDO5Kkv^n;^8Wd1si8y^vmNc{ZM;1@vZ}8wIf(LkV}BEBO^J#Gon-^;4dk~%4zq|i
zQK^&BrIgmlR43^{vuDY+IFu1MeQ(zc3TXAk#+Xn01#w;$Gx+l;mhw6890%&K?=Wca
z`y>WZ5}Hnx^z@;A|CmSFyCCc_H(vx{G_D>Ru{Jtqf6d|mDKKVOac7@|yl)k}KB;T4
zUW$`IfhC|)&^WOrO>{+q2y+%%jEbe(soS|zE8tC?pO#?1oG~|XMl;I#W&yXJeq+wd
zc`V)HBWNBrmr^R=FMu%2NMf6w@4ZJ!?g@Vn&VFKT*Dh$Su?pA=ZA-VaHvG-u-WjwN
zzT_A5lBceE75xa%xey02XJSaUU!nP_4)nt*TA%i{=j+D_?u^J8l*|;RZj+z>&WGrS
zOFK15NM?__GyRP_E5+wI8bnx-v#Ch@*!)@Ncr99Ku!%3NH}|}&RbI&KyQL({JMd>q^2*KVi9+
zt_bR(2NlMO=b`oEVk=%=~k#I
z#*0~bnP(h0xTL1w_PbC;$Nl-641>rp7X#fX+D-}_tgJ6gctto#_(+UCn@mP)^j^{>
z3&q2f{R5t^B%wgU5|zvajSG66Z|Y&oWM4C=>D9NHwkObzgYeNWzFo1)NhD19!1vHi
zZL7`i1lM3eh=e%2Y%^OgME#$Wg@p*9Ei|~`J7>gSK&H;?CZqw})m!UtPKoj3mrW|o
z3&Y57v!=NB{l%?}Di|PvJyex!E1l&IF+XHz8Op(C^P~0icG-rQ3APSkbORT@_};5X
z>;Q8~02lhzc@L23U++uqGHPlNIpv+)3yUEhE&G9RZt5L&do7&A&n>
zW5=Bzru=0%XQsTWwpxvTtBecHPTw-o0`5Pdgy)Hu#a#^ud>SYl`Y4(8!!=To;siU`
zyyGnr1xYPGh@B5l;4GT-Fl|!xE=KxSNv=)i@JKQIyvghw+H6INr|Q)^v}UVb2s=Np
zHDONv;lM)M`!`m9ymc{#3J(gdI_K>VP-
zRfXokW)Tle9gX=+$^kPYO!i>9tZ9l$p>$sCsLMjyh~n4?vlBoPM)~7bn=+osPT%23
zUEHPt!k?i9yb4!$^N15*sb_z-!36y^s3w1GHgZg5%KrtrJ3!CU;LI=f%ilIQ$TY%2
zu7m=6jKP$^r!uAD63l*q;iRu254U?s>gQGe8Xs4jO_EkK5B)r~l3X+@BP%vLz#y$P
zFckLvSBjMd9?5@%oxhubQ6(5x6euu`?f-?&1CgGqn?i$^R)c{+y6q7%L2nY6Gh^iG
z7M3xGgknn4O>%M5fe%Dn<9enQ95Z>X1g=<~KS?T7%LK=m0h_ZMZoRb@mh}um?b;|e
zr<@6fjk4M{e>6**3lv3Z_sVi#PwyN}&W@QCkVXeZ^%clSo0jP(q3Pkl^WdtwGB=uA
zt&e0)`uR9G_QRu%X;@+S(2KI7$=}5HCWAtYpy+R0b__nfv0=T~9BWu1T*29ff&)3U
z6tvM%8)oh!Xd+~X^HAK@*SI(&xl?4Utg3RIbtk7T`0Pw%I3S5L;4IVx0aX9@J6lwC
z_WlT;l-|l`f3nU6lKw=A-M_e6x8mPX6CkI)L{*Twlo&6Nt&X7nK09*3TJyp1Gm54v
zM-hshOfoH(tz6eU><>nVxtkfeL8+CgBV($s+~W^Dy#_o#gz36<;g$s3-_<
zqO3|+$naz{;5byX!Sd>o#^n;%$3w}Vu8}TrvfO|05mHxmk*uSx@z68R2)Ve_QaX%A
z4JSgZ4xb@J1Urg9^040=`q}%R)wfMyaCVgqie#j4HC+W@r}Qh&aNU#dv59(<0*On+
zkrxVX7ZDPT_J4^T#k
zz^g`+Kz!~RA{93@D%dYF3udkINY!(&6`XfE5Nx}iL3tbc0h?8eINUhmEn)vli!X%l
zn{a{+uZ(DmXrA%}_IP4%()z+}9_;Gs{D>gr!Kfsctb{5&@e4VO{~RQd*-g0C0rwM<
z!e~|e`m9X!Tm9C2Uxu2f*jE#02%>6p5|`A*Z24&oJoZo@o|r+xA;P}_-lvYme%qF8
zBs`4zAs)S-s#a*_wm;>S!>gGplbY$Bii@=M1Uq)f=er_MK&`W0lo39+*F1#pHE5e6
zXZ6kkwE&9>>f#~m${8_N37;Z0SjS_RSz*;{zy#CP?tz3kRkqBetEawOO>ioxpZ~g8
z^pYr*q-nMm3*tAB^8V_8n(!G95ZXl2&NxFAlr}GBTNxr+hJRyCh=JrwPJK(t2EI#H
z5E-_6ST69?oL;nSse3Q=Q_~)C%*2pQXDh?=Kyh?D2=CA_qaH9YiaI0+rpOPXj*toeuU{1}_k*EG
z8{Wx<2ads<6okmFc)dudBJ$JyU9fkiQXoO<`@RP;`*mK?>WHur!U@IA`L)#alB{`6
z<9YR0e+qI06#2A}sWjF*1?+^T6QU{Y8ylA^s{?^*vu}2naOgMSMf3!5a-5MS^&tN<
z{*5`-7EDlnfC!0yoHppnnAIm(iZZDz7an|aCxT(Qto4fe#KVGRO9fT$u*3uMH;_b*
z5qrKjJtbppsS|5VK&kUQ#Z6&4`}*bM?`aTJp@VoJeHpSXG@5E0n9hRwY9L2^oH5Ln
zodoZpzU=qNf=^V$mX@s@c!^BHf4WOE3l{H~lK|0XS`H?hO|0YSrp(@`CpFk6F%gaA
zAV#>L_5-A3{0Tt$Z8`@K--Kj7eD|wRK#Fwggn9a4gMs{zTu=bZF!lqwuox
zmy#l+8ac->#m%iaML1x>yN5cveN@uof01aTOU^iik{drqqw>o}50bKr)BPK;A7?b3
z5W}nW25!Kp^CMCPA)`#KgpF22Rwx!SshLapP3%mG3|^y+AM%ow8ng1D-lS{7gbS<1
zC#!
zxS+~xZ2`$dulKMtgO;=iK%AD)^PAeYXn$9+HkWB-=bdY)4Z>9RQe9~XHW(ny0+U~4
zIi&M%v^W;_TpszoU4kCY+T;q&IAkS2qs8q>KAD+hJvPSY6iSA(LN}(o9;K`qC$VDy
zAx0$cGli?FY1J@5@7M|IC*xC;00Qlvkj<+O=Tw>3aSDU}8Wr6SOVSG|NoVwR=$}$xBz)0n(@<&0w%3i_
zcPp@{LW-2d#V|ms6|rlGnwO30?Bb%hGX_&UYnH1FU{iN*A1-oqUuF>$4uLex39_?c
zYVZ?m*1QZlKdl-(!soglytwqw)G|>YAtN2HQi8u=PMTL$WadKzH&i{5BF88lZF8|-
zJyL)-W#^@JA?K0I86TS#G&v1Ibf?cx)=PDD+L*zxMs1f+Fx7R?#U&JPTq0fZ2l(#>
z!vD&K`ghn?vLkR?4-i_DDFeh%7k7-6x(82C#6;6Z3X}a%NidQ_^nK`Y@#T07(*eXJ
zsd=%uaX^u2u5OV?_9lg8jmx7;Q%x68l3L)(>X9lDs*s2?+EslDx>}}o_GEe&Ik%UN
z^t;D8A)F(M+djTpFeUDy+8V9D-x!`gjx&eA>E2$DaJf;dSg?_1(K3|mg=+~CE
zsFXudR)zLVRtgBrO-%R!S*llCp^i9LEsIuucDbFx*5NwxOZc;$Q=2OS6QuZRP|Vnc
zi3t6~l?6y~kff>b(7VN&P(F(=j1-Zw<4^e^OOy6?iv&a9Drh4bAoBHSoDqu6|B7nC
zPf@)Z%t!ngk??s_D5aDoG?ayT@Y7ak&h~c?oON0$aTQ2?YZ~ySKiZdni!YR9GX6}X
z^5D#QCNpQASLBe52N08eNBcDQ$w_w!Gm=Xq1u+*pFZlibKo}?TXj+7VUK;sW%+tPp
z5z%AjR7MysYWfoW*-KP<*T&V|vxMf1H<=ii&QHZW@>vBkT4Jl}0Th+V`y3Gm+SRP?
zwQ4G9<$HweJm{d){j-o~viFRd`i{QRI2XLTQ2Yf3aAeZ+eT`}5o9*{u|18@%qNLiG
zAYFuDWl=*)3g6IbW!nTNWrsWf#2|>{)Al)dpW7QTtx7}to_vZLQ!juMxr%3>v<56I
z+I02;t?^}5uIXW8HtW9Vvt6iI$&hxB1E^ys5(qq0Vea?(k_Gp~{X#W7bw_rTE7AZx
zIvJ)WOms_gpRTsp)*}lc?7tk%Qj=C$EvcX
zu~#Ue?`zZtkJ^RdqoV66!9xhf(TFxedE>PP1!9KcwJ_V0@#xvI#zY&5#$=DCB(>~b
z$fQZqz}}GpLz<5W*&~a2q;iYC97M6rM3tc>4H+^3B+IAv%*F5bia(Zd`-^T9DO$
zQFGCI3-rd{R2o#3YOFRgU6XVR3eVF8LvS+4cB^X;T0g_HZk?)uw=kfzek
z5e*TM{+Do+*ef6|Dq}JB+U$N(vu^yAD02&NxEU0;vHjb&h!>*WwUvIYODI>8D{`xC
zxY6v`AqaFt8&lS_I~Y^mbgBPDUT%6h4N)|S$ZOC~oYsJmpGDkpY$1q3!CU5#-AJe$
zfE*Mc(j-a(qKxunjQS~09mn}#kIU-B$IIImbJYX{+OmU^66rrFJRmx)wURE`1jXkx
zqbbrKhbTZ%2R#T=4p)1+9&w%_U|p(>A3^M5)*)@Ba*!aGqdzLJ6uimLYz=XG0+ej0
zDOnYGye?GU*w;87w~jez0R^4{hcIF1#k+Tyya+b>|6z^QIo36mJEbT-5R+pm|Xat
z;Tb||2-NLs5>8!827a>WJo6wxeXO32c4Li_FuA}k?ONRA<@o)_`N
zN({7@fV|E^Gk{m`v-*1!6rihBTXj&uXn8yIG#TAzpJcf2GVvADSQHRzvN|vtJM2?P
zqcoe0w>J(E8%sp8`4PvBh>VfQ|K2xp8(l
z>We+>0lp&&t-*y8>=Xe~Ou=G98XaCubqZqY7zFO*)I@@6YmkG*9vCP)!%)Skh+j&^
ziwwi;n)2TW)m6`F@+w0m{$8BOcgPe$ahjA)aoXFaugD);$obzLzhH=hTk8#+e6gxvLuKE4|vwS%l(77^U%S-UUNI#8($%IgS^e07apTA0ETe-xfOQ}jNP@<8C_`OE$4LW)NR
z(*MK-LEN56wLwuBJN7;NK?oA<$)6LOzlJ>u6D_m@e=?R;Esw%H5a4m(xCR{zy_u%JpsS)r)77z-T{))E^BU24Sg0eyAMi$vVml2Nv3Vd)h
zvE@lWK)A7`1t6fKT=8qGpb;b}iN$D~5AKsuRvEJz0*chY(wUK{RGMoB@%N#VFb_y%
zDYm6>Fgue{##ok9=u`;55R!ZVM*Ex}Wl$F*$D0tM+jvD>Yv_i?^mZmA6hw#_$PMB}
z-EwEW%)oX|Q!C9B*|f3+Kllr;tEaGt|Fi+>Q+Rgf?nnPYOZ3`Hujf*eHcg+gnlb1s
z?%+`4S!5NaJqneFdc|b<4mf{%uwq)+(_VyUSf-t|o*Mh}(1nzyOI>bzad*+eQD7rl
zrN`vq>b$Jx4tGyhcG)|@H9HNpE$Fc(S?AOO?y(8?DH+<8)R?CkiGnmepj}n?>Vu#?
z2rNTAp9s8g-)V*}*-ErdS!a;`lt?=nGu=FP$?x6U(zIg6dI%vGwU9bAt(cS|L6&Jj
zIyu7Uc7(?ORjq1>C!}YQYeXq9jXo50xgDZbI1qT=AT#FQG9`OPV_AAnQ>nuZl+M15
zk-MbfQ_-+ujPl0=Q}I+EU#IrY8=kb)3oRn}&45&Fl6cKoo)OeUJt~+8uEf_4gA%I|
z&HGcA!$aom`dby8l@B*ZTKf*y-=rRn_-*xO48wiWIyPO2o2HP!QBfi%s3G!b7#81n
ze={B<_cUpJwk+KP5j}s=V8XJ5
zJy3xJH^EpMTIwys6jMpv7YzCNid{W3)`377a)jEDxU!y;uEJS=6se{H$w!Et-sE`#
zlzZ94UZN{5$nWbAN=*_O?l0w!si8px_wf)Nfz9gaJ?^=YY1kH~4_l2c-MN?|u!uPN
zUf1~;JK0>`HM9+hC^S)Gq(F^u3To$r<9E?_-_*w~{jIR`TTw8xK4C2`O~$wzRXP;2
zFy*HYS3F!m+XX{HLx68TyEJ>w^1tvFUv(ZHeY*OeRy9OU@cszt^lvJ*>(}nebsSUC
z&qeOF#`!+X35QLSZI`0EfU_`-B4Wk2yHr|T4q)uqZ1}A{dT{tr-UN}$$S`aiwuytH
zlsMMlT--0-kqk}|H%k|(6q6Dvs-~%u{F$?N_hcZI!RBy-V0Ac=)ZBfCv;>hgwuAAj
zCgyuENy!!WJJr~cRbAiwmn6%EXe2XRaqh63Bt)h!n9kd&t>Y%xzZWC{;{1I!TqOV!
zb`SpEhF9YUE+@|Q%1B=1a5gR?S0*-D>UEso;i*;}r{nv@);$GwZL@CDBevc8kuNe{
zslMG-GXG%RB|(X5lkQK`l*|IAo9%m%p-Ue?w&XzW7l7CBk}_eiJKlv!)qOv-itV
zeSQ=iiKZ|1n;+*^%;LeI&2!HJs*Fw_M&uMgqVX!i(RpM>ZTAbBab_GorHJA0?P-;=
zN!Vc>cMzkXvBq1=&czm<=UC{O+3C#2{|H(BCj-+9+$Zma31_Cx`Ab_N!XV<*0=s&Y
zZy3aC-gXraCjS)9{(HMg_s~rMODh|H09Dp@s;a9JWlytKUw5dvSjJqw@aab65e336LXMOklm6{C~Zo7Y0TI=6@gl
zf4_sU;*eC*6VTPW|NiX%6O#;iJM{nSm;Zm>zRe2oxqO$oH-yF{8#n=uX(HX2H3)tu
zQv10B0UH}TndO6Uf|6QZX>X(TBFVe~x;a%vMnA%wqr2TWesbqYeiz+n2w7j>
zg`HGaBjvtCH4tt>!623_S!C`&%D%xvdI*T!5F|H!sSRuJYjrqV>z{xf_x#K_9MkRl
zPVDZ5YUb1uKUCQSC#Adl3N0Ez=quYNy@)Rb+Li(dg8UDjPvX&m&tf!h9@hSv-_hmT
zvif5D#?JTZ@8^Yxh}Yf$f|^FrGFm4Lo%zvG|M=P!WE?E=-E_8Rd_n4N_KQaNvmk^-
zY$(D!GnC~Il^8J|cU|cdu)Y%)&$0q-|LdKApFpdR5LQiufjnls9amLo@kfgAwRV(G
zEJjL=PI?jQ*3XDq8Cv+76_W_&)VA9fG0cD-#cX75Zf<9jH!__DlS-$E`5X@SL7sK(
zLA0XcBGbVsRlF?4f#Dl62wt{{SG-4FK3HnQHEM5#fN&?iZhQQagP$=nW(mY%Q6;SU
zU4i`eWfgdFfp9PZ`9hV0O?!va@|=vD4>T=oIp<*)T=j$`PO1DI=NKqTd$<6urQ1le
z^sseZIgBs3S1uU|`t>f>v}%Rig1*j3o-EIF-yeS-CblP(<5UVdJKf=5SXTtu3rJVQ
zS|}Dm3;-GeyXdCcCL=j)zS-N~txWGzrDpk>y!FQ`&Fq@>oK6E|W^Qh>uT7zlr`7H6WBPb(TeP|nCT+6uoYN)+fA)^{
z&!GUD(`Z>f8TWJOnA;xQ2Y7%-sGT^N1km$;l8=JMnaC
zS+lFgSiCPao$9Qh<|8)Lbltr3Iis4?T)@RMp2VMa#Ejpb>)RpW;dTi~(ka0}zIy3Z
zV(D;IPkj(=n25>B0N@zlg_u^?Ik5W$X6c9|b7ewa55|Nkz5z+?HBntJKkk
z$TrNE#Gdx3nN93d;ITJ__#^M=nGOtxi0$rm#4I+E?wv*knyT#5EcdRmFd+%YF~xlY
z1FIFVTVH%;hnnA7tVJ00Q(wQg!KuJ0NhOgW7#Zb3PPJEBAR7VbDABOn=|19OlDmeZ
zhEcR}yvfp7rhdAUAl8e}+~Mz!1QtC=O~#3-Tfh25O3#jXy4nTLVoWYyMfFpU6ZVs~
z#NkI8Wm0Zx)D@wX-XEJ>ayk%)aWC8_c>Z>`Byt`-@#Q
zAO8()rOOi=@&40*l}|4zR7gkJ>M#?!N1ljs$WF0{8rs&jDo79cSvO}yay25TEU=jQ
z`xp!+sNKeTFI35kb7Jf#&>|z4b!X|1Cctcc{Z*yi!B$2|Hj?EL-^hE%%Oe6oBmq5{
z*{BW%^;EX;j9)H{3=H1uqQ`tTM(q
zCUpNPYJ16I+!<~e$AzH%hViQMRqDNqBTwyWxOl}^aj_+l5-=FUmxA+qAdO_y^Mw`#
zWR9l(@PXLinh)nI>SW#^cqKOuze{(aBgB5}u6KMIX;IQmM#-Pn;e>cq5P`)dqyme;
zOQg<|{++B#%K5e_FE36dT%xdLog(sJL_SvqvGmrm-zPZuGc}Wqb?SD1LOjHayBg8W
zu%mG@iLAqpdw4T`w58Jg(9YeA^~0CH@twg*PM_{D3ag2-LEc>4It%^
zZ8pBXK&x2HVM5>ZPfSL~6Ef6h1md+0R4-_y;%w0pttXsSy3iUj3#Uq@J{|z6@L^25
z%vjIcDn_S~2ye4x46avgOwh*N=o~4O>CrY^u9WSMa1vP9{vP>m?Z+a8JC~lYwo;T5
zYMOqLkB@XCE1mM8@_l9?f>+?FF&|o$y>L!0}{$j1y!gkSS2tVFr
zo^S*MjpxBva|Kf+L)N(f>rcUTL+?+=iLq6F3~2y$|0K#p$dk#Q1GO7asNlbMs&p0b
zr8%=jO)Y5flB5FeraOBW+d~Bhtf87myimVt%q=1lGS2+8nn{}C3oX9sfKC3~ohxYs
z?7xtp6plbVwNgR>l^jxy1iWxOzrg}C%t)Vp83l{f=HW%zTjc~N&aB-^yo
znUof4=Gp*Tm|W#!KcUprlBo{`cy*1?Rv8-Phr!e%4t+KMn`GT*$4lq)e`4QLgeZgeyJ%~om
z=c2!ad$coKwaS&5*7}YG;sxD(gOBQR
z)egB4LHd#W;!8J1rP>5hk6*N5pn$q}^jgn5_nm1kCJ0K)+UNrJ38R^m(}YBD$hw=Y
z(rrF*szDLS6rH;+-;}2=Hl3lrfGj_nc_b+pm_%&3zc&?Ye3SL7z`~Zq0Lnc~nk;F3
z23DliTlnhi<7uX=m?##L7R}H?WIH!
z)qAIvR;cpC+{pcXo3DpPemka9PB}F7TL!RzhDL@96Jh?UY1n8c&h>f
z&p}H0g7zvS1N}3A!{61=e#k^F6OGb)`}=DLegT7)pc<0;7FmmDD^ZjSkRxkE2Hb#}N
z99R{9bU&a~#;`eWpq=25YWj|UGGjfc%16`I^I-;rT>4qg1lRS-?)n+C3_dQIrxJz3!xz5xQBEsmco1AM=q&M#8-^`Y
z*zXSH%Hvh*p!g<;I!5689?gc`FFZy#Kbf6AG~K)gT9&y9DMO2`uKU2i{7TotG`(}`
zose9s%np;fp8=4ol9(?;?l6s}%^yg@84evZ!Zdnv4lX>ZQ$*7e70qCO+2;W=K05n+
z*RN7=o{&hSp(@VcrQ8ci;0HfI`=moIhuo3Bd#6@86n-2ix4Sm?6-VjAgE$?Neh;*U
z)1vtCnbg<#k&4fS*-L0|=!BQ=u_S&~#gH5kbNjyaP?L^tNjS+c`LX`mtsnH}fg2v+
z&JjJL&T>zUE^*3Mze_Ek&RSQ;Z=(>L4fl{jqH(UD?kpJ%noYR=JN(5xE2#jVL}x`PhyXasR=iT358
z3h5wAQ>>Dz))1;(LrKjnweMPKJrUuOY&aaH1X);X9;OV6Njn1p-7>>#H5_
z1y?GLT|FW}>!|4L$%|J(79p|tVRGztS)=Usm1MZVChUoItKz-y#ZK`Ld?Q7@BrbEG
z8pK6g$@n`Uc$eIWb9Z
zV%#s&tF=OvMF>bCsRWODndm{!vc?sOn4WTRfrgCH;oLS(D}`=;7ZIwM?>Wg{{I8ws
zn(NVTev!0~ii$PSwJJ+GZVxu|Nvi^E8qv~z6~zmmjWNJ&cfh1b%Ei<#}NP2o_HUT%-Y
z#mP0329SKFX_#hze(mch$+iu_~v{VtCw_Ke6FA&L2P<}3NFyvH-XgNv!0acpPA
z;N+=~UKIV?84oL4WBC3PR4b_#+?&((M=kY}*O(yE?S9m++!BIV;vu@?G0|!397`6l
zNZoEYwy|f3_dF#2zF|eplux7~OW%)Z!~`)&(p)d&lLNXEmLE}$z@{IR!R!utEqI7z
zy0RH49W7@eG_)mhHMp>Xg6rL}B@7A7_?lIk*v^C^zGA@p8B|^2WY};8i3!#G99$@K
z$i}@NH*MxFCC!NyccM!Dr1B1cW;JH;EJ-i
z2H%R92K+`$b&?1)`ut+&yf0V2fbGY<*pzS({RnZgR75~I?kp(IqP4)xbY!~W`m1#Qiu_YpQq3Q1>
zXgyZUG~gf-Y@)GHe-axSq8C92lG(5oDs>BJiCXMKm&!<4$iyb~$vy~0BluB%Ar+kZ
z6*5RjccLqZF80AXua`d8fn|dip(7z4v?OWtP}z}
z8RkNKSEHiUX95De2hdV6H%WsoTup3?ePjiDo=AYa4U%(X=4ODdVHQlCsFmxet{{b9
z_{_R$?oYlcv>iUDpqzy|pn?BksPvAf-c7?&TQ}s%ribxuxkwuOLed&2JuVndFHhB@
z)ii1?x6h1PcE~r@$Kex0{4B{yBBkXvHO_EMh^cB&RfU#eImavlI7rf`l=S6Amp-_7
zAx5wVT`xbvC}jrIPqKIqT0|M%eZEEq5y|O>m4`)wNaYc#J|IJpJyBM}V;W?!H0uvaAif;(Sd0d7_Ons&o+X0{U6wAUHA
zlnPlKdcz7`iqfM&Z^Hvk@lfW$z*m1aT7%l81?}v}rzYvpZWUd&gL6rAIa{zyb-v|T
znt^2hM=mqkSFM>rdL}9kBP=NMU4sPCi)X$b(cmCbh3p3*UOv8hx|GRz4*hJN)h+Q5Yw#&jgZ&G^%d+iSwUNWKS^DS=`
zzvM7L4Xl?LEG2`|h;jOD1)c%RNj5)^XsSiK*%f=MO^u%g6vG$R8Io~{k$tB6NBTP0
zbxQQFg?XE?V}`!U5kv&bu*k;5^?DtP`nS})E6cz)wQc~Q8kFk>kBxDN@#%7N49R0@
zb7JJpbMoPR-JdW7`Ep*bvU3}DI@8IAUirMZpZvjN{K`0uNQ*lfTNOCaE+c~#+4E*#
zS!Y|#{j-lMzxrO^sM)`{VlQkm?U1W_Q!vDeb21ziM)&@BA?w1)woY8Q7fAY7)VbiQ
zb9Nqq50LI--y6%W7o#z92i%HRtPztIfvL|TNy6+u4{ur?^yiCD2~n8;N-|<~Twy~d
zixg6$;etZ*L$%@CJi28?_jsloY+XLS7n`BB`}8qJK-vdNL|Ufix*1#Mhdt6bB&XR>)yC<
zJ8Q%A36Tp5j7=gvU!;jboi*BX_Y1%(jsATF<7SSERBql8NmD=s`nR9LQfx{aW+`wCsz~CFd>UP=
z(kcyF@-7oM9FYY((!Ack4-ih@>&LO13)eX0Y$Jx@TxcI&`j=v!Y+}$8*!=ep2Su1W^bR7ho>wEvK6#6AzU=P(e2e
z#1JWf9rS1l?93ovjNfS_m(*$+}
zEXI8(fo~@mL)T8=j~;GrZZZlA;k7;Ya2ObzgBWej@x#t3*XJsjl&QhVlt}1|9J>mb
zFJpC|NCH>j59g|3H#X2&Z@;^2>Rf64EI9JZmCRG9Y56dwv&bAa*jqQrg`Ed~OBDW#
zVLle}IB^wB(AyUS3TnlD_{NzIgX%|fc5OYh+a3(PvtTNtGBXSr6xop)CB
z0nc%ySo=ax{p=`sVk5s`B+TxifjUn+$OOnl$^3aPuIt2Qkt4=yJ
z7sv)p3ZF5MCk}I>UL%EH?J?u4YktVBxnFH+Y6vbVu~=yJ#B8!%(*yY&Y1Pi_=Og-E
zpC(FtMvx%yt0O{ybG0RJ_&9^!Bw96JK+Jr<9TJ5m)-=ke8X|%V1r2F$nF4YBr#`X}
zeYL=VBE$Ubh2HpdzKI&9htL!%&cJ6u?iqMco*XHBHz^M}&3=-6TXg&qG}W@|UD$n}
z>dH&Ok^>bC#eG`Xnis8yddRIR41DWfE>aS^t&$T=`;4V#i&uJjVZejo>NUCh&!`
zChxz
z_a@esbI~)aVYZ2r{!f@Jcf4+CfLQJ}Oxn2X$6!*gSQq{pz{hNUFqDB0nrP$GBJL`f
z8p5(udaP&A=!N$`?KlRDNv3)XtbfH%75&E1MCJ8y`i5xGw7EF~LWAngH*il4k03_t
z;I^rYFUWie9De_B)yiJ`Eif~&WRQ#KC4&9ohpC2;pGys0RFR6Gn0PBLem2|A2PCMF
zB%n?X@lSI!4EgHW7^;{MKE2`RC9wJD#w|U-7qlsm@};*@%l26=NsPq2T188-t9i+<
z<*DE<8$h>u@&(7Sy)|2tI*sxGNzc}YQu-A6{v2cLSlRBTA{8R721p#3$d4>QVq&6b2J(Oi
zL8U@jTB18UMAq7<{?Lt8x||GJDBFq?y6s@Am{q~$(ws3l4>m1=JbIH@BoKKmkPDn9
z%Pyt&UZx>rg}xiNtX?pO%@030*-%0P27?G+O^j3NE%`V4_V~q5o1bz`kKUe_5L?xg
zIB&)5Q`eucVMT%%@&lz};To2;x7k3IF1VVN&7iPHYXyhO)BaLkzL6-^sjsA&!mwwh
z=(38UgnZt}OCAmkda9YfDnFJHSVEB(ef3s~iBPP)@e$^83GGhbS
zT)1t|yeK<8u=&dlB8&6Xw?0I9_i0~pwkIAqpzb;0Uc~V>#!tF*i7;aV8Fs2tM%(v@
z@Y%@g>6aH0TC>@&1kPEz$x<@u&J)}n$;n9<7D^GU$b|s4KB;=yQv2=gUr-t;CN;_a
zjOPKEy)z^FJVd9{oT4
zG3)j;-K@5Q6&u=5ALToO28X!yOHR#Dnb$EHQoCM~SakiMrI3xO(aR87U)O`tzH^dd
z70yhMGvc=CPur8k%{SmPG{?(VoY@)4u3zCLH>4n2nb$wG!~*jOUP-8pzunB-))U9#
zQXK!Px|PSQ_bLO0YGe4o%kj9bnv>Pbu&ng-WMcbCp5Ky@=NMz>rF-u(mk!6#3#S-v
zVcDg=1zb-H;>@KE^*3oCXeLW<}rxrSXt=?dqJTcMjw_Xdlj|Agphp1pA%
zZ$xDQeqLyql0(H(Iq}Ywo1ezFz(uM*^r{2aQioJpH%hWd~PP
zZ+Rut+eT-6e1hqsd?h)iJw0iO12A$vTjC`$ZMw;K$$P2qOX84i8Plm(TZ
zQY2y{>dU9g1w8y??wgqrfKP1rfE(~V41*-GXeXq#lg2NCo9axKFV!yqC5pwCF4h88
z;W!0z!hs;&wABs$ceF>>Q#7<~I(aO7{i=sH4DdK=5(nTCTidpT{*O>_4$VBmUB_G+
z4Q!qYx%i_9X^nTq2a2M|PpOj%^=xlmeyzxw)YCX$l}8mxddJ^JvE?VB1j&@}V79?h
zG^fJ)hT``#Vxx>;^&&QHw9Z=^uNOQw}b#*gh8XE82Th>VNE!bfwebsFVxyNLGl
zxe{x9Ios1SWwa-iU=M1so~_i@pAmJsz-^6OQD1Zp!x}~bM4QlZ3;a#gQ~M(jPxhv}
zPPPvc6^}6PS{WA6lzLPNWtk|KWHFtwpAzjc&zfl{k|x)_Ii&uil_4u&L6(`ulwC-r
z2D`3%I1PjF!pE-D^KLp`U7iY2O>yGVHS%Ys2ToeXm)ToB1W_foRD3-zT|H0oPHH6@
z|0$;p$+DhJ*Q$0yMq<)O++%nC!rr1iUy??Y$eji%;eEuIpCFt3EH3zil42%VzcOym
zV1GAH?qRVkC#ugmzeh1VNULduvLwH
z+bt1k=Z=Vo&0?lXJehT03xzE{F!y}9YZDbw+j>y>o>NX6r6p(f>R?3J@$C|4k^I2h
zW3gN5tbtC~M(eW;>zFEax#o9B(HOT)`3-l+T!Ucn0diKlNkW09ioyK-P+#2PDWv=>
zs$=S>B#~s_OOyb6Z1BB3UGJ#EBGap!`C5WR@R8|uEb=`UGY2s76SnzIYD{~EQ*<~0
zTMbS_RWZ>(c}8v*D=0W^N`4z%4&vLw1V?RO2x~*xuKi6q!dTu8-C2$@D|Tnse1oDj
z%2#h3!?y5{qjaKx%|RCCjqysw=*+bft6tPi-hixo5>4jCio=S3A$&|abgHtzVeR8F
zlN9MKZsV&MIX*Qc*Mp5^dJ2+uMwBK-%7`=(upDGKl5d|(Qd$x@aY(83mr<=VJcD{e
z#L0O;wUzcpaqYTQ?4AiVn*RJ&$kCtywvaC&9L|spbB!x8p#-FK{Or;OZ|_R(zEFLw
zP}kgPuO3!{tFpa3l&D1U0k%M3`9)-3N87dOs3f}S*|~#g(5s}`X#YpU3j4V#eN>Ty
zc^PDVc~-J>d}}(dyTLqG4SoI6vHIjR5a_m(?PENSwWhPPJJd#08H;v0E6kn2Y^TBUP3JESgcl1uusmOL8MUoHZ?OjSd_EuNWhnvAC>7g`d2
zUuF#+;FMfdkNZdoT46zx`Y=2Li_f5ibdynX__9KO4a7pCP%vBhAp=n>-vzN?(r)G3&oSh_m0_nKhN%vsnWxyOR^QUCXj?@bM&{@_h7X4R!tP;CFVPZ^5T0I7f~uB
zV|=vKyYli>P9As4I7)`=Fm%~xt29szR=AIm>Ns28Rv34P)i!^IRvB3`rC^00uXfUd
zn3I##C;iN+vESKDg5e!dz3{Myv@3P8n9P&SH-0buf!QG(v3;Udv(9K~;`~{j5eG8raRA=^qfUPLAy*2N4p}Xj=+@
z0$b89#^C0EXpmsjihsDy9U%&v?%@F5{GF$l1V|E~{@L;GoS_<{EO6p1ke2tWX;Fmv
zgs=U%?@VxU84Y=GV5e-?X&j{}<>Z^bneVa91XJ)KwKLSz)CFC4P9?Ch$wNvdw6I4U
zU(#1$vV&-qzP;i(erC}_Pmx}ULW2vgU^_D-q%zltA{(ab>9kDWzW~n8fZTXMvk3
z^VXjcDP2*=EtAXpg$=$iGbyfw`YPq{@7f>!;$8d|v=`t#n$ffhp3s=iJQXRY~|c9m}RI~p5IuK6VdVHN)q68O?>
z$NlL&B?SWt$_l-F^3-Oi_`nlEr0@50ZF?r@am2f{NPhxy!^POm6rX`8o3S~TT$iRe
za1NO5h%FM;pX;sAOrej4X&giNqSiXypxzxFxA;LeWjyN^$3X0S
zE0YHBK0VM*-y!Gs?5&|XwKg4s80#0kcpUl6enrXq;Om+5ue5ulXb4@&1u
zxyogYYsmc^(ryQeTxPgRL>nzSjOz3k
z9xuKP=S9BH5L*jz>B;|ughV9Gd9w(=@H~%J$%~tnzb|7P$tm&kd{7Va=KTty{JhkZ
zSY|^-)>R}`!Yh>pn;8`b`;RISud6=g-(sZ~
z(&}s#q6Mtj2e8aBO%M65Swn8J7R;L)IxH}1qIF)v$Dw1o9&F>^c8q|>#u~RP?)>fH
zKHttm!C{N(XvdU_@jePwZe-b`x-iof$0bgFP9rMO0HR1SH}dXN*UL3p~p^t&>@AWarH+
z9JpX*_5jM(@Z2__WJd8d<1za6?$})dKxc0HaE3S5vu+yFUuLD4^(r6gX{IAKeUaPX
z`(w@V*RWG!8o9-|7!I3!$P=F=^MY#j*U^%RbZK3kE{p*=k0ZR>T|ZekDgnlq((w;3
zWl=5emdi}+izy+pFQ_@G`VJ1g9xdH6SK;LhGFN3P&%Nw4i-v6|32$lPDyeBU*qEAA
z9fGDTx#vjz0|F9R=Fxv3>N4TlaS*PBXF*v*BBVnCM1eLK)j^eUF%l6*_D-&3+f@E%
zAyF*Yoyp*|=~zQiF^h!i;jwt}##ZW23(CJf!_(pspjl+bHUIPHr=d>^&0GpY
z>9^aaOaOuK_U?wuB&frCZIgE4I9go#7NJ{iOMW^7XrlbcB{ezabpDE(m&F2xBBA-3
zFHzvkcKYL?yulR=71Yw-@V0UpupLlf^Rg?*jd%#;a=xD>^?%tK=9hPkK^MgcxhbX3
zH`uhTKn>F>`LPVps>RV-eH6)=^~xiQUb~Y1D0L>KWWueJ&cpR|70g^p?U?0l1Z)Yx
zxJnX!_EQ}G37)CcdO}1Qd&hjVl%op=x^r9-!6v4y~$%9CqE@cJBiXp+u%!1^U45{U(+~n$=}QwE+y3_-!fn@YCx<}zKUEu9LKbalu1!8
z5!a7nz)qoF@}%c~lNOS`B8#^_i1CHhQnw5#gfK{*djigL_Xv}d!AHC3M3
zKEVws6xiEiSjMlIZo-tej*bv;N^J2-FCr~Q6S4tEjXO|^vphsGJ?y2jy?t;gQBZG!
z%@506G(%{%vm6Ah%MBV3%MlqjfkQ-p#AVd_OreKPE~E~ne5bMx*r78m@ZK;Q{HV|+oSxr3ADu~@W_9?8kus06V6=g@ZX%}Wh9|ql#C2eQz7!mAWL*^7ltP>e=5|cQlIH;186RB2JOM>3Q+Kq)(Mukd@3-GX?
zsc=kf4_;=I`qTc6hqfvu{tS`B7bnys6I;8d|${mj^cf9NXYv7+DmeSySQP;LJKwV
z540&sI8Lb#X|)hNa0&wr?fxs({Df4dp#X-ni__1@NH0UgkxZZNh+@*~yk6l&&upCQ
znjCLZGSevMUk#1Bgzr#NphiV8q{z)TU6!z=I=e~xmsk+_v9bPMqwp|}uB0JgVClJ|WNm4`(o`riV{%BYOc6gO5fQ|`nZl>vqgtsUWUTPFI)L2HO?Ec$`N
zEj)@!I_TA2+B-$gpZD@>)fh$GYqjHPTc%@pu{J!HD!#C~5ebBQ73Nb^FC#g2XDbV=
zc{aAWALfWW_u2-myFAO>Abw=)0
z-7uYdHaskQvvE(Jn(8V*u#fjK|JCI5+J{$4C11PO4A2r~k}q4hc6)dXQVS(<;EA$=
zmO&p_bXiATBl$9lHts7y=>AJ5O3odl?&WRHW9uzTO_?dFJms#Msn|z*>3W;FRMIKOh2(eX&?h8L@JJTNYkg|y(y6lLIj0#m#WK*0BT$%#`l~E`A$&!tk3TrfEKS`tX;p@yF1-@5m2TtuP)HgO
zl+T=z#s;SVxIpqF5m?>K?6M#t)QHNO%xi%1~#Q{il{&sOUaH%%EZMPncOJtEq3
z59K#P6I~8?rkA4;ugQ9Q9ueVRx*g8L9_JeYX|z411MG}1vh*K9O(MinbG)Zss4AD<
zG$qt8ysL&LmdCMkAz@zCp7O+IvL@_6(bNgp|Aa%qAqY1Cz%t!{om6h7Ed_QgMVywbi#XA)5xaQV^
zJ8M4ru=xCFNM6)zvsT?x;OR9kVkB;6P}u!-nbF*=IC|v}0+|eKi|d&z+3%lN6-}sV
z-Dj)no2sN}AUz9lRvBrfCGu;M3-3*F>|ZKU_-qX`>1!JuD-sewcZCB=YyDRKjc+LR
zjI7y=6-Npqw_($aghX6SQl5L`v8=LwVcK8ujO$@l1SgT$I%oO~8lsm5J;}BX4SiIL
zb?5FIne%b!Gfeu~Vy`lqdQ=46H#3ZxwV&Tc2ghG%i)}?|I8ooL9g8V5?>0Cg_(Zo;
zi4Tp<1X@QY@Brh!?BI*oxt}V;3n(3n9_Vw}?TS^~|}$e=4IWTd;sbu>@t2zGGCU
zev{lKX`ro#7gI)#xE@)X0G~uRyN;F?o?@v)Mu~
zaC<~Ei#=bbBeTl?(BXXSe&M-0!^1jYHHJoakU&x6VlMW`bc*v_jMp#O-I79VTzNV+WXq+iV
zlO+?`DDHdJDzESYk~i6fXr*FvOHtFiuxC05Me)d%11Jvm{1dvjmyK1e`Gw68Na>lv
zp->PZzhs6aDYq*{)k%ry1lEMko05Pqd>C$`Vi&^}XS|Vc(`)yS@Ci-f}Z0E`b;q7sJi3rPF4g-
z6p~3WKG)pb&DS2$Bmg`VDGPgM0OXVcB7Rr6j*gQ$YGqyKbu90fJZur)FE!yy)z;RY
z44iNr^!*sk&|8d(urBnV(gwQF1loqQeF_}dkueG?Enh_57Y+NGVf-)Z2O2YubLU{Gy5sQG}9Vy+RmRt8mv(hE$^>+3e
zeZE^Sx0=8678NeOP@$&GQL|SX)VB0=Jw^Z*=P6A5CNXcg6N8B%lks*|g
z+-!^7LB+`Vine(&y2TDYzm%z%g$bB2!ZY-o>`F-C;UVoF(&Q@3=lq1^F`YjddnY#J776N-dBuKx
zb8g7au+11-ZHa6bs+#*GZZ^H1(Xm*?cRr;jP8ytYu&-dtJTrt^kRiuM<05Y!@un^}
zF|yZ8-ScZj633eMK^-DCqtfIob%BRcwPc{7UnUx=YB_ZeZ_oKd(($D5Qqg#L
z@gri7Tn#V`*n0$SA32f*<=IESET;5-fYbbNc;f{=I5#Vu{JLJDUO
zYL=bksEV;U?tgZJTmeB3%Zzdx?fm%^#fl@FYw$V%E9xE>5gRQv5-Bx@L$Zt}-l9bq
z8>xU@h`yz$^!wIOyy?WZfKHpY{?CPcMFAWj%f^x)qSC~>Mz&Sh*sXr|DJt4QOkO)BPu8Ax
z$q#wXnl?`v_vn1%wz8Bz&x>3wT2&ye6kRFR(n+x15uIhxBWpL
z7aMETlj|ay
zVjy1tXg8I9$BRbHFAHJGa7lIwUj58#wFE1$p>)`bsUnbeWj-;)a);(
z@KM$HktA*77qhV`x#PEEcr}$^9($@A6Tj~`y6&$DP7sD3vU>$6emyA_I0md#XH<>h
z9jDr^PD7~F-U0jj
zAPwp}dhM2?F*q#j7rfy_-ya%3OK2f&lZg>7L(1bn7N*^MDD(%GguH5AN{5i>iGhZM
z@F<0inN*FodYYHE;i-foJUyXWOp;IS`|)}cy`fNXp^k=RhpXR99;fL>->xU&ANxms
z2h!cs3=`tI(vP(%C9fqF`BL!n!w*ogS;<9M{7A$C)Tpc*FVtiiHXUWE^&_zig`4F4
zF+EOt4qHR!pW9VG!J~LW63td2dGL>{w^lxiXHV+)`c1(p!!Q%1+ji<=VaJM*=poT#
zT*>6R=*bmg6`3eOEg{5b;I|1-wHyW#KRxe4_LVP5fk*(Zppu#wNdZB>i3%M5fgln~
z_gVUTTV11_scDPChkg}Jt-RLVjmKrNT%|UxUdD(9;uyILzmx7RdXH;ga1g%KMbmX%
zw%cG#_+k6)pXzM-vV^=h&|7Uq*q*ov#y+
zyX^0Z^IqV(@rKkia}##R_*fb?u^w~%muX5nKavhVL2%u%-GxH%6^o>B_!gVnNh_#d
zL72$nsTV0>6}d&}{aWjJ==~-JVNfOoKq^&M^+A3QP-u~Jozsq);f!`{gEKr{ZTzHm
zqkX`9AB_53<+aOxOZIr;bV`O%@Ig{llJVn)vWDw*X&@_B%8VXzejtDp`-e`$sx`=Z
zK(7^+xK3|)9MuAjif_ud#qU#YxqbZViWuMLfiYpG>u*Tb0GAcYOIH0Z9yvlAK{)4z
zMKX75x4!2aZI`p6~*^o8B?u#YwOH8yVvcC16PHG0a$xgz|1
ziFqfEs#1uPorbkRpBu@M;pJ!Ed?q*MBeK7<*SzBYqr>t)_xsm>-aZb@T3%~g6;NNk
zv{H~7>A@@5FzOcDu~tSx;$jlCUi4tyW->6^mwEd!FhTa@-{oBYwL;bnA%Kd_tf4)R
zbtDC9k{Pwhc*=**)G$CvGgC+&(qy`9>h*2+$b~5r-#c80+Lgpv#0=Y|4h^}3^uC`m;&FT82EZwQlw*j!f$CLSx)8
z3dB~PzQ@>r`zu+th|;X>)}9fr9=ZV>!Sxe@wn_!89iqpckauz^z@e%6;t@iXs@FT4
zd>Dv?s{DTp3NTXLOTpdx3XlZ>FG!0txy00HWl#TCI5w*^wlQ1Jw~+}3sPCR
zsPI`F;yysXq~QS2E-k!a7!DUtJxBqQq7YlTg*I%{xYcT{&XqwvfS|-zKb+T(1L?yN
z=amDWgNnf3yGdH)?SD5jkx1>DAj#EsIx2OkA9sG;u$7oI`!mHvj=yIF+!B+T>RdwY
z%{?L>QGM`($(0}6k^z*Y*GV%s*NFX3D~3+yA}XGQD6CSkmn0RDnFnNIT49XSQ%6vkJM{4m84WDZAk
zH!8Te2lNr-sk)C%f3rmFqPvL|APnBf`;%da#-ZH>OdQkwWS&>teiL29gnh3t9WZOb4%GM^$L(uL1&q%u{v~7Xt2nFXcBEo
zc8Oh{{e;)w41^}t$s8E0mM7-8b7R}Q-)1-_K*{7dvXZykAJY4K<0^CoXrDA8lqPTvA6^o54FlK~Rt9e7ppi#}Y&8DTq&xZp>!Oi?XBf94}mggUse6?<~
zfyN)b-q!>SpI}|QL6Hzwm0`wTbUY06H|C|wW(n49{y_P8NESbA8tCu*GDMa5f#Ao^
zZN-E&A`ur$Wp5zuk;p_pZ$acHF}M47OYQSNevQWwcOW<-VzU(4)YiU;L|!f?M1Qxb
zK&uxeA{t3;^pyl?@O}$3@KY!c$XFQm{sa2FKvmnhF&3DcEGK=XyF^Rd^~Z^7n3z57
zH5+-5!hIS{ONQgWTaEo&P+z41t)jq*qc>Z93X_$-fY+X=J1~3Q<_E|GwaUL@QY*lj
zIS|tN<&d@Xf{J`aJ#K&OfdB+emO-}Wa}CWug=|H{dPdA)Fm2qGDM`0|*drEA`-c_p
zze4N3;%zl{P*YrBf{EUufP`)gg<8He0egMJ2+hL6W5x==4~Hgl!kG@S`B`#>{NX4S
zzx`kmrG=g%3$6PTkykx-g__;$!-q@g=wTj{d($m`I}SOB-jM2?8JJ1Bc9Z|z>Wupn
zz)GFi0u!mNgUP+`gBj?UBBlNOac@^p5g~h7(FX_K=lrx3wjNI}qviq8bQRs3?QgUT
zEhhnxLOD~CrPzA?js5R$y#DqDAdc@A6oc%o7AY41I+5k{{X#8>8E@TYg)2O|{NrD(
z8`koxHpH^Htj>Sl(x^wB`E`-H%0SpC5I|eO-tcnomyk4^1pziCKpXwPmU>VVUXVvz
zpyPQJh(+{KX?Y@qNxH8iFvQ`oW9RU1Ce?@-w8{^cf7v~-exM2a-#bzDciq
z50?YiALUC^Gh0|MB}MjpNfaR^1+R=_7GvVSiHVC8C*QEZ)#ztJ;Q#BP0pm^5Kbexp
z-rMt{e-}mmw`EcN2Qp}ccjjyK|KH*NeH{4q-tO{nz`MAhR$`S1D}|&KN>*~NdYyxZ
zlM%a@xgCmw=!=BL-weY4?}`1#r}oG{#}tH>M%XRDFiyo1xI-~r-;IA`!|3W&7OVM}
zz|>freo0W@2ma&eu|_vm5UETB_U)k+U*A3pm$3pN21XTiM3{|_L-$-D*fQq*SaToW
zxB|mH=l7j>E--c$jfe5b++Yu>K&&49H^0LNjMueJ>BDIiv*@22iCE9VwPQnl(&F2b
zPEY0jBKo#I4rEOcd|M)sYVJqRq$!oFlH23smEHX_Xsc3i`SXR;CT4G8LE#(SXKa$4f429s0Z5`~>zyD{
zYmLJ8?Z3-E|MTVa`;#eRrt;-h_~lHgmV03WG%{*9Gll1abz3{wj7JHRyG~;Mr!Yb)
ziWyRTr`oVCA3%U!5mK7CA@rA*sU7e`g*^>h6$WmikBUS`u>iM;?)T=T=0AohXdWTR
z<3r$Z$makc9~3h)_>&J(+spPOx%Koe!ipaoz;ZcnJOCI`5K-lT`c{b3
zx}PsZA|k!bPDnn?eVNQ%8Co|gCDd6G5I1lIL6^HQO0FwI_99d}exGfRqc&z-!m#B;
z0X8Uc_ShWYr`LqOm=3{+VriFOM(j#=p6Uw!UFfCh
zFxyLNgr9WlNz5z9rK*#vcXBQQ7z)Jy%-5sXzP2Gj<5X%Nn~G$=b(l;
ztAA}*L`C9j*eq2ahQ-$Sexlcx7uUo!!*qZ~#}MpwXOBzLehW&{Xbfd@*$h^z-G^y*
za!2h46i19-?*7N9{)tl3>!~fp*zDmM67lMyC|j~T^AB_}9A
z7VQnQNj1+PeXZQ2$1FTjyo%bWi#X)sQ`GCtH5H3tw-eC@k|TpVg1!5}$bX6v{_BXl
zY6vpohZURLg+hlhZWH*bk#WnGQAX#EUtln3l`5C;jtAP6aHBi}^uVEGcoHb|Bl}6!
z0^HZiUy`StqG1vzjW~7kaZTL1&$drp5c7hIZPSDrFkmek7%Vl05*_lM$sda2qqQ#_
zUJL5aJq-}cGuxqH<%JVJUJ0y`x$Z%zq>z78ie6ltj(p~zao3kszT5bX%f1IThI<1>
z<-0oN%{NU?&uf$g!ImJa+B36v_0o+pV_}GT@9*NC;N?@wSw_ha5qmoHp9pzpu!Y*?
zgQDB$f2}nmU2TZUUsZ+XsT~thIeZO&&g%-KVpsKkZu8spr;!ZrZMFF=Npv~SA*|jv
z?y|ITvly9g;NQHY+r92BwOv(Ll=?hK%MDW1@#SoIer$05RbEWnoyllodytIzm7V-$
zGTQEu45M4pboSe6=)z>R!1mC&nt+!e+>s0|gu0VFfe$#)V&+)
z
zIsN5p#HqBp>D%~*h@g5oW+%>9`7sjdy35|^ab9g
zw0B8c@1Ls!Lh_5sBd>_@RU`>Q$MyVpj<1N8JDoAA?sH}s(*yz9mnN|*^kniL>^h*$
zi>Ht18c!&!ZGH=Oy+vcrzAAHWH~T#|={Jd6+hwzF@!CaoX|zzXMQ>q^pEB?j@eU71
z=tzJy-SPaRN_QPm$PQ)g_^ujAyIUg>riK1$rJYfHEU3$FcEncZeOZ!b$1k#sg;pAF
z8Rwws;qf3@Lg?Y|ULEv^^iWb$Eep*7$A_;yyvru
zv8^Y8_=I%#FI_Vrw2;idTl5A&5pip&Rul`
zloIFZ#gnpGmN9{Yke>NC;&z7v?;j%`W$UnozacjJWj-}G+oU1mz-hDi3kz)psk-V-
z-bnROXnDx52Fq7`glp3>zd9LUO@r4+H8f(~!hVUCzgLfvo)>!$%V9dNx!`hHI~{Yk
z9RCu}V!!r&)cj-f{b%Q2Qk--@@z*r~LF|f0vV|60_165ZJi)Z9o}$NS%DWN6qD-#;
z7(^KA6L+c;JuEQDNsFfcd>GNTx~-0k%oh(Xz6!cTa4qD~sEG~sP;)$+jN+KdN}74J
z&sy3F1-+8HH@#`N%y;mc!yJ{XAGQb&95!wSHT=GW-#$NqQy>&nRMOp_QX!o!Hn~#|_B>(-Wv(EqnG(Up=%G7WEu;jf%4%@+(AADI$x7bj
z{6NH<3f*#3usmPtaX8k-MIq?C&NtaZ=wc4HW`?b;u(CXHst-Dh-&!w7U9@MRfwowg
zusCG{U>dq6)=+!OPmL02hW$Qcz8kQu!KKI%KT(w-26bOp`_5KV^FBt$f|njFSfXlw
zI#a>rljunSaaP*8M)kVIQZr>tV&~{DFEd3NmgjFk_+P}22FkJhqEQnEzJVO?B}hB2
zIxM4eiIRmUG71e~n;Hn$A}Bk2D$`V9>GyEFO><;BNtiqR^(#SNGVM8*K*^uB6=PCcETTe|xbF5tKg8f(!0Ay;nJH+{@yBdu!g
zJbq)+{|+~=Vdj8|k`?8u;t^i?*tkUV>9c!g#n(XBm(1+y@cSaJk6Z7GhcR2txjqCg
zh~(0}*3Af_RF^=}@5BH>t32rpxsctGOsr%Tv0ZgPM`9F24@CbG++oA8B=$uz+IcBq
z#1*TIfCFX=W@xhfUqa6&pj8r(kpf)sx<>M!cs3J9Hyb*}GaySq9^?{~^rlem^@e}o
zW@3=clUA?&sDv{Uas+V+UvFgWcZ=GEBte-HwU_0geq+**li4l3q567_DruKJev4M?
zI?sbZ#XGdY3rjTEjm&CrOnMO(CJokTWq?w6`EIm@r}&jPK`g6ME@oyl5$bAbZKpQNL^7?hf}MTU~&Gaxl$3QhV(VHqdc%AIn^k*F4
zBN)=yA?*+{m>$-fg8P{Z240%qz)H&_KK?(??|?e$Ga?Mk^Yc>S%kF=gS^hGFH_((L
z5RF1&h+^PH__7dc=Fwz#xL9@jqr<(@Znw2+C3Yofg>(U#Fam`tBG-TSs|)LSlmsU+PTQltrY(&+_v#def8t3jzWm#>=lTTyM7w^jtyelcSg
zKPpBgh)DR_C7!U(Zrt^CouAyBu;@-6y^D~|)QsMtcybf#Ln^uzztP$pxX@~c$xntQL|p6
z=+}r;lZbv*Pvm_y)k~_yrUoWBj4xU>w+9*@Yo6nNa6I#lqI#**hlN+e
z!?(stln`@lyVuA2h%3AXQ+Cm#uq*c$UW|b*BX1MFPU$+7R`0qsds`z5b^c_{R_c%z
z`B#?r&)5>A6Aj7ys0fjyKiJP4qad1kNiw}NopJT+s%+iKHMKMu)IXG9qQl?bknQ}Y
zZi>N?QC0IopQB%s;mI3E>eS>S|2ue|imd(A2R6X1nq*)KW
z74Z8X0^;Z?pINHRCGR)EQS-F4HqJ78!Zuv}kvR0~ASlW8u7O95Tmqrdy=PCqNTY>Y
z^YMGchZmn*@CHP3Ooop`C5`Qt3OD_sf~q#Yu9l)g0iJSYk>0gN*>5JReepRQr}l?V
z)*{0bv!O_^R0wga=b=yf!e8TvRVh(tMzT<DPbXW9qGaVcpN|utRVnA%iu=
zn}EY`cf)&p;=hCWkah1|ryzK{8!Qibh@S5PIVG6c;bC66GSXqJu!@F8B97y*ILEYj
z-0CL%rtArF-2M7iOsE~z^Huq6)?bone@c))U~;soq3-LFYKx(3co0(LCa&r+r&+Xr
zwIAy^{hN)0`I9+o>718He~+PIb;i&}_hz`HW;tm)|WRbJny5H4ipj
zUAUH?Rqu$O-TFgfCEY|KRVB^^VV78g@MSwXQ^_^_nw9A&4Nr4^sH75rWajU*!h2^d
zqL%Xhcar%0R5^tcb{1`59=zleHV-8LDp_cBM-cLJ)sM+bi}`^92^S@Z*s`;_?i(d)
zZ7B=>`EJ&Vj$~PgyedbK;chb84Njks+m5_Hnt&WG;T_R4yhSwc4{coM;)c*$rLzK3
zgznp+>b#}Fa<%mL@>vF|%mu>jn2$()UkqeWgXU#_5vnB8)$&w0Xy|Zf`ktV8J9N^G
z?oWO;(LE0aiy9gHnF%q{D>wI0&?yTvv=>4nR3+?3J?Qs4S{?%0YHZN)hi!id?r+dI
z{2822^h>IxC%^ur|9OQVr)sBJ!}6*sAVrN4Vp5AlZkR`tPye<*S2c9+so5!k;V;LJqDd68mL(P
zHR?`|KxkMefjwbl^6Pc1vdx*b1-Sf82g6*0-&YF=;NY9~0XJI36cDp$Tdgk=Iun^5MA`MVTqfQQ=A02XR_VTBFBYVDxr~$nR$}Mh54)u+b?c9
zP(xE9D?pod=8_=Etp}St86x^0hMDmgbfoP}%aDdJ2K+aG8Pqh+32tN<4etjNa~sOH
z(Ziz>u2Ji>R*}VfKO0^IzqnlSry?92|4S+dj>ftvLPqMlXGD$=ELow*a?!1+oBfTT
zAxgz~^)Qd@D?FaDM*NLnisN>K@4*~*`<0d^7{fN84qr#02+?zeFF>S@(R#{<@%0Wv
zVIms$P>R1Bw_SwdH`dAgA)1=H+S%fgkKp;K;2t2JTo@Q3OhO6aJCdea3
z-{s)&U@j!UQJ)>9DvO_@ykAiF{e#2uOPV(k%advGv)$4ZRpM6gzQ{r&>#?7j*S)e`{c_gt!rOG;WpR1JHcXXs|~7srU4uQtfpy
zX3T=$cK~Z{B=grW3@c3$^{4OzLx&tOhKS!?)bSi#>Gu)~a(ww+aDDe2vQP9lFtcAT
z(aP+#?sp>S>ARaGO(8k-X?T&!??ZcnfFJJ(;6ZTYl^Lo+E-L++2Y#%O=Lf9j5TytD)eP6;34yBV&BI9j
zC?GWC2puOiU#!2Zk`oO8-2ipY_!y|#y>3<^2^0u*y!3DL|G6pscP%a`2M#D9r!4h@
zpl}ET=Cr{5`$v~X2?qY7$@_r&XXuvc=DkBGf(#i?Ue_YDbF9#zQiGSk!x?iJdIauJ
zzMedG-}&(ccQ0SzzdR2ZCX*l-F8W|
zPX2c8zq#PcA3(>umSkVjzx@0^isleBz#}Ds(AUM&=5H=|Ck9-w;7orj@E_y!&*37B
z0jRtjH$P9N|K@^)VBmt<9py8(zv&Zj5CQ{kb~3(E^q)!Me?L<#{GSWPvbGO_Od==;
zA?URe%;r$EUBl{nLcFw_LC-&@re7L_O($#Zs(T!~))S6N9&^wV4D6C-n13cQ+virp
zQ116!NUrs582I6cCFVfqphVBdmD#=jVatSQ4F#xEV90nd$2!W}WkA;rnuQWJ?=DVB
zPg;+$jy`^EF`#gmVq8z4qlR{3hV8CiZ}cB&o=gvMEjz8X)}Egft$*a_YxmwjPxhXF
zm@B#ec~0M;fb4c(L9pB6VTzdPNX$0+Bl-~`wEP;p(^rnrXC6=OZCAFDi5>Q4^s}}M
z;w3>=P{~t|^rdL4nO?^-U>Addv3eS6D(LXAxAUOB>!8go+`#mK%m^`5{L+g)pvkZtM5Zu
z?10|8WC8K4>~hK5s~_Wz-eZN;M&?o5BY6fb&RE}E9`D?moiA;nkIjA6k&w;)NYg_E
zzJh4uT3gz$`pw;?PcquBM+;al`QCvX;NWt#I$A}&`8Toyo~u^C6I5gmg3qElEpOeL
z{aVz>VHL`u36xDo_rIrjJUpLSAzd%XrBH#{kVK6Ul6!+yI&V*i%c?;jzS