@camunda/ccma-shared-types 0.6.0 → 1.0.0

package/dist/_tests/types/alertSubscription.enum.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/connectivityStatus.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/secondaryStorageStatus.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/constants/failoverRegionPairs.const.d.ts

@@ -11,8 +11,26 @@
  */
 export declare const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string>;
 /**
- * `stage` mirrors the featureflags `onlyDev` gate: the EU test pairs unlock only
- * on 'local'/'dev'. Omitting stage (or passing any non-dev stage) allows the
- * base set only, so prod never sees the dev pairs.
+ * GCP's prod dual-region pair. Stathis confirmed it in the same Slack thread
+ * as `GCP_FAILOVER_REGION_PAIRS` (#9816).
+ *
+ * `isSupportedFailoverRegionPair` reads this set on the 'prod' stage. Two
+ * changes made this safe: GCP clusters have no BYOK option, so the AWS-only
+ * key-policy screen never shows for a GCP cluster; and the operator
+ * clone-role logic added a GCP branch in #9835.
+ *
+ * This set does not control customer access on its own. Two independent
+ * gates still apply: the `failover` feature flag, which allows only
+ * Camunda's internal org in prod, and the `failover` plan limit, which the
+ * org must also have enabled. This set only tells the backend and c4 which
+ * region pairs to treat as failover-capable.
+ */
+export declare const GCP_FAILOVER_REGION_PAIRS_PROD: ReadonlySet<string>;
+/**
+ * `stage` mirrors the featureflags `onlyDev` and `onlyPreprod` gates. The EU
+ * test pairs unlock only on 'local' and 'dev'. The GCP test pair also unlocks
+ * on 'int', because dev has no GCP failover test cluster. The GCP prod pair
+ * unlocks only on 'prod'. When you omit stage, the function allows the base
+ * set only.
  */
 export declare function isSupportedFailoverRegionPair(regionA: string | undefined, regionB: string | undefined, stage?: string): boolean;

package/dist/constants/failoverRegionPairs.const.js

@@ -8,14 +8,26 @@ const DEV_FAILOVER_REGION_PAIRS = /* @__PURE__ */ new Set([
   "eu-west-1:eu-west-2",
   "eu-west-2:eu-west-1"
 ]);
+const GCP_FAILOVER_REGION_PAIRS = /* @__PURE__ */ new Set([
+  "europe-north1:europe-west1",
+  "europe-west1:europe-north1"
+]);
+const GCP_FAILOVER_REGION_PAIRS_PROD = /* @__PURE__ */ new Set([
+  "us-central1:us-east1",
+  "us-east1:us-central1"
+]);
 function isSupportedFailoverRegionPair(regionA, regionB, stage) {
   if (!regionA || !regionB) return false;
   const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`;
   if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true;
   const isDev = stage === "local" || stage === "dev";
-  return isDev && DEV_FAILOVER_REGION_PAIRS.has(pair);
+  if (isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)) return true;
+  const isPreprod = isDev || stage === "int";
+  if (isPreprod && GCP_FAILOVER_REGION_PAIRS.has(pair)) return true;
+  return stage === "prod" && GCP_FAILOVER_REGION_PAIRS_PROD.has(pair);
 }
 export {
+  GCP_FAILOVER_REGION_PAIRS_PROD,
   SUPPORTED_FAILOVER_REGION_PAIRS,
   isSupportedFailoverRegionPair
 };

package/dist/constants/failoverRegionPairs.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/failoverRegionPairs.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Region pairs supported for cross-region failover (#9120). Failover is only\n * offered for dual-region clusters whose primary and secondary regions form\n * one of these reverse-region pairs \u2014 cluster creation must be supported in\n * both directions. Both directions of each pair are listed.\n *\n * This is the base set, enabled on every stage.\n *\n * Shared between console-backend (FailoverRouter guard) and c4 (hiding the\n * failover action for unsupported pairs).\n */\nexport const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'us-east-2:us-west-2',\n  'us-west-2:us-east-2',\n  'us-east-2:us-east-1',\n  'us-east-1:us-east-2',\n])\n\n// Dev-only test pairs: EU failover validation on dev/local before prod rollout.\nconst DEV_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'eu-west-1:eu-west-2',\n  'eu-west-2:eu-west-1',\n])\n\n/**\n * `stage` mirrors the featureflags `onlyDev` gate: the EU test pairs unlock only\n * on 'local'/'dev'. Omitting stage (or passing any non-dev stage) allows the\n * base set only, so prod never sees the dev pairs.\n */\nexport function isSupportedFailoverRegionPair(\n  regionA: string | undefined,\n  regionB: string | undefined,\n  stage?: string,\n): boolean {\n  if (!regionA || !regionB) return false\n  const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`\n  if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isDev = stage === 'local' || stage === 'dev'\n  return isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)\n}\n"],
-  "mappings": "AAiBO,MAAM,kCAAuD,oBAAI,IAAI;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAOM,SAAS,8BACd,SACA,SACA,OACS;AACT,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AACjC,QAAM,OAAO,GAAG,QAAQ,YAAY,CAAC,IAAI,QAAQ,YAAY,CAAC;AAC9D,MAAI,gCAAgC,IAAI,IAAI,EAAG,QAAO;AACtD,QAAM,QAAQ,UAAU,WAAW,UAAU;AAC7C,SAAO,SAAS,0BAA0B,IAAI,IAAI;AACpD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Region pairs supported for cross-region failover (#9120). Failover is only\n * offered for dual-region clusters whose primary and secondary regions form\n * one of these reverse-region pairs \u2014 cluster creation must be supported in\n * both directions. Both directions of each pair are listed.\n *\n * This is the base set, enabled on every stage.\n *\n * Shared between console-backend (FailoverRouter guard) and c4 (hiding the\n * failover action for unsupported pairs).\n */\nexport const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'us-east-2:us-west-2',\n  'us-west-2:us-east-2',\n  'us-east-2:us-east-1',\n  'us-east-1:us-east-2',\n])\n\n// Dev-only test pairs: EU failover validation on dev/local before prod rollout.\nconst DEV_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'eu-west-1:eu-west-2',\n  'eu-west-2:eu-west-1',\n])\n\n// GCP test pair \u2014 INT's dual region. Stathis confirmed this pair in the\n// Slack thread on #9816. This set unlocks on preprod stages only. It exists\n// to test the failover action on a second GCP region pair before that pair\n// is confirmed for prod. See `GCP_FAILOVER_REGION_PAIRS_PROD` for the pair\n// that GCP failover uses in prod.\nconst GCP_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'europe-north1:europe-west1',\n  'europe-west1:europe-north1',\n])\n\n/**\n * GCP's prod dual-region pair. Stathis confirmed it in the same Slack thread\n * as `GCP_FAILOVER_REGION_PAIRS` (#9816).\n *\n * `isSupportedFailoverRegionPair` reads this set on the 'prod' stage. Two\n * changes made this safe: GCP clusters have no BYOK option, so the AWS-only\n * key-policy screen never shows for a GCP cluster; and the operator\n * clone-role logic added a GCP branch in #9835.\n *\n * This set does not control customer access on its own. Two independent\n * gates still apply: the `failover` feature flag, which allows only\n * Camunda's internal org in prod, and the `failover` plan limit, which the\n * org must also have enabled. This set only tells the backend and c4 which\n * region pairs to treat as failover-capable.\n */\nexport const GCP_FAILOVER_REGION_PAIRS_PROD: ReadonlySet<string> = new Set([\n  'us-central1:us-east1',\n  'us-east1:us-central1',\n])\n\n/**\n * `stage` mirrors the featureflags `onlyDev` and `onlyPreprod` gates. The EU\n * test pairs unlock only on 'local' and 'dev'. The GCP test pair also unlocks\n * on 'int', because dev has no GCP failover test cluster. The GCP prod pair\n * unlocks only on 'prod'. When you omit stage, the function allows the base\n * set only.\n */\nexport function isSupportedFailoverRegionPair(\n  regionA: string | undefined,\n  regionB: string | undefined,\n  stage?: string,\n): boolean {\n  if (!regionA || !regionB) return false\n  const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`\n  if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isDev = stage === 'local' || stage === 'dev'\n  if (isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isPreprod = isDev || stage === 'int'\n  if (isPreprod && GCP_FAILOVER_REGION_PAIRS.has(pair)) return true\n  return stage === 'prod' && GCP_FAILOVER_REGION_PAIRS_PROD.has(pair)\n}\n"],
+  "mappings": "AAiBO,MAAM,kCAAuD,oBAAI,IAAI;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAOD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAiBM,MAAM,iCAAsD,oBAAI,IAAI;AAAA,EACzE;AAAA,EACA;AACF,CAAC;AASM,SAAS,8BACd,SACA,SACA,OACS;AACT,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AACjC,QAAM,OAAO,GAAG,QAAQ,YAAY,CAAC,IAAI,QAAQ,YAAY,CAAC;AAC9D,MAAI,gCAAgC,IAAI,IAAI,EAAG,QAAO;AACtD,QAAM,QAAQ,UAAU,WAAW,UAAU;AAC7C,MAAI,SAAS,0BAA0B,IAAI,IAAI,EAAG,QAAO;AACzD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,aAAa,0BAA0B,IAAI,IAAI,EAAG,QAAO;AAC7D,SAAO,UAAU,UAAU,+BAA+B,IAAI,IAAI;AACpE;",
   "names": []
 }

package/dist/constants/misc.const.d.ts

@@ -16,85 +16,3 @@ export declare const MINIMUM_EYEPAIRS: {
     CLUSTER_MODIFICATION: number;
 };
 export declare const MAX_HARDWARE_PACKAGE_COUNT = 4;
-/**
- * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by
- * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate
- * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,
- * where the exporter starts honoring the filters) — this is the product rollout gate.
- */
-export declare const OPTIMIZE_FILTERING_MIN_VERSION = "8.10.0-alpha1";
-/**
- * Minimum cluster (zeebe) version at which the operator understands the new
- * cluster-secret CRDs (camunda-operator#5760) — SecretSource and SecretSync exist and
- * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:
- * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's
- * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef
- * (ByoidpSecretDeliveryController.deliverSecret refuses without one).
- *
- * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP
- * shipped on. Raising it would strand BYOIDP on every alpha below the new value.
- */
-export declare const SECRET_SOURCE_MIN_VERSION = "8.10.0-alpha3";
-/**
- * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).
- * Shared by the c4 settings tile gate and the console-backend update guard so both
- * stay in lockstep.
- *
- * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP
- * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its
- * clientSecret through the SecretSource), so the two answer the same question and a
- * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION
- * — that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,
- * where it currently ships to prod.
- */
-export declare const BYOIDP_MIN_VERSION = "8.10.0-alpha3";
-/**
- * Minimum cluster (zeebe) version at which a cluster's *connector and internal*
- * secrets live in the new per-stage secret manager rather than the legacy store.
- *
- * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a
- * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy
- * store and it gets no connector SecretSync. The one thing that must never drift is
- * the pair inside THIS concern: store routing
- * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync
- * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),
- * the pre-8.10-backup mirror check, and the upgrade-copy crossing check
- * (GenerationController.crossesInto810) all read THIS constant. #9703 was those
- * disagreeing — where Console writes a secret must equal where the cluster reads it.
- *
- * Deliberately the 8.10 GA line, not any particular alpha. semver sorts a
- * prerelease below its release, so every `8.10.0-alphaN` — present and future —
- * falls below this floor, while `SNAPSHOT` and `8.10-SNAPSHOT` normalize above it
- * and do route to the new store.
- *
- * Why alphas must stay out: routing is version-based with no persisted "which store
- * holds this cluster's secrets" marker, so a cluster above the floor while the
- * feature gate is off has its secrets in the legacy store, and enabling the gate
- * later reroutes it to a store nobody ever populated. The copy that would fix that
- * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only
- * fires on a generation CHANGE, and alpha generations have no upgrade chain at all
- * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) — an alpha cluster is
- * created on its generation and stays there. So an alpha cohort above this floor
- * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that
- * cohort.
- *
- * Keeping the floor on the GA line means clusters enter the new store only where the
- * copy is actually reachable: a real 8.10.0 upgrade, which does cross generations.
- * Alphas stay on the legacy store consistently and permanently.
- *
- * Do NOT lower this to name an alpha. The remaining ordering requirement is that a
- * stage's gate be enabled before the first at-floor cluster exists on it — which for
- * SNAPSHOT-tagged clusters (at-floor by design, since they run the newest operator)
- * still has to be respected by hand.
- */
-export declare const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0";
-/**
- * Version floors for App Integrations (#8536). The fix landed as patches on
- * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything
- * from 8.10.0-alpha4 on already carries both fixes. Shared by
- * isAppIntegrationsVersionSupported (c4 settings tile + console-backend
- * update guard) so the gate logic and its error message stay in lockstep.
- */
-export declare const APP_INTEGRATIONS_MIN_VERSION = "8.10.0-alpha4";
-export declare const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = "8.9.14";
-export declare const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = "8.9.7";

package/dist/constants/misc.const.js

@@ -18,19 +18,7 @@ const MINIMUM_EYEPAIRS = {
   CLUSTER_MODIFICATION: 1
 };
 const MAX_HARDWARE_PACKAGE_COUNT = 4;
-const OPTIMIZE_FILTERING_MIN_VERSION = "8.10.0-alpha1";
-const SECRET_SOURCE_MIN_VERSION = "8.10.0-alpha3";
-const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION;
-const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0";
-const APP_INTEGRATIONS_MIN_VERSION = "8.10.0-alpha4";
-const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = "8.9.14";
-const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = "8.9.7";
 export {
-  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,
-  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,
-  APP_INTEGRATIONS_MIN_VERSION,
-  BYOIDP_MIN_VERSION,
-  CONNECTOR_SECRET_SYNC_MIN_VERSION,
   CONSOLE_API_USER_ID,
   FIRSTNAME_LASTNAME_MAX_LENGTH,
   HOTBACKUP_MIN_CREATE_PERIOD,
@@ -38,9 +26,7 @@ export {
   MAX_LENGTH_CLUSTER_NAME,
   MINIMUM_EYEPAIRS,
   NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,
-  OPTIMIZE_FILTERING_MIN_VERSION,
   SECRETS_MAX_LENGTH,
-  SECRET_SOURCE_MIN_VERSION,
   STARTING_PRICE_PER_MONTH_IN_EURO,
   TEMPORARY_CLUSTER_NAME
 };

package/dist/constants/misc.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/misc.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n\n/**\n * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by\n * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate\n * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,\n * where the exporter starts honoring the filters) \u2014 this is the product rollout gate.\n */\nexport const OPTIMIZE_FILTERING_MIN_VERSION = '8.10.0-alpha1'\n\n/**\n * Minimum cluster (zeebe) version at which the operator understands the new\n * cluster-secret CRDs (camunda-operator#5760) \u2014 SecretSource and SecretSync exist and\n * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:\n * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's\n * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef\n * (ByoidpSecretDeliveryController.deliverSecret refuses without one).\n *\n * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP\n * shipped on. Raising it would strand BYOIDP on every alpha below the new value.\n */\nexport const SECRET_SOURCE_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).\n * Shared by the c4 settings tile gate and the console-backend update guard so both\n * stay in lockstep.\n *\n * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP\n * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its\n * clientSecret through the SecretSource), so the two answer the same question and a\n * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION\n * \u2014 that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,\n * where it currently ships to prod.\n */\nexport const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version at which a cluster's *connector and internal*\n * secrets live in the new per-stage secret manager rather than the legacy store.\n *\n * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a\n * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy\n * store and it gets no connector SecretSync. The one thing that must never drift is\n * the pair inside THIS concern: store routing\n * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync\n * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),\n * the pre-8.10-backup mirror check, and the upgrade-copy crossing check\n * (GenerationController.crossesInto810) all read THIS constant. #9703 was those\n * disagreeing \u2014 where Console writes a secret must equal where the cluster reads it.\n *\n * Deliberately the 8.10 GA line, not any particular alpha. semver sorts a\n * prerelease below its release, so every `8.10.0-alphaN` \u2014 present and future \u2014\n * falls below this floor, while `SNAPSHOT` and `8.10-SNAPSHOT` normalize above it\n * and do route to the new store.\n *\n * Why alphas must stay out: routing is version-based with no persisted \"which store\n * holds this cluster's secrets\" marker, so a cluster above the floor while the\n * feature gate is off has its secrets in the legacy store, and enabling the gate\n * later reroutes it to a store nobody ever populated. The copy that would fix that\n * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only\n * fires on a generation CHANGE, and alpha generations have no upgrade chain at all\n * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) \u2014 an alpha cluster is\n * created on its generation and stays there. So an alpha cohort above this floor\n * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that\n * cohort.\n *\n * Keeping the floor on the GA line means clusters enter the new store only where the\n * copy is actually reachable: a real 8.10.0 upgrade, which does cross generations.\n * Alphas stay on the legacy store consistently and permanently.\n *\n * Do NOT lower this to name an alpha. The remaining ordering requirement is that a\n * stage's gate be enabled before the first at-floor cluster exists on it \u2014 which for\n * SNAPSHOT-tagged clusters (at-floor by design, since they run the newest operator)\n * still has to be respected by hand.\n */\nexport const CONNECTOR_SECRET_SYNC_MIN_VERSION = '8.10.0'\n\n/**\n * Version floors for App Integrations (#8536). The fix landed as patches on\n * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything\n * from 8.10.0-alpha4 on already carries both fixes. Shared by\n * isAppIntegrationsVersionSupported (c4 settings tile + console-backend\n * update guard) so the gate logic and its error message stay in lockstep.\n */\nexport const APP_INTEGRATIONS_MIN_VERSION = '8.10.0-alpha4'\nexport const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = '8.9.14'\nexport const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = '8.9.7'\n"],
-  "mappings": "AAMO,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;AAQnC,MAAM,iCAAiC;AAavC,MAAM,4BAA4B;AAclC,MAAM,qBAAqB;AAyC3B,MAAM,oCAAoC;AAS1C,MAAM,+BAA+B;AACrC,MAAM,+CAA+C;AACrD,MAAM,0DAA0D;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
+  "mappings": "AAMO,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;",
   "names": []
 }

package/dist/constants/version-gates.const.d.ts

@@ -0,0 +1,343 @@
+/**
+ * Central list of the cluster version floors that gate features.
+ *
+ * Every `checkVersion({ versionToCompareTo })` / `checkClusterVersion()` call in
+ * the apps and in `packages/c4` reads its floor from here. Put a new floor here
+ * before you use it. Do not write a version literal at the call site — the same
+ * feature is usually gated in more than one place (a c4 tile, a console-backend
+ * guard, a CRD spec), and two literals drift. Incident #9703 was two copies of
+ * one floor that disagreed.
+ *
+ * `packages/c3` keeps its own copy of the version helpers and is out of scope:
+ * it is a public package that this repo must not change.
+ *
+ * The values compare with semver, so the spelling of a floor decides which
+ * prerelease cohort it covers:
+ * - `8.10.0-0` and `8.10.0-alpha0` sort below every `8.10.0-alphaN`.
+ * - `8.10.0-alpha1` sorts above `alpha0` but below `alpha2`.
+ * - `8.10.0` sorts above ALL `8.10.0-*` prereleases.
+ *
+ * Two constants in this file can hold the same value. Then they gate different
+ * features and can move apart. When a name is an alias of another constant, the
+ * two answer the same question and must never drift.
+ *
+ * A call site compares a floor against the zeebe version of the generation,
+ * unless the comment of the constant names a different field. Name that field
+ * in the comment when you add a floor for one, because the same number means a
+ * different thing for `connectorBridge` or for a generation name.
+ */
+/** Start of the 8.9 line, prereleases included. */
+export declare const LINE_8_9_MIN_VERSION = "8.9.0-0";
+/** Start of the 8.10 line, prereleases included. */
+export declare const LINE_8_10_MIN_VERSION = "8.10.0-0";
+/** Hot backups are available on the cluster (c4 hot-backups tab). */
+export declare const HOT_BACKUP_MIN_VERSION = "8.2.4";
+/**
+ * The "enforce groups" toggle is offered (c4 settings tile). The tile also
+ * disappears again on 8.8 clusters that run Tasklist V2 — see
+ * `ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION`.
+ */
+export declare const ENFORCE_GROUPS_TOGGLE_MIN_VERSION = "8.5.0-alpha2";
+/** Resource-based authorizations exist. Replaced by identity authorizations. */
+export declare const RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION = "8.6.0";
+/**
+ * Identity-based authorizations replace the resource-based ones. Read as an
+ * upper bound by the c4 settings tile: below this the cluster still shows the
+ * resource-based section.
+ */
+export declare const IDENTITY_AUTHORIZATION_MIN_VERSION = "8.8.0-alpha1";
+/**
+ * Upper bound of the "your upgrade turns on identity authorizations" notice in
+ * the c4 overview tab. The notice is for 8.8-line targets only, so an 8.9
+ * target does not show it.
+ */
+export declare const IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION = "8.9.0-alpha1";
+/**
+ * The cluster uses the 8.8 role model, so the legacy per-cluster roles are
+ * gone (c4 user-details and management widgets).
+ */
+export declare const NEW_CLUSTER_ROLES_MIN_VERSION = "8.8.0-alpha4";
+/**
+ * The authorizations toggle is offered while creating a cluster (c4 create
+ * cluster wizard).
+ */
+export declare const AUTHORIZATION_TOGGLE_MIN_VERSION = "8.8.0-alpha4";
+/**
+ * Identity manages users, groups and tenants. The cluster shows the Identity
+ * screens (c4 cluster details, user details, group details, management widget,
+ * console-frontend and console-sm-frontend), and the CRD spec sends the
+ * internal client IDs to Identity
+ * (`K8sSpecUtils.clusterHasEnabledIdentityIntegration`).
+ *
+ * console-backend used `8.8.0-alpha4` until the gates moved here. That floor
+ * was one alpha under the frontend. As a result, an 8.8.0-alpha4 cluster got
+ * its `internalClientIDs` sent to an Identity that the UI did not show. There
+ * is one floor now, on the version the UI has always used.
+ */
+export declare const IDENTITY_MANAGEMENT_MIN_VERSION = "8.8.0-alpha5";
+/** The multi-tenancy toggle is offered (c4 settings tile). */
+export declare const MULTI_TENANCY_TOGGLE_MIN_VERSION = "8.8.0-alpha7";
+/** Business-ID uniqueness toggle is offered (c4 settings tile). */
+export declare const BUSINESS_ID_UNIQUENESS_MIN_VERSION = "8.9.0-alpha5";
+/**
+ * The current generation is good enough to upgrade to Tasklist V2 (c4 overview
+ * tab).
+ */
+export declare const TASKLIST_V2_UPGRADE_MIN_VERSION = "8.7.0-alpha4";
+/**
+ * The upgrade target carries Tasklist V2 (c4 overview tab). Pairs with
+ * `LINE_8_10_MIN_VERSION` as the upper bound, because from 8.10 on the setting
+ * is gone.
+ */
+export declare const TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION = "8.8.0-alpha1";
+/**
+ * A new cluster gets `tasklistV2Enabled` by default (console-backend cluster
+ * creation). Reads the generation's tasklist version when it has one, else
+ * zeebe.
+ */
+export declare const TASKLIST_V2_DEFAULT_ON_MIN_VERSION = "8.8.0";
+/**
+ * From this version, the c4 settings tile hides the "enforce groups" toggle on
+ * a cluster that runs Tasklist V2. The tile reads the constant with `>=`, and
+ * it also needs `tasklistV2Enabled` to be true.
+ *
+ * The name says MIN because of that `>=`. The other MAX names in this file mark
+ * the version where a gate stops, and their call sites read them with `<`.
+ */
+export declare const ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION = "8.8.0";
+/** The Tasklist upgrade banner is offered (c4 settings tile). */
+export declare const TASKLIST_UPGRADE_BANNER_MIN_VERSION = "8.8.0-alpha2";
+/**
+ * The Tasklist mode toggle is offered while creating a cluster (c4 create
+ * cluster wizard). Upper bound is `LINE_8_10_MIN_VERSION`.
+ */
+export declare const TASKLIST_MODE_TOGGLE_MIN_VERSION = "8.8.0-alpha8";
+/**
+ * Minor-version pair that turns Tasklist V2 on during a generation update
+ * (console-backend). Both are read with `VersionCheckOperator.SameMinor`: an
+ * 8.7 cluster that moves to an 8.8 generation gets the setting.
+ */
+export declare const TASKLIST_V2_AUTO_ENABLE_FROM_MINOR = "8.7.0";
+export declare const TASKLIST_V2_AUTO_ENABLE_TO_MINOR = "8.8.0";
+/**
+ * The version where the Tasklist V2 flag stops to mean anything, because there
+ * is no Tasklist V1 left to switch away from. Two readers use it. The CRD spec
+ * stops to emit the Tasklist V2 mode environment variable
+ * (`K8sSpecUtils.shouldSkipTasklistV2ModeEnvVar`). The accounts-frontend
+ * support rows stop to show the flag.
+ *
+ * Spelled `8.10.0` and NOT `LINE_8_10_MIN_VERSION` (`8.10.0-0`). Cluster
+ * creation sets the flag on every generation from
+ * `TASKLIST_V2_DEFAULT_ON_MIN_VERSION` on. An 8.10 prerelease thus carries a
+ * live value, and it must stay under this bound.
+ *
+ * c4 bounds its own Tasklist V2 checks with `LINE_8_10_MIN_VERSION` instead.
+ * That constant answers a different question: can Console still offer the
+ * Tasklist upgrade to this cluster. It correctly leaves out the 8.10
+ * prereleases.
+ */
+export declare const TASKLIST_V2_SETTING_MAX_VERSION = "8.10.0";
+/** The internal connectors-management page exists (c4 overview tab link). */
+export declare const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = "8.7.0-alpha1";
+/**
+ * The applications list offers "Manage" for connectors (c4 overview tab).
+ * Matches what console-frontend has always done.
+ */
+export declare const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = "8.8.0-alpha1";
+/**
+ * Connector management shows the outbound connectors, the per-connector metrics
+ * and the restart button. Under this floor the pages show the inbound-only
+ * table.
+ *
+ * CAUTION: the two readers compare this floor against different version fields.
+ * The c4 connector-management widgets compare
+ * `generation.versions.connectorBridge`
+ * (`useConnectorManagementRuntime.checkClusterVersion`). The
+ * console-sm-frontend pages compare the generation name of the cluster
+ * (`page.getData().generation`). Both sites had the same literal before the
+ * gates moved here, so this constant keeps that. Do not read it as one
+ * question until the two readers compare the same field.
+ */
+export declare const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = "8.10.0-alpha3";
+/**
+ * The secrets filter mode setting is offered on the 8.6 line (zeebe). Shared by
+ * isSecretsFilterModeConfigurable (c4 settings tile + console-backend update
+ * guard).
+ */
+export declare const SECRETS_FILTER_MODE_8_6_MIN_VERSION = "8.6.28";
+/** Same setting, floor for the 8.7 line. */
+export declare const SECRETS_FILTER_MODE_8_7_MIN_VERSION = "8.7.25";
+/** Same setting, floor for the 8.8 line. */
+export declare const SECRETS_FILTER_MODE_8_8_MIN_VERSION = "8.8.19";
+/**
+ * Same setting, floor for the 8.9 line. The env var works from 8.9.7, but the
+ * default stays DISABLED until 8.9.10. The floor waits for that default
+ * change, so the toggle never shows an unset value with an unknown default.
+ */
+export declare const SECRETS_FILTER_MODE_8_9_MIN_VERSION = "8.9.10";
+/**
+ * Same setting, floor for the 8.10 line and every line above it.
+ *
+ * This is the last floor: isSecretsFilterModeConfigurable applies it to all
+ * versions above the 8.9 line, so 8.11 and later need no floor of their own.
+ *
+ * Two different reasons keep the versions below it out, and the second one is
+ * why this floor is alpha6 and not alpha5:
+ *
+ * - alpha1 to alpha4 shipped the DISABLED default. Same reason as 8.9.7-8.9.9.
+ * - alpha5 shipped the STRICT default, but not the Connectors change that this
+ *   setting needs. SaaS runs Connectors with legacy.mode=FALLBACK from the 8.10
+ *   line on, and the Connectors runtime of alpha5 refuses to start unless
+ *   FALLBACK is paired with STRICT
+ *   (ConnectorsAutoConfiguration.checkLegacyFallbackSecretFilter). A customer
+ *   who selects LAX or DISABLED on alpha5 crashes their own Connectors runtime
+ *   at startup, so the toggle must stay hidden there.
+ *
+ * Connectors removed that check after the alpha5 release (2026-09-03). The
+ * removal is in the SNAPSHOT images and lands in the releases from alpha6 on.
+ * SNAPSHOT clusters run the newest images, so they get the toggle.
+ */
+export declare const SECRETS_FILTER_MODE_8_10_MIN_VERSION = "8.10.0-alpha6";
+/** The client details page can transform the cluster URL string (c4). */
+export declare const REST_API_URL_TRANSFORM_MIN_VERSION = "8.6.0";
+/** The cluster publishes a Zeebe REST URL, so the client details page uses it. */
+export declare const ZEEBE_REST_URL_MIN_VERSION = "8.8.0-alpha1";
+/** The cluster serves the v2 REST API under `<clusterUrl>/v2` (c4). */
+export declare const REST_API_V2_MIN_VERSION = "8.10.0-alpha1";
+/** The Swagger toggle and the Swagger link are offered (c4). */
+export declare const SWAGGER_MIN_VERSION = "8.8.0-alpha8";
+/**
+ * The Swagger URL moves to its 8.9 shape (c4 `buildClusterSwaggerUrl`).
+ * Spelled `8.9.0`, so 8.9 prereleases keep the older URL.
+ */
+export declare const SWAGGER_URL_8_9_MIN_VERSION = "8.9.0";
+/** The MCP toggle and the MCP client tab are offered (c4). */
+export declare const MCP_MIN_VERSION = "8.9.0-alpha4";
+/**
+ * Identity is called "Admin" from here on (c4 navigation and overview tab,
+ * console-sm-frontend). The URL and the permission still say `identity`.
+ */
+export declare const ADMIN_APP_RENAME_MIN_VERSION = "8.9.0-alpha5";
+/** The job dashboard is offered (c4 overview tab and console-sm-frontend). */
+export declare const JOB_DASHBOARD_MIN_VERSION = "8.9.0-alpha5";
+/** The cluster serves the statistics config endpoint (c4 cluster details). */
+export declare const CLUSTER_STATISTICS_CONFIG_MIN_VERSION = "8.9.0-alpha5";
+/** The audit log tab is offered (c4 cluster details). */
+export declare const AUDIT_LOG_TAB_MIN_VERSION = "8.9.0-alpha5";
+/** Only 8.7 and newer generations are offered to AWS-only orgs (console-backend). */
+export declare const AWS_ONLY_GENERATION_MIN_VERSION = "8.7.0";
+/**
+ * The gateway spec takes its 8.9 shape (console-backend
+ * `K8sSpecUtils.getGatewaySpec`). Spelled `-alpha0`, so every 8.9 prerelease
+ * is included.
+ */
+export declare const GATEWAY_SPEC_8_9_MIN_VERSION = "8.9.0-alpha0";
+/**
+ * The operator wires the session idle-timeout config through to Operate,
+ * Tasklist and the unified app (camunda-security-library ADR-0042,
+ * camunda-operator#5863). This floor matches the `SessionConfigSupported` gate
+ * of the operator. The CRD spec and the c4 settings tile both read it, which is
+ * why it lives here.
+ */
+export declare const SESSION_CONFIG_MIN_VERSION = "8.10.0-alpha5";
+/** A new cluster gets Optimize turned on by default (console-backend). */
+export declare const OPTIMIZE_DEFAULT_ON_MIN_VERSION = "8.10.0-alpha5";
+/**
+ * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by
+ * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate
+ * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,
+ * where the exporter starts honoring the filters) — this is the product rollout gate.
+ */
+export declare const OPTIMIZE_FILTERING_MIN_VERSION = "8.10.0-alpha1";
+/**
+ * Minimum cluster (zeebe) version at which the operator understands the new
+ * cluster-secret CRDs (camunda-operator#5760) — SecretSource and SecretSync exist and
+ * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:
+ * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's
+ * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef
+ * (ByoidpSecretDeliveryController.deliverSecret refuses without one).
+ *
+ * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP
+ * shipped on. Raising it would strand BYOIDP on every alpha below the new value.
+ */
+export declare const SECRET_SOURCE_MIN_VERSION = "8.10.0-alpha3";
+/**
+ * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).
+ * Shared by the c4 settings tile gate and the console-backend update guard so both
+ * stay in lockstep.
+ *
+ * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP
+ * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its
+ * clientSecret through the SecretSource), so the two answer the same question and a
+ * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION
+ * — that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,
+ * where it currently ships to prod.
+ */
+export declare const BYOIDP_MIN_VERSION = "8.10.0-alpha3";
+/**
+ * Minimum cluster (zeebe) version at which a cluster's *connector and internal*
+ * secrets live in the new per-stage secret manager rather than the legacy store.
+ *
+ * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a
+ * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy
+ * store and it gets no connector SecretSync. The one thing that must never drift is
+ * the pair inside THIS concern: store routing
+ * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync
+ * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),
+ * the pre-8.10-backup mirror check, and the upgrade-copy crossing check
+ * (GenerationController.crossesInto810) all read THIS constant. #9703 was those
+ * disagreeing — where Console writes a secret must equal where the cluster reads it.
+ *
+ * Was the 8.10 GA line (`8.10.0`) until the connector-secret changes landed on
+ * `8.10.0-alpha5` (2026-09-02). The floor moved down to that alpha because the
+ * ordering requirement below was already met at that time: no
+ * `8.10.0-alpha5` cluster existed yet, on any stage. So no cluster's secrets
+ * were left in the legacy store under the new floor.
+ *
+ * Why alphas normally stay out: routing is version-based with no persisted "which
+ * store holds this cluster's secrets" marker, so a cluster above the floor while the
+ * feature gate is off has its secrets in the legacy store, and enabling the gate
+ * later reroutes it to a store nobody ever populated. The copy that would fix that
+ * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only
+ * fires on a generation CHANGE, and alpha generations have no upgrade chain at all
+ * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) — an alpha cluster is
+ * created on its generation and stays there. So an alpha cohort above this floor
+ * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that
+ * cohort, and they stay below THIS floor (`alpha4 < alpha5`), so they are unaffected.
+ *
+ * The remaining ordering requirement is that a stage's gate be enabled before the
+ * first at-floor cluster exists on it — which for SNAPSHOT-tagged clusters (at-floor
+ * by design, since they run the newest operator) still has to be respected by hand. A
+ * future move to `8.10.0-alpha6` or higher must check the same thing this move did:
+ * no cluster already sitting at that version on any stage.
+ */
+export declare const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0-alpha5";
+/**
+ * Version floors for App Integrations (#8536). The fix landed as patches on
+ * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything
+ * from 8.10.0-alpha4 on already carries both fixes. Shared by
+ * isAppIntegrationsVersionSupported (c4 settings tile + console-backend
+ * update guard) so the gate logic and its error message stay in lockstep.
+ */
+export declare const APP_INTEGRATIONS_MIN_VERSION = "8.10.0-alpha4";
+export declare const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = "8.9.14";
+export declare const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = "8.9.7";
+/**
+ * Minor selector for the 8.9 stream, read with `VersionCheckOperator.SameMinor`
+ * by `isAppIntegrationsVersionSupported`. It picks the stream, it is not a
+ * floor: the floors are the two constants above.
+ */
+export declare const APP_INTEGRATIONS_89_STREAM_MINOR = "8.9.0";
+/**
+ * The cluster details header calls the secrets "cluster secrets" instead of
+ * the legacy name (c4).
+ *
+ * Aliased to CONNECTOR_SECRET_SYNC_MIN_VERSION rather than repeating the
+ * literal: the label must follow the store the cluster actually uses, so the
+ * two answer the same question.
+ */
+export declare const CLUSTER_SECRETS_LABEL_MIN_VERSION = "8.10.0-alpha5";
+/**
+ * Minimum cluster (zeebe) version for the optional telemetry toggle.
+ */
+export declare const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha5";