@camunda/ccma-shared-types 0.7.0 → 1.0.0

package/dist/_tests/types/alertSubscription.enum.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/connectivityStatus.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/secondaryStorageStatus.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/constants/failoverRegionPairs.const.d.ts

@@ -11,8 +11,26 @@
  */
 export declare const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string>;
 /**
- * `stage` mirrors the featureflags `onlyDev` gate: the EU test pairs unlock only
- * on 'local'/'dev'. Omitting stage (or passing any non-dev stage) allows the
- * base set only, so prod never sees the dev pairs.
+ * GCP's prod dual-region pair. Stathis confirmed it in the same Slack thread
+ * as `GCP_FAILOVER_REGION_PAIRS` (#9816).
+ *
+ * `isSupportedFailoverRegionPair` reads this set on the 'prod' stage. Two
+ * changes made this safe: GCP clusters have no BYOK option, so the AWS-only
+ * key-policy screen never shows for a GCP cluster; and the operator
+ * clone-role logic added a GCP branch in #9835.
+ *
+ * This set does not control customer access on its own. Two independent
+ * gates still apply: the `failover` feature flag, which allows only
+ * Camunda's internal org in prod, and the `failover` plan limit, which the
+ * org must also have enabled. This set only tells the backend and c4 which
+ * region pairs to treat as failover-capable.
+ */
+export declare const GCP_FAILOVER_REGION_PAIRS_PROD: ReadonlySet<string>;
+/**
+ * `stage` mirrors the featureflags `onlyDev` and `onlyPreprod` gates. The EU
+ * test pairs unlock only on 'local' and 'dev'. The GCP test pair also unlocks
+ * on 'int', because dev has no GCP failover test cluster. The GCP prod pair
+ * unlocks only on 'prod'. When you omit stage, the function allows the base
+ * set only.
  */
 export declare function isSupportedFailoverRegionPair(regionA: string | undefined, regionB: string | undefined, stage?: string): boolean;

package/dist/constants/failoverRegionPairs.const.js

@@ -8,14 +8,26 @@ const DEV_FAILOVER_REGION_PAIRS = /* @__PURE__ */ new Set([
   "eu-west-1:eu-west-2",
   "eu-west-2:eu-west-1"
 ]);
+const GCP_FAILOVER_REGION_PAIRS = /* @__PURE__ */ new Set([
+  "europe-north1:europe-west1",
+  "europe-west1:europe-north1"
+]);
+const GCP_FAILOVER_REGION_PAIRS_PROD = /* @__PURE__ */ new Set([
+  "us-central1:us-east1",
+  "us-east1:us-central1"
+]);
 function isSupportedFailoverRegionPair(regionA, regionB, stage) {
   if (!regionA || !regionB) return false;
   const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`;
   if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true;
   const isDev = stage === "local" || stage === "dev";
-  return isDev && DEV_FAILOVER_REGION_PAIRS.has(pair);
+  if (isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)) return true;
+  const isPreprod = isDev || stage === "int";
+  if (isPreprod && GCP_FAILOVER_REGION_PAIRS.has(pair)) return true;
+  return stage === "prod" && GCP_FAILOVER_REGION_PAIRS_PROD.has(pair);
 }
 export {
+  GCP_FAILOVER_REGION_PAIRS_PROD,
   SUPPORTED_FAILOVER_REGION_PAIRS,
   isSupportedFailoverRegionPair
 };

package/dist/constants/failoverRegionPairs.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/failoverRegionPairs.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Region pairs supported for cross-region failover (#9120). Failover is only\n * offered for dual-region clusters whose primary and secondary regions form\n * one of these reverse-region pairs \u2014 cluster creation must be supported in\n * both directions. Both directions of each pair are listed.\n *\n * This is the base set, enabled on every stage.\n *\n * Shared between console-backend (FailoverRouter guard) and c4 (hiding the\n * failover action for unsupported pairs).\n */\nexport const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'us-east-2:us-west-2',\n  'us-west-2:us-east-2',\n  'us-east-2:us-east-1',\n  'us-east-1:us-east-2',\n])\n\n// Dev-only test pairs: EU failover validation on dev/local before prod rollout.\nconst DEV_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'eu-west-1:eu-west-2',\n  'eu-west-2:eu-west-1',\n])\n\n/**\n * `stage` mirrors the featureflags `onlyDev` gate: the EU test pairs unlock only\n * on 'local'/'dev'. Omitting stage (or passing any non-dev stage) allows the\n * base set only, so prod never sees the dev pairs.\n */\nexport function isSupportedFailoverRegionPair(\n  regionA: string | undefined,\n  regionB: string | undefined,\n  stage?: string,\n): boolean {\n  if (!regionA || !regionB) return false\n  const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`\n  if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isDev = stage === 'local' || stage === 'dev'\n  return isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)\n}\n"],
-  "mappings": "AAiBO,MAAM,kCAAuD,oBAAI,IAAI;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAOM,SAAS,8BACd,SACA,SACA,OACS;AACT,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AACjC,QAAM,OAAO,GAAG,QAAQ,YAAY,CAAC,IAAI,QAAQ,YAAY,CAAC;AAC9D,MAAI,gCAAgC,IAAI,IAAI,EAAG,QAAO;AACtD,QAAM,QAAQ,UAAU,WAAW,UAAU;AAC7C,SAAO,SAAS,0BAA0B,IAAI,IAAI;AACpD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Region pairs supported for cross-region failover (#9120). Failover is only\n * offered for dual-region clusters whose primary and secondary regions form\n * one of these reverse-region pairs \u2014 cluster creation must be supported in\n * both directions. Both directions of each pair are listed.\n *\n * This is the base set, enabled on every stage.\n *\n * Shared between console-backend (FailoverRouter guard) and c4 (hiding the\n * failover action for unsupported pairs).\n */\nexport const SUPPORTED_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'us-east-2:us-west-2',\n  'us-west-2:us-east-2',\n  'us-east-2:us-east-1',\n  'us-east-1:us-east-2',\n])\n\n// Dev-only test pairs: EU failover validation on dev/local before prod rollout.\nconst DEV_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'eu-west-1:eu-west-2',\n  'eu-west-2:eu-west-1',\n])\n\n// GCP test pair \u2014 INT's dual region. Stathis confirmed this pair in the\n// Slack thread on #9816. This set unlocks on preprod stages only. It exists\n// to test the failover action on a second GCP region pair before that pair\n// is confirmed for prod. See `GCP_FAILOVER_REGION_PAIRS_PROD` for the pair\n// that GCP failover uses in prod.\nconst GCP_FAILOVER_REGION_PAIRS: ReadonlySet<string> = new Set([\n  'europe-north1:europe-west1',\n  'europe-west1:europe-north1',\n])\n\n/**\n * GCP's prod dual-region pair. Stathis confirmed it in the same Slack thread\n * as `GCP_FAILOVER_REGION_PAIRS` (#9816).\n *\n * `isSupportedFailoverRegionPair` reads this set on the 'prod' stage. Two\n * changes made this safe: GCP clusters have no BYOK option, so the AWS-only\n * key-policy screen never shows for a GCP cluster; and the operator\n * clone-role logic added a GCP branch in #9835.\n *\n * This set does not control customer access on its own. Two independent\n * gates still apply: the `failover` feature flag, which allows only\n * Camunda's internal org in prod, and the `failover` plan limit, which the\n * org must also have enabled. This set only tells the backend and c4 which\n * region pairs to treat as failover-capable.\n */\nexport const GCP_FAILOVER_REGION_PAIRS_PROD: ReadonlySet<string> = new Set([\n  'us-central1:us-east1',\n  'us-east1:us-central1',\n])\n\n/**\n * `stage` mirrors the featureflags `onlyDev` and `onlyPreprod` gates. The EU\n * test pairs unlock only on 'local' and 'dev'. The GCP test pair also unlocks\n * on 'int', because dev has no GCP failover test cluster. The GCP prod pair\n * unlocks only on 'prod'. When you omit stage, the function allows the base\n * set only.\n */\nexport function isSupportedFailoverRegionPair(\n  regionA: string | undefined,\n  regionB: string | undefined,\n  stage?: string,\n): boolean {\n  if (!regionA || !regionB) return false\n  const pair = `${regionA.toLowerCase()}:${regionB.toLowerCase()}`\n  if (SUPPORTED_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isDev = stage === 'local' || stage === 'dev'\n  if (isDev && DEV_FAILOVER_REGION_PAIRS.has(pair)) return true\n  const isPreprod = isDev || stage === 'int'\n  if (isPreprod && GCP_FAILOVER_REGION_PAIRS.has(pair)) return true\n  return stage === 'prod' && GCP_FAILOVER_REGION_PAIRS_PROD.has(pair)\n}\n"],
+  "mappings": "AAiBO,MAAM,kCAAuD,oBAAI,IAAI;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAOD,MAAM,4BAAiD,oBAAI,IAAI;AAAA,EAC7D;AAAA,EACA;AACF,CAAC;AAiBM,MAAM,iCAAsD,oBAAI,IAAI;AAAA,EACzE;AAAA,EACA;AACF,CAAC;AASM,SAAS,8BACd,SACA,SACA,OACS;AACT,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AACjC,QAAM,OAAO,GAAG,QAAQ,YAAY,CAAC,IAAI,QAAQ,YAAY,CAAC;AAC9D,MAAI,gCAAgC,IAAI,IAAI,EAAG,QAAO;AACtD,QAAM,QAAQ,UAAU,WAAW,UAAU;AAC7C,MAAI,SAAS,0BAA0B,IAAI,IAAI,EAAG,QAAO;AACzD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,aAAa,0BAA0B,IAAI,IAAI,EAAG,QAAO;AAC7D,SAAO,UAAU,UAAU,+BAA+B,IAAI,IAAI;AACpE;",
   "names": []
 }

package/dist/constants/version-gates.const.d.ts

@@ -159,6 +159,45 @@ export declare const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = "8.8.0-alpha1"
  * question until the two readers compare the same field.
  */
 export declare const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = "8.10.0-alpha3";
+/**
+ * The secrets filter mode setting is offered on the 8.6 line (zeebe). Shared by
+ * isSecretsFilterModeConfigurable (c4 settings tile + console-backend update
+ * guard).
+ */
+export declare const SECRETS_FILTER_MODE_8_6_MIN_VERSION = "8.6.28";
+/** Same setting, floor for the 8.7 line. */
+export declare const SECRETS_FILTER_MODE_8_7_MIN_VERSION = "8.7.25";
+/** Same setting, floor for the 8.8 line. */
+export declare const SECRETS_FILTER_MODE_8_8_MIN_VERSION = "8.8.19";
+/**
+ * Same setting, floor for the 8.9 line. The env var works from 8.9.7, but the
+ * default stays DISABLED until 8.9.10. The floor waits for that default
+ * change, so the toggle never shows an unset value with an unknown default.
+ */
+export declare const SECRETS_FILTER_MODE_8_9_MIN_VERSION = "8.9.10";
+/**
+ * Same setting, floor for the 8.10 line and every line above it.
+ *
+ * This is the last floor: isSecretsFilterModeConfigurable applies it to all
+ * versions above the 8.9 line, so 8.11 and later need no floor of their own.
+ *
+ * Two different reasons keep the versions below it out, and the second one is
+ * why this floor is alpha6 and not alpha5:
+ *
+ * - alpha1 to alpha4 shipped the DISABLED default. Same reason as 8.9.7-8.9.9.
+ * - alpha5 shipped the STRICT default, but not the Connectors change that this
+ *   setting needs. SaaS runs Connectors with legacy.mode=FALLBACK from the 8.10
+ *   line on, and the Connectors runtime of alpha5 refuses to start unless
+ *   FALLBACK is paired with STRICT
+ *   (ConnectorsAutoConfiguration.checkLegacyFallbackSecretFilter). A customer
+ *   who selects LAX or DISABLED on alpha5 crashes their own Connectors runtime
+ *   at startup, so the toggle must stay hidden there.
+ *
+ * Connectors removed that check after the alpha5 release (2026-09-03). The
+ * removal is in the SNAPSHOT images and lands in the releases from alpha6 on.
+ * SNAPSHOT clusters run the newest images, so they get the toggle.
+ */
+export declare const SECRETS_FILTER_MODE_8_10_MIN_VERSION = "8.10.0-alpha6";
 /** The client details page can transform the cluster URL string (c4). */
 export declare const REST_API_URL_TRANSFORM_MIN_VERSION = "8.6.0";
 /** The cluster publishes a Zeebe REST URL, so the client details page uses it. */
@@ -249,13 +288,14 @@ export declare const BYOIDP_MIN_VERSION = "8.10.0-alpha3";
  * (GenerationController.crossesInto810) all read THIS constant. #9703 was those
  * disagreeing — where Console writes a secret must equal where the cluster reads it.
  *
- * Deliberately the 8.10 GA line, not any particular alpha. semver sorts a
- * prerelease below its release, so every `8.10.0-alphaN` — present and future —
- * falls below this floor, while `SNAPSHOT` and `8.10-SNAPSHOT` normalize above it
- * and do route to the new store.
+ * Was the 8.10 GA line (`8.10.0`) until the connector-secret changes landed on
+ * `8.10.0-alpha5` (2026-09-02). The floor moved down to that alpha because the
+ * ordering requirement below was already met at that time: no
+ * `8.10.0-alpha5` cluster existed yet, on any stage. So no cluster's secrets
+ * were left in the legacy store under the new floor.
  *
- * Why alphas must stay out: routing is version-based with no persisted "which store
- * holds this cluster's secrets" marker, so a cluster above the floor while the
+ * Why alphas normally stay out: routing is version-based with no persisted "which
+ * store holds this cluster's secrets" marker, so a cluster above the floor while the
  * feature gate is off has its secrets in the legacy store, and enabling the gate
  * later reroutes it to a store nobody ever populated. The copy that would fix that
  * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only
@@ -263,18 +303,15 @@ export declare const BYOIDP_MIN_VERSION = "8.10.0-alpha3";
  * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) — an alpha cluster is
  * created on its generation and stays there. So an alpha cohort above this floor
  * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that
- * cohort.
+ * cohort, and they stay below THIS floor (`alpha4 < alpha5`), so they are unaffected.
  *
- * Keeping the floor on the GA line means clusters enter the new store only where the
- * copy is actually reachable: a real 8.10.0 upgrade, which does cross generations.
- * Alphas stay on the legacy store consistently and permanently.
- *
- * Do NOT lower this to name an alpha. The remaining ordering requirement is that a
- * stage's gate be enabled before the first at-floor cluster exists on it — which for
- * SNAPSHOT-tagged clusters (at-floor by design, since they run the newest operator)
- * still has to be respected by hand.
+ * The remaining ordering requirement is that a stage's gate be enabled before the
+ * first at-floor cluster exists on it — which for SNAPSHOT-tagged clusters (at-floor
+ * by design, since they run the newest operator) still has to be respected by hand. A
+ * future move to `8.10.0-alpha6` or higher must check the same thing this move did:
+ * no cluster already sitting at that version on any stage.
  */
-export declare const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0";
+export declare const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0-alpha5";
 /**
  * Version floors for App Integrations (#8536). The fix landed as patches on
  * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything
@@ -299,4 +336,8 @@ export declare const APP_INTEGRATIONS_89_STREAM_MINOR = "8.9.0";
  * literal: the label must follow the store the cluster actually uses, so the
  * two answer the same question.
  */
-export declare const CLUSTER_SECRETS_LABEL_MIN_VERSION = "8.10.0";
+export declare const CLUSTER_SECRETS_LABEL_MIN_VERSION = "8.10.0-alpha5";
+/**
+ * Minimum cluster (zeebe) version for the optional telemetry toggle.
+ */
+export declare const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha5";

package/dist/constants/version-gates.const.js

@@ -22,6 +22,11 @@ const TASKLIST_V2_SETTING_MAX_VERSION = "8.10.0";
 const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = "8.7.0-alpha1";
 const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = "8.8.0-alpha1";
 const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = "8.10.0-alpha3";
+const SECRETS_FILTER_MODE_8_6_MIN_VERSION = "8.6.28";
+const SECRETS_FILTER_MODE_8_7_MIN_VERSION = "8.7.25";
+const SECRETS_FILTER_MODE_8_8_MIN_VERSION = "8.8.19";
+const SECRETS_FILTER_MODE_8_9_MIN_VERSION = "8.9.10";
+const SECRETS_FILTER_MODE_8_10_MIN_VERSION = "8.10.0-alpha6";
 const REST_API_URL_TRANSFORM_MIN_VERSION = "8.6.0";
 const ZEEBE_REST_URL_MIN_VERSION = "8.8.0-alpha1";
 const REST_API_V2_MIN_VERSION = "8.10.0-alpha1";
@@ -39,12 +44,13 @@ const OPTIMIZE_DEFAULT_ON_MIN_VERSION = "8.10.0-alpha5";
 const OPTIMIZE_FILTERING_MIN_VERSION = "8.10.0-alpha1";
 const SECRET_SOURCE_MIN_VERSION = "8.10.0-alpha3";
 const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION;
-const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0";
+const CONNECTOR_SECRET_SYNC_MIN_VERSION = "8.10.0-alpha5";
 const APP_INTEGRATIONS_MIN_VERSION = "8.10.0-alpha4";
 const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = "8.9.14";
 const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = "8.9.7";
 const APP_INTEGRATIONS_89_STREAM_MINOR = "8.9.0";
 const CLUSTER_SECRETS_LABEL_MIN_VERSION = CONNECTOR_SECRET_SYNC_MIN_VERSION;
+const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha5";
 export {
   ADMIN_APP_RENAME_MIN_VERSION,
   APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,
@@ -77,9 +83,15 @@ export {
   NEW_CLUSTER_ROLES_MIN_VERSION,
   OPTIMIZE_DEFAULT_ON_MIN_VERSION,
   OPTIMIZE_FILTERING_MIN_VERSION,
+  OPTIONAL_TELEMETRY_MIN_VERSION,
   RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,
   REST_API_URL_TRANSFORM_MIN_VERSION,
   REST_API_V2_MIN_VERSION,
+  SECRETS_FILTER_MODE_8_10_MIN_VERSION,
+  SECRETS_FILTER_MODE_8_6_MIN_VERSION,
+  SECRETS_FILTER_MODE_8_7_MIN_VERSION,
+  SECRETS_FILTER_MODE_8_8_MIN_VERSION,
+  SECRETS_FILTER_MODE_8_9_MIN_VERSION,
   SECRET_SOURCE_MIN_VERSION,
   SESSION_CONFIG_MIN_VERSION,
   SWAGGER_MIN_VERSION,

package/dist/constants/version-gates.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/version-gates.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Central list of the cluster version floors that gate features.\n *\n * Every `checkVersion({ versionToCompareTo })` / `checkClusterVersion()` call in\n * the apps and in `packages/c4` reads its floor from here. Put a new floor here\n * before you use it. Do not write a version literal at the call site \u2014 the same\n * feature is usually gated in more than one place (a c4 tile, a console-backend\n * guard, a CRD spec), and two literals drift. Incident #9703 was two copies of\n * one floor that disagreed.\n *\n * `packages/c3` keeps its own copy of the version helpers and is out of scope:\n * it is a public package that this repo must not change.\n *\n * The values compare with semver, so the spelling of a floor decides which\n * prerelease cohort it covers:\n * - `8.10.0-0` and `8.10.0-alpha0` sort below every `8.10.0-alphaN`.\n * - `8.10.0-alpha1` sorts above `alpha0` but below `alpha2`.\n * - `8.10.0` sorts above ALL `8.10.0-*` prereleases.\n *\n * Two constants in this file can hold the same value. Then they gate different\n * features and can move apart. When a name is an alias of another constant, the\n * two answer the same question and must never drift.\n *\n * A call site compares a floor against the zeebe version of the generation,\n * unless the comment of the constant names a different field. Name that field\n * in the comment when you add a floor for one, because the same number means a\n * different thing for `connectorBridge` or for a generation name.\n */\n\n// ---------------------------------------------------------------------------\n// Release-line floors\n//\n// Used where the code asks \"is this generation on the 8.x line?\" and no single\n// feature owns the answer. Both spell the line start as `-0`, so every\n// prerelease of that line is included.\n// ---------------------------------------------------------------------------\n\n/** Start of the 8.9 line, prereleases included. */\nexport const LINE_8_9_MIN_VERSION = '8.9.0-0'\n\n/** Start of the 8.10 line, prereleases included. */\nexport const LINE_8_10_MIN_VERSION = '8.10.0-0'\n\n// ---------------------------------------------------------------------------\n// Backups\n// ---------------------------------------------------------------------------\n\n/** Hot backups are available on the cluster (c4 hot-backups tab). */\nexport const HOT_BACKUP_MIN_VERSION = '8.2.4'\n\n// ---------------------------------------------------------------------------\n// Identity, authorizations and roles\n// ---------------------------------------------------------------------------\n\n/**\n * The \"enforce groups\" toggle is offered (c4 settings tile). The tile also\n * disappears again on 8.8 clusters that run Tasklist V2 \u2014 see\n * `ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION`.\n */\nexport const ENFORCE_GROUPS_TOGGLE_MIN_VERSION = '8.5.0-alpha2'\n\n/** Resource-based authorizations exist. Replaced by identity authorizations. */\nexport const RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION = '8.6.0'\n\n/**\n * Identity-based authorizations replace the resource-based ones. Read as an\n * upper bound by the c4 settings tile: below this the cluster still shows the\n * resource-based section.\n */\nexport const IDENTITY_AUTHORIZATION_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Upper bound of the \"your upgrade turns on identity authorizations\" notice in\n * the c4 overview tab. The notice is for 8.8-line targets only, so an 8.9\n * target does not show it.\n */\nexport const IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION = '8.9.0-alpha1'\n\n/**\n * The cluster uses the 8.8 role model, so the legacy per-cluster roles are\n * gone (c4 user-details and management widgets).\n */\nexport const NEW_CLUSTER_ROLES_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * The authorizations toggle is offered while creating a cluster (c4 create\n * cluster wizard).\n */\nexport const AUTHORIZATION_TOGGLE_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * Identity manages users, groups and tenants. The cluster shows the Identity\n * screens (c4 cluster details, user details, group details, management widget,\n * console-frontend and console-sm-frontend), and the CRD spec sends the\n * internal client IDs to Identity\n * (`K8sSpecUtils.clusterHasEnabledIdentityIntegration`).\n *\n * console-backend used `8.8.0-alpha4` until the gates moved here. That floor\n * was one alpha under the frontend. As a result, an 8.8.0-alpha4 cluster got\n * its `internalClientIDs` sent to an Identity that the UI did not show. There\n * is one floor now, on the version the UI has always used.\n */\nexport const IDENTITY_MANAGEMENT_MIN_VERSION = '8.8.0-alpha5'\n\n/** The multi-tenancy toggle is offered (c4 settings tile). */\nexport const MULTI_TENANCY_TOGGLE_MIN_VERSION = '8.8.0-alpha7'\n\n/** Business-ID uniqueness toggle is offered (c4 settings tile). */\nexport const BUSINESS_ID_UNIQUENESS_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Tasklist\n// ---------------------------------------------------------------------------\n\n/**\n * The current generation is good enough to upgrade to Tasklist V2 (c4 overview\n * tab).\n */\nexport const TASKLIST_V2_UPGRADE_MIN_VERSION = '8.7.0-alpha4'\n\n/**\n * The upgrade target carries Tasklist V2 (c4 overview tab). Pairs with\n * `LINE_8_10_MIN_VERSION` as the upper bound, because from 8.10 on the setting\n * is gone.\n */\nexport const TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * A new cluster gets `tasklistV2Enabled` by default (console-backend cluster\n * creation). Reads the generation's tasklist version when it has one, else\n * zeebe.\n */\nexport const TASKLIST_V2_DEFAULT_ON_MIN_VERSION = '8.8.0'\n\n/**\n * From this version, the c4 settings tile hides the \"enforce groups\" toggle on\n * a cluster that runs Tasklist V2. The tile reads the constant with `>=`, and\n * it also needs `tasklistV2Enabled` to be true.\n *\n * The name says MIN because of that `>=`. The other MAX names in this file mark\n * the version where a gate stops, and their call sites read them with `<`.\n */\nexport const ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION = '8.8.0'\n\n/** The Tasklist upgrade banner is offered (c4 settings tile). */\nexport const TASKLIST_UPGRADE_BANNER_MIN_VERSION = '8.8.0-alpha2'\n\n/**\n * The Tasklist mode toggle is offered while creating a cluster (c4 create\n * cluster wizard). Upper bound is `LINE_8_10_MIN_VERSION`.\n */\nexport const TASKLIST_MODE_TOGGLE_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * Minor-version pair that turns Tasklist V2 on during a generation update\n * (console-backend). Both are read with `VersionCheckOperator.SameMinor`: an\n * 8.7 cluster that moves to an 8.8 generation gets the setting.\n */\nexport const TASKLIST_V2_AUTO_ENABLE_FROM_MINOR = '8.7.0'\nexport const TASKLIST_V2_AUTO_ENABLE_TO_MINOR = '8.8.0'\n\n/**\n * The version where the Tasklist V2 flag stops to mean anything, because there\n * is no Tasklist V1 left to switch away from. Two readers use it. The CRD spec\n * stops to emit the Tasklist V2 mode environment variable\n * (`K8sSpecUtils.shouldSkipTasklistV2ModeEnvVar`). The accounts-frontend\n * support rows stop to show the flag.\n *\n * Spelled `8.10.0` and NOT `LINE_8_10_MIN_VERSION` (`8.10.0-0`). Cluster\n * creation sets the flag on every generation from\n * `TASKLIST_V2_DEFAULT_ON_MIN_VERSION` on. An 8.10 prerelease thus carries a\n * live value, and it must stay under this bound.\n *\n * c4 bounds its own Tasklist V2 checks with `LINE_8_10_MIN_VERSION` instead.\n * That constant answers a different question: can Console still offer the\n * Tasklist upgrade to this cluster. It correctly leaves out the 8.10\n * prereleases.\n */\nexport const TASKLIST_V2_SETTING_MAX_VERSION = '8.10.0'\n\n// ---------------------------------------------------------------------------\n// Connectors\n// ---------------------------------------------------------------------------\n\n/** The internal connectors-management page exists (c4 overview tab link). */\nexport const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = '8.7.0-alpha1'\n\n/**\n * The applications list offers \"Manage\" for connectors (c4 overview tab).\n * Matches what console-frontend has always done.\n */\nexport const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Connector management shows the outbound connectors, the per-connector metrics\n * and the restart button. Under this floor the pages show the inbound-only\n * table.\n *\n * CAUTION: the two readers compare this floor against different version fields.\n * The c4 connector-management widgets compare\n * `generation.versions.connectorBridge`\n * (`useConnectorManagementRuntime.checkClusterVersion`). The\n * console-sm-frontend pages compare the generation name of the cluster\n * (`page.getData().generation`). Both sites had the same literal before the\n * gates moved here, so this constant keeps that. Do not read it as one\n * question until the two readers compare the same field.\n */\nexport const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = '8.10.0-alpha3'\n\n// ---------------------------------------------------------------------------\n// APIs and cluster URLs\n// ---------------------------------------------------------------------------\n\n/** The client details page can transform the cluster URL string (c4). */\nexport const REST_API_URL_TRANSFORM_MIN_VERSION = '8.6.0'\n\n/** The cluster publishes a Zeebe REST URL, so the client details page uses it. */\nexport const ZEEBE_REST_URL_MIN_VERSION = '8.8.0-alpha1'\n\n/** The cluster serves the v2 REST API under `<clusterUrl>/v2` (c4). */\nexport const REST_API_V2_MIN_VERSION = '8.10.0-alpha1'\n\n/** The Swagger toggle and the Swagger link are offered (c4). */\nexport const SWAGGER_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * The Swagger URL moves to its 8.9 shape (c4 `buildClusterSwaggerUrl`).\n * Spelled `8.9.0`, so 8.9 prereleases keep the older URL.\n */\nexport const SWAGGER_URL_8_9_MIN_VERSION = '8.9.0'\n\n/** The MCP toggle and the MCP client tab are offered (c4). */\nexport const MCP_MIN_VERSION = '8.9.0-alpha4'\n\n// ---------------------------------------------------------------------------\n// Apps, tabs and dashboards\n// ---------------------------------------------------------------------------\n\n/**\n * Identity is called \"Admin\" from here on (c4 navigation and overview tab,\n * console-sm-frontend). The URL and the permission still say `identity`.\n */\nexport const ADMIN_APP_RENAME_MIN_VERSION = '8.9.0-alpha5'\n\n/** The job dashboard is offered (c4 overview tab and console-sm-frontend). */\nexport const JOB_DASHBOARD_MIN_VERSION = '8.9.0-alpha5'\n\n/** The cluster serves the statistics config endpoint (c4 cluster details). */\nexport const CLUSTER_STATISTICS_CONFIG_MIN_VERSION = '8.9.0-alpha5'\n\n/** The audit log tab is offered (c4 cluster details). */\nexport const AUDIT_LOG_TAB_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Cluster spec and provisioning\n// ---------------------------------------------------------------------------\n\n/** Only 8.7 and newer generations are offered to AWS-only orgs (console-backend). */\nexport const AWS_ONLY_GENERATION_MIN_VERSION = '8.7.0'\n\n/**\n * The gateway spec takes its 8.9 shape (console-backend\n * `K8sSpecUtils.getGatewaySpec`). Spelled `-alpha0`, so every 8.9 prerelease\n * is included.\n */\nexport const GATEWAY_SPEC_8_9_MIN_VERSION = '8.9.0-alpha0'\n\n/**\n * The operator wires the session idle-timeout config through to Operate,\n * Tasklist and the unified app (camunda-security-library ADR-0042,\n * camunda-operator#5863). This floor matches the `SessionConfigSupported` gate\n * of the operator. The CRD spec and the c4 settings tile both read it, which is\n * why it lives here.\n */\nexport const SESSION_CONFIG_MIN_VERSION = '8.10.0-alpha5'\n\n/** A new cluster gets Optimize turned on by default (console-backend). */\nexport const OPTIMIZE_DEFAULT_ON_MIN_VERSION = '8.10.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Secrets, BYOIDP, Optimize and App Integrations\n//\n// Moved here from misc.const.ts. Same names, same values.\n// ---------------------------------------------------------------------------\n/**\n * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by\n * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate\n * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,\n * where the exporter starts honoring the filters) \u2014 this is the product rollout gate.\n */\nexport const OPTIMIZE_FILTERING_MIN_VERSION = '8.10.0-alpha1'\n\n/**\n * Minimum cluster (zeebe) version at which the operator understands the new\n * cluster-secret CRDs (camunda-operator#5760) \u2014 SecretSource and SecretSync exist and\n * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:\n * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's\n * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef\n * (ByoidpSecretDeliveryController.deliverSecret refuses without one).\n *\n * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP\n * shipped on. Raising it would strand BYOIDP on every alpha below the new value.\n */\nexport const SECRET_SOURCE_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).\n * Shared by the c4 settings tile gate and the console-backend update guard so both\n * stay in lockstep.\n *\n * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP\n * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its\n * clientSecret through the SecretSource), so the two answer the same question and a\n * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION\n * \u2014 that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,\n * where it currently ships to prod.\n */\nexport const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version at which a cluster's *connector and internal*\n * secrets live in the new per-stage secret manager rather than the legacy store.\n *\n * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a\n * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy\n * store and it gets no connector SecretSync. The one thing that must never drift is\n * the pair inside THIS concern: store routing\n * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync\n * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),\n * the pre-8.10-backup mirror check, and the upgrade-copy crossing check\n * (GenerationController.crossesInto810) all read THIS constant. #9703 was those\n * disagreeing \u2014 where Console writes a secret must equal where the cluster reads it.\n *\n * Deliberately the 8.10 GA line, not any particular alpha. semver sorts a\n * prerelease below its release, so every `8.10.0-alphaN` \u2014 present and future \u2014\n * falls below this floor, while `SNAPSHOT` and `8.10-SNAPSHOT` normalize above it\n * and do route to the new store.\n *\n * Why alphas must stay out: routing is version-based with no persisted \"which store\n * holds this cluster's secrets\" marker, so a cluster above the floor while the\n * feature gate is off has its secrets in the legacy store, and enabling the gate\n * later reroutes it to a store nobody ever populated. The copy that would fix that\n * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only\n * fires on a generation CHANGE, and alpha generations have no upgrade chain at all\n * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) \u2014 an alpha cluster is\n * created on its generation and stays there. So an alpha cohort above this floor\n * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that\n * cohort.\n *\n * Keeping the floor on the GA line means clusters enter the new store only where the\n * copy is actually reachable: a real 8.10.0 upgrade, which does cross generations.\n * Alphas stay on the legacy store consistently and permanently.\n *\n * Do NOT lower this to name an alpha. The remaining ordering requirement is that a\n * stage's gate be enabled before the first at-floor cluster exists on it \u2014 which for\n * SNAPSHOT-tagged clusters (at-floor by design, since they run the newest operator)\n * still has to be respected by hand.\n */\nexport const CONNECTOR_SECRET_SYNC_MIN_VERSION = '8.10.0'\n\n/**\n * Version floors for App Integrations (#8536). The fix landed as patches on\n * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything\n * from 8.10.0-alpha4 on already carries both fixes. Shared by\n * isAppIntegrationsVersionSupported (c4 settings tile + console-backend\n * update guard) so the gate logic and its error message stay in lockstep.\n */\nexport const APP_INTEGRATIONS_MIN_VERSION = '8.10.0-alpha4'\nexport const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = '8.9.14'\nexport const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = '8.9.7'\n\n/**\n * Minor selector for the 8.9 stream, read with `VersionCheckOperator.SameMinor`\n * by `isAppIntegrationsVersionSupported`. It picks the stream, it is not a\n * floor: the floors are the two constants above.\n */\nexport const APP_INTEGRATIONS_89_STREAM_MINOR = '8.9.0'\n\n/**\n * The cluster details header calls the secrets \"cluster secrets\" instead of\n * the legacy name (c4).\n *\n * Aliased to CONNECTOR_SECRET_SYNC_MIN_VERSION rather than repeating the\n * literal: the label must follow the store the cluster actually uses, so the\n * two answer the same question.\n */\nexport const CLUSTER_SECRETS_LABEL_MIN_VERSION =\n  CONNECTOR_SECRET_SYNC_MIN_VERSION\n"],
-  "mappings": "AA4CO,MAAM,uBAAuB;AAG7B,MAAM,wBAAwB;AAO9B,MAAM,yBAAyB;AAW/B,MAAM,oCAAoC;AAG1C,MAAM,4CAA4C;AAOlD,MAAM,qCAAqC;AAO3C,MAAM,4CAA4C;AAMlD,MAAM,gCAAgC;AAMtC,MAAM,mCAAmC;AAczC,MAAM,kCAAkC;AAGxC,MAAM,mCAAmC;AAGzC,MAAM,qCAAqC;AAU3C,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAO/C,MAAM,qCAAqC;AAU3C,MAAM,gDAAgD;AAGtD,MAAM,sCAAsC;AAM5C,MAAM,mCAAmC;AAOzC,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAmBzC,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAM/C,MAAM,6CAA6C;AAgBnD,MAAM,2CAA2C;AAOjD,MAAM,qCAAqC;AAG3C,MAAM,6BAA6B;AAGnC,MAAM,0BAA0B;AAGhC,MAAM,sBAAsB;AAM5B,MAAM,8BAA8B;AAGpC,MAAM,kBAAkB;AAUxB,MAAM,+BAA+B;AAGrC,MAAM,4BAA4B;AAGlC,MAAM,wCAAwC;AAG9C,MAAM,4BAA4B;AAOlC,MAAM,kCAAkC;AAOxC,MAAM,+BAA+B;AASrC,MAAM,6BAA6B;AAGnC,MAAM,kCAAkC;AAaxC,MAAM,iCAAiC;AAavC,MAAM,4BAA4B;AAclC,MAAM,qBAAqB;AAyC3B,MAAM,oCAAoC;AAS1C,MAAM,+BAA+B;AACrC,MAAM,+CAA+C;AACrD,MAAM,0DAA0D;AAOhE,MAAM,mCAAmC;AAUzC,MAAM,oCACX;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Central list of the cluster version floors that gate features.\n *\n * Every `checkVersion({ versionToCompareTo })` / `checkClusterVersion()` call in\n * the apps and in `packages/c4` reads its floor from here. Put a new floor here\n * before you use it. Do not write a version literal at the call site \u2014 the same\n * feature is usually gated in more than one place (a c4 tile, a console-backend\n * guard, a CRD spec), and two literals drift. Incident #9703 was two copies of\n * one floor that disagreed.\n *\n * `packages/c3` keeps its own copy of the version helpers and is out of scope:\n * it is a public package that this repo must not change.\n *\n * The values compare with semver, so the spelling of a floor decides which\n * prerelease cohort it covers:\n * - `8.10.0-0` and `8.10.0-alpha0` sort below every `8.10.0-alphaN`.\n * - `8.10.0-alpha1` sorts above `alpha0` but below `alpha2`.\n * - `8.10.0` sorts above ALL `8.10.0-*` prereleases.\n *\n * Two constants in this file can hold the same value. Then they gate different\n * features and can move apart. When a name is an alias of another constant, the\n * two answer the same question and must never drift.\n *\n * A call site compares a floor against the zeebe version of the generation,\n * unless the comment of the constant names a different field. Name that field\n * in the comment when you add a floor for one, because the same number means a\n * different thing for `connectorBridge` or for a generation name.\n */\n\n// ---------------------------------------------------------------------------\n// Release-line floors\n//\n// Used where the code asks \"is this generation on the 8.x line?\" and no single\n// feature owns the answer. Both spell the line start as `-0`, so every\n// prerelease of that line is included.\n// ---------------------------------------------------------------------------\n\n/** Start of the 8.9 line, prereleases included. */\nexport const LINE_8_9_MIN_VERSION = '8.9.0-0'\n\n/** Start of the 8.10 line, prereleases included. */\nexport const LINE_8_10_MIN_VERSION = '8.10.0-0'\n\n// ---------------------------------------------------------------------------\n// Backups\n// ---------------------------------------------------------------------------\n\n/** Hot backups are available on the cluster (c4 hot-backups tab). */\nexport const HOT_BACKUP_MIN_VERSION = '8.2.4'\n\n// ---------------------------------------------------------------------------\n// Identity, authorizations and roles\n// ---------------------------------------------------------------------------\n\n/**\n * The \"enforce groups\" toggle is offered (c4 settings tile). The tile also\n * disappears again on 8.8 clusters that run Tasklist V2 \u2014 see\n * `ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION`.\n */\nexport const ENFORCE_GROUPS_TOGGLE_MIN_VERSION = '8.5.0-alpha2'\n\n/** Resource-based authorizations exist. Replaced by identity authorizations. */\nexport const RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION = '8.6.0'\n\n/**\n * Identity-based authorizations replace the resource-based ones. Read as an\n * upper bound by the c4 settings tile: below this the cluster still shows the\n * resource-based section.\n */\nexport const IDENTITY_AUTHORIZATION_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Upper bound of the \"your upgrade turns on identity authorizations\" notice in\n * the c4 overview tab. The notice is for 8.8-line targets only, so an 8.9\n * target does not show it.\n */\nexport const IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION = '8.9.0-alpha1'\n\n/**\n * The cluster uses the 8.8 role model, so the legacy per-cluster roles are\n * gone (c4 user-details and management widgets).\n */\nexport const NEW_CLUSTER_ROLES_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * The authorizations toggle is offered while creating a cluster (c4 create\n * cluster wizard).\n */\nexport const AUTHORIZATION_TOGGLE_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * Identity manages users, groups and tenants. The cluster shows the Identity\n * screens (c4 cluster details, user details, group details, management widget,\n * console-frontend and console-sm-frontend), and the CRD spec sends the\n * internal client IDs to Identity\n * (`K8sSpecUtils.clusterHasEnabledIdentityIntegration`).\n *\n * console-backend used `8.8.0-alpha4` until the gates moved here. That floor\n * was one alpha under the frontend. As a result, an 8.8.0-alpha4 cluster got\n * its `internalClientIDs` sent to an Identity that the UI did not show. There\n * is one floor now, on the version the UI has always used.\n */\nexport const IDENTITY_MANAGEMENT_MIN_VERSION = '8.8.0-alpha5'\n\n/** The multi-tenancy toggle is offered (c4 settings tile). */\nexport const MULTI_TENANCY_TOGGLE_MIN_VERSION = '8.8.0-alpha7'\n\n/** Business-ID uniqueness toggle is offered (c4 settings tile). */\nexport const BUSINESS_ID_UNIQUENESS_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Tasklist\n// ---------------------------------------------------------------------------\n\n/**\n * The current generation is good enough to upgrade to Tasklist V2 (c4 overview\n * tab).\n */\nexport const TASKLIST_V2_UPGRADE_MIN_VERSION = '8.7.0-alpha4'\n\n/**\n * The upgrade target carries Tasklist V2 (c4 overview tab). Pairs with\n * `LINE_8_10_MIN_VERSION` as the upper bound, because from 8.10 on the setting\n * is gone.\n */\nexport const TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * A new cluster gets `tasklistV2Enabled` by default (console-backend cluster\n * creation). Reads the generation's tasklist version when it has one, else\n * zeebe.\n */\nexport const TASKLIST_V2_DEFAULT_ON_MIN_VERSION = '8.8.0'\n\n/**\n * From this version, the c4 settings tile hides the \"enforce groups\" toggle on\n * a cluster that runs Tasklist V2. The tile reads the constant with `>=`, and\n * it also needs `tasklistV2Enabled` to be true.\n *\n * The name says MIN because of that `>=`. The other MAX names in this file mark\n * the version where a gate stops, and their call sites read them with `<`.\n */\nexport const ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION = '8.8.0'\n\n/** The Tasklist upgrade banner is offered (c4 settings tile). */\nexport const TASKLIST_UPGRADE_BANNER_MIN_VERSION = '8.8.0-alpha2'\n\n/**\n * The Tasklist mode toggle is offered while creating a cluster (c4 create\n * cluster wizard). Upper bound is `LINE_8_10_MIN_VERSION`.\n */\nexport const TASKLIST_MODE_TOGGLE_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * Minor-version pair that turns Tasklist V2 on during a generation update\n * (console-backend). Both are read with `VersionCheckOperator.SameMinor`: an\n * 8.7 cluster that moves to an 8.8 generation gets the setting.\n */\nexport const TASKLIST_V2_AUTO_ENABLE_FROM_MINOR = '8.7.0'\nexport const TASKLIST_V2_AUTO_ENABLE_TO_MINOR = '8.8.0'\n\n/**\n * The version where the Tasklist V2 flag stops to mean anything, because there\n * is no Tasklist V1 left to switch away from. Two readers use it. The CRD spec\n * stops to emit the Tasklist V2 mode environment variable\n * (`K8sSpecUtils.shouldSkipTasklistV2ModeEnvVar`). The accounts-frontend\n * support rows stop to show the flag.\n *\n * Spelled `8.10.0` and NOT `LINE_8_10_MIN_VERSION` (`8.10.0-0`). Cluster\n * creation sets the flag on every generation from\n * `TASKLIST_V2_DEFAULT_ON_MIN_VERSION` on. An 8.10 prerelease thus carries a\n * live value, and it must stay under this bound.\n *\n * c4 bounds its own Tasklist V2 checks with `LINE_8_10_MIN_VERSION` instead.\n * That constant answers a different question: can Console still offer the\n * Tasklist upgrade to this cluster. It correctly leaves out the 8.10\n * prereleases.\n */\nexport const TASKLIST_V2_SETTING_MAX_VERSION = '8.10.0'\n\n// ---------------------------------------------------------------------------\n// Connectors\n// ---------------------------------------------------------------------------\n\n/** The internal connectors-management page exists (c4 overview tab link). */\nexport const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = '8.7.0-alpha1'\n\n/**\n * The applications list offers \"Manage\" for connectors (c4 overview tab).\n * Matches what console-frontend has always done.\n */\nexport const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Connector management shows the outbound connectors, the per-connector metrics\n * and the restart button. Under this floor the pages show the inbound-only\n * table.\n *\n * CAUTION: the two readers compare this floor against different version fields.\n * The c4 connector-management widgets compare\n * `generation.versions.connectorBridge`\n * (`useConnectorManagementRuntime.checkClusterVersion`). The\n * console-sm-frontend pages compare the generation name of the cluster\n * (`page.getData().generation`). Both sites had the same literal before the\n * gates moved here, so this constant keeps that. Do not read it as one\n * question until the two readers compare the same field.\n */\nexport const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * The secrets filter mode setting is offered on the 8.6 line (zeebe). Shared by\n * isSecretsFilterModeConfigurable (c4 settings tile + console-backend update\n * guard).\n */\nexport const SECRETS_FILTER_MODE_8_6_MIN_VERSION = '8.6.28'\n\n/** Same setting, floor for the 8.7 line. */\nexport const SECRETS_FILTER_MODE_8_7_MIN_VERSION = '8.7.25'\n\n/** Same setting, floor for the 8.8 line. */\nexport const SECRETS_FILTER_MODE_8_8_MIN_VERSION = '8.8.19'\n\n/**\n * Same setting, floor for the 8.9 line. The env var works from 8.9.7, but the\n * default stays DISABLED until 8.9.10. The floor waits for that default\n * change, so the toggle never shows an unset value with an unknown default.\n */\nexport const SECRETS_FILTER_MODE_8_9_MIN_VERSION = '8.9.10'\n\n/**\n * Same setting, floor for the 8.10 line and every line above it.\n *\n * This is the last floor: isSecretsFilterModeConfigurable applies it to all\n * versions above the 8.9 line, so 8.11 and later need no floor of their own.\n *\n * Two different reasons keep the versions below it out, and the second one is\n * why this floor is alpha6 and not alpha5:\n *\n * - alpha1 to alpha4 shipped the DISABLED default. Same reason as 8.9.7-8.9.9.\n * - alpha5 shipped the STRICT default, but not the Connectors change that this\n *   setting needs. SaaS runs Connectors with legacy.mode=FALLBACK from the 8.10\n *   line on, and the Connectors runtime of alpha5 refuses to start unless\n *   FALLBACK is paired with STRICT\n *   (ConnectorsAutoConfiguration.checkLegacyFallbackSecretFilter). A customer\n *   who selects LAX or DISABLED on alpha5 crashes their own Connectors runtime\n *   at startup, so the toggle must stay hidden there.\n *\n * Connectors removed that check after the alpha5 release (2026-09-03). The\n * removal is in the SNAPSHOT images and lands in the releases from alpha6 on.\n * SNAPSHOT clusters run the newest images, so they get the toggle.\n */\nexport const SECRETS_FILTER_MODE_8_10_MIN_VERSION = '8.10.0-alpha6'\n\n// ---------------------------------------------------------------------------\n// APIs and cluster URLs\n// ---------------------------------------------------------------------------\n\n/** The client details page can transform the cluster URL string (c4). */\nexport const REST_API_URL_TRANSFORM_MIN_VERSION = '8.6.0'\n\n/** The cluster publishes a Zeebe REST URL, so the client details page uses it. */\nexport const ZEEBE_REST_URL_MIN_VERSION = '8.8.0-alpha1'\n\n/** The cluster serves the v2 REST API under `<clusterUrl>/v2` (c4). */\nexport const REST_API_V2_MIN_VERSION = '8.10.0-alpha1'\n\n/** The Swagger toggle and the Swagger link are offered (c4). */\nexport const SWAGGER_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * The Swagger URL moves to its 8.9 shape (c4 `buildClusterSwaggerUrl`).\n * Spelled `8.9.0`, so 8.9 prereleases keep the older URL.\n */\nexport const SWAGGER_URL_8_9_MIN_VERSION = '8.9.0'\n\n/** The MCP toggle and the MCP client tab are offered (c4). */\nexport const MCP_MIN_VERSION = '8.9.0-alpha4'\n\n// ---------------------------------------------------------------------------\n// Apps, tabs and dashboards\n// ---------------------------------------------------------------------------\n\n/**\n * Identity is called \"Admin\" from here on (c4 navigation and overview tab,\n * console-sm-frontend). The URL and the permission still say `identity`.\n */\nexport const ADMIN_APP_RENAME_MIN_VERSION = '8.9.0-alpha5'\n\n/** The job dashboard is offered (c4 overview tab and console-sm-frontend). */\nexport const JOB_DASHBOARD_MIN_VERSION = '8.9.0-alpha5'\n\n/** The cluster serves the statistics config endpoint (c4 cluster details). */\nexport const CLUSTER_STATISTICS_CONFIG_MIN_VERSION = '8.9.0-alpha5'\n\n/** The audit log tab is offered (c4 cluster details). */\nexport const AUDIT_LOG_TAB_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Cluster spec and provisioning\n// ---------------------------------------------------------------------------\n\n/** Only 8.7 and newer generations are offered to AWS-only orgs (console-backend). */\nexport const AWS_ONLY_GENERATION_MIN_VERSION = '8.7.0'\n\n/**\n * The gateway spec takes its 8.9 shape (console-backend\n * `K8sSpecUtils.getGatewaySpec`). Spelled `-alpha0`, so every 8.9 prerelease\n * is included.\n */\nexport const GATEWAY_SPEC_8_9_MIN_VERSION = '8.9.0-alpha0'\n\n/**\n * The operator wires the session idle-timeout config through to Operate,\n * Tasklist and the unified app (camunda-security-library ADR-0042,\n * camunda-operator#5863). This floor matches the `SessionConfigSupported` gate\n * of the operator. The CRD spec and the c4 settings tile both read it, which is\n * why it lives here.\n */\nexport const SESSION_CONFIG_MIN_VERSION = '8.10.0-alpha5'\n\n/** A new cluster gets Optimize turned on by default (console-backend). */\nexport const OPTIMIZE_DEFAULT_ON_MIN_VERSION = '8.10.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Secrets, BYOIDP, Optimize and App Integrations\n//\n// Moved here from misc.const.ts. Same names, same values.\n// ---------------------------------------------------------------------------\n/**\n * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by\n * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate\n * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,\n * where the exporter starts honoring the filters) \u2014 this is the product rollout gate.\n */\nexport const OPTIMIZE_FILTERING_MIN_VERSION = '8.10.0-alpha1'\n\n/**\n * Minimum cluster (zeebe) version at which the operator understands the new\n * cluster-secret CRDs (camunda-operator#5760) \u2014 SecretSource and SecretSync exist and\n * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:\n * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's\n * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef\n * (ByoidpSecretDeliveryController.deliverSecret refuses without one).\n *\n * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP\n * shipped on. Raising it would strand BYOIDP on every alpha below the new value.\n */\nexport const SECRET_SOURCE_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).\n * Shared by the c4 settings tile gate and the console-backend update guard so both\n * stay in lockstep.\n *\n * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP\n * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its\n * clientSecret through the SecretSource), so the two answer the same question and a\n * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION\n * \u2014 that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,\n * where it currently ships to prod.\n */\nexport const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version at which a cluster's *connector and internal*\n * secrets live in the new per-stage secret manager rather than the legacy store.\n *\n * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a\n * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy\n * store and it gets no connector SecretSync. The one thing that must never drift is\n * the pair inside THIS concern: store routing\n * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync\n * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),\n * the pre-8.10-backup mirror check, and the upgrade-copy crossing check\n * (GenerationController.crossesInto810) all read THIS constant. #9703 was those\n * disagreeing \u2014 where Console writes a secret must equal where the cluster reads it.\n *\n * Was the 8.10 GA line (`8.10.0`) until the connector-secret changes landed on\n * `8.10.0-alpha5` (2026-09-02). The floor moved down to that alpha because the\n * ordering requirement below was already met at that time: no\n * `8.10.0-alpha5` cluster existed yet, on any stage. So no cluster's secrets\n * were left in the legacy store under the new floor.\n *\n * Why alphas normally stay out: routing is version-based with no persisted \"which\n * store holds this cluster's secrets\" marker, so a cluster above the floor while the\n * feature gate is off has its secrets in the legacy store, and enabling the gate\n * later reroutes it to a store nobody ever populated. The copy that would fix that\n * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only\n * fires on a generation CHANGE, and alpha generations have no upgrade chain at all\n * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) \u2014 an alpha cluster is\n * created on its generation and stays there. So an alpha cohort above this floor\n * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that\n * cohort, and they stay below THIS floor (`alpha4 < alpha5`), so they are unaffected.\n *\n * The remaining ordering requirement is that a stage's gate be enabled before the\n * first at-floor cluster exists on it \u2014 which for SNAPSHOT-tagged clusters (at-floor\n * by design, since they run the newest operator) still has to be respected by hand. A\n * future move to `8.10.0-alpha6` or higher must check the same thing this move did:\n * no cluster already sitting at that version on any stage.\n */\nexport const CONNECTOR_SECRET_SYNC_MIN_VERSION = '8.10.0-alpha5'\n\n/**\n * Version floors for App Integrations (#8536). The fix landed as patches on\n * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything\n * from 8.10.0-alpha4 on already carries both fixes. Shared by\n * isAppIntegrationsVersionSupported (c4 settings tile + console-backend\n * update guard) so the gate logic and its error message stay in lockstep.\n */\nexport const APP_INTEGRATIONS_MIN_VERSION = '8.10.0-alpha4'\nexport const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = '8.9.14'\nexport const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = '8.9.7'\n\n/**\n * Minor selector for the 8.9 stream, read with `VersionCheckOperator.SameMinor`\n * by `isAppIntegrationsVersionSupported`. It picks the stream, it is not a\n * floor: the floors are the two constants above.\n */\nexport const APP_INTEGRATIONS_89_STREAM_MINOR = '8.9.0'\n\n/**\n * The cluster details header calls the secrets \"cluster secrets\" instead of\n * the legacy name (c4).\n *\n * Aliased to CONNECTOR_SECRET_SYNC_MIN_VERSION rather than repeating the\n * literal: the label must follow the store the cluster actually uses, so the\n * two answer the same question.\n */\nexport const CLUSTER_SECRETS_LABEL_MIN_VERSION =\n  CONNECTOR_SECRET_SYNC_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version for the optional telemetry toggle.\n */\nexport const OPTIONAL_TELEMETRY_MIN_VERSION = '8.10.0-alpha5'\n"],
+  "mappings": "AA4CO,MAAM,uBAAuB;AAG7B,MAAM,wBAAwB;AAO9B,MAAM,yBAAyB;AAW/B,MAAM,oCAAoC;AAG1C,MAAM,4CAA4C;AAOlD,MAAM,qCAAqC;AAO3C,MAAM,4CAA4C;AAMlD,MAAM,gCAAgC;AAMtC,MAAM,mCAAmC;AAczC,MAAM,kCAAkC;AAGxC,MAAM,mCAAmC;AAGzC,MAAM,qCAAqC;AAU3C,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAO/C,MAAM,qCAAqC;AAU3C,MAAM,gDAAgD;AAGtD,MAAM,sCAAsC;AAM5C,MAAM,mCAAmC;AAOzC,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAmBzC,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAM/C,MAAM,6CAA6C;AAgBnD,MAAM,2CAA2C;AAOjD,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAO5C,MAAM,sCAAsC;AAwB5C,MAAM,uCAAuC;AAO7C,MAAM,qCAAqC;AAG3C,MAAM,6BAA6B;AAGnC,MAAM,0BAA0B;AAGhC,MAAM,sBAAsB;AAM5B,MAAM,8BAA8B;AAGpC,MAAM,kBAAkB;AAUxB,MAAM,+BAA+B;AAGrC,MAAM,4BAA4B;AAGlC,MAAM,wCAAwC;AAG9C,MAAM,4BAA4B;AAOlC,MAAM,kCAAkC;AAOxC,MAAM,+BAA+B;AASrC,MAAM,6BAA6B;AAGnC,MAAM,kCAAkC;AAaxC,MAAM,iCAAiC;AAavC,MAAM,4BAA4B;AAclC,MAAM,qBAAqB;AAuC3B,MAAM,oCAAoC;AAS1C,MAAM,+BAA+B;AACrC,MAAM,+CAA+C;AACrD,MAAM,0DAA0D;AAOhE,MAAM,mCAAmC;AAUzC,MAAM,oCACX;AAKK,MAAM,iCAAiC;",
   "names": []
 }

package/dist/dtos/AlertSubscription.dto.d.ts

@@ -28,7 +28,7 @@ export interface AlertSubscriptionEntryDto {
 export declare const HMAC_SUPPORTED_ALGORITHM = "sha256";
 export declare const HMAC_HEADER_POSITION = "X-Camunda-Signature-256";
 export declare const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS: string[];
-export type ALERT_SUBSCRIPTION_TYPES = 'ClusterAlert' | 'ProcessAlert' | 'AllAlerts';
+export type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert';
 export type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook';
 export interface AlertSubscriptionWebhookAuth {
     hmac?: {

package/dist/dtos/AlertSubscription.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/AlertSubscription.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n}\n\nexport interface AlertSubscriptionEntryDto {\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES =\n  | 'ClusterAlert'\n  | 'ProcessAlert'\n  | 'AllAlerts'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n}\n\nexport interface AlertSubscriptionEntryDto {\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
   "mappings": "AAuCO,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAE7B,MAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/dtos/CommonCluster.dto.d.ts

@@ -1,4 +1,10 @@
 import type { ClusterPlanTypeDto } from './ClusterPlanType.dto.js';
+/**
+ * The Connectors secrets filter mode
+ * (`CAMUNDA_CONNECTOR_SECRETRESOLVER_SECRETFILTER_MODE`). See the Connectors
+ * config docs for what each mode does.
+ */
+export type SecretsFilterMode = 'DISABLED' | 'LAX' | 'STRICT';
 /** Inclusion/exclusion pattern lists. Exclusion takes precedence over inclusion;
  *  an empty inclusion list includes everything. */
 export interface OptimizeFilteringIncludeExclude {
@@ -51,8 +57,17 @@ export interface ExternalIdpConfig {
     clientId: string;
     scopes?: string[];
     usernameClaim?: string;
-    groupsClaim?: string;
     clientIdClaim?: string;
+    /** Token audiences (`aud` values) the cluster accepts from this provider. A list,
+     *  and named for the CRD field (`oidcProviders[].audiences`,
+     *  camunda-operator#5961) — an `audience` string would be pruned on write.
+     *  Some providers (Entra) put an Application ID URI here, not the client id, so
+     *  Console does not default the list to `clientId`: the admin gives the values. */
+    audiences?: string[];
+    /** More JWKS endpoints, for a provider that publishes more than one (Ping).
+     *  camunda-security-library reads them as `OidcConfiguration.additionalJwkSetUris`
+     *  and merges them through `CompositeJWKSource` (camunda-operator#5958). */
+    additionalJwkSetUris?: string[];
     /** Rotation marker — bumped on every secret write so the CR changes and pods roll. */
     secretUpdatedAt?: string;
 }
@@ -83,6 +98,9 @@ export interface CommonClusterDto {
             status?: string;
             reason?: string;
             message?: string;
+            /** The `metadata.generation` the condition was set for. Optional: not every
+             *  condition the operator emits carries it. */
+            observedGeneration?: number;
             lastTransitionTime?: string;
         }>;
         updateClusterStatus?: {
@@ -143,6 +161,7 @@ export interface CommonClusterDto {
         appIntegrationsEnabled?: boolean;
         optimizeEnabled?: boolean;
         optimizeFiltering?: OptimizeFilteringConfig;
+        secretsFilterMode?: SecretsFilterMode;
     };
     rba?: boolean;
     identityBackendChecksEnabled?: boolean;
@@ -155,6 +174,7 @@ export interface CommonClusterDto {
     enforceGroups?: boolean;
     playMode?: boolean;
     mcpEnabled?: boolean;
+    optionalTelemetryEnabled?: boolean;
     autoUpdate?: boolean;
     wokeUpAt?: string;
     spec?: {

package/dist/dtos/ControlV2.dto.d.ts

@@ -50,7 +50,7 @@ export interface ListOrganizationsV2Params extends CursorParams {
      * ANDed with `q`/`filter` server-side; a bare term behaves like `q`.
      */
     query?: string;
-    sort?: 'name' | 'created' | 'internal';
+    sort?: 'name' | 'created' | 'internal' | 'salesPlanType' | 'salesPlanName';
     order?: 'asc' | 'desc';
     filter?: {
         internal?: boolean;

package/dist/dtos/K8sContext.dto.d.ts

@@ -25,6 +25,13 @@ export interface K8sBackupConfig {
      * clusters that use it read as single-region.
      */
     hidden?: boolean;
+    /**
+     * Set by SREs in console-admin.yaml.
+     * True when the operator supports failover for this pairing.
+     * For example, some GCP pairings do not get `cloneRoleId`, so a failover request fails.
+     * This flag is informational. It does not affect `isSupportedFailoverRegionPair`.
+     */
+    failover?: boolean;
 }
 export interface K8sContext {
     visibility: 'hidden' | 'internal-only' | 'internal-paid-only' | 'all';

package/dist/enums/AlertSubscription.enum.d.ts

@@ -1,7 +1,5 @@
 export declare enum AlertSubscriptionType {
-    ClusterAlert = "ClusterAlert",
-    ProcessAlert = "ProcessAlert",
-    AllAlerts = "AllAlerts"
+    ProcessAlert = "ProcessAlert"
 }
 export declare enum AlertSubscriptionReportType {
     Email = "Email",

package/dist/enums/AlertSubscription.enum.js

@@ -1,7 +1,5 @@
 var AlertSubscriptionType = /* @__PURE__ */ ((AlertSubscriptionType2) => {
-  AlertSubscriptionType2["ClusterAlert"] = "ClusterAlert";
   AlertSubscriptionType2["ProcessAlert"] = "ProcessAlert";
-  AlertSubscriptionType2["AllAlerts"] = "AllAlerts";
   return AlertSubscriptionType2;
 })(AlertSubscriptionType || {});
 var AlertSubscriptionReportType = /* @__PURE__ */ ((AlertSubscriptionReportType2) => {

package/dist/enums/AlertSubscription.enum.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/enums/AlertSubscription.enum.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// eslint-disable-next-line no-shadow\nexport enum AlertSubscriptionType {\n  ClusterAlert = 'ClusterAlert',\n  ProcessAlert = 'ProcessAlert',\n  AllAlerts = 'AllAlerts',\n}\n\n// eslint-disable-next-line no-shadow\nexport enum AlertSubscriptionReportType {\n  Email = 'Email',\n  Webhook = 'Webhook',\n}\n"],
-  "mappings": "AAOO,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,kBAAe;AACf,EAAAA,uBAAA,kBAAe;AACf,EAAAA,uBAAA,eAAY;AAHF,SAAAA;AAAA,GAAA;AAOL,IAAK,8BAAL,kBAAKC,iCAAL;AACL,EAAAA,6BAAA,WAAQ;AACR,EAAAA,6BAAA,aAAU;AAFA,SAAAA;AAAA,GAAA;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// eslint-disable-next-line no-shadow\nexport enum AlertSubscriptionType {\n  ProcessAlert = 'ProcessAlert',\n}\n\n// eslint-disable-next-line no-shadow\nexport enum AlertSubscriptionReportType {\n  Email = 'Email',\n  Webhook = 'Webhook',\n}\n"],
+  "mappings": "AAOO,IAAK,wBAAL,kBAAKA,2BAAL;AACL,EAAAA,uBAAA,kBAAe;AADL,SAAAA;AAAA,GAAA;AAKL,IAAK,8BAAL,kBAAKC,iCAAL;AACL,EAAAA,6BAAA,WAAQ;AACR,EAAAA,6BAAA,aAAU;AAFA,SAAAA;AAAA,GAAA;",
   "names": ["AlertSubscriptionType", "AlertSubscriptionReportType"]
 }

package/dist/enums/AuditEntity.enum.d.ts

@@ -28,7 +28,9 @@ export declare enum AuditEntityAttribute {
     CLUSTER_PLAYMODE = "Cluster Play Mode",
     CLUSTER_MCP_ENABLED = "MCP Support",
     CLUSTER_SWAGGER = "Cluster Swagger",
+    CLUSTER_SECRETS_FILTER_MODE = "Secrets Filter Mode",
     CLUSTER_BUSINESS_ID_UNIQUENESS = "Business ID Uniqueness",
+    CLUSTER_OPTIONAL_TELEMETRY = "Optional telemetry",
     CLUSTER_MULTI_TENANCY = "Multi-tenancy",
     CLUSTER_SESSION_MAX_INACTIVE_INTERVAL = "Session idle timeout",
     CLUSTER_SESSION_HEARTBEAT = "Session heartbeat",

package/dist/enums/AuditEntity.enum.js

@@ -29,7 +29,9 @@ var AuditEntityAttribute = /* @__PURE__ */ ((AuditEntityAttribute2) => {
   AuditEntityAttribute2["CLUSTER_PLAYMODE"] = "Cluster Play Mode";
   AuditEntityAttribute2["CLUSTER_MCP_ENABLED"] = "MCP Support";
   AuditEntityAttribute2["CLUSTER_SWAGGER"] = "Cluster Swagger";
+  AuditEntityAttribute2["CLUSTER_SECRETS_FILTER_MODE"] = "Secrets Filter Mode";
   AuditEntityAttribute2["CLUSTER_BUSINESS_ID_UNIQUENESS"] = "Business ID Uniqueness";
+  AuditEntityAttribute2["CLUSTER_OPTIONAL_TELEMETRY"] = "Optional telemetry";
   AuditEntityAttribute2["CLUSTER_MULTI_TENANCY"] = "Multi-tenancy";
   AuditEntityAttribute2["CLUSTER_SESSION_MAX_INACTIVE_INTERVAL"] = "Session idle timeout";
   AuditEntityAttribute2["CLUSTER_SESSION_HEARTBEAT"] = "Session heartbeat";

package/dist/enums/AuditEntity.enum.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/enums/AuditEntity.enum.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/* eslint-disable no-shadow */\nexport enum AuditEntity {\n  CLUSTER = 'Cluster',\n  CLIENT = 'Client',\n  ALERT_SUBSCRIPTION = 'Alert Subscription',\n  API_CLIENT = 'API Client',\n  SECURE_CONNECTIVITY_CRD = 'Private networking',\n  BYOM_CLIENT = 'External Monitoring Client',\n  BYOM_CRD = 'External Monitoring',\n  INVITATION = 'Invitation',\n  MEMBER = 'Member',\n  ORGANIZATION = 'Organization',\n  SALES_PLAN = 'SalesPlan',\n  CLUSTER_PLAN = 'ClusterPlan',\n  GENERATION = 'Generation',\n  BILLING = 'Billing',\n  USAGE_ALERT = 'Usage Alert',\n  ACCEPT_BETA_TERMS = 'Accept Alpha terms',\n  TOGGLE_BETA_FEATURE = 'Toggle Alpha feature',\n  CONNECTOR_SECRET = 'Connector Secret',\n  CLUSTER_MODIFICATION = 'Cluster Modification',\n}\n\nexport enum AuditEntityAttribute {\n  CLUSTER_CLUSTER_PLAN = 'ClusterPlan',\n  CLUSTER_GENERATION = 'Generation',\n  CLUSTER_NAME = 'Name',\n  CLUSTER_RBA = 'Resource Based Authorizations',\n  CLUSTER_ENFORCE_GROUPS = 'Enforce Group Management',\n  CLUSTER_PLAYMODE = 'Cluster Play Mode',\n  CLUSTER_MCP_ENABLED = 'MCP Support',\n  CLUSTER_SWAGGER = 'Cluster Swagger',\n  CLUSTER_BUSINESS_ID_UNIQUENESS = 'Business ID Uniqueness',\n  CLUSTER_MULTI_TENANCY = 'Multi-tenancy',\n  CLUSTER_SESSION_MAX_INACTIVE_INTERVAL = 'Session idle timeout',\n  CLUSTER_SESSION_HEARTBEAT = 'Session heartbeat',\n  CLUSTER_EXTERNAL_IDP = 'External identity provider',\n  CLUSTER_ENABLE_LOW_LATENCY = 'Enable low latency',\n  CLUSTER_AUTOUPDATE = 'Auto Update',\n  CLUSTER_OWNER = 'Owner',\n  CLUSTER_STATUS = 'Status',\n  CLUSTER_TASKLIST_V2_ENABLED = 'Taklist V2 Enabled',\n  CLUSTER_AUDIT_LOG = 'Audit Log',\n  INVITATION_ROLE = 'Role',\n  ORGANIZATION_NAME = 'Name',\n  SALES_PLAN = 'Plan',\n  BILLING_RESERVATION = 'Reservation',\n  BILLING_GENERAL_USERS = 'GeneralUsers', // paid cc legaly - only kept for audit logs compatibility\n  MEMBER_ROLE = 'Role',\n  USAGE_ALERT_THRESHOLD = 'Threshold',\n  USAGE_ALERT_STATUS = 'Status',\n  CLUSTER_AUDIT_LOGS = 'Audit Logging',\n  LLM_BUDGET = 'LLM Budget',\n  LLM_KEY_BLOCKED = 'LLM Key Blocked',\n  ORGANIZATION_LIMIT = 'Limit',\n  CLUSTER_MODIFICATION = 'Modification',\n  ORGANIZATION_TRIAL_EXPIRES_AT = 'Trial Expiration Date',\n}\n"],
-  "mappings": "AAOO,IAAK,cAAL,kBAAKA,iBAAL;AACL,EAAAA,aAAA,aAAU;AACV,EAAAA,aAAA,YAAS;AACT,EAAAA,aAAA,wBAAqB;AACrB,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,6BAA0B;AAC1B,EAAAA,aAAA,iBAAc;AACd,EAAAA,aAAA,cAAW;AACX,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,YAAS;AACT,EAAAA,aAAA,kBAAe;AACf,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,kBAAe;AACf,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,aAAU;AACV,EAAAA,aAAA,iBAAc;AACd,EAAAA,aAAA,uBAAoB;AACpB,EAAAA,aAAA,yBAAsB;AACtB,EAAAA,aAAA,sBAAmB;AACnB,EAAAA,aAAA,0BAAuB;AAnBb,SAAAA;AAAA,GAAA;AAsBL,IAAK,uBAAL,kBAAKC,0BAAL;AACL,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,kBAAe;AACf,EAAAA,sBAAA,iBAAc;AACd,EAAAA,sBAAA,4BAAyB;AACzB,EAAAA,sBAAA,sBAAmB;AACnB,EAAAA,sBAAA,yBAAsB;AACtB,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,oCAAiC;AACjC,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,2CAAwC;AACxC,EAAAA,sBAAA,+BAA4B;AAC5B,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,gCAA6B;AAC7B,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,mBAAgB;AAChB,EAAAA,sBAAA,oBAAiB;AACjB,EAAAA,sBAAA,iCAA8B;AAC9B,EAAAA,sBAAA,uBAAoB;AACpB,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,uBAAoB;AACpB,EAAAA,sBAAA,gBAAa;AACb,EAAAA,sBAAA,yBAAsB;AACtB,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,iBAAc;AACd,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,gBAAa;AACb,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,mCAAgC;AAjCtB,SAAAA;AAAA,GAAA;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/* eslint-disable no-shadow */\nexport enum AuditEntity {\n  CLUSTER = 'Cluster',\n  CLIENT = 'Client',\n  ALERT_SUBSCRIPTION = 'Alert Subscription',\n  API_CLIENT = 'API Client',\n  SECURE_CONNECTIVITY_CRD = 'Private networking',\n  BYOM_CLIENT = 'External Monitoring Client',\n  BYOM_CRD = 'External Monitoring',\n  INVITATION = 'Invitation',\n  MEMBER = 'Member',\n  ORGANIZATION = 'Organization',\n  SALES_PLAN = 'SalesPlan',\n  CLUSTER_PLAN = 'ClusterPlan',\n  GENERATION = 'Generation',\n  BILLING = 'Billing',\n  USAGE_ALERT = 'Usage Alert',\n  ACCEPT_BETA_TERMS = 'Accept Alpha terms',\n  TOGGLE_BETA_FEATURE = 'Toggle Alpha feature',\n  CONNECTOR_SECRET = 'Connector Secret',\n  CLUSTER_MODIFICATION = 'Cluster Modification',\n}\n\nexport enum AuditEntityAttribute {\n  CLUSTER_CLUSTER_PLAN = 'ClusterPlan',\n  CLUSTER_GENERATION = 'Generation',\n  CLUSTER_NAME = 'Name',\n  CLUSTER_RBA = 'Resource Based Authorizations',\n  CLUSTER_ENFORCE_GROUPS = 'Enforce Group Management',\n  CLUSTER_PLAYMODE = 'Cluster Play Mode',\n  CLUSTER_MCP_ENABLED = 'MCP Support',\n  CLUSTER_SWAGGER = 'Cluster Swagger',\n  CLUSTER_SECRETS_FILTER_MODE = 'Secrets Filter Mode',\n  CLUSTER_BUSINESS_ID_UNIQUENESS = 'Business ID Uniqueness',\n  CLUSTER_OPTIONAL_TELEMETRY = 'Optional telemetry',\n  CLUSTER_MULTI_TENANCY = 'Multi-tenancy',\n  CLUSTER_SESSION_MAX_INACTIVE_INTERVAL = 'Session idle timeout',\n  CLUSTER_SESSION_HEARTBEAT = 'Session heartbeat',\n  CLUSTER_EXTERNAL_IDP = 'External identity provider',\n  CLUSTER_ENABLE_LOW_LATENCY = 'Enable low latency',\n  CLUSTER_AUTOUPDATE = 'Auto Update',\n  CLUSTER_OWNER = 'Owner',\n  CLUSTER_STATUS = 'Status',\n  CLUSTER_TASKLIST_V2_ENABLED = 'Taklist V2 Enabled',\n  CLUSTER_AUDIT_LOG = 'Audit Log',\n  INVITATION_ROLE = 'Role',\n  ORGANIZATION_NAME = 'Name',\n  SALES_PLAN = 'Plan',\n  BILLING_RESERVATION = 'Reservation',\n  BILLING_GENERAL_USERS = 'GeneralUsers', // paid cc legaly - only kept for audit logs compatibility\n  MEMBER_ROLE = 'Role',\n  USAGE_ALERT_THRESHOLD = 'Threshold',\n  USAGE_ALERT_STATUS = 'Status',\n  CLUSTER_AUDIT_LOGS = 'Audit Logging',\n  LLM_BUDGET = 'LLM Budget',\n  LLM_KEY_BLOCKED = 'LLM Key Blocked',\n  ORGANIZATION_LIMIT = 'Limit',\n  CLUSTER_MODIFICATION = 'Modification',\n  ORGANIZATION_TRIAL_EXPIRES_AT = 'Trial Expiration Date',\n}\n"],
+  "mappings": "AAOO,IAAK,cAAL,kBAAKA,iBAAL;AACL,EAAAA,aAAA,aAAU;AACV,EAAAA,aAAA,YAAS;AACT,EAAAA,aAAA,wBAAqB;AACrB,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,6BAA0B;AAC1B,EAAAA,aAAA,iBAAc;AACd,EAAAA,aAAA,cAAW;AACX,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,YAAS;AACT,EAAAA,aAAA,kBAAe;AACf,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,kBAAe;AACf,EAAAA,aAAA,gBAAa;AACb,EAAAA,aAAA,aAAU;AACV,EAAAA,aAAA,iBAAc;AACd,EAAAA,aAAA,uBAAoB;AACpB,EAAAA,aAAA,yBAAsB;AACtB,EAAAA,aAAA,sBAAmB;AACnB,EAAAA,aAAA,0BAAuB;AAnBb,SAAAA;AAAA,GAAA;AAsBL,IAAK,uBAAL,kBAAKC,0BAAL;AACL,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,kBAAe;AACf,EAAAA,sBAAA,iBAAc;AACd,EAAAA,sBAAA,4BAAyB;AACzB,EAAAA,sBAAA,sBAAmB;AACnB,EAAAA,sBAAA,yBAAsB;AACtB,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,iCAA8B;AAC9B,EAAAA,sBAAA,oCAAiC;AACjC,EAAAA,sBAAA,gCAA6B;AAC7B,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,2CAAwC;AACxC,EAAAA,sBAAA,+BAA4B;AAC5B,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,gCAA6B;AAC7B,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,mBAAgB;AAChB,EAAAA,sBAAA,oBAAiB;AACjB,EAAAA,sBAAA,iCAA8B;AAC9B,EAAAA,sBAAA,uBAAoB;AACpB,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,uBAAoB;AACpB,EAAAA,sBAAA,gBAAa;AACb,EAAAA,sBAAA,yBAAsB;AACtB,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,iBAAc;AACd,EAAAA,sBAAA,2BAAwB;AACxB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,gBAAa;AACb,EAAAA,sBAAA,qBAAkB;AAClB,EAAAA,sBAAA,wBAAqB;AACrB,EAAAA,sBAAA,0BAAuB;AACvB,EAAAA,sBAAA,mCAAgC;AAnCtB,SAAAA;AAAA,GAAA;",
   "names": ["AuditEntity", "AuditEntityAttribute"]
 }

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js';
 export { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js';
 export type { TrialExtensionSurveyAnswer, TrialExtensionSurveyQuestion, } from './constants/trialExtensionSurvey.const.js';
 export { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js';
-export { ADMIN_APP_RENAME_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_MINOR, APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION, APP_INTEGRATIONS_MIN_VERSION, AUDIT_LOG_TAB_MIN_VERSION, AUTHORIZATION_TOGGLE_MIN_VERSION, AWS_ONLY_GENERATION_MIN_VERSION, BUSINESS_ID_UNIQUENESS_MIN_VERSION, BYOIDP_MIN_VERSION, CLUSTER_SECRETS_LABEL_MIN_VERSION, CLUSTER_STATISTICS_CONFIG_MIN_VERSION, CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION, CONNECTOR_SECRET_SYNC_MIN_VERSION, CONNECTORS_MANAGEMENT_LINK_MIN_VERSION, ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION, ENFORCE_GROUPS_TOGGLE_MIN_VERSION, GATEWAY_SPEC_8_9_MIN_VERSION, HOT_BACKUP_MIN_VERSION, IDENTITY_AUTHORIZATION_MIN_VERSION, IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION, IDENTITY_MANAGEMENT_MIN_VERSION, INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION, JOB_DASHBOARD_MIN_VERSION, LINE_8_9_MIN_VERSION, LINE_8_10_MIN_VERSION, MCP_MIN_VERSION, MULTI_TENANCY_TOGGLE_MIN_VERSION, NEW_CLUSTER_ROLES_MIN_VERSION, OPTIMIZE_DEFAULT_ON_MIN_VERSION, OPTIMIZE_FILTERING_MIN_VERSION, RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION, REST_API_URL_TRANSFORM_MIN_VERSION, REST_API_V2_MIN_VERSION, SECRET_SOURCE_MIN_VERSION, SESSION_CONFIG_MIN_VERSION, SWAGGER_MIN_VERSION, SWAGGER_URL_8_9_MIN_VERSION, TASKLIST_MODE_TOGGLE_MIN_VERSION, TASKLIST_UPGRADE_BANNER_MIN_VERSION, TASKLIST_V2_AUTO_ENABLE_FROM_MINOR, TASKLIST_V2_AUTO_ENABLE_TO_MINOR, TASKLIST_V2_DEFAULT_ON_MIN_VERSION, TASKLIST_V2_SETTING_MAX_VERSION, TASKLIST_V2_UPGRADE_MIN_VERSION, TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION, ZEEBE_REST_URL_MIN_VERSION, } from './constants/version-gates.const.js';
+export { ADMIN_APP_RENAME_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_MINOR, APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION, APP_INTEGRATIONS_MIN_VERSION, AUDIT_LOG_TAB_MIN_VERSION, AUTHORIZATION_TOGGLE_MIN_VERSION, AWS_ONLY_GENERATION_MIN_VERSION, BUSINESS_ID_UNIQUENESS_MIN_VERSION, BYOIDP_MIN_VERSION, CLUSTER_SECRETS_LABEL_MIN_VERSION, CLUSTER_STATISTICS_CONFIG_MIN_VERSION, CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION, CONNECTOR_SECRET_SYNC_MIN_VERSION, CONNECTORS_MANAGEMENT_LINK_MIN_VERSION, ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION, ENFORCE_GROUPS_TOGGLE_MIN_VERSION, GATEWAY_SPEC_8_9_MIN_VERSION, HOT_BACKUP_MIN_VERSION, IDENTITY_AUTHORIZATION_MIN_VERSION, IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION, IDENTITY_MANAGEMENT_MIN_VERSION, INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION, JOB_DASHBOARD_MIN_VERSION, LINE_8_9_MIN_VERSION, LINE_8_10_MIN_VERSION, MCP_MIN_VERSION, MULTI_TENANCY_TOGGLE_MIN_VERSION, NEW_CLUSTER_ROLES_MIN_VERSION, OPTIMIZE_DEFAULT_ON_MIN_VERSION, OPTIMIZE_FILTERING_MIN_VERSION, OPTIONAL_TELEMETRY_MIN_VERSION, RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION, REST_API_URL_TRANSFORM_MIN_VERSION, REST_API_V2_MIN_VERSION, SECRET_SOURCE_MIN_VERSION, SECRETS_FILTER_MODE_8_6_MIN_VERSION, SECRETS_FILTER_MODE_8_7_MIN_VERSION, SECRETS_FILTER_MODE_8_8_MIN_VERSION, SECRETS_FILTER_MODE_8_9_MIN_VERSION, SECRETS_FILTER_MODE_8_10_MIN_VERSION, SESSION_CONFIG_MIN_VERSION, SWAGGER_MIN_VERSION, SWAGGER_URL_8_9_MIN_VERSION, TASKLIST_MODE_TOGGLE_MIN_VERSION, TASKLIST_UPGRADE_BANNER_MIN_VERSION, TASKLIST_V2_AUTO_ENABLE_FROM_MINOR, TASKLIST_V2_AUTO_ENABLE_TO_MINOR, TASKLIST_V2_DEFAULT_ON_MIN_VERSION, TASKLIST_V2_SETTING_MAX_VERSION, TASKLIST_V2_UPGRADE_MIN_VERSION, TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION, ZEEBE_REST_URL_MIN_VERSION, } from './constants/version-gates.const.js';
 export type { ALERT_SUBSCRIPTION_REPORT_TYPES, ALERT_SUBSCRIPTION_TYPES, AlertSubscriptionDto, AlertSubscriptionEntryDto, AlertSubscriptionWebhookAuth, CheckFailedReason, } from './dtos/AlertSubscription.dto.js';
 export { FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS, HMAC_HEADER_POSITION, HMAC_SUPPORTED_ALGORITHM, } from './dtos/AlertSubscription.dto.js';
 export type { AuditDto } from './dtos/Audit.dto.js';
@@ -19,7 +19,7 @@ export type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js';
 export type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js';
 export type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js';
 export type { ClusterSpecChange, ClusterSpecChangeActor, ClusterSpecHistory, } from './dtos/ClusterSpecHistory.dto.js';
-export type { CommonClusterDto, ExternalIdpConfig, OptimizeFilteringConfig, OptimizeFilteringIncludeExclude, OptimizeFilteringPatch, } from './dtos/CommonCluster.dto.js';
+export type { CommonClusterDto, ExternalIdpConfig, OptimizeFilteringConfig, OptimizeFilteringIncludeExclude, OptimizeFilteringPatch, SecretsFilterMode, } from './dtos/CommonCluster.dto.js';
 export type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js';
 export type { ClusterByClientV2Dto, ClusterDatacenterOptionV2Dto, ClusterDetailV2Dto, ClusterFacetsV2Dto, ClusterListItemV2Dto, ClusterParameterOptionV2Dto, ClusterParametersV2Dto, ControlResolvedPermissions, ControlSessionDto, ControlSessionUser, CursorPage, CursorParams, ListClustersV2Params, ListOrganizationsV2Params, ListOrgMembersV2Params, OrgDetailV2Dto, OrgListItemV2Dto, OrgMemberV2Dto, OrgSummaryV2Dto, } from './dtos/ControlV2.dto.js';
 export type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js';
@@ -118,6 +118,7 @@ export type { AccountsData, AppMetadata, BasicUser, BlockedFor, Identity, OrgMem
 export { UserMetadataEvent } from './types/User.type.js';
 export type { UniqueTaskUser, ValueMetrics, ValueMetricsPerYearMonth, } from './types/ValueMetrics.type.js';
 export { CLOUD_PROVIDER_ORDER, getCloudProviderLabel, getCloudProviderRank, } from './utils/cloudProvider.utils.js';
+export { type ConnectivityStatus, deriveConnectivityMessage, deriveConnectivityStatus, } from './utils/connectivityStatus.utils.js';
 export { ConsoleSelfManagedUtils } from './utils/console-sm.utils.js';
 export type { CronScheduleValidationFailure, CronScheduleValidationResult, CronScheduleValidationSuccess, } from './utils/cronSchedule.utils.js';
 export { BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES, validateCronSchedule, } from './utils/cronSchedule.utils.js';
@@ -134,10 +135,11 @@ export { ObjectMergeUtils } from './utils/objectMerge.utils.js';
 export { getPermissionsByRoles, getUserPermissionsForOrg, } from './utils/orgs/OrgHelper.js';
 export type { PasswordPolicyRequest, PasswordPolicyResult, } from './utils/PasswordPolicy.js';
 export { MAXLENGTH as PASSWORD_POLICY_MAXLENGTH, MINLENGTH as PASSWORD_POLICY_MINLENGTH, passwordPolicyCheck, } from './utils/PasswordPolicy.js';
+export { deriveSecondaryStorageStatus, type SecondaryStorageStatus, } from './utils/secondaryStorageStatus.utils.js';
 export { allSettledResultsCounts, getFulfilledPromises, getRejectedPromises, getSettledSummary, } from './utils/settledPromises.util.js';
 export { isValidAwsArn, isValidCIDR, isValidCIDRList, isValidClientName, isValidHostname, isValidPrivateLinkRegion, normalizeCIDRList, } from './utils/string-validation.utils.js';
 export { extractCamundaUserEmail, guessName, isCamundaUserId, } from './utils/user.utils.js';
-export { checkVersion, isAppIntegrationsVersionSupported, VersionCheckOperator, } from './utils/versionCheck.utils.js';
+export { checkVersion, isAppIntegrationsVersionSupported, isSecretsFilterModeConfigurable, VersionCheckOperator, } from './utils/versionCheck.utils.js';
 export { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js';
 export type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js';
 export { augmentCamundiPermissions, getApplicableRolesForEmployee, isManager, } from './utils/camundiPermissionAugmenter.utils.js';