@camunda/ccma-shared-types 1.0.0 → 1.2.0

package/dist/search/compiler.d.ts

@@ -40,6 +40,31 @@ export interface CompiledQuery {
 }
 /** Compile a parsed query into a single parameterized SQL fragment. */
 export declare const compileQuery: (node: QueryNode, ctx: CompileContext) => CompiledQuery;
+/**
+ * Match `column` against an id set that arrives as ONE parameter.
+ *
+ * `IN (:...ids)` expands to one bind parameter, and one literal in the
+ * statement, for each id. A dimension that does not live in SQL resolves to an
+ * id set, and such a set follows the size of the fleet: the prod cluster fleet
+ * is more than 1000. Both the statement text and the parameter count would
+ * grow with it, and Postgres would plan the statement again at every size.
+ *
+ * Postgres splits the string here, thus the statement text is constant.
+ * `= ANY(...)` can still use an index on the column.
+ */
+export declare const idSetPredicate: (column: string, parameter: string) => string;
+/**
+ * The id set as one separated string, for {@link idSetPredicate}.
+ *
+ * The value is a bind parameter, thus it cannot change the statement. But an
+ * id that holds the separator would become two ids, thus such an id is
+ * dropped. The id columns are text columns, so this stays a guard and not an
+ * assumption.
+ *
+ * An empty string gives an empty array in Postgres. Thus the match finds
+ * nothing, which is correct for an empty set.
+ */
+export declare const joinIdSet: (ids: readonly string[]) => string;
 /**
  * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\`) are
  * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain

package/dist/search/compiler.js

@@ -93,7 +93,7 @@ class Compiler {
     if (ids.length === 0) {
       return "1 = 0";
     }
-    return `${binding.idColumn} IN (${this.bind(ids, true)})`;
+    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)));
   }
   dateTerm(binding, canonical, operator, value) {
     if (operator === ":") {
@@ -158,13 +158,20 @@ class Compiler {
     }
     return parsed;
   }
-  bind(value, isList = false) {
+  /** Register a value and give back its parameter name, with no marker. */
+  bindName(value) {
     const name = `${this.ctx.paramPrefix}_${this.counter++}`;
     this.params[name] = value;
-    return isList ? `:...${name}` : `:${name}`;
+    return name;
+  }
+  bind(value) {
+    return `:${this.bindName(value)}`;
   }
 }
 const compileQuery = (node, ctx) => new Compiler(ctx).compile(node);
+const ID_SET_SEPARATOR = ",";
+const idSetPredicate = (column, parameter) => `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`;
+const joinIdSet = (ids) => ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR);
 const likeArgument = (value, match) => {
   const escaped = value.replace(/([\\%_])/g, "\\$1");
   if (/[*?]/.test(value)) {
@@ -212,6 +219,8 @@ const editDistance = (left, right) => {
 };
 export {
   compileQuery,
+  idSetPredicate,
+  joinIdSet,
   likeArgument
 };
 //# sourceMappingURL=compiler.js.map

package/dist/search/compiler.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/compiler.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n// ============================================================================\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | { kind: 'date'; column: string }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  constructor(private readonly ctx: CompileContext) {\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        return `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lower = this.bind(this.parseDate(canonical, node.lower))\n    const upper = this.bind(this.parseDate(canonical, node.upper))\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      const target = cast ? `CAST(${column} AS TEXT)` : column\n      return `${target} ILIKE ${this.bind(likeArgument(value, 'substring'))}`\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    const target = binding.cast\n      ? `CAST(${binding.column} AS TEXT)`\n      : binding.column\n    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    return `${binding.idColumn} IN (${this.bind(ids, true)})`\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value).toISOString()\n    return `${binding.column} ${operator} ${this.bind(bound)}`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  private bind(value: unknown, isList = false): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return isList ? `:...${name}` : `:${name}`\n  }\n}\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nconst closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
-  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AAiDP,MAAM,SAAS;AAAA,EASb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAP6B;AAAA,EARZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAcjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AACH,eAAO,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACtC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,YAAM,SAAS,OAAO,QAAQ,MAAM,cAAc;AAClD,aAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,UAAM,SAAS,QAAQ,OACnB,QAAQ,QAAQ,MAAM,cACtB,QAAQ;AACZ,WAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzE;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,QAAQ,QAAQ,QAAQ,KAAK,KAAK,KAAK,IAAI,CAAC;AAAA,EACxD;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,KAAK,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC/H;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK,EAAE,YAAY;AAC3D,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AAAA,EAC1D;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAgB,SAAS,OAAe;AACnD,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO,SAAS,OAAO,IAAI,KAAK,IAAI,IAAI;AAAA,EAC1C;AACF;AAGO,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAO3C,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGA,MAAM,eAAe,CACnB,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n// ============================================================================\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | { kind: 'date'; column: string }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  constructor(private readonly ctx: CompileContext) {\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        return `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lower = this.bind(this.parseDate(canonical, node.lower))\n    const upper = this.bind(this.parseDate(canonical, node.upper))\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      const target = cast ? `CAST(${column} AS TEXT)` : column\n      return `${target} ILIKE ${this.bind(likeArgument(value, 'substring'))}`\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    const target = binding.cast\n      ? `CAST(${binding.column} AS TEXT)`\n      : binding.column\n    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    // One parameter, not one for each id. `status:healthy` resolves to the\n    // whole healthy fleet, thus the set follows the size of the fleet.\n    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)))\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value).toISOString()\n    return `${binding.column} ${operator} ${this.bind(bound)}`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  /** Register a value and give back its parameter name, with no marker. */\n  private bindName(value: unknown): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return name\n  }\n\n  private bind(value: unknown): string {\n    return `:${this.bindName(value)}`\n  }\n}\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\nconst ID_SET_SEPARATOR = ','\n\n/**\n * Match `column` against an id set that arrives as ONE parameter.\n *\n * `IN (:...ids)` expands to one bind parameter, and one literal in the\n * statement, for each id. A dimension that does not live in SQL resolves to an\n * id set, and such a set follows the size of the fleet: the prod cluster fleet\n * is more than 1000. Both the statement text and the parameter count would\n * grow with it, and Postgres would plan the statement again at every size.\n *\n * Postgres splits the string here, thus the statement text is constant.\n * `= ANY(...)` can still use an index on the column.\n */\nexport const idSetPredicate = (column: string, parameter: string): string =>\n  `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`\n\n/**\n * The id set as one separated string, for {@link idSetPredicate}.\n *\n * The value is a bind parameter, thus it cannot change the statement. But an\n * id that holds the separator would become two ids, thus such an id is\n * dropped. The id columns are text columns, so this stays a guard and not an\n * assumption.\n *\n * An empty string gives an empty array in Postgres. Thus the match finds\n * nothing, which is correct for an empty set.\n */\nexport const joinIdSet = (ids: readonly string[]): string =>\n  ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nconst closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AAiDP,MAAM,SAAS;AAAA,EASb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAP6B;AAAA,EARZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAcjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AACH,eAAO,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACtC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,YAAM,SAAS,OAAO,QAAQ,MAAM,cAAc;AAClD,aAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,UAAM,SAAS,QAAQ,OACnB,QAAQ,QAAQ,MAAM,cACtB,QAAQ;AACZ,WAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzE;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AAGA,WAAO,eAAe,QAAQ,UAAU,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,EACvE;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,KAAK,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC/H;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK,EAAE,YAAY;AAC3D,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AAAA,EAC1D;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,SAAS,OAAwB;AACvC,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAwB;AACnC,WAAO,IAAI,KAAK,SAAS,KAAK,CAAC;AAAA,EACjC;AACF;AAGO,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAElD,MAAM,mBAAmB;AAclB,MAAM,iBAAiB,CAAC,QAAgB,cAC7C,GAAG,MAAM,2BAA2B,SAAS,MAAM,gBAAgB;AAa9D,MAAM,YAAY,CAAC,QACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,KAAK,gBAAgB;AAOnE,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGA,MAAM,eAAe,CACnB,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
   "names": []
 }

package/dist/search/index.d.ts

@@ -1,6 +1,6 @@
 export { type AndNode, isLuceneQueryError, LuceneQueryError, type NotNode, type OrNode, type QueryNode, type RangeNode, type SearchTermOperator, type TermNode, } from './ast.js';
 export { CLUSTER_DEFAULT_SEARCH_FIELDS, CLUSTER_SEARCH_FIELDS, } from './cluster-search-fields.js';
-export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, likeArgument, } from './compiler.js';
+export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, idSetPredicate, joinIdSet, likeArgument, } from './compiler.js';
 export { findSearchField, type SearchFieldCapability, type SearchFieldSpec, type SearchFieldType, } from './fields.js';
 export { ORG_DEFAULT_SEARCH_FIELDS, ORGANIZATION_SEARCH_FIELDS, } from './organization-search-fields.js';
 export { parseLuceneQuery } from './parser.js';

package/dist/search/index.js

@@ -8,6 +8,8 @@ import {
 } from "./cluster-search-fields.js";
 import {
   compileQuery,
+  idSetPredicate,
+  joinIdSet,
   likeArgument
 } from "./compiler.js";
 import {
@@ -26,7 +28,9 @@ export {
   ORG_DEFAULT_SEARCH_FIELDS,
   compileQuery,
   findSearchField,
+  idSetPredicate,
   isLuceneQueryError,
+  joinIdSet,
   likeArgument,
   parseLuceneQuery
 };

package/dist/search/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  likeArgument,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
-  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  idSetPredicate,\n  joinIdSet,\n  likeArgument,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
+  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
   "names": []
 }

package/dist/types/ClusterBulkOperation.type.d.ts

@@ -30,6 +30,36 @@ export type ClusterBulkOperationParameter = ClusterBulkOperationGenerationUpdate
 export interface ClusterBulkOperationGenerationUpdateParameter {
     toGenerationUuid: string;
     onlyAutoUpgrade?: boolean;
+    /**
+     * Patches every selected cluster, whatever state the cluster is in. The flag
+     * has two effects. First, a sleeping cluster stays asleep: the new generation
+     * reaches the CR, and the cluster starts on it at the next wake-up. A wake-up
+     * is costly, because a trial cluster suspends with ScaleDownAndDeleteDisk and
+     * the 8h sleep cron then suspends the cluster again. Second, a cluster that
+     * already has the target generation gets a forced spec write instead of a
+     * skip.
+     *
+     * Needs the permission `canUpgradeGenerationYolo`, on the creation of the
+     * operation and on each acknowledgement and the execution.
+     */
+    yoloAllClusters?: boolean;
+    /**
+     * Retries a refused generation write with the
+     * `cloud.camunda.io/force-generation-update` annotation of the operator.
+     *
+     * The admission webhook refuses a new generation while the cluster did not
+     * finish the previous generation update. The annotation waives that one
+     * check. Console sends the plain write first, thus only a cluster that the
+     * webhook refuses gets the bypass, and the result of the operation names
+     * the clusters that needed it.
+     *
+     * Different from `yoloAllClusters`, which selects the clusters to patch.
+     * This flag changes what console does when the operator says no.
+     *
+     * Needs the permission `canUpgradeGenerationYolo`, on the creation of the
+     * operation and on each acknowledgement and the execution.
+     */
+    yoloForceUpdate?: boolean;
 }
 export interface ClusterBulkOperationPlanTypeUpdateParameter {
     toPlanTypeUuid: string;

package/dist/types/OrganizationPermission.type.js

@@ -620,11 +620,14 @@ const PermissionsForOrganizationRole = /* @__PURE__ */ new Map([
         settings: CRUD_READ_TRUE,
         usage: CRUD_FALSE,
         billing: CRUD_FALSE,
+        // Only Organization Owner and Organization Admin see the org member
+        // list. Developer kept read access, which showed the Users and Groups
+        // tabs with disabled row actions (#9948).
         users: {
-          general: CRUD_READ_TRUE,
+          general: CRUD_FALSE,
           owner: CRUD_FALSE,
           admin: CRUD_FALSE,
-          member: CRUD_READ_TRUE
+          member: CRUD_FALSE
         },
         activity: CRUD_FALSE,
         diagrams: {

package/dist/types/OrganizationPermission.type.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/types/OrganizationPermission.type.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { OrganizationRole } from '../enums/OrganizationRole.enum.js'\n\n// new roles and permissions according to\n// https://docs.google.com/document/d/1FZYFn9fK2sn6ksjh7drSNad1vyMEIwK6p4KlG353yfM/edit#heading=h.kjgwc8d48e3a\n\nconst CRUD_TRUE: CreateReadUpdateDelete = {\n  create: true,\n  read: true,\n  update: true,\n  delete: true,\n}\n\nconst CRUD_FALSE: CreateReadUpdateDelete = {\n  create: false,\n  read: false,\n  update: false,\n  delete: false,\n}\n\nconst CRUD_READ_TRUE: CreateReadUpdateDelete = {\n  create: false,\n  read: true,\n  update: false,\n  delete: false,\n}\n\nconst CRUD_READ_UPDATE_TRUE: CreateReadUpdateDelete = {\n  create: false,\n  read: true,\n  update: true,\n  delete: false,\n}\n\nexport interface CreateReadUpdateDelete {\n  create: boolean\n  read: boolean\n  update: boolean\n  delete: boolean\n}\n\nexport interface CreateReadUpdateDeleteDescriptions {\n  create: string\n  read: string\n  update: string\n  delete: string\n}\n\nexport interface OrganizationPermissionsInternal<T> {\n  org: {\n    clusters: T\n    clients: T\n    settings: T\n    usage: T\n    billing: T\n    users: {\n      general: T\n      owner: T\n      admin: T\n      member: T\n    }\n    activity: T\n    diagrams: T\n    forms: T\n    instances: T // create === start new instances\n    workflows: T // create === deploy diagrams\n    webide: T\n    earlyAccessFeatures: T\n  }\n  cluster: {\n    clients: T\n    alerts: T\n    operate: T\n    tasklist: T\n    optimize: T\n    identity: T\n    ipWhitelist: T\n    secureConnectivity: T\n    encryption: T\n    connectorSecrets: T\n    connectors: T\n    settings: {\n      resourceBasedAuthorizations: {\n        activate: T\n        configure: T\n      }\n      identityBasedAuthorizations: {\n        activate: T\n      }\n      multiTenancy: {\n        activate: T\n      }\n    }\n  }\n}\n\nexport interface OrganizationPermissions\n  extends OrganizationPermissionsInternal<CreateReadUpdateDelete> {}\n\nexport const OrganizationPermissionsDescriptions: OrganizationPermissionsInternal<CreateReadUpdateDeleteDescriptions> =\n  {\n    org: {\n      clusters: {\n        create: 'Create new clusters',\n        read: 'View clusters',\n        update: 'Update clusters',\n        delete: 'Delete clusters',\n      },\n      clients: {\n        create: 'Create new console clients',\n        read: 'View console clients',\n        update: 'Update console clients',\n        delete: 'Delete console clients',\n      },\n      settings: {\n        create: 'unused',\n        read: 'View settings',\n        update: 'Update settings',\n        delete: 'Delete settings',\n      },\n      usage: {\n        create: 'unused',\n        read: 'View usage metrics',\n        update: 'unused',\n        delete: 'unused',\n      },\n      billing: {\n        create: 'unused',\n        read: 'View billing information',\n        update: 'Update billing information',\n        delete: 'unused',\n      },\n      users: {\n        general: {\n          create: 'Add users',\n          read: 'View users',\n          update: 'Update users',\n          delete: 'Remove users',\n        },\n        owner: {\n          create: 'Initiate owner change',\n          read: 'Read owners',\n          update: 'Update owners',\n          delete: 'Remove owners',\n        },\n        admin: {\n          create: 'Add admins',\n          read: 'Read admins',\n          update: 'Update admins',\n          delete: 'Remove admins',\n        },\n        member: {\n          create: 'Add members',\n          read: 'Read members',\n          update: 'Update members',\n          delete: 'Remove members',\n        },\n      },\n      activity: {\n        create: 'unused',\n        read: 'View activity',\n        update: 'unused',\n        delete: 'unused',\n      },\n      diagrams: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      forms: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      instances: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      workflows: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      webide: {\n        create: 'unused',\n        read: 'Open Web Modeler',\n        update: 'unused',\n        delete: 'unused',\n      },\n      earlyAccessFeatures: {\n        create: 'Enable early access features',\n        read: 'View early access features',\n        update: 'Update early access features',\n        delete: 'Disable early access features',\n      },\n    },\n    cluster: {\n      clients: {\n        create: 'Create cluster clients',\n        read: 'View cluster clients',\n        update: 'Update cluster clients',\n        delete: 'Delete cluster clients',\n      },\n      alerts: {\n        create: 'Create cluster alerts',\n        read: 'View cluster alerts',\n        update: 'Update cluster alerts',\n        delete: 'Delete cluster alerts',\n      },\n      operate: {\n        create: 'unused',\n        read: 'Open Operate',\n        update: 'unused',\n        delete: 'unused',\n      },\n      tasklist: {\n        create: 'unused',\n        read: 'Open Task List',\n        update: 'unused',\n        delete: 'unused',\n      },\n      optimize: {\n        create: 'unused',\n        read: 'Open Optimize',\n        update: 'unused',\n        delete: 'unused',\n      },\n      identity: {\n        create: 'unused',\n        read: 'Open Identity',\n        update: 'unused',\n        delete: 'unused',\n      },\n      ipWhitelist: {\n        create: 'Create IP Whitelist',\n        read: 'Read IP Whitelist',\n        update: 'Update IP Whitelist',\n        delete: 'Delete IP Whitelist',\n      },\n      secureConnectivity: {\n        create: 'Create Secure Connectivity',\n        read: 'Read Secure Connectivity',\n        update: 'Update Secure Connectivity',\n        delete: 'Delete Secure Connectivity',\n      },\n      encryption: {\n        create: 'Create BYO Encryption',\n        read: 'Read BYO Encryption',\n        update: 'Update BYO Encryption',\n        delete: 'Delete BYO Encryption',\n      },\n      connectorSecrets: {\n        create: 'Create Connector Secrets',\n        read: 'View Connector Secrets',\n        update: 'Update Connector Secrets',\n        delete: 'Delete Connector Secrets',\n      },\n      connectors: {\n        create: 'unused',\n        read: 'Read Manage Connectors View',\n        update: 'unused',\n        delete: 'unused',\n      },\n      settings: {\n        resourceBasedAuthorizations: {\n          activate: {\n            create: 'unused',\n            read: 'View resource-based authorizations settings',\n            update: 'Enable/Disable resource-based authorizations',\n            delete: 'unused',\n          },\n          configure: {\n            create: 'unused',\n            read: 'Read resource-based authorizations for users',\n            update: 'Update resource-based authorizations for users',\n            delete: 'unused',\n          },\n        },\n        identityBasedAuthorizations: {\n          activate: {\n            create: 'unused',\n            read: 'View identity-based authorizations settings',\n            update: 'Enable/Disable identity-based authorizations',\n            delete: 'unused',\n          },\n        },\n        multiTenancy: {\n          activate: {\n            create: 'unused',\n            read: 'View Multi-tenency settings',\n            update: 'Enable/Disable Multi-tenancy',\n            delete: 'unused',\n          },\n        },\n      },\n    },\n  }\n\nexport const PermissionsForOrganizationRole: Map<\n  OrganizationRole,\n  OrganizationPermissions\n> = new Map([\n  [\n    OrganizationRole.MEMBER,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.ADMIN,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_UPDATE_TRUE,\n        users: {\n          general: CRUD_TRUE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_TRUE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_TRUE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_TRUE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_TRUE,\n          },\n          multiTenancy: {\n            activate: CRUD_TRUE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.OWNER,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: {\n          create: false,\n          read: true,\n          update: true,\n          delete: true,\n        },\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_UPDATE_TRUE,\n        users: {\n          general: CRUD_TRUE,\n          owner: CRUD_TRUE,\n          admin: CRUD_TRUE,\n          member: CRUD_TRUE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_TRUE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_TRUE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_TRUE,\n          },\n          multiTenancy: {\n            activate: CRUD_TRUE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.SUPPORTAGENT,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_READ_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_TRUE,\n        users: {\n          general: CRUD_READ_TRUE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_READ_TRUE,\n        forms: CRUD_READ_TRUE,\n        instances: CRUD_READ_TRUE,\n        workflows: CRUD_READ_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_READ_TRUE,\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_READ_TRUE,\n        tasklist: CRUD_READ_TRUE,\n        optimize: CRUD_READ_TRUE,\n        identity: CRUD_READ_TRUE,\n        ipWhitelist: CRUD_READ_TRUE,\n        secureConnectivity: CRUD_READ_TRUE,\n        encryption: CRUD_READ_TRUE,\n        connectorSecrets: CRUD_READ_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.OPERATIONS_ENGINEER,\n    {\n      org: {\n        clusters: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_TRUE,\n        workflows: CRUD_READ_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.TASK_USER,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_FALSE,\n        forms: CRUD_FALSE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.ANALYST,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_READ_TRUE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.DEVELOPER,\n    {\n      org: {\n        clusters: {\n          create: true,\n          read: true,\n          update: false,\n          delete: false,\n        },\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_READ_TRUE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_READ_TRUE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_READ_TRUE,\n        secureConnectivity: CRUD_READ_TRUE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.VISITOR,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_READ_TRUE,\n        forms: CRUD_READ_TRUE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_READ_TRUE,\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_READ_TRUE,\n        tasklist: CRUD_READ_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.MODELER,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_FALSE,\n        forms: CRUD_FALSE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n])\n"],
-  "mappings": "AAMA,SAAS,wBAAwB;AAKjC,MAAM,YAAoC;AAAA,EACxC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,aAAqC;AAAA,EACzC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,iBAAyC;AAAA,EAC7C,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,wBAAgD;AAAA,EACpD,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAmEO,MAAM,sCACX;AAAA,EACE,KAAK;AAAA,IACH,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,QACN,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,qBAAqB;AAAA,MACnB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,oBAAoB;AAAA,MAClB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,kBAAkB;AAAA,MAChB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,6BAA6B;AAAA,QAC3B,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,UACT,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,6BAA6B;AAAA,QAC3B,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEK,MAAM,iCAGT,oBAAI,IAAI;AAAA,EACV;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { OrganizationRole } from '../enums/OrganizationRole.enum.js'\n\n// new roles and permissions according to\n// https://docs.google.com/document/d/1FZYFn9fK2sn6ksjh7drSNad1vyMEIwK6p4KlG353yfM/edit#heading=h.kjgwc8d48e3a\n\nconst CRUD_TRUE: CreateReadUpdateDelete = {\n  create: true,\n  read: true,\n  update: true,\n  delete: true,\n}\n\nconst CRUD_FALSE: CreateReadUpdateDelete = {\n  create: false,\n  read: false,\n  update: false,\n  delete: false,\n}\n\nconst CRUD_READ_TRUE: CreateReadUpdateDelete = {\n  create: false,\n  read: true,\n  update: false,\n  delete: false,\n}\n\nconst CRUD_READ_UPDATE_TRUE: CreateReadUpdateDelete = {\n  create: false,\n  read: true,\n  update: true,\n  delete: false,\n}\n\nexport interface CreateReadUpdateDelete {\n  create: boolean\n  read: boolean\n  update: boolean\n  delete: boolean\n}\n\nexport interface CreateReadUpdateDeleteDescriptions {\n  create: string\n  read: string\n  update: string\n  delete: string\n}\n\nexport interface OrganizationPermissionsInternal<T> {\n  org: {\n    clusters: T\n    clients: T\n    settings: T\n    usage: T\n    billing: T\n    users: {\n      general: T\n      owner: T\n      admin: T\n      member: T\n    }\n    activity: T\n    diagrams: T\n    forms: T\n    instances: T // create === start new instances\n    workflows: T // create === deploy diagrams\n    webide: T\n    earlyAccessFeatures: T\n  }\n  cluster: {\n    clients: T\n    alerts: T\n    operate: T\n    tasklist: T\n    optimize: T\n    identity: T\n    ipWhitelist: T\n    secureConnectivity: T\n    encryption: T\n    connectorSecrets: T\n    connectors: T\n    settings: {\n      resourceBasedAuthorizations: {\n        activate: T\n        configure: T\n      }\n      identityBasedAuthorizations: {\n        activate: T\n      }\n      multiTenancy: {\n        activate: T\n      }\n    }\n  }\n}\n\nexport interface OrganizationPermissions\n  extends OrganizationPermissionsInternal<CreateReadUpdateDelete> {}\n\nexport const OrganizationPermissionsDescriptions: OrganizationPermissionsInternal<CreateReadUpdateDeleteDescriptions> =\n  {\n    org: {\n      clusters: {\n        create: 'Create new clusters',\n        read: 'View clusters',\n        update: 'Update clusters',\n        delete: 'Delete clusters',\n      },\n      clients: {\n        create: 'Create new console clients',\n        read: 'View console clients',\n        update: 'Update console clients',\n        delete: 'Delete console clients',\n      },\n      settings: {\n        create: 'unused',\n        read: 'View settings',\n        update: 'Update settings',\n        delete: 'Delete settings',\n      },\n      usage: {\n        create: 'unused',\n        read: 'View usage metrics',\n        update: 'unused',\n        delete: 'unused',\n      },\n      billing: {\n        create: 'unused',\n        read: 'View billing information',\n        update: 'Update billing information',\n        delete: 'unused',\n      },\n      users: {\n        general: {\n          create: 'Add users',\n          read: 'View users',\n          update: 'Update users',\n          delete: 'Remove users',\n        },\n        owner: {\n          create: 'Initiate owner change',\n          read: 'Read owners',\n          update: 'Update owners',\n          delete: 'Remove owners',\n        },\n        admin: {\n          create: 'Add admins',\n          read: 'Read admins',\n          update: 'Update admins',\n          delete: 'Remove admins',\n        },\n        member: {\n          create: 'Add members',\n          read: 'Read members',\n          update: 'Update members',\n          delete: 'Remove members',\n        },\n      },\n      activity: {\n        create: 'unused',\n        read: 'View activity',\n        update: 'unused',\n        delete: 'unused',\n      },\n      diagrams: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      forms: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      instances: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      workflows: {\n        create: 'unused',\n        read: 'unused',\n        update: 'unused',\n        delete: 'unused',\n      },\n      webide: {\n        create: 'unused',\n        read: 'Open Web Modeler',\n        update: 'unused',\n        delete: 'unused',\n      },\n      earlyAccessFeatures: {\n        create: 'Enable early access features',\n        read: 'View early access features',\n        update: 'Update early access features',\n        delete: 'Disable early access features',\n      },\n    },\n    cluster: {\n      clients: {\n        create: 'Create cluster clients',\n        read: 'View cluster clients',\n        update: 'Update cluster clients',\n        delete: 'Delete cluster clients',\n      },\n      alerts: {\n        create: 'Create cluster alerts',\n        read: 'View cluster alerts',\n        update: 'Update cluster alerts',\n        delete: 'Delete cluster alerts',\n      },\n      operate: {\n        create: 'unused',\n        read: 'Open Operate',\n        update: 'unused',\n        delete: 'unused',\n      },\n      tasklist: {\n        create: 'unused',\n        read: 'Open Task List',\n        update: 'unused',\n        delete: 'unused',\n      },\n      optimize: {\n        create: 'unused',\n        read: 'Open Optimize',\n        update: 'unused',\n        delete: 'unused',\n      },\n      identity: {\n        create: 'unused',\n        read: 'Open Identity',\n        update: 'unused',\n        delete: 'unused',\n      },\n      ipWhitelist: {\n        create: 'Create IP Whitelist',\n        read: 'Read IP Whitelist',\n        update: 'Update IP Whitelist',\n        delete: 'Delete IP Whitelist',\n      },\n      secureConnectivity: {\n        create: 'Create Secure Connectivity',\n        read: 'Read Secure Connectivity',\n        update: 'Update Secure Connectivity',\n        delete: 'Delete Secure Connectivity',\n      },\n      encryption: {\n        create: 'Create BYO Encryption',\n        read: 'Read BYO Encryption',\n        update: 'Update BYO Encryption',\n        delete: 'Delete BYO Encryption',\n      },\n      connectorSecrets: {\n        create: 'Create Connector Secrets',\n        read: 'View Connector Secrets',\n        update: 'Update Connector Secrets',\n        delete: 'Delete Connector Secrets',\n      },\n      connectors: {\n        create: 'unused',\n        read: 'Read Manage Connectors View',\n        update: 'unused',\n        delete: 'unused',\n      },\n      settings: {\n        resourceBasedAuthorizations: {\n          activate: {\n            create: 'unused',\n            read: 'View resource-based authorizations settings',\n            update: 'Enable/Disable resource-based authorizations',\n            delete: 'unused',\n          },\n          configure: {\n            create: 'unused',\n            read: 'Read resource-based authorizations for users',\n            update: 'Update resource-based authorizations for users',\n            delete: 'unused',\n          },\n        },\n        identityBasedAuthorizations: {\n          activate: {\n            create: 'unused',\n            read: 'View identity-based authorizations settings',\n            update: 'Enable/Disable identity-based authorizations',\n            delete: 'unused',\n          },\n        },\n        multiTenancy: {\n          activate: {\n            create: 'unused',\n            read: 'View Multi-tenency settings',\n            update: 'Enable/Disable Multi-tenancy',\n            delete: 'unused',\n          },\n        },\n      },\n    },\n  }\n\nexport const PermissionsForOrganizationRole: Map<\n  OrganizationRole,\n  OrganizationPermissions\n> = new Map([\n  [\n    OrganizationRole.MEMBER,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.ADMIN,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_UPDATE_TRUE,\n        users: {\n          general: CRUD_TRUE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_TRUE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_TRUE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_TRUE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_TRUE,\n          },\n          multiTenancy: {\n            activate: CRUD_TRUE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.OWNER,\n    {\n      org: {\n        clusters: CRUD_TRUE,\n        clients: CRUD_TRUE,\n        settings: {\n          create: false,\n          read: true,\n          update: true,\n          delete: true,\n        },\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_UPDATE_TRUE,\n        users: {\n          general: CRUD_TRUE,\n          owner: CRUD_TRUE,\n          admin: CRUD_TRUE,\n          member: CRUD_TRUE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_TRUE,\n        forms: CRUD_TRUE,\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_TRUE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_TRUE,\n        identity: CRUD_TRUE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_TRUE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_TRUE,\n          },\n          multiTenancy: {\n            activate: CRUD_TRUE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.SUPPORTAGENT,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_READ_TRUE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_READ_TRUE,\n        billing: CRUD_READ_TRUE,\n        users: {\n          general: CRUD_READ_TRUE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_READ_TRUE,\n        diagrams: CRUD_READ_TRUE,\n        forms: CRUD_READ_TRUE,\n        instances: CRUD_READ_TRUE,\n        workflows: CRUD_READ_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_READ_TRUE,\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_READ_TRUE,\n        tasklist: CRUD_READ_TRUE,\n        optimize: CRUD_READ_TRUE,\n        identity: CRUD_READ_TRUE,\n        ipWhitelist: CRUD_READ_TRUE,\n        secureConnectivity: CRUD_READ_TRUE,\n        encryption: CRUD_READ_TRUE,\n        connectorSecrets: CRUD_READ_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.OPERATIONS_ENGINEER,\n    {\n      org: {\n        clusters: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_TRUE,\n        workflows: CRUD_READ_TRUE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_TRUE,\n        alerts: CRUD_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_TRUE,\n        secureConnectivity: CRUD_TRUE,\n        encryption: CRUD_TRUE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.TASK_USER,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_FALSE,\n        forms: CRUD_FALSE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.ANALYST,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_READ_TRUE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.DEVELOPER,\n    {\n      org: {\n        clusters: {\n          create: true,\n          read: true,\n          update: false,\n          delete: false,\n        },\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        // Only Organization Owner and Organization Admin see the org member\n        // list. Developer kept read access, which showed the Users and Groups\n        // tabs with disabled row actions (#9948).\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        forms: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        instances: CRUD_TRUE,\n        workflows: CRUD_TRUE,\n        webide: CRUD_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: {\n          create: true,\n          read: true,\n          update: true,\n          delete: false,\n        },\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_TRUE,\n        tasklist: CRUD_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_READ_TRUE,\n        secureConnectivity: CRUD_READ_TRUE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_TRUE,\n        connectors: CRUD_READ_TRUE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_TRUE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.VISITOR,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_READ_TRUE,\n        forms: CRUD_READ_TRUE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_READ_TRUE,\n        alerts: CRUD_READ_TRUE,\n        operate: CRUD_READ_TRUE,\n        tasklist: CRUD_READ_TRUE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n  [\n    OrganizationRole.MODELER,\n    {\n      org: {\n        clusters: CRUD_READ_TRUE,\n        clients: CRUD_FALSE,\n        settings: CRUD_READ_TRUE,\n        usage: CRUD_FALSE,\n        billing: CRUD_FALSE,\n        users: {\n          general: CRUD_FALSE,\n          owner: CRUD_FALSE,\n          admin: CRUD_FALSE,\n          member: CRUD_FALSE,\n        },\n        activity: CRUD_FALSE,\n        diagrams: CRUD_FALSE,\n        forms: CRUD_FALSE,\n        instances: CRUD_FALSE,\n        workflows: CRUD_FALSE,\n        webide: CRUD_READ_TRUE,\n        earlyAccessFeatures: CRUD_FALSE,\n      },\n      cluster: {\n        clients: CRUD_FALSE,\n        alerts: CRUD_FALSE,\n        operate: CRUD_FALSE,\n        tasklist: CRUD_FALSE,\n        optimize: CRUD_FALSE,\n        identity: CRUD_FALSE,\n        ipWhitelist: CRUD_FALSE,\n        secureConnectivity: CRUD_FALSE,\n        encryption: CRUD_FALSE,\n        connectorSecrets: CRUD_FALSE,\n        connectors: CRUD_FALSE,\n        settings: {\n          resourceBasedAuthorizations: {\n            activate: CRUD_FALSE,\n            configure: CRUD_FALSE,\n          },\n          identityBasedAuthorizations: {\n            activate: CRUD_FALSE,\n          },\n          multiTenancy: {\n            activate: CRUD_FALSE,\n          },\n        },\n      },\n    },\n  ],\n])\n"],
+  "mappings": "AAMA,SAAS,wBAAwB;AAKjC,MAAM,YAAoC;AAAA,EACxC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,aAAqC;AAAA,EACzC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,iBAAyC;AAAA,EAC7C,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,MAAM,wBAAgD;AAAA,EACpD,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAmEO,MAAM,sCACX;AAAA,EACE,KAAK;AAAA,IACH,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,QAAQ;AAAA,QACN,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,OAAO;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,qBAAqB;AAAA,MACnB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,aAAa;AAAA,MACX,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,oBAAoB;AAAA,MAClB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,kBAAkB;AAAA,MAChB,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,IACA,UAAU;AAAA,MACR,6BAA6B;AAAA,QAC3B,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,UACT,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,6BAA6B;AAAA,QAC3B,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEK,MAAM,iCAGT,oBAAI,IAAI;AAAA,EACV;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA;AAAA;AAAA;AAAA,QAIT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,OAAO;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,iBAAiB;AAAA,IACjB;AAAA,MACE,KAAK;AAAA,QACH,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,OAAO;AAAA,QACP,SAAS;AAAA,QACT,OAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,UACP,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,qBAAqB;AAAA,MACvB;AAAA,MACA,SAAS;AAAA,QACP,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,YAAY;AAAA,QACZ,kBAAkB;AAAA,QAClB,YAAY;AAAA,QACZ,UAAU;AAAA,UACR,6BAA6B;AAAA,YAC3B,UAAU;AAAA,YACV,WAAW;AAAA,UACb;AAAA,UACA,6BAA6B;AAAA,YAC3B,UAAU;AAAA,UACZ;AAAA,UACA,cAAc;AAAA,YACZ,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/utils/camundiPermissionAugmenter.utils.d.ts

@@ -1,5 +1,19 @@
 import { type CamundiPermissionRules, type HibobEmployee } from '../config/camundi-permission-rules.types.js';
 import type { Roles } from '../types/Roles.js';
+/**
+ * Where the HiBob employee list is cached, in the Redis of the fleet.
+ *
+ * accounts-backend writes the entry. Every other service only reads it, and
+ * each one must address it with these two names: a service that reads another
+ * key finds nothing, adds no permission of a role, and says nothing about it.
+ *
+ * They live here, and not in a server package, because both server layers read
+ * them. `shared-backend-server` serves the Express services and
+ * `shared-backend-fastify` serves the Fastify services, and two copies of one
+ * string is how the two engines come apart.
+ */
+export declare const HIBOB_CACHE_NAMESPACE = "hibobUsersCache";
+export declare const HIBOB_CACHE_KEY = "allUsers";
 /**
  * Determines which permission rules apply to a given employee based on their
  * department, division, and subdivision.

package/dist/utils/camundiPermissionAugmenter.utils.js

@@ -5,6 +5,8 @@ import {
   SUB_DIVISION
 } from "../config/camundi-permission-rules.types.js";
 import { expandRolesToPermissions } from "../permissions/roleExpansion.utils.js";
+const HIBOB_CACHE_NAMESPACE = "hibobUsersCache";
+const HIBOB_CACHE_KEY = "allUsers";
 function getApplicableRolesForEmployee(employee, rules = CAMUNDI_PERMISSION_RULES) {
   const applicableRoles = /* @__PURE__ */ new Set();
   const department = employee[DEPARTMENT]?.value || "";
@@ -63,6 +65,8 @@ function isManager(userEmail, employees) {
   );
 }
 export {
+  HIBOB_CACHE_KEY,
+  HIBOB_CACHE_NAMESPACE,
   augmentCamundiPermissions,
   getApplicableRolesForEmployee,
   isManager

package/dist/utils/camundiPermissionAugmenter.utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/utils/camundiPermissionAugmenter.utils.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { default as CAMUNDI_PERMISSION_RULES } from '../config/camundi-permission-rules.js'\nimport {\n  type CamundiPermissionRules,\n  DEPARTMENT,\n  DIVISION,\n  type HibobEmployee,\n  SUB_DIVISION,\n} from '../config/camundi-permission-rules.types.js'\nimport { expandRolesToPermissions } from '../permissions/roleExpansion.utils.js'\nimport type { Roles } from '../types/Roles.js'\n\n/**\n * Determines which permission rules apply to a given employee based on their\n * department, division, and subdivision.\n *\n * @param employee - HiBob employee data\n * @param rules - Permission rules configuration\n * @returns Array of roles that should be granted to the employee\n */\nexport function getApplicableRolesForEmployee(\n  employee: HibobEmployee,\n  rules: CamundiPermissionRules = CAMUNDI_PERMISSION_RULES,\n): Roles[] {\n  const applicableRoles = new Set<Roles>()\n\n  // Extract employee organizational data - use only direct field paths\n  const department = employee[DEPARTMENT]?.value || ''\n  const division = employee[DIVISION]?.value || ''\n  const subdivision = employee[SUB_DIVISION]?.value || ''\n\n  // Check department rules\n  if (department && rules.departmentRules[department]) {\n    for (const role of rules.departmentRules[department]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check division rules\n  if (division && rules.divisionRules[division]) {\n    for (const role of rules.divisionRules[division]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check subdivision rules\n  if (subdivision && rules.subdivisionRules[subdivision]) {\n    for (const role of rules.subdivisionRules[subdivision]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  return Array.from(applicableRoles)\n}\n\n/**\n * Augments user permissions based on their Camunda employee status and organizational position.\n *\n * @param userEmail - Email of the user\n * @param currentPermissions - Current permissions from JWT\n * @param employees - List of all HiBob employees\n * @returns Augmented permissions array (original + new permissions from rules)\n */\nexport function augmentCamundiPermissions(\n  userEmail: string,\n  currentPermissions: string[],\n  employees: HibobEmployee[],\n): {\n  augmentedPermissions: string[]\n  hibobEmployee?: HibobEmployee\n  applicableRoles?: Roles[]\n} {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Find the employee in HiBob data\n  const employee = employees.find((emp) => {\n    const empEmail = emp.email || emp['/root/email']?.value\n    return empEmail?.toLowerCase() === userEmail.toLowerCase()\n  })\n\n  if (!employee) {\n    // Employee not found in HiBob - return original permissions\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Get applicable roles based on organizational structure\n  const applicableRoles = getApplicableRolesForEmployee(employee)\n\n  if (applicableRoles.length === 0) {\n    // No rules apply to this employee\n    return {\n      augmentedPermissions: currentPermissions,\n      hibobEmployee: employee,\n      applicableRoles,\n    }\n  }\n\n  // Expand roles to permissions\n  const newPermissions = expandRolesToPermissions(applicableRoles)\n\n  // Merge with existing permissions (deduplication via Set)\n  const mergedPermissions = new Set([...currentPermissions, ...newPermissions])\n\n  return {\n    augmentedPermissions: Array.from(mergedPermissions),\n    hibobEmployee: employee,\n    applicableRoles,\n  }\n}\n\nexport function isManager(\n  userEmail: string,\n  employees: HibobEmployee[],\n): boolean {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return false\n  }\n  return employees.some(\n    (emp) =>\n      emp['/work/reportsTo']?.value?.email?.toLowerCase() ===\n      userEmail.toLowerCase(),\n  )\n}\n"],
-  "mappings": "AAMA,SAAS,WAAW,gCAAgC;AACpD;AAAA,EAEE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,gCAAgC;AAWlC,SAAS,8BACd,UACA,QAAgC,0BACvB;AACT,QAAM,kBAAkB,oBAAI,IAAW;AAGvC,QAAM,aAAa,SAAS,UAAU,GAAG,SAAS;AAClD,QAAM,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC9C,QAAM,cAAc,SAAS,YAAY,GAAG,SAAS;AAGrD,MAAI,cAAc,MAAM,gBAAgB,UAAU,GAAG;AACnD,eAAW,QAAQ,MAAM,gBAAgB,UAAU,GAAG;AACpD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,YAAY,MAAM,cAAc,QAAQ,GAAG;AAC7C,eAAW,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAChD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,eAAe,MAAM,iBAAiB,WAAW,GAAG;AACtD,eAAW,QAAQ,MAAM,iBAAiB,WAAW,GAAG;AACtD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe;AACnC;AAUO,SAAS,0BACd,WACA,oBACA,WAKA;AAEA,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,WAAW,UAAU,KAAK,CAAC,QAAQ;AACvC,UAAM,WAAW,IAAI,SAAS,IAAI,aAAa,GAAG;AAClD,WAAO,UAAU,YAAY,MAAM,UAAU,YAAY;AAAA,EAC3D,CAAC;AAED,MAAI,CAAC,UAAU;AAEb,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,kBAAkB,8BAA8B,QAAQ;AAE9D,MAAI,gBAAgB,WAAW,GAAG;AAEhC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,yBAAyB,eAAe;AAG/D,QAAM,oBAAoB,oBAAI,IAAI,CAAC,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAE5E,SAAO;AAAA,IACL,sBAAsB,MAAM,KAAK,iBAAiB;AAAA,IAClD,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAEO,SAAS,UACd,WACA,WACS;AAET,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AAAA,IACf,CAAC,QACC,IAAI,iBAAiB,GAAG,OAAO,OAAO,YAAY,MAClD,UAAU,YAAY;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { default as CAMUNDI_PERMISSION_RULES } from '../config/camundi-permission-rules.js'\nimport {\n  type CamundiPermissionRules,\n  DEPARTMENT,\n  DIVISION,\n  type HibobEmployee,\n  SUB_DIVISION,\n} from '../config/camundi-permission-rules.types.js'\nimport { expandRolesToPermissions } from '../permissions/roleExpansion.utils.js'\nimport type { Roles } from '../types/Roles.js'\n\n/**\n * Where the HiBob employee list is cached, in the Redis of the fleet.\n *\n * accounts-backend writes the entry. Every other service only reads it, and\n * each one must address it with these two names: a service that reads another\n * key finds nothing, adds no permission of a role, and says nothing about it.\n *\n * They live here, and not in a server package, because both server layers read\n * them. `shared-backend-server` serves the Express services and\n * `shared-backend-fastify` serves the Fastify services, and two copies of one\n * string is how the two engines come apart.\n */\nexport const HIBOB_CACHE_NAMESPACE = 'hibobUsersCache'\nexport const HIBOB_CACHE_KEY = 'allUsers'\n\n/**\n * Determines which permission rules apply to a given employee based on their\n * department, division, and subdivision.\n *\n * @param employee - HiBob employee data\n * @param rules - Permission rules configuration\n * @returns Array of roles that should be granted to the employee\n */\nexport function getApplicableRolesForEmployee(\n  employee: HibobEmployee,\n  rules: CamundiPermissionRules = CAMUNDI_PERMISSION_RULES,\n): Roles[] {\n  const applicableRoles = new Set<Roles>()\n\n  // Extract employee organizational data - use only direct field paths\n  const department = employee[DEPARTMENT]?.value || ''\n  const division = employee[DIVISION]?.value || ''\n  const subdivision = employee[SUB_DIVISION]?.value || ''\n\n  // Check department rules\n  if (department && rules.departmentRules[department]) {\n    for (const role of rules.departmentRules[department]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check division rules\n  if (division && rules.divisionRules[division]) {\n    for (const role of rules.divisionRules[division]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check subdivision rules\n  if (subdivision && rules.subdivisionRules[subdivision]) {\n    for (const role of rules.subdivisionRules[subdivision]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  return Array.from(applicableRoles)\n}\n\n/**\n * Augments user permissions based on their Camunda employee status and organizational position.\n *\n * @param userEmail - Email of the user\n * @param currentPermissions - Current permissions from JWT\n * @param employees - List of all HiBob employees\n * @returns Augmented permissions array (original + new permissions from rules)\n */\nexport function augmentCamundiPermissions(\n  userEmail: string,\n  currentPermissions: string[],\n  employees: HibobEmployee[],\n): {\n  augmentedPermissions: string[]\n  hibobEmployee?: HibobEmployee\n  applicableRoles?: Roles[]\n} {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Find the employee in HiBob data\n  const employee = employees.find((emp) => {\n    const empEmail = emp.email || emp['/root/email']?.value\n    return empEmail?.toLowerCase() === userEmail.toLowerCase()\n  })\n\n  if (!employee) {\n    // Employee not found in HiBob - return original permissions\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Get applicable roles based on organizational structure\n  const applicableRoles = getApplicableRolesForEmployee(employee)\n\n  if (applicableRoles.length === 0) {\n    // No rules apply to this employee\n    return {\n      augmentedPermissions: currentPermissions,\n      hibobEmployee: employee,\n      applicableRoles,\n    }\n  }\n\n  // Expand roles to permissions\n  const newPermissions = expandRolesToPermissions(applicableRoles)\n\n  // Merge with existing permissions (deduplication via Set)\n  const mergedPermissions = new Set([...currentPermissions, ...newPermissions])\n\n  return {\n    augmentedPermissions: Array.from(mergedPermissions),\n    hibobEmployee: employee,\n    applicableRoles,\n  }\n}\n\nexport function isManager(\n  userEmail: string,\n  employees: HibobEmployee[],\n): boolean {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return false\n  }\n  return employees.some(\n    (emp) =>\n      emp['/work/reportsTo']?.value?.email?.toLowerCase() ===\n      userEmail.toLowerCase(),\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,WAAW,gCAAgC;AACpD;AAAA,EAEE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,gCAAgC;AAelC,MAAM,wBAAwB;AAC9B,MAAM,kBAAkB;AAUxB,SAAS,8BACd,UACA,QAAgC,0BACvB;AACT,QAAM,kBAAkB,oBAAI,IAAW;AAGvC,QAAM,aAAa,SAAS,UAAU,GAAG,SAAS;AAClD,QAAM,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC9C,QAAM,cAAc,SAAS,YAAY,GAAG,SAAS;AAGrD,MAAI,cAAc,MAAM,gBAAgB,UAAU,GAAG;AACnD,eAAW,QAAQ,MAAM,gBAAgB,UAAU,GAAG;AACpD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,YAAY,MAAM,cAAc,QAAQ,GAAG;AAC7C,eAAW,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAChD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,eAAe,MAAM,iBAAiB,WAAW,GAAG;AACtD,eAAW,QAAQ,MAAM,iBAAiB,WAAW,GAAG;AACtD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe;AACnC;AAUO,SAAS,0BACd,WACA,oBACA,WAKA;AAEA,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,WAAW,UAAU,KAAK,CAAC,QAAQ;AACvC,UAAM,WAAW,IAAI,SAAS,IAAI,aAAa,GAAG;AAClD,WAAO,UAAU,YAAY,MAAM,UAAU,YAAY;AAAA,EAC3D,CAAC;AAED,MAAI,CAAC,UAAU;AAEb,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,kBAAkB,8BAA8B,QAAQ;AAE9D,MAAI,gBAAgB,WAAW,GAAG;AAEhC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,yBAAyB,eAAe;AAG/D,QAAM,oBAAoB,oBAAI,IAAI,CAAC,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAE5E,SAAO;AAAA,IACL,sBAAsB,MAAM,KAAK,iBAAiB;AAAA,IAClD,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAEO,SAAS,UACd,WACA,WACS;AAET,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AAAA,IACf,CAAC,QACC,IAAI,iBAAiB,GAAG,OAAO,OAAO,YAAY,MAClD,UAAU,YAAY;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/utils/camundiPermissionAugmenter.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/orgStartDate.utils.d.ts

@@ -0,0 +1,28 @@
+/** Minimal org shape `computeOrgStartDate` needs. `OrganizationDto` satisfies it. */
+export interface OrgStartDateInput {
+    created?: Date | string;
+    organizationToSalesPlan?: {
+        salesPlan: {
+            salesPlanType?: string;
+        };
+        trialPlanStartDate?: Date | string;
+        enterpriseStartDate?: Date | string;
+    };
+}
+/**
+ * The date an org's value metrics start counting from, by sales-plan type.
+ *
+ * - `enterprise`: `enterpriseStartDate`, or now when that is missing.
+ * - `trial`: `created`, or `trialPlanStartDate` when `created` is missing, or
+ *   now when neither is set.
+ * - every other plan type (`in-negotiation`, `free`, `internal`, …): `created`,
+ *   or now when `created` is missing.
+ *
+ * Ported from accounts-frontend's `computeOrgStartDate`
+ * (`apps/accounts-frontend/src/models/api/valueMetrics.ts`) so
+ * control-frontend's Value metrics "group by" control buckets periods the
+ * same way the legacy Accounts tool did. Kept here so the two surfaces
+ * cannot silently disagree about which day a period starts on — the same
+ * reason `enterpriseTerm.utils.ts` in this file was extracted.
+ */
+export declare function computeOrgStartDate(organisation: OrgStartDateInput | undefined): Date;

package/dist/utils/orgStartDate.utils.js

@@ -0,0 +1,25 @@
+function computeOrgStartDate(organisation) {
+  if (!organisation) {
+    return /* @__PURE__ */ new Date();
+  }
+  const created = organisation.created ? new Date(organisation.created) : void 0;
+  switch (organisation.organizationToSalesPlan?.salesPlan.salesPlanType) {
+    case "trial": {
+      if (created) {
+        return created;
+      }
+      const trialStart = organisation.organizationToSalesPlan.trialPlanStartDate;
+      return trialStart ? new Date(trialStart) : /* @__PURE__ */ new Date();
+    }
+    case "enterprise": {
+      const enterpriseStart = organisation.organizationToSalesPlan.enterpriseStartDate;
+      return enterpriseStart ? new Date(enterpriseStart) : /* @__PURE__ */ new Date();
+    }
+    default:
+      return created ?? /* @__PURE__ */ new Date();
+  }
+}
+export {
+  computeOrgStartDate
+};
+//# sourceMappingURL=orgStartDate.utils.js.map

package/dist/utils/orgStartDate.utils.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/orgStartDate.utils.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/** Minimal org shape `computeOrgStartDate` needs. `OrganizationDto` satisfies it. */\nexport interface OrgStartDateInput {\n  created?: Date | string\n  organizationToSalesPlan?: {\n    salesPlan: { salesPlanType?: string }\n    trialPlanStartDate?: Date | string\n    enterpriseStartDate?: Date | string\n  }\n}\n\n/**\n * The date an org's value metrics start counting from, by sales-plan type.\n *\n * - `enterprise`: `enterpriseStartDate`, or now when that is missing.\n * - `trial`: `created`, or `trialPlanStartDate` when `created` is missing, or\n *   now when neither is set.\n * - every other plan type (`in-negotiation`, `free`, `internal`, \u2026): `created`,\n *   or now when `created` is missing.\n *\n * Ported from accounts-frontend's `computeOrgStartDate`\n * (`apps/accounts-frontend/src/models/api/valueMetrics.ts`) so\n * control-frontend's Value metrics \"group by\" control buckets periods the\n * same way the legacy Accounts tool did. Kept here so the two surfaces\n * cannot silently disagree about which day a period starts on \u2014 the same\n * reason `enterpriseTerm.utils.ts` in this file was extracted.\n */\nexport function computeOrgStartDate(\n  organisation: OrgStartDateInput | undefined,\n): Date {\n  if (!organisation) {\n    return new Date()\n  }\n\n  const created = organisation.created\n    ? new Date(organisation.created)\n    : undefined\n\n  switch (organisation.organizationToSalesPlan?.salesPlan.salesPlanType) {\n    case 'trial': {\n      if (created) {\n        return created\n      }\n      const trialStart = organisation.organizationToSalesPlan.trialPlanStartDate\n      return trialStart ? new Date(trialStart) : new Date()\n    }\n    case 'enterprise': {\n      const enterpriseStart =\n        organisation.organizationToSalesPlan.enterpriseStartDate\n      return enterpriseStart ? new Date(enterpriseStart) : new Date()\n    }\n    default:\n      return created ?? new Date()\n  }\n}\n"],
+  "mappings": "AAgCO,SAAS,oBACd,cACM;AACN,MAAI,CAAC,cAAc;AACjB,WAAO,oBAAI,KAAK;AAAA,EAClB;AAEA,QAAM,UAAU,aAAa,UACzB,IAAI,KAAK,aAAa,OAAO,IAC7B;AAEJ,UAAQ,aAAa,yBAAyB,UAAU,eAAe;AAAA,IACrE,KAAK,SAAS;AACZ,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AACA,YAAM,aAAa,aAAa,wBAAwB;AACxD,aAAO,aAAa,IAAI,KAAK,UAAU,IAAI,oBAAI,KAAK;AAAA,IACtD;AAAA,IACA,KAAK,cAAc;AACjB,YAAM,kBACJ,aAAa,wBAAwB;AACvC,aAAO,kBAAkB,IAAI,KAAK,eAAe,IAAI,oBAAI,KAAK;AAAA,IAChE;AAAA,IACA;AACE,aAAO,WAAW,oBAAI,KAAK;AAAA,EAC/B;AACF;",
+  "names": []
+}

package/dist/utils/orgStartDate.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/orgs/OrgHelper.spec.d.ts

@@ -0,0 +1 @@
+export {};