@camunda/ccma-shared-types 1.0.0 → 1.2.0

package/dist/utils/versionCheck.utils.d.ts

@@ -1,3 +1,21 @@
+/**
+ * stripSecfixPostfix removes the `-secfix` postfix of a version.
+ *
+ * A security patch tags the images of a generation with the postfix
+ * (`8.8.19-secfix`). Semver reads the postfix as a prerelease, which sorts
+ * under the release it patches. A `>= 8.8.19` gate thus refuses a patched
+ * build of 8.8.19 itself. The postfix holds no version information, so it
+ * comes off before every comparison.
+ *
+ * Only the postfix comes off, not the whole prerelease. A patched alpha
+ * (`8.10.0-alpha5-secfix`) stays an alpha, which the 8.10 floors and
+ * `isGenerationResumable` both depend on.
+ *
+ * A surface that shows a version reads this helper too, because the postfix is
+ * an internal build detail. One helper keeps the version a customer sees and
+ * the version a gate compares on the same rule.
+ */
+export declare const stripSecfixPostfix: (version: string) => string;
 export declare enum VersionCheckOperator {
     LessThan = 0,
     LessThanOrEqual = 1,
@@ -13,6 +31,31 @@ export declare const checkVersion: (params: {
     versionToCompareTo: string;
     trueOnInvalidVersion?: boolean;
 }) => boolean;
+/**
+ * Can a suspended cluster on this generation resume? An alpha generation under
+ * `RESUME_ALPHA_MIN_VERSION` answers false. Every other generation answers
+ * true.
+ *
+ * The floor applies to alphas only, because they have no upgrade chain.
+ * `RESUME_ALPHA_MIN_VERSION` gives the full reason. A release generation under
+ * the floor, 8.9 for example, keeps its resume action.
+ *
+ * An alpha carries a prerelease tag that starts with `alpha`. The test reads
+ * that tag, not the presence of a prerelease. A security patch tags a release
+ * generation `8.9.0-secfix`, which semver also reads as a prerelease. That
+ * generation is a release and keeps its upgrade chain, so it stays resumable.
+ *
+ * The c4 resume actions and the console-backend wake-up guards share this
+ * function. The frontend keeps the action and disables it, the backend refuses
+ * the request, and both must agree on the cohort. Two copies of one floor is
+ * #9703.
+ *
+ * The answer is true for a version this function cannot read as an alpha:
+ * - A `SNAPSHOT` tag is built from main, so it is never one of the old alphas.
+ * - An empty or invalid version tells us nothing. A guess of false locks a
+ *   customer out of a cluster that is good, so the safe answer is true.
+ */
+export declare const isGenerationResumable: (zeebeVersion?: string) => boolean;
 /**
  * Version gate for the App Integrations exporter toggle (#8536). Shared by the
  * c4 settings tile and the console-backend update guard so both stay in

package/dist/utils/versionCheck.utils.js

@@ -4,12 +4,28 @@ import {
   APP_INTEGRATIONS_89_STREAM_MINOR,
   APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,
   APP_INTEGRATIONS_MIN_VERSION,
+  RESUME_ALPHA_MIN_VERSION,
   SECRETS_FILTER_MODE_8_6_MIN_VERSION,
   SECRETS_FILTER_MODE_8_7_MIN_VERSION,
   SECRETS_FILTER_MODE_8_8_MIN_VERSION,
   SECRETS_FILTER_MODE_8_9_MIN_VERSION,
   SECRETS_FILTER_MODE_8_10_MIN_VERSION
 } from "../constants/version-gates.const.js";
+const stripSecfixPostfix = (version) => {
+  const postfixStart = version.toLowerCase().indexOf("-secfix");
+  return postfixStart === -1 ? version : version.slice(0, postfixStart);
+};
+const extractVersion = (possiblyVersionOrDockerPath) => {
+  const raw = possiblyVersionOrDockerPath ?? "";
+  if (semver.valid(raw)) {
+    return stripSecfixPostfix(raw);
+  }
+  const versionSplit = raw.split(":");
+  if (versionSplit.length > 1) {
+    return stripSecfixPostfix(versionSplit[1]);
+  }
+  return raw;
+};
 var VersionCheckOperator = /* @__PURE__ */ ((VersionCheckOperator2) => {
   VersionCheckOperator2[VersionCheckOperator2["LessThan"] = 0] = "LessThan";
   VersionCheckOperator2[VersionCheckOperator2["LessThanOrEqual"] = 1] = "LessThanOrEqual";
@@ -38,17 +54,7 @@ const checkVersion = (params) => {
   if (!semver.valid(versionToCompareTo)) {
     throw new Error("Invalid version to compare to");
   }
-  let version = "";
-  if (semver.valid(params.possiblyVersionOrDockerPath ?? "")) {
-    version = params.possiblyVersionOrDockerPath ?? "";
-  } else {
-    const versionSplit = params.possiblyVersionOrDockerPath?.split(":") ?? [];
-    if (versionSplit.length > 1) {
-      version = versionSplit[1];
-    } else {
-      version = params.possiblyVersionOrDockerPath ?? "";
-    }
-  }
+  let version = extractVersion(params.possiblyVersionOrDockerPath);
   if (params.trueForSnapshot && version.includes("SNAPSHOT")) {
     if (version === "SNAPSHOT") {
       if (params.trueForSnapshot !== "compare") {
@@ -99,6 +105,21 @@ const checkVersion = (params) => {
       return false;
   }
 };
+const isGenerationResumable = (zeebeVersion) => {
+  const version = extractVersion(zeebeVersion);
+  const isAlpha = (semver.prerelease(version) ?? []).some(
+    (part) => typeof part === "string" && part.toLowerCase().startsWith("alpha")
+  );
+  if (!semver.valid(version) || !isAlpha) {
+    return true;
+  }
+  return checkVersion({
+    possiblyVersionOrDockerPath: zeebeVersion,
+    trueForSnapshot: true,
+    operator: 3 /* GreaterThanOrEqual */,
+    versionToCompareTo: RESUME_ALPHA_MIN_VERSION
+  });
+};
 const isAppIntegrationsVersionSupported = (versions) => {
   if (!versions.zeebe) {
     return false;
@@ -166,6 +187,8 @@ export {
   VersionCheckOperator,
   checkVersion,
   isAppIntegrationsVersionSupported,
-  isSecretsFilterModeConfigurable
+  isGenerationResumable,
+  isSecretsFilterModeConfigurable,
+  stripSecfixPostfix
 };
 //# sourceMappingURL=versionCheck.utils.js.map

package/dist/utils/versionCheck.utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/utils/versionCheck.utils.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport * as semver from 'semver'\nimport {\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n} from '../constants/version-gates.const.js'\n\n// eslint-disable-next-line no-shadow\nexport enum VersionCheckOperator {\n  LessThan,\n  LessThanOrEqual,\n  GreaterThan,\n  GreaterThanOrEqual,\n  SameMajor,\n  SameMinor,\n}\n\nexport const checkVersion = (params: {\n  possiblyVersionOrDockerPath?: string\n  trueForSnapshot: boolean | 'compare'\n  operator: VersionCheckOperator\n  versionToCompareTo: string\n  trueOnInvalidVersion?: boolean\n}) => {\n  // quick exit: if the versionToCompareTo is\n  //   - `SNAPSHOT` there is not a lot we can compare here to, so we return false directly\n  //   - ends with `-SNAPSHOT` we ignore the `-SNAPSHOT` part for the comparison, guess a good matching semver compliant version and try to move on with the generated one in the code\n  if (params.versionToCompareTo === 'SNAPSHOT') {\n    return false\n  }\n  let versionToCompareTo = params.versionToCompareTo\n  if (versionToCompareTo.endsWith('-SNAPSHOT')) {\n    versionToCompareTo = versionToCompareTo.replace('-SNAPSHOT', '')\n    const parts = versionToCompareTo.split('.')\n    if (parts.length === 1) {\n      versionToCompareTo = `${parts[0]}.0.0`\n    } else if (parts.length === 2) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.0`\n    } else if (parts.length === 3) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.${parts[2]}`\n    }\n  }\n  if (!semver.valid(versionToCompareTo)) {\n    throw new Error('Invalid version to compare to')\n  }\n  let version: string = ''\n  if (semver.valid(params.possiblyVersionOrDockerPath ?? '')) {\n    version = params.possiblyVersionOrDockerPath ?? ''\n  } else {\n    const versionSplit = params.possiblyVersionOrDockerPath?.split(':') ?? []\n    if (versionSplit.length > 1) {\n      version = versionSplit[1]\n    } else {\n      // bare version string not valid semver (e.g. '8.10-SNAPSHOT') \u2014 use as-is so SNAPSHOT expansion can handle it\n      version = params.possiblyVersionOrDockerPath ?? ''\n    }\n  }\n  if (params.trueForSnapshot && version.includes('SNAPSHOT')) {\n    if (version === 'SNAPSHOT') {\n      // bare SNAPSHOT: `true` short-circuits here; `'compare'` falls through to invalid-version handling\n      if (params.trueForSnapshot !== 'compare') {\n        return true\n      }\n    } else {\n      version = version.replace('-SNAPSHOT', '')\n      if (version.split('.').length === 1) {\n        version = `${version}.99.99`\n      }\n      if (version.split('.').length === 2) {\n        version = `${version}.99`\n      }\n      if (version.split('.').length === 3) {\n        version = `${version.split('.')[0]}.${version.split('.')[1]}.99`\n      }\n    }\n  }\n\n  let parsedVersionToCompareTo: string = ''\n  if (semver.valid(versionToCompareTo ?? '')) {\n    parsedVersionToCompareTo = versionToCompareTo ?? ''\n  } else {\n    const versionSplit = versionToCompareTo?.split(':') ?? []\n    if (versionSplit.length > 1) {\n      parsedVersionToCompareTo = versionSplit[1]\n    }\n  }\n  if (params.trueForSnapshot && parsedVersionToCompareTo === 'SNAPSHOT') {\n    return true\n  }\n\n  if (!semver.valid(version)) {\n    return !!params.trueOnInvalidVersion\n  }\n\n  switch (params.operator) {\n    case VersionCheckOperator.LessThan:\n      return semver.lt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.LessThanOrEqual:\n      return semver.lte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThan:\n      return semver.gt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThanOrEqual:\n      return semver.gte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMajor:\n      return semver.major(version) === semver.major(parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMinor:\n      return (\n        semver.major(version) === semver.major(parsedVersionToCompareTo) &&\n        semver.minor(version) === semver.minor(parsedVersionToCompareTo)\n      )\n    default:\n      return false\n  }\n}\n\n/**\n * Version gate for the App Integrations exporter toggle (#8536). Shared by the\n * c4 settings tile and the console-backend update guard so both stay in\n * lockstep \u2014 the fix landed as patches on the 8.9 stream (zeebe >=8.9.14 AND\n * connectorBridge >=8.9.7), everything from 8.10.0-alpha4 on already carries\n * both fixes. A plain zeebe >=8.9.14 check would wrongly match\n * 8.10.0-alpha1/2/3, which predate the fix.\n */\nexport const isAppIntegrationsVersionSupported = (versions: {\n  zeebe?: string\n  connectorBridge?: string\n}): boolean => {\n  if (!versions.zeebe) {\n    return false\n  }\n  const isIn89Stream = checkVersion({\n    possiblyVersionOrDockerPath: versions.zeebe,\n    trueForSnapshot: 'compare',\n    operator: VersionCheckOperator.SameMinor,\n    versionToCompareTo: APP_INTEGRATIONS_89_STREAM_MINOR,\n  })\n  if (!isIn89Stream) {\n    return checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_MIN_VERSION,\n    })\n  }\n  return (\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n    }) &&\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.connectorBridge,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo:\n        APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n    })\n  )\n}\n\n/**\n * Version gate for the secrets filter mode setting on Connectors\n * (`CAMUNDA_CONNECTOR_SECRETRESOLVER_SECRETFILTER_MODE`). Each 8.x line got the\n * fix on a different patch, so a single floor across all lines is wrong: it\n * would open the setting on an early patch of a newer line, or close it on a\n * late patch of an older line. This picks the zeebe minor line first, then\n * applies that line's own floor.\n *\n * On the 8.6 to 8.9 lines, each floor is the patch where the shipped default\n * became STRICT. Below its floor a line either has no setting at all, or has it\n * with the DISABLED default, so the toggle stays hidden and never shows a mode\n * the cluster does not use.\n *\n * Above the 8.9 line, one floor covers everything: 8.10.0-alpha6 and all later\n * versions, 8.11 included. That floor has a second reason, which\n * SECRETS_FILTER_MODE_8_10_MIN_VERSION gives: on 8.10.0-alpha5 a mode other\n * than STRICT crashes the Connectors runtime at startup.\n *\n * Shared by the c4 settings tile and the console-backend update guard so\n * both stay in lockstep.\n */\nexport const isSecretsFilterModeConfigurable = (\n  zeebeVersion: string | undefined,\n): boolean => {\n  if (!zeebeVersion) {\n    return false\n  }\n  const lineFloors = [\n    SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  ]\n  for (const floor of lineFloors) {\n    const isOnThisLine = checkVersion({\n      possiblyVersionOrDockerPath: zeebeVersion,\n      trueForSnapshot: 'compare',\n      operator: VersionCheckOperator.SameMinor,\n      versionToCompareTo: floor,\n    })\n    if (isOnThisLine) {\n      return checkVersion({\n        possiblyVersionOrDockerPath: zeebeVersion,\n        trueForSnapshot: true,\n        operator: VersionCheckOperator.GreaterThanOrEqual,\n        versionToCompareTo: floor,\n      })\n    }\n  }\n  // Not on the 8.6-8.9 lines: either older than 8.6, which never had the\n  // setting, or 8.10 and above, which all share the 8.10 floor.\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  })\n}\n"],
-  "mappings": "AAMA,YAAY,YAAY;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGA,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AANU,SAAAA;AAAA,GAAA;AASL,MAAM,eAAe,CAAC,WAMvB;AAIJ,MAAI,OAAO,uBAAuB,YAAY;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,OAAO;AAChC,MAAI,mBAAmB,SAAS,WAAW,GAAG;AAC5C,yBAAqB,mBAAmB,QAAQ,aAAa,EAAE;AAC/D,UAAM,QAAQ,mBAAmB,MAAM,GAAG;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,2BAAqB,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC9C,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,MAAI,CAAC,OAAO,MAAM,kBAAkB,GAAG;AACrC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,UAAkB;AACtB,MAAI,OAAO,MAAM,OAAO,+BAA+B,EAAE,GAAG;AAC1D,cAAU,OAAO,+BAA+B;AAAA,EAClD,OAAO;AACL,UAAM,eAAe,OAAO,6BAA6B,MAAM,GAAG,KAAK,CAAC;AACxE,QAAI,aAAa,SAAS,GAAG;AAC3B,gBAAU,aAAa,CAAC;AAAA,IAC1B,OAAO;AAEL,gBAAU,OAAO,+BAA+B;AAAA,IAClD;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,QAAQ,SAAS,UAAU,GAAG;AAC1D,QAAI,YAAY,YAAY;AAE1B,UAAI,OAAO,oBAAoB,WAAW;AACxC,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,QAAQ,aAAa,EAAE;AACzC,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,2BAAmC;AACvC,MAAI,OAAO,MAAM,sBAAsB,EAAE,GAAG;AAC1C,+BAA2B,sBAAsB;AAAA,EACnD,OAAO;AACL,UAAM,eAAe,oBAAoB,MAAM,GAAG,KAAK,CAAC;AACxD,QAAI,aAAa,SAAS,GAAG;AAC3B,iCAA2B,aAAa,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,6BAA6B,YAAY;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,MAAM,OAAO,GAAG;AAC1B,WAAO,CAAC,CAAC,OAAO;AAAA,EAClB;AAEA,UAAQ,OAAO,UAAU;AAAA,IACvB,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IACxE,KAAK;AACH,aACE,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB,KAC/D,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IAEnE;AACE,aAAO;AAAA,EACX;AACF;AAUO,MAAM,oCAAoC,CAAC,aAGnC;AACb,MAAI,CAAC,SAAS,OAAO;AACnB,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa;AAAA,IAChC,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa;AAAA,MAClB,6BAA6B,SAAS;AAAA,MACtC,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SACE,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC,KACD,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBACE;AAAA,EACJ,CAAC;AAEL;AAuBO,MAAM,kCAAkC,CAC7C,iBACY;AACZ,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,YAAY;AAC9B,UAAM,eAAe,aAAa;AAAA,MAChC,6BAA6B;AAAA,MAC7B,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa;AAAA,QAClB,6BAA6B;AAAA,QAC7B,iBAAiB;AAAA,QACjB,UAAU;AAAA,QACV,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport * as semver from 'semver'\nimport {\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n} from '../constants/version-gates.const.js'\n\n/**\n * stripSecfixPostfix removes the `-secfix` postfix of a version.\n *\n * A security patch tags the images of a generation with the postfix\n * (`8.8.19-secfix`). Semver reads the postfix as a prerelease, which sorts\n * under the release it patches. A `>= 8.8.19` gate thus refuses a patched\n * build of 8.8.19 itself. The postfix holds no version information, so it\n * comes off before every comparison.\n *\n * Only the postfix comes off, not the whole prerelease. A patched alpha\n * (`8.10.0-alpha5-secfix`) stays an alpha, which the 8.10 floors and\n * `isGenerationResumable` both depend on.\n *\n * A surface that shows a version reads this helper too, because the postfix is\n * an internal build detail. One helper keeps the version a customer sees and\n * the version a gate compares on the same rule.\n */\nexport const stripSecfixPostfix = (version: string): string => {\n  // A search for the marker, and not a regular expression. `-secfix.*$` over\n  // the input of an exported function is a polynomial backtracking pattern,\n  // which code scanning rejects (CodeQL js/polynomial-redos).\n  const postfixStart = version.toLowerCase().indexOf('-secfix')\n  return postfixStart === -1 ? version : version.slice(0, postfixStart)\n}\n\n/**\n * Takes the version out of a generation version field. The field holds either a\n * bare version (`8.10.0-alpha4`) or a docker path\n * (`camunda/zeebe:8.10.0-alpha4`). A value that is neither comes back\n * unchanged, so the caller can still expand a `SNAPSHOT` tag.\n *\n * The postfix comes off after the tag, never before it. A repository path can\n * hold a `-` of its own, and a strip over the whole string would cut the path.\n */\nconst extractVersion = (possiblyVersionOrDockerPath?: string): string => {\n  const raw = possiblyVersionOrDockerPath ?? ''\n  if (semver.valid(raw)) {\n    return stripSecfixPostfix(raw)\n  }\n  const versionSplit = raw.split(':')\n  if (versionSplit.length > 1) {\n    return stripSecfixPostfix(versionSplit[1])\n  }\n  // bare version string not valid semver (e.g. '8.10-SNAPSHOT') \u2014 use as-is so SNAPSHOT expansion can handle it\n  return raw\n}\n\n// eslint-disable-next-line no-shadow\nexport enum VersionCheckOperator {\n  LessThan,\n  LessThanOrEqual,\n  GreaterThan,\n  GreaterThanOrEqual,\n  SameMajor,\n  SameMinor,\n}\n\nexport const checkVersion = (params: {\n  possiblyVersionOrDockerPath?: string\n  trueForSnapshot: boolean | 'compare'\n  operator: VersionCheckOperator\n  versionToCompareTo: string\n  trueOnInvalidVersion?: boolean\n}) => {\n  // quick exit: if the versionToCompareTo is\n  //   - `SNAPSHOT` there is not a lot we can compare here to, so we return false directly\n  //   - ends with `-SNAPSHOT` we ignore the `-SNAPSHOT` part for the comparison, guess a good matching semver compliant version and try to move on with the generated one in the code\n  if (params.versionToCompareTo === 'SNAPSHOT') {\n    return false\n  }\n  let versionToCompareTo = params.versionToCompareTo\n  if (versionToCompareTo.endsWith('-SNAPSHOT')) {\n    versionToCompareTo = versionToCompareTo.replace('-SNAPSHOT', '')\n    const parts = versionToCompareTo.split('.')\n    if (parts.length === 1) {\n      versionToCompareTo = `${parts[0]}.0.0`\n    } else if (parts.length === 2) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.0`\n    } else if (parts.length === 3) {\n      versionToCompareTo = `${parts[0]}.${parts[1]}.${parts[2]}`\n    }\n  }\n  if (!semver.valid(versionToCompareTo)) {\n    throw new Error('Invalid version to compare to')\n  }\n  let version: string = extractVersion(params.possiblyVersionOrDockerPath)\n  if (params.trueForSnapshot && version.includes('SNAPSHOT')) {\n    if (version === 'SNAPSHOT') {\n      // bare SNAPSHOT: `true` short-circuits here; `'compare'` falls through to invalid-version handling\n      if (params.trueForSnapshot !== 'compare') {\n        return true\n      }\n    } else {\n      version = version.replace('-SNAPSHOT', '')\n      if (version.split('.').length === 1) {\n        version = `${version}.99.99`\n      }\n      if (version.split('.').length === 2) {\n        version = `${version}.99`\n      }\n      if (version.split('.').length === 3) {\n        version = `${version.split('.')[0]}.${version.split('.')[1]}.99`\n      }\n    }\n  }\n\n  let parsedVersionToCompareTo: string = ''\n  if (semver.valid(versionToCompareTo ?? '')) {\n    parsedVersionToCompareTo = versionToCompareTo ?? ''\n  } else {\n    const versionSplit = versionToCompareTo?.split(':') ?? []\n    if (versionSplit.length > 1) {\n      parsedVersionToCompareTo = versionSplit[1]\n    }\n  }\n  if (params.trueForSnapshot && parsedVersionToCompareTo === 'SNAPSHOT') {\n    return true\n  }\n\n  if (!semver.valid(version)) {\n    return !!params.trueOnInvalidVersion\n  }\n\n  switch (params.operator) {\n    case VersionCheckOperator.LessThan:\n      return semver.lt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.LessThanOrEqual:\n      return semver.lte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThan:\n      return semver.gt(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.GreaterThanOrEqual:\n      return semver.gte(version, parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMajor:\n      return semver.major(version) === semver.major(parsedVersionToCompareTo)\n    case VersionCheckOperator.SameMinor:\n      return (\n        semver.major(version) === semver.major(parsedVersionToCompareTo) &&\n        semver.minor(version) === semver.minor(parsedVersionToCompareTo)\n      )\n    default:\n      return false\n  }\n}\n\n/**\n * Can a suspended cluster on this generation resume? An alpha generation under\n * `RESUME_ALPHA_MIN_VERSION` answers false. Every other generation answers\n * true.\n *\n * The floor applies to alphas only, because they have no upgrade chain.\n * `RESUME_ALPHA_MIN_VERSION` gives the full reason. A release generation under\n * the floor, 8.9 for example, keeps its resume action.\n *\n * An alpha carries a prerelease tag that starts with `alpha`. The test reads\n * that tag, not the presence of a prerelease. A security patch tags a release\n * generation `8.9.0-secfix`, which semver also reads as a prerelease. That\n * generation is a release and keeps its upgrade chain, so it stays resumable.\n *\n * The c4 resume actions and the console-backend wake-up guards share this\n * function. The frontend keeps the action and disables it, the backend refuses\n * the request, and both must agree on the cohort. Two copies of one floor is\n * #9703.\n *\n * The answer is true for a version this function cannot read as an alpha:\n * - A `SNAPSHOT` tag is built from main, so it is never one of the old alphas.\n * - An empty or invalid version tells us nothing. A guess of false locks a\n *   customer out of a cluster that is good, so the safe answer is true.\n */\nexport const isGenerationResumable = (zeebeVersion?: string): boolean => {\n  const version = extractVersion(zeebeVersion)\n  const isAlpha = (semver.prerelease(version) ?? []).some(\n    (part) =>\n      typeof part === 'string' && part.toLowerCase().startsWith('alpha'),\n  )\n  if (!semver.valid(version) || !isAlpha) {\n    return true\n  }\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: RESUME_ALPHA_MIN_VERSION,\n  })\n}\n\n/**\n * Version gate for the App Integrations exporter toggle (#8536). Shared by the\n * c4 settings tile and the console-backend update guard so both stay in\n * lockstep \u2014 the fix landed as patches on the 8.9 stream (zeebe >=8.9.14 AND\n * connectorBridge >=8.9.7), everything from 8.10.0-alpha4 on already carries\n * both fixes. A plain zeebe >=8.9.14 check would wrongly match\n * 8.10.0-alpha1/2/3, which predate the fix.\n */\nexport const isAppIntegrationsVersionSupported = (versions: {\n  zeebe?: string\n  connectorBridge?: string\n}): boolean => {\n  if (!versions.zeebe) {\n    return false\n  }\n  const isIn89Stream = checkVersion({\n    possiblyVersionOrDockerPath: versions.zeebe,\n    trueForSnapshot: 'compare',\n    operator: VersionCheckOperator.SameMinor,\n    versionToCompareTo: APP_INTEGRATIONS_89_STREAM_MINOR,\n  })\n  if (!isIn89Stream) {\n    return checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_MIN_VERSION,\n    })\n  }\n  return (\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.zeebe,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo: APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n    }) &&\n    checkVersion({\n      possiblyVersionOrDockerPath: versions.connectorBridge,\n      trueForSnapshot: true,\n      operator: VersionCheckOperator.GreaterThanOrEqual,\n      versionToCompareTo:\n        APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n    })\n  )\n}\n\n/**\n * Version gate for the secrets filter mode setting on Connectors\n * (`CAMUNDA_CONNECTOR_SECRETRESOLVER_SECRETFILTER_MODE`). Each 8.x line got the\n * fix on a different patch, so a single floor across all lines is wrong: it\n * would open the setting on an early patch of a newer line, or close it on a\n * late patch of an older line. This picks the zeebe minor line first, then\n * applies that line's own floor.\n *\n * On the 8.6 to 8.9 lines, each floor is the patch where the shipped default\n * became STRICT. Below its floor a line either has no setting at all, or has it\n * with the DISABLED default, so the toggle stays hidden and never shows a mode\n * the cluster does not use.\n *\n * Above the 8.9 line, one floor covers everything: 8.10.0-alpha6 and all later\n * versions, 8.11 included. That floor has a second reason, which\n * SECRETS_FILTER_MODE_8_10_MIN_VERSION gives: on 8.10.0-alpha5 a mode other\n * than STRICT crashes the Connectors runtime at startup.\n *\n * Shared by the c4 settings tile and the console-backend update guard so\n * both stay in lockstep.\n */\nexport const isSecretsFilterModeConfigurable = (\n  zeebeVersion: string | undefined,\n): boolean => {\n  if (!zeebeVersion) {\n    return false\n  }\n  const lineFloors = [\n    SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n    SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  ]\n  for (const floor of lineFloors) {\n    const isOnThisLine = checkVersion({\n      possiblyVersionOrDockerPath: zeebeVersion,\n      trueForSnapshot: 'compare',\n      operator: VersionCheckOperator.SameMinor,\n      versionToCompareTo: floor,\n    })\n    if (isOnThisLine) {\n      return checkVersion({\n        possiblyVersionOrDockerPath: zeebeVersion,\n        trueForSnapshot: true,\n        operator: VersionCheckOperator.GreaterThanOrEqual,\n        versionToCompareTo: floor,\n      })\n    }\n  }\n  // Not on the 8.6-8.9 lines: either older than 8.6, which never had the\n  // setting, or 8.10 and above, which all share the 8.10 floor.\n  return checkVersion({\n    possiblyVersionOrDockerPath: zeebeVersion,\n    trueForSnapshot: true,\n    operator: VersionCheckOperator.GreaterThanOrEqual,\n    versionToCompareTo: SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  })\n}\n"],
+  "mappings": "AAMA,YAAY,YAAY;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBA,MAAM,qBAAqB,CAAC,YAA4B;AAI7D,QAAM,eAAe,QAAQ,YAAY,EAAE,QAAQ,SAAS;AAC5D,SAAO,iBAAiB,KAAK,UAAU,QAAQ,MAAM,GAAG,YAAY;AACtE;AAWA,MAAM,iBAAiB,CAAC,gCAAiD;AACvE,QAAM,MAAM,+BAA+B;AAC3C,MAAI,OAAO,MAAM,GAAG,GAAG;AACrB,WAAO,mBAAmB,GAAG;AAAA,EAC/B;AACA,QAAM,eAAe,IAAI,MAAM,GAAG;AAClC,MAAI,aAAa,SAAS,GAAG;AAC3B,WAAO,mBAAmB,aAAa,CAAC,CAAC;AAAA,EAC3C;AAEA,SAAO;AACT;AAGO,IAAK,uBAAL,kBAAKA,0BAAL;AACL,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AACA,EAAAA,4CAAA;AANU,SAAAA;AAAA,GAAA;AASL,MAAM,eAAe,CAAC,WAMvB;AAIJ,MAAI,OAAO,uBAAuB,YAAY;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,qBAAqB,OAAO;AAChC,MAAI,mBAAmB,SAAS,WAAW,GAAG;AAC5C,yBAAqB,mBAAmB,QAAQ,aAAa,EAAE;AAC/D,UAAM,QAAQ,mBAAmB,MAAM,GAAG;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,2BAAqB,GAAG,MAAM,CAAC,CAAC;AAAA,IAClC,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC9C,WAAW,MAAM,WAAW,GAAG;AAC7B,2BAAqB,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,MAAI,CAAC,OAAO,MAAM,kBAAkB,GAAG;AACrC,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,UAAkB,eAAe,OAAO,2BAA2B;AACvE,MAAI,OAAO,mBAAmB,QAAQ,SAAS,UAAU,GAAG;AAC1D,QAAI,YAAY,YAAY;AAE1B,UAAI,OAAO,oBAAoB,WAAW;AACxC,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,QAAQ,aAAa,EAAE;AACzC,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,OAAO;AAAA,MACtB;AACA,UAAI,QAAQ,MAAM,GAAG,EAAE,WAAW,GAAG;AACnC,kBAAU,GAAG,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,MAAI,2BAAmC;AACvC,MAAI,OAAO,MAAM,sBAAsB,EAAE,GAAG;AAC1C,+BAA2B,sBAAsB;AAAA,EACnD,OAAO;AACL,UAAM,eAAe,oBAAoB,MAAM,GAAG,KAAK,CAAC;AACxD,QAAI,aAAa,SAAS,GAAG;AAC3B,iCAA2B,aAAa,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,6BAA6B,YAAY;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,OAAO,MAAM,OAAO,GAAG;AAC1B,WAAO,CAAC,CAAC,OAAO;AAAA,EAClB;AAEA,UAAQ,OAAO,UAAU;AAAA,IACvB,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,GAAG,SAAS,wBAAwB;AAAA,IACpD,KAAK;AACH,aAAO,OAAO,IAAI,SAAS,wBAAwB;AAAA,IACrD,KAAK;AACH,aAAO,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IACxE,KAAK;AACH,aACE,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB,KAC/D,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,wBAAwB;AAAA,IAEnE;AACE,aAAO;AAAA,EACX;AACF;AA0BO,MAAM,wBAAwB,CAAC,iBAAmC;AACvE,QAAM,UAAU,eAAe,YAAY;AAC3C,QAAM,WAAW,OAAO,WAAW,OAAO,KAAK,CAAC,GAAG;AAAA,IACjD,CAAC,SACC,OAAO,SAAS,YAAY,KAAK,YAAY,EAAE,WAAW,OAAO;AAAA,EACrE;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,SAAS;AACtC,WAAO;AAAA,EACT;AACA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;AAUO,MAAM,oCAAoC,CAAC,aAGnC;AACb,MAAI,CAAC,SAAS,OAAO;AACnB,WAAO;AAAA,EACT;AACA,QAAM,eAAe,aAAa;AAAA,IAChC,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa;AAAA,MAClB,6BAA6B,SAAS;AAAA,MACtC,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SACE,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC,KACD,aAAa;AAAA,IACX,6BAA6B,SAAS;AAAA,IACtC,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBACE;AAAA,EACJ,CAAC;AAEL;AAuBO,MAAM,kCAAkC,CAC7C,iBACY;AACZ,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,EACT;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,YAAY;AAC9B,UAAM,eAAe,aAAa;AAAA,MAChC,6BAA6B;AAAA,MAC7B,iBAAiB;AAAA,MACjB,UAAU;AAAA,MACV,oBAAoB;AAAA,IACtB,CAAC;AACD,QAAI,cAAc;AAChB,aAAO,aAAa;AAAA,QAClB,6BAA6B;AAAA,QAC7B,iBAAiB;AAAA,QACjB,UAAU;AAAA,QACV,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,aAAa;AAAA,IAClB,6BAA6B;AAAA,IAC7B,iBAAiB;AAAA,IACjB,UAAU;AAAA,IACV,oBAAoB;AAAA,EACtB,CAAC;AACH;",
   "names": ["VersionCheckOperator"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"