@camunda/ccma-shared-types 1.1.0 → 1.2.0

package/dist/_tests/approvals/policy.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/approvals/policy.d.ts

@@ -0,0 +1,109 @@
+import type { ApprovalJobDto, ApprovalUseCaseDto } from '../dtos/ApprovalJob.dto.js';
+/**
+ * The rules of the approval mechanism, as pure functions.
+ *
+ * Three consumers run this file: control-backend decides whether to reject a
+ * request, control-frontend decides whether to disable a button, and cloudbot
+ * decides whether to answer. One copy means the button and the endpoint can
+ * never disagree.
+ *
+ * Two choices in the signatures carry the design:
+ *
+ * - The actor is an interface with a `has` method. The backend holds an array
+ *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of
+ *   booleans. Neither side has to convert to the shape of the other.
+ * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can
+ *   be expired already. A parameter makes a difference between the two clocks
+ *   an input that a test can set, and not a silent disagreement.
+ *
+ * No function here does I/O or returns a promise. The browser call site is what
+ * enforces that, and it also stops a later use case from turning a list of 50
+ * rows into 200 network calls.
+ */
+/** Who is asking. See the note above on why this is an interface. */
+export interface ApprovalActorView {
+    userId: string;
+    /**
+     * The email of the actor. It is the SECOND identity of the four-eyes rule.
+     *
+     * `userId` alone is not enough. One person can hold more than one identity in
+     * Auth0 — a connection through SSO and a connection through a database, or an
+     * account that was made again — and each one carries a different `sub`. The
+     * same human then opens a request with one identity and approves it with the
+     * other, which is the rule defeated.
+     *
+     * It is optional because a token can carry no email. See
+     * `isSameActorEmail` for what that means for the comparison.
+     */
+    email?: string;
+    has(permission: string): boolean;
+}
+/**
+ * Reports whether two email addresses name one person.
+ *
+ * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one
+ * person. A token with no email would otherwise make every actor equal to
+ * every other actor, and the rule would refuse everybody.
+ *
+ * The comparison removes the spaces and the case. Auth0 gives the address as
+ * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`
+ * are one mailbox and must not pass as two people.
+ */
+export declare function isSameActorEmail(one?: string, other?: string): boolean;
+/**
+ * Why an action is not allowed.
+ *
+ * The code is for a program: control-backend maps it to a status, and the
+ * frontend can branch on it. The message is for a person, and it is shown as
+ * written.
+ */
+export type ApprovalDenialCode = 'forbidden' | 'not-pending' | 'self-approval' | 'already-acknowledged' | 'expired' | 'not-creator' | 'not-executable' | 'no-reason';
+export type ApprovalDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    code: ApprovalDenialCode;
+    message: string;
+};
+/**
+ * Reports whether the time to answer a request has passed.
+ *
+ * Only a `pending` request expires. A request that already reached an end state
+ * keeps that state, because "expired" would lose the answer that was given.
+ */
+export declare function isExpired(job: ApprovalJobDto, now: Date): boolean;
+/** Reports the status to show, which is `expired` once the time has passed. */
+export declare function effectiveStatus(job: ApprovalJobDto, now: Date): ApprovalJobDto['status'];
+/** Reports how many more acknowledgements the request needs. */
+export declare function remainingAcks(job: ApprovalJobDto): number;
+export declare function canCreate(actor: ApprovalActorView, useCase: ApprovalUseCaseDto): ApprovalDecision;
+/**
+ * The four-eyes rule.
+ *
+ * The bans are in the order a person meets them, and each one has its own
+ * message: "you already approved this" and "you cannot approve your own
+ * request" are different mistakes, and one message for both helps nobody.
+ *
+ * Each of the two bans on a person reads BOTH identities: the `sub` of the
+ * token, and the email. See `ApprovalActorView.email` for why one of them is
+ * not enough.
+ */
+export declare function canAcknowledge(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto, now: Date): ApprovalDecision;
+/**
+ * A rejection needs the same permission as an acknowledgement, and a reason.
+ *
+ * The creator MAY reject their own request. That is a withdrawal with a reason,
+ * and stopping it would only push the person to the withdraw button, where the
+ * reason is lost.
+ */
+export declare function canReject(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto, now: Date, reason: string): ApprovalDecision;
+/** Only the person who opened a request can take it back. */
+export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorView, now: Date): ApprovalDecision;
+/**
+ * Runs a request that has its approvals.
+ *
+ * This is the button of the explicit mode. `failed` is executable again,
+ * because a failure is often a problem of the system that is now repaired, and
+ * asking for the approvals a second time helps nobody.
+ */
+export declare function canExecute(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto): ApprovalDecision;

package/dist/approvals/policy.js

@@ -0,0 +1,123 @@
+import { UNKNOWN_ACTOR_EMAIL } from "../constants/misc.const.js";
+function isSameActorEmail(one, other) {
+  const normalize = (value) => {
+    const trimmed = value?.trim().toLowerCase() ?? "";
+    return trimmed === UNKNOWN_ACTOR_EMAIL ? "" : trimmed;
+  };
+  const left = normalize(one);
+  return left.length > 0 && left === normalize(other);
+}
+const ALLOWED = { allowed: true };
+function deny(code, message) {
+  return { allowed: false, code, message };
+}
+function isExpired(job, now) {
+  return job.status === "pending" && new Date(job.expiresAt).getTime() <= now.getTime();
+}
+function effectiveStatus(job, now) {
+  return isExpired(job, now) ? "expired" : job.status;
+}
+function remainingAcks(job) {
+  return Math.max(0, job.requiredAcks - job.acks.length);
+}
+function canCreate(actor, useCase) {
+  if (useCase.createPermission && !actor.has(useCase.createPermission)) {
+    return deny("forbidden", "You cannot open this request.");
+  }
+  return ALLOWED;
+}
+function canAcknowledge(job, actor, useCase, now) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot approve this request.");
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be approved."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be approved.`
+    );
+  }
+  if (job.createdBy.userId === actor.userId || isSameActorEmail(job.createdBy.email, actor.email)) {
+    return deny(
+      "self-approval",
+      "You opened this request, so you cannot approve it."
+    );
+  }
+  if (job.acks.some(
+    (ack) => ack.userId === actor.userId || isSameActorEmail(ack.email, actor.email)
+  )) {
+    return deny("already-acknowledged", "You already approved this request.");
+  }
+  return ALLOWED;
+}
+function canReject(job, actor, useCase, now, reason) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot reject this request.");
+  }
+  if (reason.trim().length === 0) {
+    return deny("no-reason", "Give a reason to reject this request.");
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be rejected."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be rejected.`
+    );
+  }
+  return ALLOWED;
+}
+function canWithdraw(job, actor, now) {
+  if (job.createdBy.userId !== actor.userId) {
+    return deny(
+      "not-creator",
+      "Only the person who opened a request can withdraw it."
+    );
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be withdrawn."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be withdrawn.`
+    );
+  }
+  return ALLOWED;
+}
+function canExecute(job, actor, useCase) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot run this request.");
+  }
+  if (job.status !== "approved" && job.status !== "failed") {
+    return deny(
+      "not-executable",
+      `This request is ${job.status} and cannot be run.`
+    );
+  }
+  return ALLOWED;
+}
+export {
+  canAcknowledge,
+  canCreate,
+  canExecute,
+  canReject,
+  canWithdraw,
+  effectiveStatus,
+  isExpired,
+  isSameActorEmail,
+  remainingAcks
+};
+//# sourceMappingURL=policy.js.map

package/dist/approvals/policy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/policy.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const normalize = (value?: string): string => {\n    const trimmed = value?.trim().toLowerCase() ?? ''\n    return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n  }\n  const left = normalize(one)\n  return left.length > 0 && left === normalize(other)\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny('forbidden', 'You cannot open this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  now: Date,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (\n    job.createdBy.userId === actor.userId ||\n    isSameActorEmail(job.createdBy.email, actor.email)\n  ) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (\n    job.acks.some(\n      (ack) =>\n        ack.userId === actor.userId || isSameActorEmail(ack.email, actor.email),\n    )\n  ) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * The creator MAY reject their own request. That is a withdrawal with a reason,\n * and stopping it would only push the person to the withdraw button, where the\n * reason is lost.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  return ALLOWED\n}\n\n/** Only the person who opened a request can take it back. */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (job.createdBy.userId !== actor.userId) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AA0D7B,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,YAAY,CAAC,UAA2B;AAC5C,UAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,WAAO,YAAY,sBAAsB,KAAK;AAAA,EAChD;AACA,QAAM,OAAO,UAAU,GAAG;AAC1B,SAAO,KAAK,SAAS,KAAK,SAAS,UAAU,KAAK;AACpD;AAuBA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAEO,SAAS,UACd,OACA,SACkB;AAClB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO,KAAK,aAAa,+BAA+B;AAAA,EAC1D;AACA,SAAO;AACT;AAaO,SAAS,eACd,KACA,OACA,SACA,KACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MACE,IAAI,UAAU,WAAW,MAAM,UAC/B,iBAAiB,IAAI,UAAU,OAAO,MAAM,KAAK,GACjD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,IAAI,KAAK;AAAA,IACP,CAAC,QACC,IAAI,WAAW,MAAM,UAAU,iBAAiB,IAAI,OAAO,MAAM,KAAK;AAAA,EAC1E,GACA;AACA,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AASO,SAAS,UACd,KACA,OACA,SACA,KACA,QACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,IAAI,UAAU,WAAW,MAAM,QAAQ;AACzC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,WACd,KACA,OACA,SACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/config/camundi-permission-rules.js

@@ -26,16 +26,22 @@ const CONFIG = {
     // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole
   },
   subdivisionRules: {
-    "256909487": ["accounts:admin", "console:admin", "consoleTeam"],
-    // console team
+    // The console team is the "Control plane" subdivision. The id was
+    // `256909487` until a HiBob restructure, and the augmenter matches a
+    // subdivision exactly and stays quiet on a miss, thus the rule granted
+    // nothing to anybody and nobody saw it.
+    "267516827": ["accounts:admin", "console:admin", "consoleTeam"],
+    // Control plane
     "Engineering Management": [
       "accounts:addSafeRoles",
       "accounts:orgCreator",
       "console:C8ReleaseManager"
     ],
     // Engineering Management
-    "258049291": ["console:clusterPlanManager", "console:operationsEngineer"]
-    // controller team
+    // Same story: the id `258049291` is gone. The subdivision carries the name
+    // `Controller` now, and a name is a valid key — `Engineering Management`
+    // above is one too.
+    Controller: ["console:clusterPlanManager", "console:operationsEngineer"]
   }
 };
 var camundi_permission_rules_default = CONFIG;

package/dist/config/camundi-permission-rules.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/config/camundi-permission-rules.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { CamundiPermissionRules } from './camundi-permission-rules.types.js'\n\nconst CONFIG: CamundiPermissionRules = {\n  departmentRules: {\n    '205882305': ['accounts:read', 'accounts:trialExtender'], // CS\n    Marketing: ['accounts:read', 'accounts:trialExtender'],\n    '205882307': ['accounts:read', 'accounts:trialExtender'], // revops\n    Products: ['console:admin:readonly', 'accounts:read'],\n    Executive: ['accounts:read'],\n    '259633605': ['accounts:read', 'accounts:trialExtender'], // Sales\n  },\n  divisionRules: {\n    Engineering: ['console:admin:readonly'],\n    '259633608': [\n      'accounts:connections:create',\n      'accounts:connections:update',\n      'support:agent',\n    ], // Support\n    '259633611': [\n      'accounts:trialExtender',\n      'accounts:limitExtender',\n      'support:agent',\n    ], // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole\n  },\n  subdivisionRules: {\n    '256909487': ['accounts:admin', 'console:admin', 'consoleTeam'], // console team\n    'Engineering Management': [\n      'accounts:addSafeRoles',\n      'accounts:orgCreator',\n      'console:C8ReleaseManager',\n    ], // Engineering Management\n    '258049291': ['console:clusterPlanManager', 'console:operationsEngineer'], // controller team\n  },\n}\nexport default CONFIG\n"],
-  "mappings": "AAQA,MAAM,SAAiC;AAAA,EACrC,iBAAiB;AAAA,IACf,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,WAAW,CAAC,iBAAiB,wBAAwB;AAAA,IACrD,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,UAAU,CAAC,0BAA0B,eAAe;AAAA,IACpD,WAAW,CAAC,eAAe;AAAA,IAC3B,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,EACzD;AAAA,EACA,eAAe;AAAA,IACb,aAAa,CAAC,wBAAwB;AAAA,IACtC,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa,CAAC,kBAAkB,iBAAiB,aAAa;AAAA;AAAA,IAC9D,0BAA0B;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa,CAAC,8BAA8B,4BAA4B;AAAA;AAAA,EAC1E;AACF;AACA,IAAO,mCAAQ;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { CamundiPermissionRules } from './camundi-permission-rules.types.js'\n\nconst CONFIG: CamundiPermissionRules = {\n  departmentRules: {\n    '205882305': ['accounts:read', 'accounts:trialExtender'], // CS\n    Marketing: ['accounts:read', 'accounts:trialExtender'],\n    '205882307': ['accounts:read', 'accounts:trialExtender'], // revops\n    Products: ['console:admin:readonly', 'accounts:read'],\n    Executive: ['accounts:read'],\n    '259633605': ['accounts:read', 'accounts:trialExtender'], // Sales\n  },\n  divisionRules: {\n    Engineering: ['console:admin:readonly'],\n    '259633608': [\n      'accounts:connections:create',\n      'accounts:connections:update',\n      'support:agent',\n    ], // Support\n    '259633611': [\n      'accounts:trialExtender',\n      'accounts:limitExtender',\n      'support:agent',\n    ], // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole\n  },\n  subdivisionRules: {\n    // The console team is the \"Control plane\" subdivision. The id was\n    // `256909487` until a HiBob restructure, and the augmenter matches a\n    // subdivision exactly and stays quiet on a miss, thus the rule granted\n    // nothing to anybody and nobody saw it.\n    '267516827': ['accounts:admin', 'console:admin', 'consoleTeam'], // Control plane\n    'Engineering Management': [\n      'accounts:addSafeRoles',\n      'accounts:orgCreator',\n      'console:C8ReleaseManager',\n    ], // Engineering Management\n    // Same story: the id `258049291` is gone. The subdivision carries the name\n    // `Controller` now, and a name is a valid key \u2014 `Engineering Management`\n    // above is one too.\n    Controller: ['console:clusterPlanManager', 'console:operationsEngineer'],\n  },\n}\nexport default CONFIG\n"],
+  "mappings": "AAQA,MAAM,SAAiC;AAAA,EACrC,iBAAiB;AAAA,IACf,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,WAAW,CAAC,iBAAiB,wBAAwB;AAAA,IACrD,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,UAAU,CAAC,0BAA0B,eAAe;AAAA,IACpD,WAAW,CAAC,eAAe;AAAA,IAC3B,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,EACzD;AAAA,EACA,eAAe;AAAA,IACb,aAAa,CAAC,wBAAwB;AAAA,IACtC,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,aAAa,CAAC,kBAAkB,iBAAiB,aAAa;AAAA;AAAA,IAC9D,0BAA0B;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAIA,YAAY,CAAC,8BAA8B,4BAA4B;AAAA,EACzE;AACF;AACA,IAAO,mCAAQ;",
   "names": []
 }

package/dist/constants/misc.const.d.ts

@@ -1,4 +1,25 @@
 export declare const CONSOLE_API_USER_ID = "console-api";
+/**
+ * The namespace of the custom claims that Auth0 adds to a token of this fleet.
+ *
+ * An Auth0 API access token carries no `email` claim of its own. The rules of
+ * the tenant put the email of the person under this namespace instead, and
+ * every reader of the fleet must look there. A service that reads a top-level
+ * `email` claim gets nothing, and the failure is silent: the identity is still
+ * valid, so the request continues with an empty email.
+ */
+export declare const CAMUNDA_CLAIMS_NAMESPACE = "https://camunda.com/meta";
+/**
+ * The email of an actor whose token carries no email.
+ *
+ * It is a value and not an empty string, because an empty string reads like a
+ * field that nobody wrote. A record that says `unknown` says that the token had
+ * no email, which is a different fact.
+ *
+ * A rule that compares two people MUST NOT treat two of these as one person.
+ * `isSameActorEmail` in `approvals/policy.ts` holds that.
+ */
+export declare const UNKNOWN_ACTOR_EMAIL = "unknown";
 export declare const TEMPORARY_CLUSTER_NAME = "Get Started";
 export type Stage = 'local' | 'dev' | 'int' | 'prod';
 export declare const HOTBACKUP_MIN_CREATE_PERIOD: number;

package/dist/constants/misc.const.js

@@ -1,4 +1,6 @@
 const CONSOLE_API_USER_ID = "console-api";
+const CAMUNDA_CLAIMS_NAMESPACE = "https://camunda.com/meta";
+const UNKNOWN_ACTOR_EMAIL = "unknown";
 const TEMPORARY_CLUSTER_NAME = "Get Started";
 const HOTBACKUP_MIN_CREATE_PERIOD = 1e3 * 60 * 60 * 0.25;
 const SECRETS_MAX_LENGTH = 4096;
@@ -19,6 +21,7 @@ const MINIMUM_EYEPAIRS = {
 };
 const MAX_HARDWARE_PACKAGE_COUNT = 4;
 export {
+  CAMUNDA_CLAIMS_NAMESPACE,
   CONSOLE_API_USER_ID,
   FIRSTNAME_LASTNAME_MAX_LENGTH,
   HOTBACKUP_MIN_CREATE_PERIOD,
@@ -28,6 +31,7 @@ export {
   NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,
   SECRETS_MAX_LENGTH,
   STARTING_PRICE_PER_MONTH_IN_EURO,
-  TEMPORARY_CLUSTER_NAME
+  TEMPORARY_CLUSTER_NAME,
+  UNKNOWN_ACTOR_EMAIL
 };
 //# sourceMappingURL=misc.const.js.map

package/dist/constants/misc.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/misc.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
-  "mappings": "AAMO,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\n\n/**\n * The namespace of the custom claims that Auth0 adds to a token of this fleet.\n *\n * An Auth0 API access token carries no `email` claim of its own. The rules of\n * the tenant put the email of the person under this namespace instead, and\n * every reader of the fleet must look there. A service that reads a top-level\n * `email` claim gets nothing, and the failure is silent: the identity is still\n * valid, so the request continues with an empty email.\n */\nexport const CAMUNDA_CLAIMS_NAMESPACE = 'https://camunda.com/meta'\n\n/**\n * The email of an actor whose token carries no email.\n *\n * It is a value and not an empty string, because an empty string reads like a\n * field that nobody wrote. A record that says `unknown` says that the token had\n * no email, which is a different fact.\n *\n * A rule that compares two people MUST NOT treat two of these as one person.\n * `isSameActorEmail` in `approvals/policy.ts` holds that.\n */\nexport const UNKNOWN_ACTOR_EMAIL = 'unknown'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
+  "mappings": "AAMO,MAAM,sBAAsB;AAW5B,MAAM,2BAA2B;AAYjC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;",
   "names": []
 }

package/dist/constants/v2-list.const.d.ts

@@ -0,0 +1,12 @@
+/** Largest page a `/v2` list endpoint returns. The backends clamp `limit` to this. */
+export declare const V2_MAX_PAGE_LIMIT = 200;
+/**
+ * Most uuids a `/v2` list endpoint accepts in a comma-list query filter such as
+ * `filter.ids`. The backends drop entries past this count without an error.
+ */
+export declare const V2_FILTER_IDS_MAX = 500;
+/**
+ * Most uuids a `/v2` list endpoint accepts in a POST body list. Over this the
+ * endpoint rejects with 400 instead of a silent cut.
+ */
+export declare const V2_BODY_IDS_MAX = 10000;

package/dist/constants/v2-list.const.js

@@ -0,0 +1,9 @@
+const V2_MAX_PAGE_LIMIT = 200;
+const V2_FILTER_IDS_MAX = 500;
+const V2_BODY_IDS_MAX = 1e4;
+export {
+  V2_BODY_IDS_MAX,
+  V2_FILTER_IDS_MAX,
+  V2_MAX_PAGE_LIMIT
+};
+//# sourceMappingURL=v2-list.const.js.map

package/dist/constants/v2-list.const.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/constants/v2-list.const.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/** Largest page a `/v2` list endpoint returns. The backends clamp `limit` to this. */\nexport const V2_MAX_PAGE_LIMIT = 200\n\n/**\n * Most uuids a `/v2` list endpoint accepts in a comma-list query filter such as\n * `filter.ids`. The backends drop entries past this count without an error.\n */\nexport const V2_FILTER_IDS_MAX = 500\n\n/**\n * Most uuids a `/v2` list endpoint accepts in a POST body list. Over this the\n * endpoint rejects with 400 instead of a silent cut.\n */\nexport const V2_BODY_IDS_MAX = 10_000\n"],
+  "mappings": "AAOO,MAAM,oBAAoB;AAM1B,MAAM,oBAAoB;AAM1B,MAAM,kBAAkB;",
+  "names": []
+}

package/dist/dtos/ApprovalJob.dto.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The wire types of the generic approval mechanism.
+ *
+ * This file holds no logic and no dependency, because three consumers read it:
+ * control-backend, control-frontend and cloudbot. The rules that read these
+ * types are in `../approvals/policy.js`, and they are pure for the same reason.
+ */
+/**
+ * Every state that an approval request can hold.
+ *
+ * A `const` tuple, not an enum, so it is both the union type and the list that
+ * validates a status filter at run time.
+ *
+ * The path of a request: `pending` until it reaches the threshold. Then
+ * `executing` (automatic mode) or `approved` (explicit mode, which waits for a
+ * person to press the button). `executed` or `failed` after the action ran. A
+ * request that never reaches the threshold ends `rejected`, `withdrawn` or
+ * `expired`.
+ */
+export declare const APPROVAL_JOB_STATUSES: readonly ["pending", "approved", "executing", "executed", "failed", "rejected", "withdrawn", "expired"];
+export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
+/**
+ * What happens when a request reaches its threshold.
+ *
+ * `auto` runs the action immediately. `explicit` holds the request at
+ * `approved` and waits for a person to run it.
+ */
+export type ApprovalExecutionMode = 'auto' | 'explicit';
+/**
+ * A person, as an approval request records them.
+ *
+ * Both keys are kept. The machine then never has to choose one identity key,
+ * which is what split the earlier acknowledgement flows: some held an email and
+ * some held a user id, and the two could not be compared.
+ */
+export interface ApprovalActor {
+    userId: string;
+    email: string;
+}
+export interface ApprovalAck extends ApprovalActor {
+    /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */
+    date: string;
+}
+/** One approval request, as the API returns it. */
+export interface ApprovalJobDto {
+    id: string;
+    type: string;
+    dedupeKey?: string;
+    payload: Record<string, unknown>;
+    createdBy: ApprovalActor;
+    acks: ApprovalAck[];
+    /** Copied from the use case, so a reader can render "1 of 2". */
+    requiredAcks: number;
+    executionMode: ApprovalExecutionMode;
+    status: ApprovalJobStatus;
+    closedBy?: ApprovalActor;
+    closedReason?: string;
+    /** An ISO timestamp. */
+    expiresAt: string;
+    executedAt?: string;
+    executionError?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * What a use case is, as the API reports it.
+ *
+ * The frontend needs `requiredPermission` to run the same rule as the backend.
+ * PR #9301 kept this registry a second time, by hand, in the frontend. A
+ * registry that the server owns means a new use case needs no frontend deploy.
+ */
+export interface ApprovalUseCaseDto {
+    type: string;
+    /** A short name for a person to read. */
+    label: string;
+    requiredAcks: number;
+    ttlDays: number;
+    executionMode: ApprovalExecutionMode;
+    /** The permission that acknowledge, reject and run all need. */
+    requiredPermission: string;
+    /** The permission to open a request. Absent means any signed-in user. */
+    createPermission?: string;
+}

package/dist/dtos/ApprovalJob.dto.js

@@ -0,0 +1,14 @@
+const APPROVAL_JOB_STATUSES = [
+  "pending",
+  "approved",
+  "executing",
+  "executed",
+  "failed",
+  "rejected",
+  "withdrawn",
+  "expired"
+];
+export {
+  APPROVAL_JOB_STATUSES
+};
+//# sourceMappingURL=ApprovalJob.dto.js.map

package/dist/dtos/ApprovalJob.dto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/dtos/ApprovalJob.dto.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /** Copied from the use case, so a reader can render \"1 of 2\". */\n  requiredAcks: number\n  executionMode: ApprovalExecutionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  executedAt?: string\n  executionError?: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  requiredAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** The permission that acknowledge, reject and run all need. */\n  requiredPermission: string\n  /** The permission to open a request. Absent means any signed-in user. */\n  createPermission?: string\n}\n"],
+  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "names": []
+}

package/dist/dtos/ControlV2.dto.d.ts

@@ -1,4 +1,5 @@
 import type { SalesPlanType } from '../types/SalesPlanType.type.js';
+import type { LicensingModelType } from './Organization.dto.js';
 /** Generic cursor-paginated response. `nextCursor === null` on the last page. */
 export interface CursorPage<T> {
     items: T[];
@@ -42,6 +43,19 @@ export interface OrgListItemV2Dto {
     /** Concrete plan name (`SalesPlan.name`), distinct from the tier `salesPlanType`. */
     salesPlanName?: string;
     salesForceId?: string;
+    /** ISO-8601 end of the trial, when the org is or was on a trial plan. */
+    trialExpiresAt?: string;
+    /**
+     * Persisted trial state: `true` when the trial ran out, `false` while it
+     * runs. Absent when the org is not on a trial plan or the state is not set.
+     */
+    trialExpired?: boolean;
+    /** Org metadata flag: the org can only create clusters on AWS. */
+    awsOnly?: boolean;
+    /** Org metadata flag: enterprise plan limited to development use. */
+    enterpriseDevOnly?: boolean;
+    /** Org metadata: which licensing model prices the org. */
+    licensingModel?: LicensingModelType;
 }
 export interface ListOrganizationsV2Params extends CursorParams {
     q?: string;
@@ -132,6 +146,55 @@ export interface ClusterListItemV2Dto {
 }
 /** Detail extends the list shape; richer fields are added in Phase 3. */
 export type ClusterDetailV2Dto = ClusterListItemV2Dto;
+/**
+ * How much work a cluster did, inside the 30-day activity window.
+ *
+ * `idle` and `unknown` are different facts and must stay apart. `idle` is
+ * evidence that the cluster did no work. `unknown` is the absence of
+ * evidence: on the dev stage most clusters have no row at all.
+ *
+ * The source is the Holistic Data Platform (HDP), which holds one row per
+ * cluster, per day, per value metric. The window is 30 days, thus a bucket
+ * for "did work, but more than 30 days ago" is not possible.
+ */
+export type ClusterActivityBucket = 
+/** Work inside the 30-day window. */
+'active'
+/** Rows exist inside the window. All values are zero. */
+ | 'idle'
+/** No row at all inside the window. */
+ | 'unknown';
+/** Quick-filter tiles on the clusters list. */
+export type ClusterActivityTile = 'all' | 'active' | 'idle' | 'unknown'
+/** More than 90 days old, and not active. */
+ | 'old-idle'
+/** No more than 30 days old, with no work and no data. */
+ | 'new-idle';
+export interface ClusterActivityV2Dto {
+    clusterId: string;
+    /**
+     * ISO-8601 instant of the last UTC day with work. HDP buckets by day, thus
+     * the time part is always midnight. Absent when the cluster did no work
+     * inside the window.
+     */
+    lastActiveAt?: string;
+    processInstances30d: number;
+    bucket: ClusterActivityBucket;
+}
+export interface ClusterActivityV2Response {
+    /**
+     * One entry per live cluster that has an HDP row inside the window. A
+     * cluster in the `unknown` bucket has no entry, because the bucket means
+     * that no row exists.
+     */
+    items: ClusterActivityV2Dto[];
+    /** Fleet-wide tile counts. The server joins `cluster.created` for the age tiles. */
+    counts: Record<ClusterActivityTile, number>;
+    /** ISO-8601 instant when the server assembled this response. */
+    fetchedAt: string;
+    /** The number of days that the window covers. */
+    windowDays: number;
+}
 export interface ListClustersV2Params extends CursorParams {
     q?: string;
     /**
@@ -207,8 +270,22 @@ export interface ListClustersV2Params extends CursorParams {
         minorVersion?: string;
         /** Restrict to these release channel names. */
         channels?: string[];
-        /** ISO-8601 lower bound on `created` (e.g. "created in the last 7 days"). */
+        /**
+         * ISO-8601 lower bound on `created` (e.g. "created in the last 7 days").
+         * Inclusive: a cluster created at this instant matches.
+         */
         createdAfter?: string;
+        /**
+         * ISO-8601 upper bound on `created`. Pairs with `createdAfter` for the
+         * age axis. Exclusive: a cluster created at this instant does not match.
+         */
+        createdBefore?: string;
+        /**
+         * Restrict to these activity buckets. The controller resolves the buckets
+         * to a cluster id set from the cached HDP activity map, the same way
+         * `filter.status` resolves K8s state to a cluster id set.
+         */
+        activity?: ClusterActivityBucket[];
     };
 }
 export interface ClusterParameterOptionV2Dto {

package/dist/dtos/FeatureFlags.dto.d.ts

@@ -32,9 +32,11 @@ export interface Features {
         backupScheduleApi: boolean;
         clusterCreationBlocked: boolean;
         deferSpecChangeWhileAsleep: boolean;
+        clusterDuplication: boolean;
     };
     control: {
         frontendTelemetry: boolean;
+        sendToExpiredTrialApproval: boolean;
     };
     accounts: {
         moveClusterOrg: boolean;