@camunda/ccma-shared-types 1.1.0 → 1.2.0

package/dist/dtos/Generations.dto.d.ts

@@ -30,3 +30,13 @@ export declare function sortGenerationBySemverOfZeebe(generationA: {
         zeebe: string;
     };
 }): number;
+/**
+ * Orders generation names by product, then newest first within a product, by
+ * numeric collation: `8.10` comes before `8.9`, and `gen10` before `gen9`.
+ * Products stay in alphabetic order, so the Camunda generations come before
+ * the older Zeebe ones. A release comes before its prereleases, so
+ * `8.10.0` is above `8.10.0-alpha1`. For a list that has no zeebe image to
+ * compare, such as a filter facet. When the image is known, use
+ * `sortGenerationBySemverOfZeebe`.
+ */
+export declare const compareGenerationNamesNewestFirst: (nameA: string, nameB: string) => number;

package/dist/dtos/Generations.dto.js

@@ -14,16 +14,50 @@ function sortGenerationBySemverOfZeebe(generationA, generationB) {
     if (byVersion !== 0) {
       return byVersion;
     }
-    return secfixRank(zeebeB) - secfixRank(zeebeA);
+    const bySecfix = secfixRank(zeebeB) - secfixRank(zeebeA);
+    if (bySecfix !== 0) {
+      return bySecfix;
+    }
+    return compareGenerationNamesNewestFirst(generationA.name, generationB.name);
   } else if (versionAvalid) {
     return -1;
   } else if (versionBvalid) {
     return 1;
   } else {
-    return generationB.name.localeCompare(generationA.name);
+    return compareGenerationNamesNewestFirst(generationA.name, generationB.name);
   }
 }
+const productPrefix = (name) => {
+  const firstDigit = name.search(/\d/);
+  return firstDigit === -1 ? name : name.slice(0, firstDigit);
+};
+const splitPrerelease = (name) => {
+  const dash = name.indexOf("-", name.search(/\d/));
+  return dash === -1 ? [name, ""] : [name.slice(0, dash), name.slice(dash + 1)];
+};
+const compareGenerationNamesNewestFirst = (nameA, nameB) => {
+  const collation = { numeric: true, sensitivity: "base" };
+  const byProduct = productPrefix(nameA).localeCompare(
+    productPrefix(nameB),
+    void 0,
+    collation
+  );
+  if (byProduct !== 0) {
+    return byProduct;
+  }
+  const [baseA, suffixA] = splitPrerelease(nameA);
+  const [baseB, suffixB] = splitPrerelease(nameB);
+  const byBase = baseB.localeCompare(baseA, void 0, collation);
+  if (byBase !== 0) {
+    return byBase;
+  }
+  if (suffixA === "" || suffixB === "") {
+    return suffixA === suffixB ? 0 : suffixA === "" ? -1 : 1;
+  }
+  return suffixB.localeCompare(suffixA, void 0, collation);
+};
 export {
+  compareGenerationNamesNewestFirst,
   sortGenerationBySemverOfZeebe
 };
 //# sourceMappingURL=Generations.dto.js.map

package/dist/dtos/Generations.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/Generations.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport semver from 'semver'\nimport type { ZeebeClusterVersionsDto } from '../types/C8ClusterComponentVersions.type.js'\nimport { stripSecfixPostfix } from '../utils/versionCheck.utils.js'\n\nexport interface GenerationDto {\n  name: string\n  uuid: string\n  versions: ZeebeClusterVersionsDto\n  upgradeableFrom: GenerationDto[]\n  createdBy: string\n  createdByName?: string\n  created: Date\n  updatedBy: string\n  updated: Date\n  isUnsupportedStarting?: Date\n  isBespoke?: boolean\n}\n\nexport interface GenerationWithClusterCountDto extends GenerationDto {\n  clusterCount: number\n}\n\nexport interface UpgradableGenerationsDto {\n  preferred: GenerationDto | null\n  options: GenerationDto[]\n}\n\nconst secfixRank = (version: string): number =>\n  version === stripSecfixPostfix(version) ? 0 : 1\n\nexport function sortGenerationBySemverOfZeebe(\n  generationA: { name: string; versions?: { zeebe: string } },\n  generationB: { name: string; versions?: { zeebe: string } },\n) {\n  // magic sorting algorithm\n  // uses the generation version of zeebe for comparison\n  // if version invalid: use localeCompare\n\n  const versionAvalid: boolean =\n    generationA.versions?.zeebe !== undefined &&\n    semver.valid(generationA.versions.zeebe.split(':')[1]) !== null\n  const versionBvalid: boolean =\n    generationB.versions?.zeebe !== undefined &&\n    semver.valid(generationB.versions.zeebe.split(':')[1]) !== null\n\n  if (versionAvalid && versionBvalid) {\n    const zeebeA = generationA.versions!.zeebe.split(':')[1]\n    const zeebeB = generationB.versions!.zeebe.split(':')[1]\n    const byVersion = semver.compare(\n      stripSecfixPostfix(zeebeB),\n      stripSecfixPostfix(zeebeA),\n    )\n    if (byVersion !== 0) {\n      return byVersion\n    }\n    // Both builds carry the same Camunda version here, so only the postfix\n    // separates them. A secfix build holds that version plus a security patch,\n    // thus it is the newer of the two and takes the higher rank.\n    return secfixRank(zeebeB) - secfixRank(zeebeA)\n  } else if (versionAvalid) {\n    return -1\n  } else if (versionBvalid) {\n    return 1\n  } else {\n    return generationB.name.localeCompare(generationA.name)\n  }\n}\n"],
-  "mappings": "AAMA,OAAO,YAAY;AAEnB,SAAS,0BAA0B;AAyBnC,MAAM,aAAa,CAAC,YAClB,YAAY,mBAAmB,OAAO,IAAI,IAAI;AAEzC,SAAS,8BACd,aACA,aACA;AAKA,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAC7D,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAE7D,MAAI,iBAAiB,eAAe;AAClC,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,YAAY,OAAO;AAAA,MACvB,mBAAmB,MAAM;AAAA,MACzB,mBAAmB,MAAM;AAAA,IAC3B;AACA,QAAI,cAAc,GAAG;AACnB,aAAO;AAAA,IACT;AAIA,WAAO,WAAW,MAAM,IAAI,WAAW,MAAM;AAAA,EAC/C,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,OAAO;AACL,WAAO,YAAY,KAAK,cAAc,YAAY,IAAI;AAAA,EACxD;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport semver from 'semver'\nimport type { ZeebeClusterVersionsDto } from '../types/C8ClusterComponentVersions.type.js'\nimport { stripSecfixPostfix } from '../utils/versionCheck.utils.js'\n\nexport interface GenerationDto {\n  name: string\n  uuid: string\n  versions: ZeebeClusterVersionsDto\n  upgradeableFrom: GenerationDto[]\n  createdBy: string\n  createdByName?: string\n  created: Date\n  updatedBy: string\n  updated: Date\n  isUnsupportedStarting?: Date\n  isBespoke?: boolean\n}\n\nexport interface GenerationWithClusterCountDto extends GenerationDto {\n  clusterCount: number\n}\n\nexport interface UpgradableGenerationsDto {\n  preferred: GenerationDto | null\n  options: GenerationDto[]\n}\n\nconst secfixRank = (version: string): number =>\n  version === stripSecfixPostfix(version) ? 0 : 1\n\nexport function sortGenerationBySemverOfZeebe(\n  generationA: { name: string; versions?: { zeebe: string } },\n  generationB: { name: string; versions?: { zeebe: string } },\n) {\n  // magic sorting algorithm\n  // uses the generation version of zeebe for comparison\n  // if version invalid: use localeCompare\n\n  const versionAvalid: boolean =\n    generationA.versions?.zeebe !== undefined &&\n    semver.valid(generationA.versions.zeebe.split(':')[1]) !== null\n  const versionBvalid: boolean =\n    generationB.versions?.zeebe !== undefined &&\n    semver.valid(generationB.versions.zeebe.split(':')[1]) !== null\n\n  if (versionAvalid && versionBvalid) {\n    const zeebeA = generationA.versions!.zeebe.split(':')[1]\n    const zeebeB = generationB.versions!.zeebe.split(':')[1]\n    const byVersion = semver.compare(\n      stripSecfixPostfix(zeebeB),\n      stripSecfixPostfix(zeebeA),\n    )\n    if (byVersion !== 0) {\n      return byVersion\n    }\n    // Both builds carry the same Camunda version here, so only the postfix\n    // separates them. A secfix build holds that version plus a security patch,\n    // thus it is the newer of the two and takes the higher rank.\n    const bySecfix = secfixRank(zeebeB) - secfixRank(zeebeA)\n    if (bySecfix !== 0) {\n      return bySecfix\n    }\n    // Same image on both (8.9+gen5 and 8.9+gen6 both run 8.9.5). The name is\n    // the only order left, so a picker does not show them in input order.\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  } else if (versionAvalid) {\n    return -1\n  } else if (versionBvalid) {\n    return 1\n  } else {\n    return compareGenerationNamesNewestFirst(generationA.name, generationB.name)\n  }\n}\n\n/** The text before the first digit: \"Camunda \" for \"Camunda 8.9+gen20\". */\nconst productPrefix = (name: string): string => {\n  const firstDigit = name.search(/\\d/)\n  return firstDigit === -1 ? name : name.slice(0, firstDigit)\n}\n\n/**\n * Splits a name at the first dash after the version: \"Camunda 8.10.0-alpha1\"\n * gives [\"Camunda 8.10.0\", \"alpha1\"]. A name without a dash gives an empty\n * suffix.\n */\nconst splitPrerelease = (name: string): [base: string, suffix: string] => {\n  const dash = name.indexOf('-', name.search(/\\d/))\n  return dash === -1 ? [name, ''] : [name.slice(0, dash), name.slice(dash + 1)]\n}\n\n/**\n * Orders generation names by product, then newest first within a product, by\n * numeric collation: `8.10` comes before `8.9`, and `gen10` before `gen9`.\n * Products stay in alphabetic order, so the Camunda generations come before\n * the older Zeebe ones. A release comes before its prereleases, so\n * `8.10.0` is above `8.10.0-alpha1`. For a list that has no zeebe image to\n * compare, such as a filter facet. When the image is known, use\n * `sortGenerationBySemverOfZeebe`.\n */\nexport const compareGenerationNamesNewestFirst = (\n  nameA: string,\n  nameB: string,\n): number => {\n  const collation = { numeric: true, sensitivity: 'base' } as const\n  const byProduct = productPrefix(nameA).localeCompare(\n    productPrefix(nameB),\n    undefined,\n    collation,\n  )\n  if (byProduct !== 0) {\n    return byProduct\n  }\n  const [baseA, suffixA] = splitPrerelease(nameA)\n  const [baseB, suffixB] = splitPrerelease(nameB)\n  const byBase = baseB.localeCompare(baseA, undefined, collation)\n  if (byBase !== 0) {\n    return byBase\n  }\n  if (suffixA === '' || suffixB === '') {\n    return suffixA === suffixB ? 0 : suffixA === '' ? -1 : 1\n  }\n  return suffixB.localeCompare(suffixA, undefined, collation)\n}\n"],
+  "mappings": "AAMA,OAAO,YAAY;AAEnB,SAAS,0BAA0B;AAyBnC,MAAM,aAAa,CAAC,YAClB,YAAY,mBAAmB,OAAO,IAAI,IAAI;AAEzC,SAAS,8BACd,aACA,aACA;AAKA,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAC7D,QAAM,gBACJ,YAAY,UAAU,UAAU,UAChC,OAAO,MAAM,YAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM;AAE7D,MAAI,iBAAiB,eAAe;AAClC,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,SAAS,YAAY,SAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AACvD,UAAM,YAAY,OAAO;AAAA,MACvB,mBAAmB,MAAM;AAAA,MACzB,mBAAmB,MAAM;AAAA,IAC3B;AACA,QAAI,cAAc,GAAG;AACnB,aAAO;AAAA,IACT;AAIA,UAAM,WAAW,WAAW,MAAM,IAAI,WAAW,MAAM;AACvD,QAAI,aAAa,GAAG;AAClB,aAAO;AAAA,IACT;AAGA,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,WAAW,eAAe;AACxB,WAAO;AAAA,EACT,OAAO;AACL,WAAO,kCAAkC,YAAY,MAAM,YAAY,IAAI;AAAA,EAC7E;AACF;AAGA,MAAM,gBAAgB,CAAC,SAAyB;AAC9C,QAAM,aAAa,KAAK,OAAO,IAAI;AACnC,SAAO,eAAe,KAAK,OAAO,KAAK,MAAM,GAAG,UAAU;AAC5D;AAOA,MAAM,kBAAkB,CAAC,SAAiD;AACxE,QAAM,OAAO,KAAK,QAAQ,KAAK,KAAK,OAAO,IAAI,CAAC;AAChD,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAC9E;AAWO,MAAM,oCAAoC,CAC/C,OACA,UACW;AACX,QAAM,YAAY,EAAE,SAAS,MAAM,aAAa,OAAO;AACvD,QAAM,YAAY,cAAc,KAAK,EAAE;AAAA,IACrC,cAAc,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACA,MAAI,cAAc,GAAG;AACnB,WAAO;AAAA,EACT;AACA,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,CAAC,OAAO,OAAO,IAAI,gBAAgB,KAAK;AAC9C,QAAM,SAAS,MAAM,cAAc,OAAO,QAAW,SAAS;AAC9D,MAAI,WAAW,GAAG;AAChB,WAAO;AAAA,EACT;AACA,MAAI,YAAY,MAAM,YAAY,IAAI;AACpC,WAAO,YAAY,UAAU,IAAI,YAAY,KAAK,KAAK;AAAA,EACzD;AACA,SAAO,QAAQ,cAAc,SAAS,QAAW,SAAS;AAC5D;",
   "names": []
 }

package/dist/dtos/Hdp.dto.d.ts

@@ -22,4 +22,33 @@ export declare namespace Hdp {
         minDate: string;
         maxDate: string;
     }
+    /**
+     * The work of one cluster inside the activity window. HDP aggregates, thus
+     * one row comes back for each cluster and not one for each cluster and day.
+     */
+    interface ClusterActivityRow {
+        clusterId: string;
+        /**
+         * The last UTC day with work, as `YYYY-MM-DD`. When no day inside the
+         * window carries work, this field is absent. accounts-backend makes this
+         * string from the BigQuery DATE, thus no caller reads the shape that the
+         * BigQuery client gives.
+         */
+        lastActiveAt?: string;
+        processInstances: number;
+    }
+    /**
+     * Every cluster that HDP holds inside the window, for the whole fleet.
+     *
+     * The reader joins these rows against its own cluster table. HDP keeps the
+     * rows of clusters that no longer exist, thus the set is bigger than the
+     * live fleet.
+     */
+    interface ClusterActivity {
+        rows: ClusterActivityRow[];
+        /** The window that `rows` covers, in days. */
+        windowDays: number;
+        /** The time of the query, as an ISO instant. */
+        fetchedAt: string;
+    }
 }

package/dist/dtos/Organization.dto.d.ts

@@ -48,6 +48,26 @@ export interface OrganizationMetadata {
          * that matches on the name of the key.
          */
         keyHash?: string;
+        /**
+         * The key that a provider migration replaced, kept until the delete of
+         * that key is confirmed.
+         *
+         * The migration to OpenRouter writes the new key over `tenantKey` before
+         * it deletes the old one. Without this record the old key stays alive on
+         * the old upstream and nothing points at it. The migration removes this
+         * field when the old upstream confirms the delete, and it uses the field
+         * to find the orgs that a re-run must finish.
+         *
+         * Absent for every org that never moved upstream.
+         */
+        migratedFrom?: {
+            /** Upstream that holds the replaced key. */
+            provider: LlmProviderName;
+            /** The replaced key itself. It is a credential. Never log it. */
+            tenantKey: string;
+            /** Team that held the replaced key on LiteLLM. */
+            teamId?: string;
+        };
     };
 }
 export interface AutoJoinAssignment {

package/dist/dtos/Organization.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/Organization.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { OrganizationPermissions } from '../types/OrganizationPermission.type.js'\nimport type { SalesPlanType } from '../types/SalesPlanType.type.js'\nimport type { OrganizationToSalesPlanDto } from './OrganizationToSalesPlan.dto.js'\n\nexport type LicensingModelType = 'legacy' | '2025'\n\nexport const VALID_LICENSING_MODELS: readonly LicensingModelType[] = [\n  'legacy',\n  '2025',\n] as const\n\nexport const LICENSING_MODEL_DISPLAY_NAMES: Record<LicensingModelType, string> =\n  {\n    legacy: 'Legacy (PI, DI, TU)',\n    '2025': '2025 (PI+Tenant)',\n  } as const\n\n/**\n * Upstream that holds a managed LLM key.\n *\n * `@camunda-cloud/featureflags` owns the `LlmProvider` type and its rollout\n * rules. This package must not depend on that one, so the union is repeated\n * here. Keep the two in step.\n */\nexport type LlmProviderName = 'litellm' | 'openrouter'\n\nexport interface OrganizationMetadata {\n  clickedRequestPaidPlan?: boolean\n  salesForceId?: string\n  enterpriseDevOnly?: boolean\n  awsOnly?: boolean\n  licensingModel?: LicensingModelType\n  autoJoin?: AutoJoinAssignment\n  llm?: {\n    tenantKey: string\n    /**\n     * Team that holds the key on LiteLLM.\n     *\n     * Optional, and every call site already treats it as such. Old LiteLLM\n     * orgs got a key without a team. OpenRouter has no teams at all.\n     */\n    teamId?: string\n    created: number\n    /** Epoch ms of the last key rotation \u2014 set when the tenant key is regenerated. */\n    updated?: number\n    /**\n     * Upstream that holds this key. Absent means `litellm`, because every key\n     * from before the OpenRouter rollout is on LiteLLM.\n     *\n     * This value, and not the OpenRouter feature flag, decides where the\n     * read, block, top-up and delete paths look for the key. A flag change\n     * must never move a live key to a provider that does not hold it.\n     */\n    provider?: LlmProviderName\n    /**\n     * Handle for the key on OpenRouter, which addresses a key by hash and not\n     * by its value. Absent for a LiteLLM key.\n     *\n     * Without it, an OpenRouter key can be found again only by a list request\n     * that matches on the name of the key.\n     */\n    keyHash?: string\n  }\n}\n\nexport interface AutoJoinAssignment {\n  departments: Array<{ hibobId: string; roles: string[] }>\n  divisions: Array<{ hibobId: string; roles: string[] }>\n  subdivisions: Array<{ hibobId: string; roles: string[] }>\n}\nexport interface OrganizationDto {\n  uuid: string\n  name: string\n  organizationToSalesPlan?: OrganizationToSalesPlanDto\n  permissions?: OrganizationPermissions\n  metadata?: OrganizationMetadata\n  created: Date\n  internal: boolean\n}\n\nexport interface OrgOwner {\n  owner: string\n  email: string\n  first: string\n  last: string\n}\n\nexport interface OrgWithNameAndSalesPlan {\n  uuid: string\n  name: string | undefined\n  salesPlanName: string | undefined\n  salesPlanUuid: string | undefined\n  salesPlanType: SalesPlanType | undefined\n}\n"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { OrganizationPermissions } from '../types/OrganizationPermission.type.js'\nimport type { SalesPlanType } from '../types/SalesPlanType.type.js'\nimport type { OrganizationToSalesPlanDto } from './OrganizationToSalesPlan.dto.js'\n\nexport type LicensingModelType = 'legacy' | '2025'\n\nexport const VALID_LICENSING_MODELS: readonly LicensingModelType[] = [\n  'legacy',\n  '2025',\n] as const\n\nexport const LICENSING_MODEL_DISPLAY_NAMES: Record<LicensingModelType, string> =\n  {\n    legacy: 'Legacy (PI, DI, TU)',\n    '2025': '2025 (PI+Tenant)',\n  } as const\n\n/**\n * Upstream that holds a managed LLM key.\n *\n * `@camunda-cloud/featureflags` owns the `LlmProvider` type and its rollout\n * rules. This package must not depend on that one, so the union is repeated\n * here. Keep the two in step.\n */\nexport type LlmProviderName = 'litellm' | 'openrouter'\n\nexport interface OrganizationMetadata {\n  clickedRequestPaidPlan?: boolean\n  salesForceId?: string\n  enterpriseDevOnly?: boolean\n  awsOnly?: boolean\n  licensingModel?: LicensingModelType\n  autoJoin?: AutoJoinAssignment\n  llm?: {\n    tenantKey: string\n    /**\n     * Team that holds the key on LiteLLM.\n     *\n     * Optional, and every call site already treats it as such. Old LiteLLM\n     * orgs got a key without a team. OpenRouter has no teams at all.\n     */\n    teamId?: string\n    created: number\n    /** Epoch ms of the last key rotation \u2014 set when the tenant key is regenerated. */\n    updated?: number\n    /**\n     * Upstream that holds this key. Absent means `litellm`, because every key\n     * from before the OpenRouter rollout is on LiteLLM.\n     *\n     * This value, and not the OpenRouter feature flag, decides where the\n     * read, block, top-up and delete paths look for the key. A flag change\n     * must never move a live key to a provider that does not hold it.\n     */\n    provider?: LlmProviderName\n    /**\n     * Handle for the key on OpenRouter, which addresses a key by hash and not\n     * by its value. Absent for a LiteLLM key.\n     *\n     * Without it, an OpenRouter key can be found again only by a list request\n     * that matches on the name of the key.\n     */\n    keyHash?: string\n    /**\n     * The key that a provider migration replaced, kept until the delete of\n     * that key is confirmed.\n     *\n     * The migration to OpenRouter writes the new key over `tenantKey` before\n     * it deletes the old one. Without this record the old key stays alive on\n     * the old upstream and nothing points at it. The migration removes this\n     * field when the old upstream confirms the delete, and it uses the field\n     * to find the orgs that a re-run must finish.\n     *\n     * Absent for every org that never moved upstream.\n     */\n    migratedFrom?: {\n      /** Upstream that holds the replaced key. */\n      provider: LlmProviderName\n      /** The replaced key itself. It is a credential. Never log it. */\n      tenantKey: string\n      /** Team that held the replaced key on LiteLLM. */\n      teamId?: string\n    }\n  }\n}\n\nexport interface AutoJoinAssignment {\n  departments: Array<{ hibobId: string; roles: string[] }>\n  divisions: Array<{ hibobId: string; roles: string[] }>\n  subdivisions: Array<{ hibobId: string; roles: string[] }>\n}\nexport interface OrganizationDto {\n  uuid: string\n  name: string\n  organizationToSalesPlan?: OrganizationToSalesPlanDto\n  permissions?: OrganizationPermissions\n  metadata?: OrganizationMetadata\n  created: Date\n  internal: boolean\n}\n\nexport interface OrgOwner {\n  owner: string\n  email: string\n  first: string\n  last: string\n}\n\nexport interface OrgWithNameAndSalesPlan {\n  uuid: string\n  name: string | undefined\n  salesPlanName: string | undefined\n  salesPlanUuid: string | undefined\n  salesPlanType: SalesPlanType | undefined\n}\n"],
   "mappings": "AAYO,MAAM,yBAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,gCACX;AAAA,EACE,QAAQ;AAAA,EACR,QAAQ;AACV;",
   "names": []
 }

package/dist/enums/AuditService.enum.d.ts

@@ -1,4 +1,5 @@
 export declare enum AuditService {
     CONSOLE = "console",
-    ACCOUNTS = "accounts"
+    ACCOUNTS = "accounts",
+    CONTROL = "control"
 }

package/dist/enums/AuditService.enum.js

@@ -1,6 +1,7 @@
 var AuditService = /* @__PURE__ */ ((AuditService2) => {
   AuditService2["CONSOLE"] = "console";
   AuditService2["ACCOUNTS"] = "accounts";
+  AuditService2["CONTROL"] = "control";
   return AuditService2;
 })(AuditService || {});
 export {

package/dist/enums/AuditService.enum.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/enums/AuditService.enum.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// eslint-disable-next-line no-shadow\nexport enum AuditService {\n  CONSOLE = 'console',\n  ACCOUNTS = 'accounts',\n}\n"],
-  "mappings": "AAOO,IAAK,eAAL,kBAAKA,kBAAL;AACL,EAAAA,cAAA,aAAU;AACV,EAAAA,cAAA,cAAW;AAFD,SAAAA;AAAA,GAAA;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// eslint-disable-next-line no-shadow\nexport enum AuditService {\n  CONSOLE = 'console',\n  ACCOUNTS = 'accounts',\n  // CAUTION: audit-logger stores this value and filters on it. Make sure that\n  // it accepts `control` before a deployed service writes with it.\n  CONTROL = 'control',\n}\n"],
+  "mappings": "AAOO,IAAK,eAAL,kBAAKA,kBAAL;AACL,EAAAA,cAAA,aAAU;AACV,EAAAA,cAAA,cAAW;AAGX,EAAAA,cAAA,aAAU;AALA,SAAAA;AAAA,GAAA;",
   "names": ["AuditService"]
 }

package/dist/enums/SystemAuditEntity.enum.d.ts

@@ -10,7 +10,8 @@ export declare enum SystemAuditEntity {
     CLUSTER_MODIFICATION = "Cluster Modification",
     CONNECTION = "Connection",
     RELEASE_TRAIN = "Release Train",
-    CLUSTER = "Cluster"
+    CLUSTER = "Cluster",
+    APPROVAL_JOB = "Approval Request"
 }
 /**
  * Display strings for audited attributes. The `entity` + `entityAttribute` pair
@@ -70,5 +71,8 @@ export declare enum SystemAuditEntityAttribute {
     CONNECTION_CONFIGURATION = "Configuration",
     CLUSTER_IP_ALLOWLIST = "IP Allowlist",
     CLUSTER_ENV_VAR_OVERRIDE = "Environment Variable Override",
-    CLUSTER_APPLIED_PLAN_MODIFICATION = "Plan Modification"
+    CLUSTER_APPLIED_PLAN_MODIFICATION = "Plan Modification",
+    APPROVAL_JOB_STATUS = "Status",
+    APPROVAL_JOB_ACKS = "Approvals",
+    APPROVAL_JOB_CLOSED_REASON = "Closure Reason"
 }

package/dist/enums/SystemAuditEntity.enum.js

@@ -11,6 +11,7 @@ var SystemAuditEntity = /* @__PURE__ */ ((SystemAuditEntity2) => {
   SystemAuditEntity2["CONNECTION"] = "Connection";
   SystemAuditEntity2["RELEASE_TRAIN"] = "Release Train";
   SystemAuditEntity2["CLUSTER"] = "Cluster";
+  SystemAuditEntity2["APPROVAL_JOB"] = "Approval Request";
   return SystemAuditEntity2;
 })(SystemAuditEntity || {});
 var SystemAuditEntityAttribute = /* @__PURE__ */ ((SystemAuditEntityAttribute2) => {
@@ -65,6 +66,9 @@ var SystemAuditEntityAttribute = /* @__PURE__ */ ((SystemAuditEntityAttribute2)
   SystemAuditEntityAttribute2["CLUSTER_IP_ALLOWLIST"] = "IP Allowlist";
   SystemAuditEntityAttribute2["CLUSTER_ENV_VAR_OVERRIDE"] = "Environment Variable Override";
   SystemAuditEntityAttribute2["CLUSTER_APPLIED_PLAN_MODIFICATION"] = "Plan Modification";
+  SystemAuditEntityAttribute2["APPROVAL_JOB_STATUS"] = "Status";
+  SystemAuditEntityAttribute2["APPROVAL_JOB_ACKS"] = "Approvals";
+  SystemAuditEntityAttribute2["APPROVAL_JOB_CLOSED_REASON"] = "Closure Reason";
   return SystemAuditEntityAttribute2;
 })(SystemAuditEntityAttribute || {});
 export {

package/dist/enums/SystemAuditEntity.enum.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/enums/SystemAuditEntity.enum.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/* eslint-disable no-shadow */\nexport enum SystemAuditEntity {\n  GENERATION = 'Generation',\n  CHANNEL = 'Channel',\n  CLUSTER_PLAN = 'Cluster Plan',\n  CLUSTER_PLAN_TYPE = 'Cluster Plan Type',\n  ALPHA_FEATURE = 'Alpha Feature',\n  SALES_PLAN = 'Sales Plan',\n  CLUSTER_PLAN_MODIFICATION = 'Cluster Plan Modification',\n  CLUSTER_BULK_OPERATION = 'Cluster Bulk Operation',\n  CLUSTER_MODIFICATION = 'Cluster Modification',\n  CONNECTION = 'Connection',\n  RELEASE_TRAIN = 'Release Train',\n  CLUSTER = 'Cluster',\n}\n\n/**\n * Display strings for audited attributes. The `entity` + `entityAttribute` pair\n * is always the key, so duplicate display values across entities (e.g. several\n * `*_NAME = 'Name'`) are intentional and safe. `*_STATUS = 'Status'` is the\n * lifecycle attribute for the modification/operation entities; its from/to carry\n * the raw lifecycle state.\n */\nexport enum SystemAuditEntityAttribute {\n  // Generation\n  GENERATION_NAME = 'Name',\n  GENERATION_VERSIONS = 'Versions',\n  GENERATION_UPGRADEABLE_FROM = 'Upgradeable From',\n  GENERATION_UPGRADEABLE_TO = 'Upgradeable To',\n  GENERATION_SUPPORTED_UNTIL = 'Supported Until',\n  GENERATION_BESPOKE = 'Bespoke',\n  // Channel\n  CHANNEL_NAME = 'Name',\n  CHANNEL_DESCRIPTION = 'Description',\n  CHANNEL_DEFAULT_GENERATION = 'Default Generation',\n  CHANNEL_ALLOWED_GENERATIONS = 'Allowed Generations',\n  CHANNEL_IS_DEFAULT = 'Is Default',\n  // ClusterPlan\n  CLUSTER_PLAN_MIGRATABLE_FROM = 'Migratable From',\n  CLUSTER_PLAN_PERFORMANCE_EXPECTATIONS = 'Performance Expectations',\n  // ClusterPlanType\n  CLUSTER_PLAN_TYPE_NAME = 'Name',\n  CLUSTER_PLAN_TYPE_DESCRIPTION = 'Description',\n  CLUSTER_PLAN_TYPE_DEVELOPMENT = 'Development',\n  CLUSTER_PLAN_TYPE_CATEGORY = 'Category',\n  CLUSTER_PLAN_TYPE_AVAILABILITY_CLASS = 'Availability Class',\n  CLUSTER_PLAN_TYPE_ACTIVE_PLAN = 'Active Plan',\n  CLUSTER_PLAN_TYPE_LIMITS = 'Limits',\n  // AlphaFeature (EarlyAccessFeature)\n  ALPHA_FEATURE_NAME = 'Name',\n  ALPHA_FEATURE_AVAILABLE_IN = 'Available In',\n  ALPHA_FEATURE_DOCUMENTATION_LINK = 'Documentation Link',\n  ALPHA_FEATURE_DESCRIPTION = 'Description',\n  ALPHA_FEATURE_ACTION_LABEL = 'Action Label',\n  ALPHA_FEATURE_ACTION_URL = 'Action Url',\n  ALPHA_FEATURE_CLICKWRAP = 'Clickwrap',\n  ALPHA_FEATURE_SALES_PLAN_TYPE_VISIBILITIES = 'Sales Plan Type Visibilities',\n  // SalesPlan\n  SALES_PLAN_NAME = 'Name',\n  SALES_PLAN_METADATA = 'Metadata',\n  SALES_PLAN_CLUSTER_PLAN_CONFIGURATION = 'Cluster Plan Configuration',\n  SALES_PLAN_VERSION = 'Version',\n  // ClusterPlanModification\n  CLUSTER_PLAN_MODIFICATION_NAME = 'Name',\n  CLUSTER_PLAN_MODIFICATION_DESCRIPTION = 'Description',\n  CLUSTER_PLAN_MODIFICATION_CONFIG = 'Config',\n  CLUSTER_PLAN_MODIFICATION_CLUSTER_PLANS = 'Cluster Plans',\n  CLUSTER_PLAN_MODIFICATION_URL = 'Url',\n  CLUSTER_PLAN_MODIFICATION_STATUS = 'Status',\n  // ClusterBulkOperation\n  CLUSTER_BULK_OPERATION_CLUSTERS = 'Clusters',\n  CLUSTER_BULK_OPERATION_STATUS = 'Status',\n  // ClusterModification (parent + config)\n  CLUSTER_MODIFICATION_DESCRIPTION = 'Description',\n  CLUSTER_MODIFICATION_URL = 'Url',\n  CLUSTER_MODIFICATION_PLAN_MODIFICATIONS = 'Plan Modifications',\n  CLUSTER_MODIFICATION_EXPIRES_AT = 'Expires At',\n  CLUSTER_MODIFICATION_STATUS = 'Status',\n  // Connection\n  CONNECTION_NAME = 'Name',\n  CONNECTION_STRATEGY = 'Strategy',\n  CONNECTION_CONFIGURATION = 'Configuration',\n  // Cluster (internal-only lifecycle actions with no customer-facing audit)\n  CLUSTER_IP_ALLOWLIST = 'IP Allowlist',\n  CLUSTER_ENV_VAR_OVERRIDE = 'Environment Variable Override',\n  // A cluster plan modification that was applied to (and updated) this cluster.\n  CLUSTER_APPLIED_PLAN_MODIFICATION = 'Plan Modification',\n}\n"],
-  "mappings": "AAOO,IAAK,oBAAL,kBAAKA,uBAAL;AACL,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,aAAU;AACV,EAAAA,mBAAA,kBAAe;AACf,EAAAA,mBAAA,uBAAoB;AACpB,EAAAA,mBAAA,mBAAgB;AAChB,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,+BAA4B;AAC5B,EAAAA,mBAAA,4BAAyB;AACzB,EAAAA,mBAAA,0BAAuB;AACvB,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,mBAAgB;AAChB,EAAAA,mBAAA,aAAU;AAZA,SAAAA;AAAA,GAAA;AAsBL,IAAK,6BAAL,kBAAKC,gCAAL;AAEL,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,iCAA8B;AAC9B,EAAAA,4BAAA,+BAA4B;AAC5B,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,kBAAe;AACf,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,iCAA8B;AAC9B,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,kCAA+B;AAC/B,EAAAA,4BAAA,2CAAwC;AAExC,EAAAA,4BAAA,4BAAyB;AACzB,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,0CAAuC;AACvC,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,wBAAqB;AACrB,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,+BAA4B;AAC5B,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,8BAA2B;AAC3B,EAAAA,4BAAA,6BAA0B;AAC1B,EAAAA,4BAAA,gDAA6C;AAE7C,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,2CAAwC;AACxC,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,oCAAiC;AACjC,EAAAA,4BAAA,2CAAwC;AACxC,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,6CAA0C;AAC1C,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,sCAAmC;AAEnC,EAAAA,4BAAA,qCAAkC;AAClC,EAAAA,4BAAA,mCAAgC;AAEhC,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,8BAA2B;AAC3B,EAAAA,4BAAA,6CAA0C;AAC1C,EAAAA,4BAAA,qCAAkC;AAClC,EAAAA,4BAAA,iCAA8B;AAE9B,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,0BAAuB;AACvB,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,uCAAoC;AA/D1B,SAAAA;AAAA,GAAA;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/* eslint-disable no-shadow */\nexport enum SystemAuditEntity {\n  GENERATION = 'Generation',\n  CHANNEL = 'Channel',\n  CLUSTER_PLAN = 'Cluster Plan',\n  CLUSTER_PLAN_TYPE = 'Cluster Plan Type',\n  ALPHA_FEATURE = 'Alpha Feature',\n  SALES_PLAN = 'Sales Plan',\n  CLUSTER_PLAN_MODIFICATION = 'Cluster Plan Modification',\n  CLUSTER_BULK_OPERATION = 'Cluster Bulk Operation',\n  CLUSTER_MODIFICATION = 'Cluster Modification',\n  CONNECTION = 'Connection',\n  RELEASE_TRAIN = 'Release Train',\n  CLUSTER = 'Cluster',\n  APPROVAL_JOB = 'Approval Request',\n}\n\n/**\n * Display strings for audited attributes. The `entity` + `entityAttribute` pair\n * is always the key, so duplicate display values across entities (e.g. several\n * `*_NAME = 'Name'`) are intentional and safe. `*_STATUS = 'Status'` is the\n * lifecycle attribute for the modification/operation entities; its from/to carry\n * the raw lifecycle state.\n */\nexport enum SystemAuditEntityAttribute {\n  // Generation\n  GENERATION_NAME = 'Name',\n  GENERATION_VERSIONS = 'Versions',\n  GENERATION_UPGRADEABLE_FROM = 'Upgradeable From',\n  GENERATION_UPGRADEABLE_TO = 'Upgradeable To',\n  GENERATION_SUPPORTED_UNTIL = 'Supported Until',\n  GENERATION_BESPOKE = 'Bespoke',\n  // Channel\n  CHANNEL_NAME = 'Name',\n  CHANNEL_DESCRIPTION = 'Description',\n  CHANNEL_DEFAULT_GENERATION = 'Default Generation',\n  CHANNEL_ALLOWED_GENERATIONS = 'Allowed Generations',\n  CHANNEL_IS_DEFAULT = 'Is Default',\n  // ClusterPlan\n  CLUSTER_PLAN_MIGRATABLE_FROM = 'Migratable From',\n  CLUSTER_PLAN_PERFORMANCE_EXPECTATIONS = 'Performance Expectations',\n  // ClusterPlanType\n  CLUSTER_PLAN_TYPE_NAME = 'Name',\n  CLUSTER_PLAN_TYPE_DESCRIPTION = 'Description',\n  CLUSTER_PLAN_TYPE_DEVELOPMENT = 'Development',\n  CLUSTER_PLAN_TYPE_CATEGORY = 'Category',\n  CLUSTER_PLAN_TYPE_AVAILABILITY_CLASS = 'Availability Class',\n  CLUSTER_PLAN_TYPE_ACTIVE_PLAN = 'Active Plan',\n  CLUSTER_PLAN_TYPE_LIMITS = 'Limits',\n  // AlphaFeature (EarlyAccessFeature)\n  ALPHA_FEATURE_NAME = 'Name',\n  ALPHA_FEATURE_AVAILABLE_IN = 'Available In',\n  ALPHA_FEATURE_DOCUMENTATION_LINK = 'Documentation Link',\n  ALPHA_FEATURE_DESCRIPTION = 'Description',\n  ALPHA_FEATURE_ACTION_LABEL = 'Action Label',\n  ALPHA_FEATURE_ACTION_URL = 'Action Url',\n  ALPHA_FEATURE_CLICKWRAP = 'Clickwrap',\n  ALPHA_FEATURE_SALES_PLAN_TYPE_VISIBILITIES = 'Sales Plan Type Visibilities',\n  // SalesPlan\n  SALES_PLAN_NAME = 'Name',\n  SALES_PLAN_METADATA = 'Metadata',\n  SALES_PLAN_CLUSTER_PLAN_CONFIGURATION = 'Cluster Plan Configuration',\n  SALES_PLAN_VERSION = 'Version',\n  // ClusterPlanModification\n  CLUSTER_PLAN_MODIFICATION_NAME = 'Name',\n  CLUSTER_PLAN_MODIFICATION_DESCRIPTION = 'Description',\n  CLUSTER_PLAN_MODIFICATION_CONFIG = 'Config',\n  CLUSTER_PLAN_MODIFICATION_CLUSTER_PLANS = 'Cluster Plans',\n  CLUSTER_PLAN_MODIFICATION_URL = 'Url',\n  CLUSTER_PLAN_MODIFICATION_STATUS = 'Status',\n  // ClusterBulkOperation\n  CLUSTER_BULK_OPERATION_CLUSTERS = 'Clusters',\n  CLUSTER_BULK_OPERATION_STATUS = 'Status',\n  // ClusterModification (parent + config)\n  CLUSTER_MODIFICATION_DESCRIPTION = 'Description',\n  CLUSTER_MODIFICATION_URL = 'Url',\n  CLUSTER_MODIFICATION_PLAN_MODIFICATIONS = 'Plan Modifications',\n  CLUSTER_MODIFICATION_EXPIRES_AT = 'Expires At',\n  CLUSTER_MODIFICATION_STATUS = 'Status',\n  // Connection\n  CONNECTION_NAME = 'Name',\n  CONNECTION_STRATEGY = 'Strategy',\n  CONNECTION_CONFIGURATION = 'Configuration',\n  // Cluster (internal-only lifecycle actions with no customer-facing audit)\n  CLUSTER_IP_ALLOWLIST = 'IP Allowlist',\n  CLUSTER_ENV_VAR_OVERRIDE = 'Environment Variable Override',\n  // A cluster plan modification that was applied to (and updated) this cluster.\n  CLUSTER_APPLIED_PLAN_MODIFICATION = 'Plan Modification',\n  // ApprovalJob. Every change of state of a four-eyes request is audited, not\n  // only the run: the value of the trail is the answer to \"who decided what,\n  // and when\", and a record of the outcome alone cannot give it.\n  APPROVAL_JOB_STATUS = 'Status',\n  APPROVAL_JOB_ACKS = 'Approvals',\n  APPROVAL_JOB_CLOSED_REASON = 'Closure Reason',\n}\n"],
+  "mappings": "AAOO,IAAK,oBAAL,kBAAKA,uBAAL;AACL,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,aAAU;AACV,EAAAA,mBAAA,kBAAe;AACf,EAAAA,mBAAA,uBAAoB;AACpB,EAAAA,mBAAA,mBAAgB;AAChB,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,+BAA4B;AAC5B,EAAAA,mBAAA,4BAAyB;AACzB,EAAAA,mBAAA,0BAAuB;AACvB,EAAAA,mBAAA,gBAAa;AACb,EAAAA,mBAAA,mBAAgB;AAChB,EAAAA,mBAAA,aAAU;AACV,EAAAA,mBAAA,kBAAe;AAbL,SAAAA;AAAA,GAAA;AAuBL,IAAK,6BAAL,kBAAKC,gCAAL;AAEL,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,iCAA8B;AAC9B,EAAAA,4BAAA,+BAA4B;AAC5B,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,kBAAe;AACf,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,iCAA8B;AAC9B,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,kCAA+B;AAC/B,EAAAA,4BAAA,2CAAwC;AAExC,EAAAA,4BAAA,4BAAyB;AACzB,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,0CAAuC;AACvC,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,wBAAqB;AACrB,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,+BAA4B;AAC5B,EAAAA,4BAAA,gCAA6B;AAC7B,EAAAA,4BAAA,8BAA2B;AAC3B,EAAAA,4BAAA,6BAA0B;AAC1B,EAAAA,4BAAA,gDAA6C;AAE7C,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,2CAAwC;AACxC,EAAAA,4BAAA,wBAAqB;AAErB,EAAAA,4BAAA,oCAAiC;AACjC,EAAAA,4BAAA,2CAAwC;AACxC,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,6CAA0C;AAC1C,EAAAA,4BAAA,mCAAgC;AAChC,EAAAA,4BAAA,sCAAmC;AAEnC,EAAAA,4BAAA,qCAAkC;AAClC,EAAAA,4BAAA,mCAAgC;AAEhC,EAAAA,4BAAA,sCAAmC;AACnC,EAAAA,4BAAA,8BAA2B;AAC3B,EAAAA,4BAAA,6CAA0C;AAC1C,EAAAA,4BAAA,qCAAkC;AAClC,EAAAA,4BAAA,iCAA8B;AAE9B,EAAAA,4BAAA,qBAAkB;AAClB,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,0BAAuB;AACvB,EAAAA,4BAAA,8BAA2B;AAE3B,EAAAA,4BAAA,uCAAoC;AAIpC,EAAAA,4BAAA,yBAAsB;AACtB,EAAAA,4BAAA,uBAAoB;AACpB,EAAAA,4BAAA,gCAA6B;AArEnB,SAAAA;AAAA,GAAA;",
   "names": ["SystemAuditEntity", "SystemAuditEntityAttribute"]
 }

package/dist/index.d.ts

@@ -1,15 +1,20 @@
 export { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js';
 export { isSupportedFailoverRegionPair, SUPPORTED_FAILOVER_REGION_PAIRS, } from './constants/failoverRegionPairs.const.js';
 export type { Stage } from './constants/misc.const.js';
-export { CONSOLE_API_USER_ID, FIRSTNAME_LASTNAME_MAX_LENGTH, HOTBACKUP_MIN_CREATE_PERIOD, MAX_HARDWARE_PACKAGE_COUNT, MAX_LENGTH_CLUSTER_NAME, MINIMUM_EYEPAIRS, NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS, SECRETS_MAX_LENGTH, STARTING_PRICE_PER_MONTH_IN_EURO, TEMPORARY_CLUSTER_NAME, } from './constants/misc.const.js';
+export { CAMUNDA_CLAIMS_NAMESPACE, CONSOLE_API_USER_ID, FIRSTNAME_LASTNAME_MAX_LENGTH, HOTBACKUP_MIN_CREATE_PERIOD, MAX_HARDWARE_PACKAGE_COUNT, MAX_LENGTH_CLUSTER_NAME, MINIMUM_EYEPAIRS, NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS, SECRETS_MAX_LENGTH, STARTING_PRICE_PER_MONTH_IN_EURO, TEMPORARY_CLUSTER_NAME, UNKNOWN_ACTOR_EMAIL, } from './constants/misc.const.js';
 export { getGatewayPropertyHint, getGatewayPropertyPath, isAffectedByStreamlinedDeployment, isPre89AffectedPath, PRE89_AFFECTED_PATHS, PRE89_AFFECTED_PROPERTY_PREFIXES, PRE89_GATEWAY_PROPERTY_PATHS, PRE89_GATEWAY_RESOURCE_PREFIXES, } from './constants/pre89EnvVarMapping.const.js';
 export { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js';
 export { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js';
 export type { TrialExtensionSurveyAnswer, TrialExtensionSurveyQuestion, } from './constants/trialExtensionSurvey.const.js';
 export { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js';
+export { V2_BODY_IDS_MAX, V2_FILTER_IDS_MAX, V2_MAX_PAGE_LIMIT, } from './constants/v2-list.const.js';
 export { ADMIN_APP_RENAME_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION, APP_INTEGRATIONS_89_STREAM_MINOR, APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION, APP_INTEGRATIONS_MIN_VERSION, AUDIT_LOG_TAB_MIN_VERSION, AUTHORIZATION_TOGGLE_MIN_VERSION, AWS_ONLY_GENERATION_MIN_VERSION, BUSINESS_ID_UNIQUENESS_MIN_VERSION, BYOIDP_MIN_VERSION, CLUSTER_SECRETS_LABEL_MIN_VERSION, CLUSTER_STATISTICS_CONFIG_MIN_VERSION, CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION, CONNECTOR_SECRET_SYNC_MIN_VERSION, CONNECTORS_MANAGEMENT_LINK_MIN_VERSION, ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION, ENFORCE_GROUPS_TOGGLE_MIN_VERSION, GATEWAY_SPEC_8_9_MIN_VERSION, HOT_BACKUP_MIN_VERSION, IDENTITY_AUTHORIZATION_MIN_VERSION, IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION, IDENTITY_MANAGEMENT_MIN_VERSION, INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION, JOB_DASHBOARD_MIN_VERSION, LINE_8_9_MIN_VERSION, LINE_8_10_MIN_VERSION, MCP_MIN_VERSION, MULTI_TENANCY_TOGGLE_MIN_VERSION, NEW_CLUSTER_ROLES_MIN_VERSION, OPTIMIZE_DEFAULT_ON_MIN_VERSION, OPTIMIZE_FILTERING_MIN_VERSION, OPTIONAL_TELEMETRY_MIN_VERSION, RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION, REST_API_URL_TRANSFORM_MIN_VERSION, REST_API_V2_MIN_VERSION, RESUME_ALPHA_MIN_VERSION, SECRET_SOURCE_MIN_VERSION, SECRETS_FILTER_MODE_8_6_MIN_VERSION, SECRETS_FILTER_MODE_8_7_MIN_VERSION, SECRETS_FILTER_MODE_8_8_MIN_VERSION, SECRETS_FILTER_MODE_8_9_MIN_VERSION, SECRETS_FILTER_MODE_8_10_MIN_VERSION, SESSION_CONFIG_MIN_VERSION, SWAGGER_MIN_VERSION, SWAGGER_URL_8_9_MIN_VERSION, TASKLIST_MODE_TOGGLE_MIN_VERSION, TASKLIST_UPGRADE_BANNER_MIN_VERSION, TASKLIST_V2_AUTO_ENABLE_FROM_MINOR, TASKLIST_V2_AUTO_ENABLE_TO_MINOR, TASKLIST_V2_DEFAULT_ON_MIN_VERSION, TASKLIST_V2_SETTING_MAX_VERSION, TASKLIST_V2_UPGRADE_MIN_VERSION, TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION, ZEEBE_REST_URL_MIN_VERSION, } from './constants/version-gates.const.js';
+export type { ApprovalActorView, ApprovalDecision, ApprovalDenialCode, } from './approvals/policy.js';
+export { canAcknowledge, canCreate, canExecute, canReject, canWithdraw, effectiveStatus, isExpired, isSameActorEmail, remainingAcks, } from './approvals/policy.js';
 export type { ALERT_SUBSCRIPTION_REPORT_TYPES, ALERT_SUBSCRIPTION_TYPES, AlertSubscriptionDto, AlertSubscriptionEntryDto, AlertSubscriptionWebhookAuth, CheckFailedReason, } from './dtos/AlertSubscription.dto.js';
 export { FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS, HMAC_HEADER_POSITION, HMAC_SUPPORTED_ALGORITHM, } from './dtos/AlertSubscription.dto.js';
+export type { ApprovalAck, ApprovalActor, ApprovalExecutionMode, ApprovalJobDto, ApprovalJobStatus, ApprovalUseCaseDto, } from './dtos/ApprovalJob.dto.js';
+export { APPROVAL_JOB_STATUSES } from './dtos/ApprovalJob.dto.js';
 export type { AuditDto } from './dtos/Audit.dto.js';
 export type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js';
 export type { BackupDto } from './dtos/Backup.dto.js';
@@ -22,11 +27,11 @@ export type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js';
 export type { ClusterSpecChange, ClusterSpecChangeActor, ClusterSpecHistory, } from './dtos/ClusterSpecHistory.dto.js';
 export type { CommonClusterDto, ExternalIdpConfig, OptimizeFilteringConfig, OptimizeFilteringIncludeExclude, OptimizeFilteringPatch, SecretsFilterMode, } from './dtos/CommonCluster.dto.js';
 export type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js';
-export type { ClusterByClientV2Dto, ClusterDatacenterOptionV2Dto, ClusterDetailV2Dto, ClusterFacetsV2Dto, ClusterListItemV2Dto, ClusterParameterOptionV2Dto, ClusterParametersV2Dto, ControlResolvedPermissions, ControlSessionDto, ControlSessionUser, CursorPage, CursorParams, ListClustersV2Params, ListOrganizationsV2Params, ListOrgMembersV2Params, OrgDetailV2Dto, OrgListItemV2Dto, OrgMemberV2Dto, OrgSummaryV2Dto, } from './dtos/ControlV2.dto.js';
+export type { ClusterActivityBucket, ClusterActivityTile, ClusterActivityV2Dto, ClusterActivityV2Response, ClusterByClientV2Dto, ClusterDatacenterOptionV2Dto, ClusterDetailV2Dto, ClusterFacetsV2Dto, ClusterListItemV2Dto, ClusterParameterOptionV2Dto, ClusterParametersV2Dto, ControlResolvedPermissions, ControlSessionDto, ControlSessionUser, CursorPage, CursorParams, ListClustersV2Params, ListOrganizationsV2Params, ListOrgMembersV2Params, OrgDetailV2Dto, OrgListItemV2Dto, OrgMemberV2Dto, OrgSummaryV2Dto, } from './dtos/ControlV2.dto.js';
 export type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js';
 export type { CamundaWebApp, CamundaWebAppWithZeebe, ExternalClusterDto, ExternalOrganizationDto, } from './dtos/ExternalWebapp.dto.js';
 export type { Features } from './dtos/FeatureFlags.dto.js';
-export { type GenerationDto, type GenerationWithClusterCountDto, sortGenerationBySemverOfZeebe, type UpgradableGenerationsDto, } from './dtos/Generations.dto.js';
+export { compareGenerationNamesNewestFirst, type GenerationDto, type GenerationWithClusterCountDto, sortGenerationBySemverOfZeebe, type UpgradableGenerationsDto, } from './dtos/Generations.dto.js';
 export type { Hdp } from './dtos/Hdp.dto.js';
 export type { K8sConfig, K8sConfigLegacyFormat, K8sContext, K8sContextDto, } from './dtos/K8sContext.dto.js';
 export type { MetaDto } from './dtos/Meta.dto.js';
@@ -45,7 +50,7 @@ export type { SystemAuditDto } from './dtos/SystemAudit.dto.js';
 export type { UsageAlertDto } from './dtos/UsageAlert.dto.js';
 export { UsageAlertInitValues, UsageAlertMetric, UsageAlertThresholdLimits, } from './dtos/UsageAlert.dto.js';
 export type { UserMetaDataDto } from './dtos/UserMetaData.dto.js';
-export { type AndNode, CLUSTER_DEFAULT_SEARCH_FIELDS, CLUSTER_SEARCH_FIELDS, type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, findSearchField, isLuceneQueryError, LuceneQueryError, likeArgument, type NotNode, ORG_DEFAULT_SEARCH_FIELDS, ORGANIZATION_SEARCH_FIELDS, type OrNode, parseLuceneQuery, type QueryNode, type RangeNode, type SearchFieldCapability, type SearchFieldSpec, type SearchFieldType, type SearchTermOperator, type TermNode, } from './search/index.js';
+export { type AndNode, CLUSTER_DEFAULT_SEARCH_FIELDS, CLUSTER_SEARCH_FIELDS, type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, findSearchField, idSetPredicate, isLuceneQueryError, joinIdSet, LuceneQueryError, likeArgument, type NotNode, ORG_DEFAULT_SEARCH_FIELDS, ORGANIZATION_SEARCH_FIELDS, type OrNode, parseLuceneQuery, type QueryNode, type RangeNode, type SearchFieldCapability, type SearchFieldSpec, type SearchFieldType, type SearchTermOperator, type TermNode, } from './search/index.js';
 export { AlertSubscriptionReportType, AlertSubscriptionType, } from './enums/AlertSubscription.enum.js';
 export { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js';
 export { AuditService } from './enums/AuditService.enum.js';
@@ -145,4 +150,4 @@ export { extractCamundaUserEmail, guessName, isCamundaUserId, } from './utils/us
 export { checkVersion, isAppIntegrationsVersionSupported, isGenerationResumable, isSecretsFilterModeConfigurable, stripSecfixPostfix, VersionCheckOperator, } from './utils/versionCheck.utils.js';
 export { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js';
 export type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js';
-export { augmentCamundiPermissions, getApplicableRolesForEmployee, isManager, } from './utils/camundiPermissionAugmenter.utils.js';
+export { augmentCamundiPermissions, getApplicableRolesForEmployee, HIBOB_CACHE_KEY, HIBOB_CACHE_NAMESPACE, isManager, } from './utils/camundiPermissionAugmenter.utils.js';

package/dist/index.js

@@ -4,6 +4,7 @@ import {
   SUPPORTED_FAILOVER_REGION_PAIRS
 } from "./constants/failoverRegionPairs.const.js";
 import {
+  CAMUNDA_CLAIMS_NAMESPACE,
   CONSOLE_API_USER_ID,
   FIRSTNAME_LASTNAME_MAX_LENGTH,
   HOTBACKUP_MIN_CREATE_PERIOD,
@@ -13,7 +14,8 @@ import {
   NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,
   SECRETS_MAX_LENGTH,
   STARTING_PRICE_PER_MONTH_IN_EURO,
-  TEMPORARY_CLUSTER_NAME
+  TEMPORARY_CLUSTER_NAME,
+  UNKNOWN_ACTOR_EMAIL
 } from "./constants/misc.const.js";
 import {
   getGatewayPropertyHint,
@@ -28,6 +30,11 @@ import {
 import { PRIVATE_LINK_REGIONS } from "./constants/privateLinkRegions.const.js";
 import { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from "./constants/secureConnectivity.const.js";
 import { TRIAL_EXTENSION_SURVEY_QUESTIONS } from "./constants/trialExtensionSurvey.const.js";
+import {
+  V2_BODY_IDS_MAX,
+  V2_FILTER_IDS_MAX,
+  V2_MAX_PAGE_LIMIT
+} from "./constants/v2-list.const.js";
 import {
   ADMIN_APP_RENAME_MIN_VERSION,
   APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,
@@ -84,12 +91,25 @@ import {
   TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,
   ZEEBE_REST_URL_MIN_VERSION
 } from "./constants/version-gates.const.js";
+import {
+  canAcknowledge,
+  canCreate,
+  canExecute,
+  canReject,
+  canWithdraw,
+  effectiveStatus,
+  isExpired,
+  isSameActorEmail,
+  remainingAcks
+} from "./approvals/policy.js";
 import {
   FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,
   HMAC_HEADER_POSITION,
   HMAC_SUPPORTED_ALGORITHM
 } from "./dtos/AlertSubscription.dto.js";
+import { APPROVAL_JOB_STATUSES } from "./dtos/ApprovalJob.dto.js";
 import {
+  compareGenerationNamesNewestFirst,
   sortGenerationBySemverOfZeebe
 } from "./dtos/Generations.dto.js";
 import {
@@ -118,7 +138,9 @@ import {
   CLUSTER_SEARCH_FIELDS,
   compileQuery,
   findSearchField,
+  idSetPredicate,
   isLuceneQueryError,
+  joinIdSet,
   LuceneQueryError,
   likeArgument,
   ORG_DEFAULT_SEARCH_FIELDS,
@@ -318,11 +340,14 @@ import { default as default2 } from "./config/camundi-permission-rules.js";
 import {
   augmentCamundiPermissions,
   getApplicableRolesForEmployee,
+  HIBOB_CACHE_KEY,
+  HIBOB_CACHE_NAMESPACE,
   isManager
 } from "./utils/camundiPermissionAugmenter.utils.js";
 export {
   ADMIN_APP_RENAME_MIN_VERSION,
   ALLOWED_CAMUNDA_LABELS,
+  APPROVAL_JOB_STATUSES,
   APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,
   APP_INTEGRATIONS_89_STREAM_MINOR,
   APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,
@@ -345,6 +370,7 @@ export {
   BUSINESS_ID_UNIQUENESS_MIN_VERSION,
   BYOIDP_MIN_VERSION,
   BackupStatus,
+  CAMUNDA_CLAIMS_NAMESPACE,
   default2 as CAMUNDI_PERMISSION_RULES,
   CLOUD_PROVIDER_ORDER,
   CLUSTER_DEFAULT_SEARCH_FIELDS,
@@ -378,6 +404,8 @@ export {
   FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,
   FeedbackType,
   GATEWAY_SPEC_8_9_MIN_VERSION,
+  HIBOB_CACHE_KEY,
+  HIBOB_CACHE_NAMESPACE,
   HMAC_HEADER_POSITION,
   HMAC_SUPPORTED_ALGORITHM,
   HOTBACKUP_MIN_CREATE_PERIOD,
@@ -474,11 +502,15 @@ export {
   TEMPORARY_CLUSTER_NAME,
   TRIAL_EXTENSION_SURVEY_QUESTIONS,
   Telemetry,
+  UNKNOWN_ACTOR_EMAIL,
   UnassignableOrganizationRole,
   UsageAlertInitValues,
   UsageAlertMetric,
   UsageAlertThresholdLimits,
   UserMetadataEvent,
+  V2_BODY_IDS_MAX,
+  V2_FILTER_IDS_MAX,
+  V2_MAX_PAGE_LIMIT,
   VALID_LICENSING_MODELS,
   VersionCheckOperator,
   WEEK,
@@ -489,7 +521,13 @@ export {
   allSalesPlanLimits,
   allSettledResultsCounts,
   augmentCamundiPermissions,
+  canAcknowledge,
+  canCreate,
+  canExecute,
+  canReject,
+  canWithdraw,
   checkVersion,
+  compareGenerationNamesNewestFirst,
   compileQuery,
   computeOrgStartDate,
   consoleUserFeaturesFromPermissions,
@@ -500,6 +538,7 @@ export {
   deriveFailoverKeyPolicyPrincipals,
   deriveSecondaryStorageStatus,
   diffInWholeMonths,
+  effectiveStatus,
   enterpriseConnectionMetadataToOrganizationAssignments,
   expandRolesToPermissions,
   extractCamundaUserEmail,
@@ -521,6 +560,7 @@ export {
   getUserPermissionsForOrg,
   guessName,
   hasAvailabilityClass,
+  idSetPredicate,
   isActivitySleepEligible,
   isAffectedByStreamlinedDeployment,
   isAppIntegrationsVersionSupported,
@@ -531,12 +571,14 @@ export {
   isClusterPlanFieldSpec,
   isClusterTagEligibleForSleepCron,
   isEncryptionStatus,
+  isExpired,
   isGenerationResumable,
   isIsBulkClusterGenerationUpdateIten,
   isLuceneQueryError,
   isManager,
   isPre89AffectedPath,
   isSalesPlanEligibleForSleepCron,
+  isSameActorEmail,
   isSecretsFilterModeConfigurable,
   isSleepCronEligible,
   isSupportedFailoverRegionPair,
@@ -546,6 +588,7 @@ export {
   isValidClientName,
   isValidHostname,
   isValidPrivateLinkRegion,
+  joinIdSet,
   likeArgument,
   normalizeCIDRList,
   organizationAssignmentsToEnterpriseConnectionMetadata,
@@ -554,6 +597,7 @@ export {
   parseLuceneQuery,
   passwordPolicyCheck,
   peakWithinTerm,
+  remainingAcks,
   serializeEnvVars,
   sortByAvailabilityClasses,
   sortByClusterPlanTypeCategory,