@camunda/ccma-shared-types 1.1.0 → 1.2.0

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport {\n  isSupportedFailoverRegionPair,\n  SUPPORTED_FAILOVER_REGION_PAIRS,\n} from './constants/failoverRegionPairs.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CONSOLE_API_USER_ID,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MINIMUM_EYEPAIRS,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\n\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type { Features } from './dtos/FeatureFlags.dto.js'\n// Functions\nexport {\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  deprecatedLimit,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  isLuceneQueryError,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type TermNode,\n} from './search/index.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport { expandRolesToPermissions } from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Namespace with runtime values (consts, functions, enums)\nexport { ConsoleSM } from './types/ConsoleSelfManaged.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { ConsoleSMAdminApi } from './types/ConsoleSelfManagedAdminApi.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  Audit as HdpAudit,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport { ConsoleSelfManagedUtils } from './utils/console-sm.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\n\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\n\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\n\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
-  "mappings": "AAUA,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAChD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAK1D,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0DP;AAAA,EAGE;AAAA,OAEK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAoBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EAGA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OAQK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB,SAAS,gCAAgC;AAazC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,iBAAiB;AAmD1B;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AAMxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OAEK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n// ============================================================================\n// Constants (runtime values)\n// ============================================================================\n\nexport { DAY, HOUR, MINUTE, SECOND, WEEK } from './constants/duration.const.js'\nexport {\n  isSupportedFailoverRegionPair,\n  SUPPORTED_FAILOVER_REGION_PAIRS,\n} from './constants/failoverRegionPairs.const.js'\nexport type { Stage } from './constants/misc.const.js'\nexport {\n  CAMUNDA_CLAIMS_NAMESPACE,\n  CONSOLE_API_USER_ID,\n  FIRSTNAME_LASTNAME_MAX_LENGTH,\n  HOTBACKUP_MIN_CREATE_PERIOD,\n  MAX_HARDWARE_PACKAGE_COUNT,\n  MAX_LENGTH_CLUSTER_NAME,\n  MINIMUM_EYEPAIRS,\n  NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,\n  SECRETS_MAX_LENGTH,\n  STARTING_PRICE_PER_MONTH_IN_EURO,\n  TEMPORARY_CLUSTER_NAME,\n  UNKNOWN_ACTOR_EMAIL,\n} from './constants/misc.const.js'\nexport {\n  getGatewayPropertyHint,\n  getGatewayPropertyPath,\n  isAffectedByStreamlinedDeployment,\n  isPre89AffectedPath,\n  PRE89_AFFECTED_PATHS,\n  PRE89_AFFECTED_PROPERTY_PREFIXES,\n  PRE89_GATEWAY_PROPERTY_PATHS,\n  PRE89_GATEWAY_RESOURCE_PREFIXES,\n} from './constants/pre89EnvVarMapping.const.js'\nexport { PRIVATE_LINK_REGIONS } from './constants/privateLinkRegions.const.js'\nexport { SECURE_CONNECTIVITY_ALLOWED_ENTRIES_LIMIT } from './constants/secureConnectivity.const.js'\nexport type {\n  TrialExtensionSurveyAnswer,\n  TrialExtensionSurveyQuestion,\n} from './constants/trialExtensionSurvey.const.js'\nexport { TRIAL_EXTENSION_SURVEY_QUESTIONS } from './constants/trialExtensionSurvey.const.js'\nexport {\n  V2_BODY_IDS_MAX,\n  V2_FILTER_IDS_MAX,\n  V2_MAX_PAGE_LIMIT,\n} from './constants/v2-list.const.js'\nexport {\n  ADMIN_APP_RENAME_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION,\n  APP_INTEGRATIONS_89_STREAM_MINOR,\n  APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION,\n  APP_INTEGRATIONS_MIN_VERSION,\n  AUDIT_LOG_TAB_MIN_VERSION,\n  AUTHORIZATION_TOGGLE_MIN_VERSION,\n  AWS_ONLY_GENERATION_MIN_VERSION,\n  BUSINESS_ID_UNIQUENESS_MIN_VERSION,\n  BYOIDP_MIN_VERSION,\n  CLUSTER_SECRETS_LABEL_MIN_VERSION,\n  CLUSTER_STATISTICS_CONFIG_MIN_VERSION,\n  CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION,\n  CONNECTOR_SECRET_SYNC_MIN_VERSION,\n  CONNECTORS_MANAGEMENT_LINK_MIN_VERSION,\n  ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION,\n  ENFORCE_GROUPS_TOGGLE_MIN_VERSION,\n  GATEWAY_SPEC_8_9_MIN_VERSION,\n  HOT_BACKUP_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_MIN_VERSION,\n  IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION,\n  IDENTITY_MANAGEMENT_MIN_VERSION,\n  INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION,\n  JOB_DASHBOARD_MIN_VERSION,\n  LINE_8_9_MIN_VERSION,\n  LINE_8_10_MIN_VERSION,\n  MCP_MIN_VERSION,\n  MULTI_TENANCY_TOGGLE_MIN_VERSION,\n  NEW_CLUSTER_ROLES_MIN_VERSION,\n  OPTIMIZE_DEFAULT_ON_MIN_VERSION,\n  OPTIMIZE_FILTERING_MIN_VERSION,\n  OPTIONAL_TELEMETRY_MIN_VERSION,\n  RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION,\n  REST_API_URL_TRANSFORM_MIN_VERSION,\n  REST_API_V2_MIN_VERSION,\n  RESUME_ALPHA_MIN_VERSION,\n  SECRET_SOURCE_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_6_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_7_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_8_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_9_MIN_VERSION,\n  SECRETS_FILTER_MODE_8_10_MIN_VERSION,\n  SESSION_CONFIG_MIN_VERSION,\n  SWAGGER_MIN_VERSION,\n  SWAGGER_URL_8_9_MIN_VERSION,\n  TASKLIST_MODE_TOGGLE_MIN_VERSION,\n  TASKLIST_UPGRADE_BANNER_MIN_VERSION,\n  TASKLIST_V2_AUTO_ENABLE_FROM_MINOR,\n  TASKLIST_V2_AUTO_ENABLE_TO_MINOR,\n  TASKLIST_V2_DEFAULT_ON_MIN_VERSION,\n  TASKLIST_V2_SETTING_MAX_VERSION,\n  TASKLIST_V2_UPGRADE_MIN_VERSION,\n  TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION,\n  ZEEBE_REST_URL_MIN_VERSION,\n} from './constants/version-gates.const.js'\n\n// ============================================================================\n// DTOs - Types (interfaces and type aliases)\n// ============================================================================\n\nexport type {\n  ApprovalActorView,\n  ApprovalDecision,\n  ApprovalDenialCode,\n} from './approvals/policy.js'\nexport {\n  canAcknowledge,\n  canCreate,\n  canExecute,\n  canReject,\n  canWithdraw,\n  effectiveStatus,\n  isExpired,\n  isSameActorEmail,\n  remainingAcks,\n} from './approvals/policy.js'\nexport type {\n  ALERT_SUBSCRIPTION_REPORT_TYPES,\n  ALERT_SUBSCRIPTION_TYPES,\n  AlertSubscriptionDto,\n  AlertSubscriptionEntryDto,\n  AlertSubscriptionWebhookAuth,\n  CheckFailedReason,\n} from './dtos/AlertSubscription.dto.js'\n// DTOs - Values (constants)\nexport {\n  FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS,\n  HMAC_HEADER_POSITION,\n  HMAC_SUPPORTED_ALGORITHM,\n} from './dtos/AlertSubscription.dto.js'\n// Approvals - the wire types, and the rules that read them. Both are pure and\n// browser-safe, so control-backend, control-frontend and cloudbot run the same\n// code and cannot disagree.\nexport type {\n  ApprovalAck,\n  ApprovalActor,\n  ApprovalExecutionMode,\n  ApprovalJobDto,\n  ApprovalJobStatus,\n  ApprovalUseCaseDto,\n} from './dtos/ApprovalJob.dto.js'\nexport { APPROVAL_JOB_STATUSES } from './dtos/ApprovalJob.dto.js'\n\nexport type { AuditDto } from './dtos/Audit.dto.js'\nexport type { Auth0ResourceServerDto } from './dtos/Auth0ResourceServer.dto.js'\nexport type { BackupDto } from './dtos/Backup.dto.js'\nexport type { BackupScheduleDto } from './dtos/BackupSchedule.dto.js'\nexport type { ByomClientDto, ByomStatus } from './dtos/ByomClient.dto.js'\nexport type {\n  ClusterDeferredSpecChange,\n  DeferredSpecChangeType,\n} from './dtos/ClusterDeferredSpecChange.dto.js'\nexport type { ClusterIpWhitelistDto } from './dtos/ClusterIpWhitelist.dto.js'\nexport type { ClusterPlanDto } from './dtos/ClusterPlan.dto.js'\nexport type { ClusterPlanTypeDto } from './dtos/ClusterPlanType.dto.js'\nexport type {\n  ClusterSpecChange,\n  ClusterSpecChangeActor,\n  ClusterSpecHistory,\n} from './dtos/ClusterSpecHistory.dto.js'\nexport type {\n  CommonClusterDto,\n  ExternalIdpConfig,\n  OptimizeFilteringConfig,\n  OptimizeFilteringIncludeExclude,\n  OptimizeFilteringPatch,\n  SecretsFilterMode,\n} from './dtos/CommonCluster.dto.js'\nexport type { ConsoleClusterDto } from './dtos/ConsoleCluster.dto.js'\nexport type {\n  ClusterActivityBucket,\n  ClusterActivityTile,\n  ClusterActivityV2Dto,\n  ClusterActivityV2Response,\n  ClusterByClientV2Dto,\n  ClusterDatacenterOptionV2Dto,\n  ClusterDetailV2Dto,\n  ClusterFacetsV2Dto,\n  ClusterListItemV2Dto,\n  ClusterParameterOptionV2Dto,\n  ClusterParametersV2Dto,\n  ControlResolvedPermissions,\n  ControlSessionDto,\n  ControlSessionUser,\n  CursorPage,\n  CursorParams,\n  ListClustersV2Params,\n  ListOrganizationsV2Params,\n  ListOrgMembersV2Params,\n  OrgDetailV2Dto,\n  OrgListItemV2Dto,\n  OrgMemberV2Dto,\n  OrgSummaryV2Dto,\n} from './dtos/ControlV2.dto.js'\nexport type { EarlyAccessFeatureDto } from './dtos/EarlyAccessFeature.dto.js'\nexport type {\n  CamundaWebApp,\n  CamundaWebAppWithZeebe,\n  ExternalClusterDto,\n  ExternalOrganizationDto,\n} from './dtos/ExternalWebapp.dto.js'\nexport type { Features } from './dtos/FeatureFlags.dto.js'\n// Functions\nexport {\n  compareGenerationNamesNewestFirst,\n  type GenerationDto,\n  type GenerationWithClusterCountDto,\n  sortGenerationBySemverOfZeebe,\n  type UpgradableGenerationsDto,\n} from './dtos/Generations.dto.js'\n// Namespace (type-only - contains only interfaces)\nexport type { Hdp } from './dtos/Hdp.dto.js'\nexport type {\n  K8sConfig,\n  K8sConfigLegacyFormat,\n  K8sContext,\n  K8sContextDto,\n} from './dtos/K8sContext.dto.js'\nexport type { MetaDto } from './dtos/Meta.dto.js'\nexport type {\n  AutoJoinAssignment,\n  LicensingModelType,\n  LlmProviderName,\n  OrganizationDto,\n  OrganizationMetadata,\n  OrgOwner,\n  OrgWithNameAndSalesPlan,\n} from './dtos/Organization.dto.js'\nexport {\n  LICENSING_MODEL_DISPLAY_NAMES,\n  VALID_LICENSING_MODELS,\n} from './dtos/Organization.dto.js'\nexport type { OrganizationMemberDto } from './dtos/OrganizationMember.dto.js'\nexport type { OrganizationToSalesPlanDto } from './dtos/OrganizationToSalesPlan.dto.js'\nexport type {\n  ReleaseTrainSanityReport,\n  SanityFix,\n  SanityRuleInfo,\n  SanitySeverity,\n  SanityViolation,\n} from './dtos/ReleaseTrainSanity.dto.js'\nexport type { RestoreDto, RestoreState } from './dtos/Restore.dto.js'\n// SalesPlan.dto - Types\nexport type {\n  ClusterLimits,\n  ConsumptionDataItem,\n  Limits,\n  SalesPlanDto,\n  SalesPlanMetadata,\n} from './dtos/SalesPlan.dto.js'\n// SalesPlan.dto - Values (constants and functions)\nexport {\n  allClusterBasedLimits,\n  allSalesPlanLimits,\n  deprecatedLimit,\n  MAX_CLUSTER_CLIENTS_DEFAULT,\n  MAX_CLUSTER_CLIENTS_DEV,\n  RETENTION_LIMIT_DEFAULT,\n  RETENTION_LIMIT_MAXIMUM,\n  RETENTION_LIMIT_MINIMUM,\n  unusedClusterBasedLimits,\n  unusedSalesPlanLimits,\n} from './dtos/SalesPlan.dto.js'\nexport type { SecureConnectivityDto } from './dtos/SecureConnectivity.dto.js'\nexport type { SignupDto } from './dtos/Signup.dto.js'\nexport type {\n  StorybookConfig,\n  StorybookConfigBackup,\n  StorybookConfigChannel,\n  StorybookConfigDatacenter,\n  StorybookConfigGeneration,\n} from './dtos/StorybookConfig.dto.js'\nexport type { SystemAuditDto } from './dtos/SystemAudit.dto.js'\n// UsageAlert.dto - Types\nexport type { UsageAlertDto } from './dtos/UsageAlert.dto.js'\n// UsageAlert.dto - Values (enum and constants)\nexport {\n  UsageAlertInitValues,\n  UsageAlertMetric,\n  UsageAlertThresholdLimits,\n} from './dtos/UsageAlert.dto.js'\nexport type { UserMetaDataDto } from './dtos/UserMetaData.dto.js'\n// Lucene-style table search (parser + AST \u2192 SQL compiler + field registries).\nexport {\n  type AndNode,\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  findSearchField,\n  idSetPredicate,\n  isLuceneQueryError,\n  joinIdSet,\n  LuceneQueryError,\n  likeArgument,\n  type NotNode,\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n  type OrNode,\n  parseLuceneQuery,\n  type QueryNode,\n  type RangeNode,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n  type SearchTermOperator,\n  type TermNode,\n} from './search/index.js'\n\n// ============================================================================\n// Enums (runtime values)\n// ============================================================================\n\nexport {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from './enums/AlertSubscription.enum.js'\nexport { AuditEntity, AuditEntityAttribute } from './enums/AuditEntity.enum.js'\nexport { AuditService } from './enums/AuditService.enum.js'\nexport { BackupStatus } from './enums/BackupStatus.enum.js'\nexport {\n  ClusterBulkOperationStatus,\n  ClusterBulkOperationType,\n} from './enums/ClusterBulkOperation.enum.js'\nexport { ClusterClientPermission } from './enums/ClusterClientPermissions.enum.js'\nexport { ClusterEncryptionKey } from './enums/ClusterEncryptionKey.enum.js'\nexport { ClusterStatus } from './enums/ClusterStatus.enum.js'\nexport { ConsoleAPIClientPermission } from './enums/ConsoleApiClientPermission.enum.js'\nexport { ErrorType } from './enums/ErrorType.enum.js'\nexport type {\n  AssignableOrganizationRoleType,\n  OrganizationRoleType,\n  UnassignableOrganizationRoleType,\n} from './enums/OrganizationRole.enum.js'\nexport {\n  AssignableOrganizationRole,\n  LegacyHeldOrganizationRole,\n  OrganizationRole,\n  UnassignableOrganizationRole,\n} from './enums/OrganizationRole.enum.js'\nexport { SseEntity, SseType } from './enums/Sse.enum.js'\nexport {\n  SystemAuditEntity,\n  SystemAuditEntityAttribute,\n} from './enums/SystemAuditEntity.enum.js'\n\n// ============================================================================\n// Permissions - Namespaces (runtime values)\n// ============================================================================\n\nexport { AccountsPermissions } from './permissions/accounts.permissions.js'\nexport { AlertDistributorPermissions } from './permissions/alert-distributor.permissions.js'\nexport { AuditLoggerPermissions } from './permissions/auditlogger.permissions.js'\nexport {\n  accountsUserFeaturesFromPermissions,\n  consoleUserFeaturesFromPermissions,\n} from './permissions/combo.js'\nexport { ConsolePermissions } from './permissions/console.permissions.js'\nexport { NotificationPermissions } from './permissions/notification.permissions.js'\n// profile.permissions - Types\nexport type { OnboardConfig } from './permissions/profile.permissions.js'\n// profile.permissions - Values (constants)\n// NOTE: the `allowed` email lists (CLOUD_TEAM_EMAILS, SRE_TEAM_EMAILS, etc.)\n// intentionally live in the private `@camunda-cloud/shared-backend` package\n// instead of here, since this package is published publicly to npm.\nexport { PROFILES } from './permissions/profile.permissions.js'\nexport { expandRolesToPermissions } from './permissions/roleExpansion.utils.js'\n\n// ============================================================================\n// Types - Type-only exports (interfaces and type aliases)\n// ============================================================================\n\nexport type { AuditData } from './types/AuditData.type.js'\n// AutoSleep.type - Types\nexport type {\n  ActivitySleepEligibilityOptions,\n  SleepCronEligibilityOptions,\n} from './types/AutoSleep.type.js'\n// AutoSleep.type - Values (constants and functions)\nexport {\n  INTERNAL_LOW_HARDWARE_PLAN_NAME,\n  isActivitySleepEligible,\n  isClusterTagEligibleForSleepCron,\n  isSalesPlanEligibleForSleepCron,\n  isSleepCronEligible,\n  SLEEP_CRON_ELIGIBLE_TAGS,\n} from './types/AutoSleep.type.js'\nexport type {\n  BotContext,\n  BotOptions,\n  BotRequest,\n  GetUserDetailsResponse,\n  ListRolesForUserResponse,\n  UpdateUserRolesRequest,\n  UpdateUserRolesResponse,\n  UserContext,\n  UserDetails,\n} from './types/Bot.types.js'\n// BulkOperation.type - Types\nexport type {\n  BulkClusterDeletionContent,\n  BulkClusterDeletionItem,\n  BulkClusterGenerationUpdateItem,\n  BulkClusterPlanTypeUpdateContent,\n  BulkClusterPlanTypeUpdateItem,\n  BulkClusterPlanUpdateContent,\n  BulkClusterPlanUpdateItem,\n  BulkGenerationUpdateContent,\n  GenericBulkClusterOperationContent,\n  GenericBulkOperationContent,\n  GenericClusterBulkOperationItem,\n} from './types/BulkOperation.type.js'\n// BulkOperation.type - Functions (type guards)\nexport {\n  isBulkClusterDeletionItem,\n  isBulkClusterPlanTypeUpdateItem,\n  isBulkClusterPlanUpdateItem,\n  isIsBulkClusterGenerationUpdateIten,\n} from './types/BulkOperation.type.js'\n// C8ClusterComponentVersions.type - Types\nexport type {\n  ImmutableZeebeClusterVersionsDto,\n  MutableZeebeClusterVersionsDto,\n  ZeebeClusterVersionsDto,\n} from './types/C8ClusterComponentVersions.type.js'\n// C8ClusterComponentVersions.type - Values (constants)\nexport {\n  AllThings,\n  ImmutableThings,\n  MutableThings,\n} from './types/C8ClusterComponentVersions.type.js'\n// CamundaClusterLabels.type - Types\nexport type {\n  CamundaClusterStage,\n  CamundaClusterStageLabel,\n  ClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// CamundaClusterLabels.type - Values (constants)\nexport {\n  ALLOWED_CAMUNDA_LABELS,\n  StageClusterLabels,\n} from './types/CamundaClusterLabels.type.js'\n// Chargebee.type - Types\nexport type { SubscriptionItem } from './types/Chargebee.type.js'\n// Chargebee.type - Values (enums)\nexport { ConsumptionData, ConsumptionDataType } from './types/Chargebee.type.js'\n// ClusterBulkOperation.type - Types\nexport type {\n  ClusterBulkOperationAck,\n  ClusterBulkOperationClusterDto,\n  ClusterBulkOperationContent,\n  ClusterBulkOperationDto,\n  ClusterBulkOperationGenerationUpdateParameter,\n  ClusterBulkOperationParameter,\n  ClusterBulkOperationPlanTypeUpdateParameter,\n  ClusterBulkOperationPlanUpdateParameter,\n  ClusterBulkOperationPostContent,\n  ClusterSleepWakeupParameter,\n} from './types/ClusterBulkOperation.type.js'\nexport type {\n  ClusterModificationConfigDto,\n  ClusterModificationDto,\n} from './types/ClusterModification.type.js'\n// ClusterPlanFields.type - Values (field spec and type guard)\nexport {\n  CLUSTER_PLAN_FIELDS,\n  type ClusterPlanFieldSpec,\n  type ClusterPlanFieldTree,\n  isClusterPlanFieldSpec,\n} from './types/ClusterPlanFields.type.js'\nexport type {\n  ClusterPlanModificationAck,\n  ClusterPlanModificationConfig,\n  ClusterPlanModificationDto,\n} from './types/ClusterPlanModification.type.js'\n// ClusterPlanTypeAvailabilityClass.type - Values (enum and function)\nexport {\n  ClusterPlanTypeAvailabilityClass,\n  sortByAvailabilityClasses,\n} from './types/ClusterPlanTypeAvailabilityClass.type.js'\n// ClusterPlanTypeCategory.type - Values (enum and functions)\nexport {\n  ClusterPlanTypeCategory,\n  hasAvailabilityClass,\n  sortByClusterPlanTypeCategory,\n} from './types/ClusterPlanTypeCategory.type.js'\nexport type { ClusterPlanTypesToConfig } from './types/ClusterPlanTypesToConfig.type.js'\nexport type { ClusterPlanTypesToReserved } from './types/ClusterPlanTypesToReserved.type.js'\nexport type {\n  ClusterUsageDataRequest,\n  ClusterUsageMetricsAddRequestByMetricHeap,\n  ClusterUsageMetricsData,\n  ClusterUsageMetricsFilter,\n  ClusterUsageOrgStartDate,\n} from './types/ClusterUsageMetrics.type.js'\n// Namespace with runtime values (consts, functions, enums)\nexport { ConsoleSM } from './types/ConsoleSelfManaged.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { ConsoleSMAdminApi } from './types/ConsoleSelfManagedAdminApi.type.js'\n// Dashboard.types - Types\nexport type {\n  DashboardConfig,\n  DashboardMappingItem,\n  DashboardMappingTarget,\n  DashboardResultPrimitive,\n  DashboardResultRow,\n  EngineeringOperationsDashboardResponse,\n} from './types/Dashboard.types.js'\nexport type { EnterpriseIncludingValueMetrics } from './types/EnterpriseIncludingValueMetrics.type.js'\nexport type {\n  HdpTenantUsageBreakdown,\n  HdpTenantUsagePerClusterPoint,\n  HdpTenantUsagePoint,\n} from './types/HdpTenantUsage.type.js'\n// hdp.types - Types (interfaces)\nexport type {\n  AlertSubscription as HdpAlertSubscription,\n  Audit as HdpAudit,\n  ByomClient as HdpByomClient,\n  Channel as HdpChannel,\n  Cluster as HdpCluster,\n  ClusterBackup as HdpClusterBackup,\n  ClusterBackupSchedule as HdpClusterBackupSchedule,\n  ClusterBulkOperation as HdpClusterBulkOperation,\n  ClusterClient as HdpClusterClient,\n  ClusterModification as HdpClusterModification,\n  ClusterPlan as HdpClusterPlan,\n  ClusterPlanType as HdpClusterPlanType,\n  ConnectorSecret as HdpConnectorSecret,\n  ConsoleApiClient as HdpConsoleApiClient,\n  Datacenter as HdpDatacenter,\n  Generation as HdpGeneration,\n  HdpBackendChangeEvent,\n  HdpClusterModificationConfig,\n  HdpEntity,\n  HdpPrometheusDataCapacityDataPoint,\n  Invite as HdpInvite,\n  LlmSpend as HdpLlmSpend,\n  Organization as HdpOrganization,\n  SecureConnectivity as HdpSecureConnectivity,\n  SystemAudit as HdpSystemAudit,\n  TelemetryData as HdpTelemetryData,\n  UsageAlert as HdpUsageAlert,\n  User as HdpUser,\n  UserLogin as HdpUserLogin,\n} from './types/hdp.types.js'\n// hdp.types - Values (enums)\nexport {\n  AlertSubscriptionReportType as HdpAlertSubscriptionReportType,\n  AlertSubscriptionType as HdpAlertSubscriptionType,\n} from './types/hdp.types.js'\n// notification.type - Types\nexport type {\n  GlobalNotification,\n  NotificationDto,\n  NotificationMeta,\n  NotificationOptions,\n  NotificationPermission,\n  NotificationSource,\n  NotificationState,\n  NotificationType,\n  OrgNotification,\n  UserNotification,\n  UserOrgNotification,\n} from './types/notification.type.js'\n// notification.type - Values (enums and constants)\nexport {\n  NotificationPermissionValues,\n  NotificationSourceEnum,\n  NotificationStateEnum,\n  NotificationTypeEnum,\n} from './types/notification.type.js'\n// OrganizationPermission.type - Types\nexport type {\n  CreateReadUpdateDelete,\n  OrganizationPermissions,\n} from './types/OrganizationPermission.type.js'\n// OrganizationPermission.type - Values (constants)\nexport {\n  OrganizationPermissionsDescriptions,\n  PermissionsForOrganizationRole,\n} from './types/OrganizationPermission.type.js'\n// Roles.js - Types\nexport type {\n  AccountRoles,\n  ConsoleRoles,\n  ModelerRoles,\n  Roles,\n} from './types/Roles.js'\n// Roles.js - Values (constants)\nexport { SAFE_ROLES } from './types/Roles.js'\n// SalesPlanType.type - Types\nexport type {\n  DisplayedSalesPlan,\n  RevisitedSalesPlanName,\n} from './types/SalesPlanType.type.js'\n// SalesPlanType.type - Values (enums and functions)\nexport {\n  AnalyticsSalesPlanType,\n  getAnalyticsSalesPlanFromOrgSalesPlan,\n  getDisplayedSalesPlan,\n  getRevisitedSalesPlanName,\n  OPTIMIZE_DISABLED_PLAN_TYPES,\n  SalesPlanType,\n} from './types/SalesPlanType.type.js'\n// SpamDetection.type - Types\nexport type { SpamDetectionPatterns } from './types/SpamDetection.type.js'\n// SpamDetection.type - Values (constants)\nexport { TEERGRUBE_PATTERNS } from './types/SpamDetection.type.js'\nexport type {\n  AlertSubscriptionSseEvent,\n  BackupSseEvent,\n  ClusterClientSseEvent,\n  ClusterSseEvent,\n  ConnectorSecretsSseEvent,\n  ConsoleApiClientSseEvent,\n  ConsoleSseEvent,\n  MonitoringSseEvent,\n  SecureConnectivitySseEvent,\n  SseClusterPayload,\n  SseMonitoringPayload,\n  SseSecureConnectivityPayload,\n} from './types/SseEvent.type.js'\n// Namespace (type-only - contains only interfaces)\nexport type { AccountsStats } from './types/Stats.types.js'\n// Survey.type - Types\nexport type { Persona, SurveyDto } from './types/Survey.type.js'\n// Survey.type - Values (enum)\nexport { FeedbackType } from './types/Survey.type.js'\n// SuspendStrategy.type - Types\nexport type {\n  GetSuspendStrategyOptions,\n  SuspendStrategy,\n} from './types/SuspendStrategy.type.js'\n// SuspendStrategy.type - Values (function)\nexport { getSuspendStrategy } from './types/SuspendStrategy.type.js'\nexport type { SystemAuditData } from './types/SystemAuditData.type.js'\n\n// Namespace (runtime value)\nexport { Telemetry } from './types/Telemetry.type.js'\n\n// TrialManagement.types - Types\nexport type {\n  ExtensionListItem,\n  ExtensionListResponse,\n  OrgTrialDetail,\n  TrialExtensionSource,\n  TrialManagementStats,\n} from './types/TrialManagement.types.js'\n\n// User.type - Types\nexport type {\n  AccountsData,\n  AppMetadata,\n  BasicUser,\n  BlockedFor,\n  Identity,\n  OrgMembership,\n  User,\n  UserMetadata,\n  UserRequest,\n} from './types/User.type.js'\n\n// User.type - Values (enum)\nexport { UserMetadataEvent } from './types/User.type.js'\n\nexport type {\n  UniqueTaskUser,\n  ValueMetrics,\n  ValueMetricsPerYearMonth,\n} from './types/ValueMetrics.type.js'\n\n// ============================================================================\n// Utils - Classes (runtime values)\n// ============================================================================\n\nexport {\n  CLOUD_PROVIDER_ORDER,\n  getCloudProviderLabel,\n  getCloudProviderRank,\n} from './utils/cloudProvider.utils.js'\nexport {\n  type ConnectivityStatus,\n  deriveConnectivityMessage,\n  deriveConnectivityStatus,\n} from './utils/connectivityStatus.utils.js'\nexport { ConsoleSelfManagedUtils } from './utils/console-sm.utils.js'\nexport type {\n  CronScheduleValidationFailure,\n  CronScheduleValidationResult,\n  CronScheduleValidationSuccess,\n} from './utils/cronSchedule.utils.js'\nexport {\n  BACKUP_SCHEDULE_MIN_INTERVAL_MINUTES,\n  validateCronSchedule,\n} from './utils/cronSchedule.utils.js'\nexport {\n  deriveEncryptionStatus,\n  type EncryptionStatus,\n  isEncryptionStatus,\n} from './utils/encryptionStatus.utils.js'\n// enterprise-connection.utils - Types\nexport type { EnterpriseConnectionOrganizationAssignment } from './utils/enterprise-connection.utils.js'\n// enterprise-connection.utils - Values (functions)\nexport {\n  enterpriseConnectionMetadataToOrganizationAssignments,\n  organizationAssignmentsToEnterpriseConnectionMetadata,\n} from './utils/enterprise-connection.utils.js'\nexport {\n  addMonthsClamped,\n  DEFAULT_ENTERPRISE_DURATION_IN_MONTHS,\n  diffInWholeMonths,\n  type EnterpriseTermWindow,\n  getCurrentEnterpriseTerm,\n  peakWithinTerm,\n  toUtcDayStartMs,\n} from './utils/enterpriseTerm.utils.js'\nexport type { EnvVarEntry } from './utils/envVars.js'\nexport { parseEnvVars, serializeEnvVars } from './utils/envVars.js'\nexport {\n  deriveFailoverKeyPolicyPrincipals,\n  type FailoverKeyPolicyPrincipals,\n} from './utils/failoverKeyPolicy.utils.js'\nexport {\n  KMS_ARN,\n  KMS_MRK_ARN,\n  type KmsArnValidationError,\n  type ParsedKmsArn,\n  parseKmsArn,\n  validateKmsArnForRegion,\n} from './utils/kmsArn.utils.js'\nexport { validateLabels } from './utils/labelValidator.utils.js'\nexport { ObjectMergeUtils } from './utils/objectMerge.utils.js'\nexport {\n  computeOrgStartDate,\n  type OrgStartDateInput,\n} from './utils/orgStartDate.utils.js'\nexport {\n  getPermissionsByRoles,\n  getUserPermissionsForOrg,\n} from './utils/orgs/OrgHelper.js'\n\n// PasswordPolicy - Types\nexport type {\n  PasswordPolicyRequest,\n  PasswordPolicyResult,\n} from './utils/PasswordPolicy.js'\n\n// PasswordPolicy - Values (constants and function)\nexport {\n  MAXLENGTH as PASSWORD_POLICY_MAXLENGTH,\n  MINLENGTH as PASSWORD_POLICY_MINLENGTH,\n  passwordPolicyCheck,\n} from './utils/PasswordPolicy.js'\n\nexport {\n  deriveSecondaryStorageStatus,\n  type SecondaryStorageStatus,\n} from './utils/secondaryStorageStatus.utils.js'\n\nexport {\n  allSettledResultsCounts,\n  getFulfilledPromises,\n  getRejectedPromises,\n  getSettledSummary,\n} from './utils/settledPromises.util.js'\n\nexport {\n  isValidAwsArn,\n  isValidCIDR,\n  isValidCIDRList,\n  isValidClientName,\n  isValidHostname,\n  isValidPrivateLinkRegion,\n  normalizeCIDRList,\n} from './utils/string-validation.utils.js'\nexport {\n  extractCamundaUserEmail,\n  guessName,\n  isCamundaUserId,\n} from './utils/user.utils.js'\n\n// versionCheck.utils - Values (enum and function)\nexport {\n  checkVersion,\n  isAppIntegrationsVersionSupported,\n  isGenerationResumable,\n  isSecretsFilterModeConfigurable,\n  stripSecfixPostfix,\n  VersionCheckOperator,\n} from './utils/versionCheck.utils.js'\n\n// ============================================================================\n// Config - Configuration files and types\n// ============================================================================\n\nexport { default as CAMUNDI_PERMISSION_RULES } from './config/camundi-permission-rules.js'\nexport type { CamundiPermissionRules } from './config/camundi-permission-rules.types.js'\n\nexport {\n  augmentCamundiPermissions,\n  getApplicableRolesForEmployee,\n  HIBOB_CACHE_KEY,\n  HIBOB_CACHE_NAMESPACE,\n  isManager,\n} from './utils/camundiPermissionAugmenter.utils.js'\n"],
+  "mappings": "AAUA,SAAS,KAAK,MAAM,QAAQ,QAAQ,YAAY;AAChD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAK1D,SAAS,wCAAwC;AACjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAYP,SAAS,6BAA6B;AA8DtC;AAAA,EACE;AAAA,EAGA;AAAA,OAEK;AAmBP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAoBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EAEE;AAAA,EACA;AAAA,EAGA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,OAQK;AAMP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,4BAA4B;AAClD,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AACxC,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC;AAC3C,SAAS,iBAAiB;AAM1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,eAAe;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAMP,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAOxC,SAAS,gBAAgB;AACzB,SAAS,gCAAgC;AAazC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,iBAAiB,2BAA2B;AAmBrD;AAAA,EACE;AAAA,EAGA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,iBAAiB;AAmD1B;AAAA,EACiC,+BAA/BA;AAAA,EACyB,yBAAzBC;AAAA,OACK;AAgBP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP,SAAS,kBAAkB;AAO3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,0BAA0B;AAoBnC,SAAS,oBAAoB;AAO7B,SAAS,0BAA0B;AAInC,SAAS,iBAAiB;AAyB1B,SAAS,yBAAyB;AAYlC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AACP,SAAS,+BAA+B;AAMxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAIP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,cAAc,wBAAwB;AAC/C;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASP;AAAA,EACe;AAAA,EACA;AAAA,EACb;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OAEK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAoB,WAAXC,gBAA2C;AAGpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": ["AlertSubscriptionReportType", "AlertSubscriptionType", "default"]
 }

package/dist/search/cluster-search-fields.js

@@ -50,11 +50,19 @@ const CLUSTER_SEARCH_FIELDS = [
   {
     field: "generation",
     label: "Generation",
-    description: "Cluster generation name.",
+    description: "Cluster generation name. More than one generation can carry the same name. Use a full generationId to match exactly one.",
     type: "string",
     capabilities: ["match"],
     example: 'generation:"Zeebe 8.6.0"'
   },
+  {
+    field: "generationId",
+    label: "Generation ID",
+    description: "Generation UUID. A full UUID matches one generation, even when the name repeats. A value with * or ? can match more.",
+    type: "string",
+    capabilities: ["match"],
+    example: "generationId:66e00e17-ed33-469b-90e9-40a02d0e82e6"
+  },
   {
     field: "minorVersion",
     label: "Minor version",

package/dist/search/cluster-search-fields.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/cluster-search-fields.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { SearchFieldSpec } from './fields.js'\n\n/**\n * Searchable fields for the Clusters list (mirrors `ListClustersV2Params.filter`\n * \u2014 the fields the endpoint already filters on). `status`, `region`, and\n * `provider` are resolved server-side from live K8s state / context config, so\n * they only support equality. A bare term searches\n * {@link CLUSTER_DEFAULT_SEARCH_FIELDS}.\n */\nexport const CLUSTER_SEARCH_FIELDS: readonly SearchFieldSpec[] = [\n  {\n    field: 'name',\n    label: 'Name',\n    description: 'Cluster name (substring match; supports * and ?).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'name:prod',\n  },\n  {\n    field: 'id',\n    label: 'ID',\n    description: 'Cluster UUID (substring match).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'id:9c2b',\n  },\n  {\n    field: 'orgId',\n    label: 'Organization ID',\n    description: 'Owning organization UUID.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'orgId:2f1a9c3e-4b7d-4c2a-9f1e-8a6b5c4d3e2f',\n  },\n  {\n    field: 'status',\n    label: 'Status',\n    description: 'Live cluster health (e.g. healthy, unhealthy, updating).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'status:healthy',\n  },\n  {\n    field: 'plan',\n    label: 'Plan type',\n    description: 'Cluster plan-type name (e.g. Trial, Production-S).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'plan:Production-S',\n  },\n  {\n    field: 'planName',\n    label: 'Plan name',\n    description: 'The concrete cluster-plan name (not the type).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'planName:\"Trial Cluster\"',\n  },\n  {\n    field: 'generation',\n    label: 'Generation',\n    description: 'Cluster generation name.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'generation:\"Zeebe 8.6.0\"',\n  },\n  {\n    field: 'minorVersion',\n    label: 'Minor version',\n    description: 'Zeebe minor-version prefix (e.g. 8.7 matches 8.7.x).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'minorVersion:8.7',\n  },\n  {\n    field: 'channel',\n    label: 'Channel',\n    description: 'Release channel name.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'channel:Stable',\n  },\n  {\n    field: 'region',\n    label: 'Region',\n    description: 'Region name (resolved from the K8s context).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'region:\"Europe West\"',\n  },\n  {\n    field: 'provider',\n    label: 'Cloud provider',\n    description: 'Cloud provider (resolved from the K8s context).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'provider:gcp',\n  },\n  {\n    field: 'k8sContext',\n    label: 'K8s context',\n    description: 'Exact K8s context UUID.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'k8sContext:7d3b2a10-9e5f-4c1b-b8a2-1f2e3d4c5b6a',\n  },\n  {\n    field: 'autoUpdate',\n    label: 'Auto-update',\n    description: 'Whether auto-update is enabled.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'autoUpdate:false',\n  },\n  {\n    field: 'internal',\n    label: 'Internal',\n    description: 'Whether the cluster is Camunda-owned.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'internal:true',\n  },\n  {\n    field: 'hasActiveModification',\n    label: 'Active modification',\n    description:\n      'Whether the cluster has an active (non-archived) modification.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'hasActiveModification:true',\n  },\n  {\n    field: 'created',\n    label: 'Created',\n    description: 'Creation date (ISO, e.g. 2024-01-31). Supports ranges.',\n    type: 'date',\n    capabilities: ['match', 'range'],\n    example: 'created:>2024-01-01',\n  },\n] as const\n\n/** Fields a bare term searches for clusters (name substring \u2014 matches `q`). */\nexport const CLUSTER_DEFAULT_SEARCH_FIELDS = ['name'] as const\n"],
-  "mappings": "AAeO,MAAM,wBAAoD;AAAA,EAC/D;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aACE;AAAA,IACF,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,SAAS,OAAO;AAAA,IAC/B,SAAS;AAAA,EACX;AACF;AAGO,MAAM,gCAAgC,CAAC,MAAM;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { SearchFieldSpec } from './fields.js'\n\n/**\n * Searchable fields for the Clusters list (mirrors `ListClustersV2Params.filter`\n * \u2014 the fields the endpoint already filters on). `status`, `region`, and\n * `provider` are resolved server-side from live K8s state / context config, so\n * they only support equality. A bare term searches\n * {@link CLUSTER_DEFAULT_SEARCH_FIELDS}.\n */\nexport const CLUSTER_SEARCH_FIELDS: readonly SearchFieldSpec[] = [\n  {\n    field: 'name',\n    label: 'Name',\n    description: 'Cluster name (substring match; supports * and ?).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'name:prod',\n  },\n  {\n    field: 'id',\n    label: 'ID',\n    description: 'Cluster UUID (substring match).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'id:9c2b',\n  },\n  {\n    field: 'orgId',\n    label: 'Organization ID',\n    description: 'Owning organization UUID.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'orgId:2f1a9c3e-4b7d-4c2a-9f1e-8a6b5c4d3e2f',\n  },\n  {\n    field: 'status',\n    label: 'Status',\n    description: 'Live cluster health (e.g. healthy, unhealthy, updating).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'status:healthy',\n  },\n  {\n    field: 'plan',\n    label: 'Plan type',\n    description: 'Cluster plan-type name (e.g. Trial, Production-S).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'plan:Production-S',\n  },\n  {\n    field: 'planName',\n    label: 'Plan name',\n    description: 'The concrete cluster-plan name (not the type).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'planName:\"Trial Cluster\"',\n  },\n  {\n    field: 'generation',\n    label: 'Generation',\n    description:\n      'Cluster generation name. More than one generation can carry the same name. Use a full generationId to match exactly one.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'generation:\"Zeebe 8.6.0\"',\n  },\n  {\n    field: 'generationId',\n    label: 'Generation ID',\n    description:\n      'Generation UUID. A full UUID matches one generation, even when the name repeats. A value with * or ? can match more.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'generationId:66e00e17-ed33-469b-90e9-40a02d0e82e6',\n  },\n  {\n    field: 'minorVersion',\n    label: 'Minor version',\n    description: 'Zeebe minor-version prefix (e.g. 8.7 matches 8.7.x).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'minorVersion:8.7',\n  },\n  {\n    field: 'channel',\n    label: 'Channel',\n    description: 'Release channel name.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'channel:Stable',\n  },\n  {\n    field: 'region',\n    label: 'Region',\n    description: 'Region name (resolved from the K8s context).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'region:\"Europe West\"',\n  },\n  {\n    field: 'provider',\n    label: 'Cloud provider',\n    description: 'Cloud provider (resolved from the K8s context).',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'provider:gcp',\n  },\n  {\n    field: 'k8sContext',\n    label: 'K8s context',\n    description: 'Exact K8s context UUID.',\n    type: 'string',\n    capabilities: ['match'],\n    example: 'k8sContext:7d3b2a10-9e5f-4c1b-b8a2-1f2e3d4c5b6a',\n  },\n  {\n    field: 'autoUpdate',\n    label: 'Auto-update',\n    description: 'Whether auto-update is enabled.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'autoUpdate:false',\n  },\n  {\n    field: 'internal',\n    label: 'Internal',\n    description: 'Whether the cluster is Camunda-owned.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'internal:true',\n  },\n  {\n    field: 'hasActiveModification',\n    label: 'Active modification',\n    description:\n      'Whether the cluster has an active (non-archived) modification.',\n    type: 'boolean',\n    capabilities: ['match'],\n    example: 'hasActiveModification:true',\n  },\n  {\n    field: 'created',\n    label: 'Created',\n    description: 'Creation date (ISO, e.g. 2024-01-31). Supports ranges.',\n    type: 'date',\n    capabilities: ['match', 'range'],\n    example: 'created:>2024-01-01',\n  },\n] as const\n\n/** Fields a bare term searches for clusters (name substring \u2014 matches `q`). */\nexport const CLUSTER_DEFAULT_SEARCH_FIELDS = ['name'] as const\n"],
+  "mappings": "AAeO,MAAM,wBAAoD;AAAA,EAC/D;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aACE;AAAA,IACF,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aACE;AAAA,IACF,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aACE;AAAA,IACF,MAAM;AAAA,IACN,cAAc,CAAC,OAAO;AAAA,IACtB,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,MAAM;AAAA,IACN,cAAc,CAAC,SAAS,OAAO;AAAA,IAC/B,SAAS;AAAA,EACX;AACF;AAGO,MAAM,gCAAgC,CAAC,MAAM;",
   "names": []
 }

package/dist/search/compiler.d.ts

@@ -40,6 +40,31 @@ export interface CompiledQuery {
 }
 /** Compile a parsed query into a single parameterized SQL fragment. */
 export declare const compileQuery: (node: QueryNode, ctx: CompileContext) => CompiledQuery;
+/**
+ * Match `column` against an id set that arrives as ONE parameter.
+ *
+ * `IN (:...ids)` expands to one bind parameter, and one literal in the
+ * statement, for each id. A dimension that does not live in SQL resolves to an
+ * id set, and such a set follows the size of the fleet: the prod cluster fleet
+ * is more than 1000. Both the statement text and the parameter count would
+ * grow with it, and Postgres would plan the statement again at every size.
+ *
+ * Postgres splits the string here, thus the statement text is constant.
+ * `= ANY(...)` can still use an index on the column.
+ */
+export declare const idSetPredicate: (column: string, parameter: string) => string;
+/**
+ * The id set as one separated string, for {@link idSetPredicate}.
+ *
+ * The value is a bind parameter, thus it cannot change the statement. But an
+ * id that holds the separator would become two ids, thus such an id is
+ * dropped. The id columns are text columns, so this stays a guard and not an
+ * assumption.
+ *
+ * An empty string gives an empty array in Postgres. Thus the match finds
+ * nothing, which is correct for an empty set.
+ */
+export declare const joinIdSet: (ids: readonly string[]) => string;
 /**
  * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\`) are
  * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain

package/dist/search/compiler.js

@@ -93,7 +93,7 @@ class Compiler {
     if (ids.length === 0) {
       return "1 = 0";
     }
-    return `${binding.idColumn} IN (${this.bind(ids, true)})`;
+    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)));
   }
   dateTerm(binding, canonical, operator, value) {
     if (operator === ":") {
@@ -158,13 +158,20 @@ class Compiler {
     }
     return parsed;
   }
-  bind(value, isList = false) {
+  /** Register a value and give back its parameter name, with no marker. */
+  bindName(value) {
     const name = `${this.ctx.paramPrefix}_${this.counter++}`;
     this.params[name] = value;
-    return isList ? `:...${name}` : `:${name}`;
+    return name;
+  }
+  bind(value) {
+    return `:${this.bindName(value)}`;
   }
 }
 const compileQuery = (node, ctx) => new Compiler(ctx).compile(node);
+const ID_SET_SEPARATOR = ",";
+const idSetPredicate = (column, parameter) => `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`;
+const joinIdSet = (ids) => ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR);
 const likeArgument = (value, match) => {
   const escaped = value.replace(/([\\%_])/g, "\\$1");
   if (/[*?]/.test(value)) {
@@ -212,6 +219,8 @@ const editDistance = (left, right) => {
 };
 export {
   compileQuery,
+  idSetPredicate,
+  joinIdSet,
   likeArgument
 };
 //# sourceMappingURL=compiler.js.map

package/dist/search/compiler.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/compiler.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n// ============================================================================\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | { kind: 'date'; column: string }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  constructor(private readonly ctx: CompileContext) {\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        return `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lower = this.bind(this.parseDate(canonical, node.lower))\n    const upper = this.bind(this.parseDate(canonical, node.upper))\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      const target = cast ? `CAST(${column} AS TEXT)` : column\n      return `${target} ILIKE ${this.bind(likeArgument(value, 'substring'))}`\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    const target = binding.cast\n      ? `CAST(${binding.column} AS TEXT)`\n      : binding.column\n    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    return `${binding.idColumn} IN (${this.bind(ids, true)})`\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value).toISOString()\n    return `${binding.column} ${operator} ${this.bind(bound)}`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  private bind(value: unknown, isList = false): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return isList ? `:...${name}` : `:${name}`\n  }\n}\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nconst closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
-  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AAiDP,MAAM,SAAS;AAAA,EASb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAP6B;AAAA,EARZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAcjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AACH,eAAO,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACtC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,YAAM,SAAS,OAAO,QAAQ,MAAM,cAAc;AAClD,aAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,UAAM,SAAS,QAAQ,OACnB,QAAQ,QAAQ,MAAM,cACtB,QAAQ;AACZ,WAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzE;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AACA,WAAO,GAAG,QAAQ,QAAQ,QAAQ,KAAK,KAAK,KAAK,IAAI,CAAC;AAAA,EACxD;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,KAAK,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC/H;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK,EAAE,YAAY;AAC3D,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AAAA,EAC1D;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAgB,SAAS,OAAe;AACnD,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO,SAAS,OAAO,IAAI,KAAK,IAAI,IAAI;AAAA,EAC1C;AACF;AAGO,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAO3C,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGA,MAAM,eAAe,CACnB,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  LuceneQueryError,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\n\n// ============================================================================\n// AST \u2192 parameterized SQL compiler.\n//\n// Entity-agnostic: the backend supplies a per-field {@link FieldBinding} map (the\n// SQL columns / computed resolvers stay backend-side), and this turns a parsed\n// query into a single parameterized SQL string for `qb.andWhere(sql, params)`.\n// Field names are whitelisted against the bindings; every value is a bound\n// parameter; wildcards are escaped \u2014 so a query can never inject SQL.\n// ============================================================================\n\n/** SQL binding for one searchable field (values live backend-side, not in the FE). */\nexport type FieldBinding =\n  | {\n      kind: 'string'\n      /** SQL column expression, e.g. `c.name` or `planType.name`. */\n      column: string\n      /** Cast the column to text before matching (uuid columns). */\n      cast?: boolean\n      /** `substring` \u2192 ILIKE %v%; `exact` \u2192 case-insensitive equality. */\n      match: 'substring' | 'exact'\n    }\n  | { kind: 'boolean'; column: string }\n  /** Presence/absence of a nullable column (e.g. active-modification FK). */\n  | { kind: 'nullable'; column: string }\n  | { kind: 'date'; column: string }\n  | {\n      kind: 'computed'\n      /** Column the resolved id set is matched against (e.g. `c.uuid`). */\n      idColumn: string\n      /** Resolve an equality value to matching ids (in-memory / config). */\n      resolve: (value: string) => string[]\n    }\n\nexport interface CompileContext {\n  /** Field name \u2192 SQL binding. Keys are the whitelisted, canonical field names. */\n  bindings: Record<string, FieldBinding>\n  /** Fields a bare term ORs over (must be `string` bindings); always substring. */\n  defaultFields: readonly string[]\n  /** Unique-per-call-site parameter prefix (avoids clashing with other params). */\n  paramPrefix: string\n}\n\nexport interface CompiledQuery {\n  sql: string\n  params: Record<string, unknown>\n}\n\nclass Compiler {\n  private readonly params: Record<string, unknown> = {}\n  private counter = 0\n  /** Lowercased field name \u2192 { canonical, binding }, for case-insensitive lookup. */\n  private readonly lookup: Map<\n    string,\n    { canonical: string; binding: FieldBinding }\n  >\n\n  constructor(private readonly ctx: CompileContext) {\n    this.lookup = new Map(\n      Object.entries(ctx.bindings).map(([field, binding]) => [\n        field.toLowerCase(),\n        { canonical: field, binding },\n      ]),\n    )\n  }\n\n  compile(node: QueryNode): CompiledQuery {\n    return { sql: this.node(node), params: this.params }\n  }\n\n  private node(node: QueryNode): string {\n    switch (node.kind) {\n      case 'and':\n        return `(${this.node(node.left)} AND ${this.node(node.right)})`\n      case 'or':\n        return `(${this.node(node.left)} OR ${this.node(node.right)})`\n      case 'not':\n        return `(NOT ${this.node(node.child)})`\n      case 'term':\n        return this.term(node)\n      case 'range':\n        return this.range(node)\n    }\n  }\n\n  private term(node: TermNode): string {\n    if (node.field === undefined) {\n      return this.bareTerm(node.value)\n    }\n    const { canonical, binding } = this.resolveField(node.field)\n    switch (binding.kind) {\n      case 'string':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.stringMatch(binding, node.value)\n      case 'boolean':\n        this.requireMatchOperator(canonical, node.operator)\n        return `${binding.column} = ${this.bind(this.parseBoolean(canonical, node.value))}`\n      case 'nullable':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.parseBoolean(canonical, node.value)\n          ? `${binding.column} IS NOT NULL`\n          : `${binding.column} IS NULL`\n      case 'computed':\n        this.requireMatchOperator(canonical, node.operator)\n        return this.computedMatch(binding, node.value)\n      case 'date':\n        return this.dateTerm(binding, canonical, node.operator, node.value)\n    }\n  }\n\n  private range(node: RangeNode): string {\n    const { canonical, binding } = this.resolveField(node.field)\n    if (binding.kind !== 'date') {\n      throw new LuceneQueryError(\n        `Field \"${canonical}\" does not support ranges.`,\n        'bad-operator',\n      )\n    }\n    const lowerOp = node.lowerInclusive ? '>=' : '>'\n    const upperOp = node.upperInclusive ? '<=' : '<'\n    const lower = this.bind(this.parseDate(canonical, node.lower))\n    const upper = this.bind(this.parseDate(canonical, node.upper))\n    return `(${binding.column} ${lowerOp} ${lower} AND ${binding.column} ${upperOp} ${upper})`\n  }\n\n  // --- field kinds ----------------------------------------------------------\n\n  private bareTerm(value: string): string {\n    const clauses = this.ctx.defaultFields.map((field) => {\n      const entry = this.lookup.get(field.toLowerCase())\n      if (!entry || entry.binding.kind !== 'string') {\n        // A server-side registry/binding bug, not a bad query \u2014 throw a plain\n        // Error so the routers surface it as a 5xx, never a 400.\n        throw new Error(\n          `Search misconfigured: default field \"${field}\" must be a string binding.`,\n        )\n      }\n      const { column, cast } = entry.binding\n      const target = cast ? `CAST(${column} AS TEXT)` : column\n      return `${target} ILIKE ${this.bind(likeArgument(value, 'substring'))}`\n    })\n    return clauses.length === 1 ? clauses[0] : `(${clauses.join(' OR ')})`\n  }\n\n  private stringMatch(\n    binding: Extract<FieldBinding, { kind: 'string' }>,\n    value: string,\n  ): string {\n    const target = binding.cast\n      ? `CAST(${binding.column} AS TEXT)`\n      : binding.column\n    return `${target} ILIKE ${this.bind(likeArgument(value, binding.match))}`\n  }\n\n  private computedMatch(\n    binding: Extract<FieldBinding, { kind: 'computed' }>,\n    value: string,\n  ): string {\n    const ids = binding.resolve(value)\n    if (ids.length === 0) {\n      // No entity matches this value \u2014 a guaranteed-false predicate (a\n      // surrounding NOT correctly flips it to all-rows).\n      return '1 = 0'\n    }\n    // One parameter, not one for each id. `status:healthy` resolves to the\n    // whole healthy fleet, thus the set follows the size of the fleet.\n    return idSetPredicate(binding.idColumn, this.bindName(joinIdSet(ids)))\n  }\n\n  private dateTerm(\n    binding: Extract<FieldBinding, { kind: 'date' }>,\n    canonical: string,\n    operator: SearchTermOperator,\n    value: string,\n  ): string {\n    if (operator === ':') {\n      // Equality on a date means \"that calendar day\" (UTC): [day, nextDay).\n      const start = this.parseDate(canonical, value)\n      const startDay = new Date(\n        Date.UTC(\n          start.getUTCFullYear(),\n          start.getUTCMonth(),\n          start.getUTCDate(),\n        ),\n      )\n      const nextDay = new Date(startDay.getTime() + 24 * 60 * 60 * 1000)\n      return `(${binding.column} >= ${this.bind(startDay.toISOString())} AND ${binding.column} < ${this.bind(nextDay.toISOString())})`\n    }\n    const bound = this.parseDate(canonical, value).toISOString()\n    return `${binding.column} ${operator} ${this.bind(bound)}`\n  }\n\n  // --- validation helpers ---------------------------------------------------\n\n  private resolveField(field: string): {\n    canonical: string\n    binding: FieldBinding\n  } {\n    const entry = this.lookup.get(field.toLowerCase())\n    if (!entry) {\n      const suggestion = closestField(\n        field,\n        [...this.lookup.values()].map((value) => value.canonical),\n      )\n      throw new LuceneQueryError(\n        `Unknown field \"${field}\".${suggestion ? ` Did you mean \"${suggestion}\"?` : ''}`,\n        'unknown-field',\n        suggestion,\n      )\n    }\n    return entry\n  }\n\n  private requireMatchOperator(\n    field: string,\n    operator: SearchTermOperator,\n  ): void {\n    if (operator !== ':') {\n      throw new LuceneQueryError(\n        `Field \"${field}\" supports only \"field:value\", not \"${operator}\".`,\n        'bad-operator',\n      )\n    }\n  }\n\n  private parseBoolean(field: string, value: string): boolean {\n    const normalized = value.trim().toLowerCase()\n    if (normalized === 'true') {\n      return true\n    }\n    if (normalized === 'false') {\n      return false\n    }\n    throw new LuceneQueryError(\n      `Field \"${field}\" expects true or false, got \"${value}\".`,\n      'bad-value',\n    )\n  }\n\n  private parseDate(field: string, value: string): Date {\n    const parsed = new Date(value)\n    if (Number.isNaN(parsed.getTime())) {\n      throw new LuceneQueryError(\n        `Field \"${field}\" expects a date (e.g. 2024-01-31), got \"${value}\".`,\n        'bad-value',\n      )\n    }\n    return parsed\n  }\n\n  /** Register a value and give back its parameter name, with no marker. */\n  private bindName(value: unknown): string {\n    const name = `${this.ctx.paramPrefix}_${this.counter++}`\n    this.params[name] = value\n    return name\n  }\n\n  private bind(value: unknown): string {\n    return `:${this.bindName(value)}`\n  }\n}\n\n/** Compile a parsed query into a single parameterized SQL fragment. */\nexport const compileQuery = (\n  node: QueryNode,\n  ctx: CompileContext,\n): CompiledQuery => new Compiler(ctx).compile(node)\n\nconst ID_SET_SEPARATOR = ','\n\n/**\n * Match `column` against an id set that arrives as ONE parameter.\n *\n * `IN (:...ids)` expands to one bind parameter, and one literal in the\n * statement, for each id. A dimension that does not live in SQL resolves to an\n * id set, and such a set follows the size of the fleet: the prod cluster fleet\n * is more than 1000. Both the statement text and the parameter count would\n * grow with it, and Postgres would plan the statement again at every size.\n *\n * Postgres splits the string here, thus the statement text is constant.\n * `= ANY(...)` can still use an index on the column.\n */\nexport const idSetPredicate = (column: string, parameter: string): string =>\n  `${column} = ANY(string_to_array(:${parameter}, '${ID_SET_SEPARATOR}'))`\n\n/**\n * The id set as one separated string, for {@link idSetPredicate}.\n *\n * The value is a bind parameter, thus it cannot change the statement. But an\n * id that holds the separator would become two ids, thus such an id is\n * dropped. The id columns are text columns, so this stays a guard and not an\n * assumption.\n *\n * An empty string gives an empty array in Postgres. Thus the match finds\n * nothing, which is correct for an empty set.\n */\nexport const joinIdSet = (ids: readonly string[]): string =>\n  ids.filter((id) => !id.includes(ID_SET_SEPARATOR)).join(ID_SET_SEPARATOR)\n\n/**\n * Turn a user value into an ILIKE argument: SQL wildcards (`%`, `_`, `\\`) are\n * escaped to literals, then the user's `*`/`?` become `%`/`_`; a plain\n * substring value is wrapped in `%\u2026%`.\n */\nexport const likeArgument = (\n  value: string,\n  match: 'substring' | 'exact',\n): string => {\n  const escaped = value.replace(/([\\\\%_])/g, '\\\\$1')\n  if (/[*?]/.test(value)) {\n    return escaped.replace(/\\*/g, '%').replace(/\\?/g, '_')\n  }\n  return match === 'substring' ? `%${escaped}%` : escaped\n}\n\n/** Closest field name within edit distance 3, for \"did you mean\u2026\" hints. */\nconst closestField = (\n  input: string,\n  candidates: readonly string[],\n): string | undefined => {\n  const needle = input.toLowerCase()\n  let best: string | undefined\n  let bestDistance = Number.POSITIVE_INFINITY\n  for (const candidate of candidates) {\n    const distance = editDistance(needle, candidate.toLowerCase())\n    if (distance < bestDistance) {\n      bestDistance = distance\n      best = candidate\n    }\n  }\n  return bestDistance <= 3 ? best : undefined\n}\n\n/** Standard Levenshtein distance. */\nconst editDistance = (left: string, right: string): number => {\n  const rows = left.length + 1\n  const cols = right.length + 1\n  const dist = Array.from({ length: rows }, () =>\n    new Array<number>(cols).fill(0),\n  )\n  for (let row = 0; row < rows; row += 1) {\n    dist[row][0] = row\n  }\n  for (let col = 0; col < cols; col += 1) {\n    dist[0][col] = col\n  }\n  for (let row = 1; row < rows; row += 1) {\n    for (let col = 1; col < cols; col += 1) {\n      const cost = left[row - 1] === right[col - 1] ? 0 : 1\n      dist[row][col] = Math.min(\n        dist[row - 1][col] + 1,\n        dist[row][col - 1] + 1,\n        dist[row - 1][col - 1] + cost,\n      )\n    }\n  }\n  return dist[rows - 1][cols - 1]\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,OAKK;AAiDP,MAAM,SAAS;AAAA,EASb,YAA6B,KAAqB;AAArB;AAC3B,SAAK,SAAS,IAAI;AAAA,MAChB,OAAO,QAAQ,IAAI,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,OAAO,MAAM;AAAA,QACrD,MAAM,YAAY;AAAA,QAClB,EAAE,WAAW,OAAO,QAAQ;AAAA,MAC9B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAP6B;AAAA,EARZ,SAAkC,CAAC;AAAA,EAC5C,UAAU;AAAA;AAAA,EAED;AAAA,EAcjB,QAAQ,MAAgC;AACtC,WAAO,EAAE,KAAK,KAAK,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO;AAAA,EACrD;AAAA,EAEQ,KAAK,MAAyB;AACpC,YAAQ,KAAK,MAAM;AAAA,MACjB,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC9D,KAAK;AACH,eAAO,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MAC7D,KAAK;AACH,eAAO,QAAQ,KAAK,KAAK,KAAK,KAAK,CAAC;AAAA,MACtC,KAAK;AACH,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,QAAI,KAAK,UAAU,QAAW;AAC5B,aAAO,KAAK,SAAS,KAAK,KAAK;AAAA,IACjC;AACA,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,YAAQ,QAAQ,MAAM;AAAA,MACpB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,YAAY,SAAS,KAAK,KAAK;AAAA,MAC7C,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,GAAG,QAAQ,MAAM,MAAM,KAAK,KAAK,KAAK,aAAa,WAAW,KAAK,KAAK,CAAC,CAAC;AAAA,MACnF,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,aAAa,WAAW,KAAK,KAAK,IAC1C,GAAG,QAAQ,MAAM,iBACjB,GAAG,QAAQ,MAAM;AAAA,MACvB,KAAK;AACH,aAAK,qBAAqB,WAAW,KAAK,QAAQ;AAClD,eAAO,KAAK,cAAc,SAAS,KAAK,KAAK;AAAA,MAC/C,KAAK;AACH,eAAO,KAAK,SAAS,SAAS,WAAW,KAAK,UAAU,KAAK,KAAK;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,MAAM,MAAyB;AACrC,UAAM,EAAE,WAAW,QAAQ,IAAI,KAAK,aAAa,KAAK,KAAK;AAC3D,QAAI,QAAQ,SAAS,QAAQ;AAC3B,YAAM,IAAI;AAAA,QACR,UAAU,SAAS;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,UAAU,KAAK,iBAAiB,OAAO;AAC7C,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,UAAM,QAAQ,KAAK,KAAK,KAAK,UAAU,WAAW,KAAK,KAAK,CAAC;AAC7D,WAAO,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,KAAK;AAAA,EACzF;AAAA;AAAA,EAIQ,SAAS,OAAuB;AACtC,UAAM,UAAU,KAAK,IAAI,cAAc,IAAI,CAAC,UAAU;AACpD,YAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,UAAI,CAAC,SAAS,MAAM,QAAQ,SAAS,UAAU;AAG7C,cAAM,IAAI;AAAA,UACR,wCAAwC,KAAK;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,KAAK,IAAI,MAAM;AAC/B,YAAM,SAAS,OAAO,QAAQ,MAAM,cAAc;AAClD,aAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,IACvE,CAAC;AACD,WAAO,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEQ,YACN,SACA,OACQ;AACR,UAAM,SAAS,QAAQ,OACnB,QAAQ,QAAQ,MAAM,cACtB,QAAQ;AACZ,WAAO,GAAG,MAAM,UAAU,KAAK,KAAK,aAAa,OAAO,QAAQ,KAAK,CAAC,CAAC;AAAA,EACzE;AAAA,EAEQ,cACN,SACA,OACQ;AACR,UAAM,MAAM,QAAQ,QAAQ,KAAK;AACjC,QAAI,IAAI,WAAW,GAAG;AAGpB,aAAO;AAAA,IACT;AAGA,WAAO,eAAe,QAAQ,UAAU,KAAK,SAAS,UAAU,GAAG,CAAC,CAAC;AAAA,EACvE;AAAA,EAEQ,SACN,SACA,WACA,UACA,OACQ;AACR,QAAI,aAAa,KAAK;AAEpB,YAAM,QAAQ,KAAK,UAAU,WAAW,KAAK;AAC7C,YAAM,WAAW,IAAI;AAAA,QACnB,KAAK;AAAA,UACH,MAAM,eAAe;AAAA,UACrB,MAAM,YAAY;AAAA,UAClB,MAAM,WAAW;AAAA,QACnB;AAAA,MACF;AACA,YAAM,UAAU,IAAI,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,KAAK,GAAI;AACjE,aAAO,IAAI,QAAQ,MAAM,OAAO,KAAK,KAAK,SAAS,YAAY,CAAC,CAAC,QAAQ,QAAQ,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY,CAAC,CAAC;AAAA,IAC/H;AACA,UAAM,QAAQ,KAAK,UAAU,WAAW,KAAK,EAAE,YAAY;AAC3D,WAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AAAA,EAC1D;AAAA;AAAA,EAIQ,aAAa,OAGnB;AACA,UAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,YAAY,CAAC;AACjD,QAAI,CAAC,OAAO;AACV,YAAM,aAAa;AAAA,QACjB;AAAA,QACA,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAAE,IAAI,CAAC,UAAU,MAAM,SAAS;AAAA,MAC1D;AACA,YAAM,IAAI;AAAA,QACR,kBAAkB,KAAK,KAAK,aAAa,kBAAkB,UAAU,OAAO,EAAE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,qBACN,OACA,UACM;AACN,QAAI,aAAa,KAAK;AACpB,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,uCAAuC,QAAQ;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAe,OAAwB;AAC1D,UAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,QAAI,eAAe,QAAQ;AACzB,aAAO;AAAA,IACT;AACA,QAAI,eAAe,SAAS;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,IAAI;AAAA,MACR,UAAU,KAAK,iCAAiC,KAAK;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,OAAe,OAAqB;AACpD,UAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,QAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,4CAA4C,KAAK;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGQ,SAAS,OAAwB;AACvC,UAAM,OAAO,GAAG,KAAK,IAAI,WAAW,IAAI,KAAK,SAAS;AACtD,SAAK,OAAO,IAAI,IAAI;AACpB,WAAO;AAAA,EACT;AAAA,EAEQ,KAAK,OAAwB;AACnC,WAAO,IAAI,KAAK,SAAS,KAAK,CAAC;AAAA,EACjC;AACF;AAGO,MAAM,eAAe,CAC1B,MACA,QACkB,IAAI,SAAS,GAAG,EAAE,QAAQ,IAAI;AAElD,MAAM,mBAAmB;AAclB,MAAM,iBAAiB,CAAC,QAAgB,cAC7C,GAAG,MAAM,2BAA2B,SAAS,MAAM,gBAAgB;AAa9D,MAAM,YAAY,CAAC,QACxB,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,gBAAgB,CAAC,EAAE,KAAK,gBAAgB;AAOnE,MAAM,eAAe,CAC1B,OACA,UACW;AACX,QAAM,UAAU,MAAM,QAAQ,aAAa,MAAM;AACjD,MAAI,OAAO,KAAK,KAAK,GAAG;AACtB,WAAO,QAAQ,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA,EACvD;AACA,SAAO,UAAU,cAAc,IAAI,OAAO,MAAM;AAClD;AAGA,MAAM,eAAe,CACnB,OACA,eACuB;AACvB,QAAM,SAAS,MAAM,YAAY;AACjC,MAAI;AACJ,MAAI,eAAe,OAAO;AAC1B,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,aAAa,QAAQ,UAAU,YAAY,CAAC;AAC7D,QAAI,WAAW,cAAc;AAC3B,qBAAe;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,gBAAgB,IAAI,OAAO;AACpC;AAGA,MAAM,eAAe,CAAC,MAAc,UAA0B;AAC5D,QAAM,OAAO,KAAK,SAAS;AAC3B,QAAM,OAAO,MAAM,SAAS;AAC5B,QAAM,OAAO,MAAM;AAAA,IAAK,EAAE,QAAQ,KAAK;AAAA,IAAG,MACxC,IAAI,MAAc,IAAI,EAAE,KAAK,CAAC;AAAA,EAChC;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,GAAG,EAAE,CAAC,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,SAAK,CAAC,EAAE,GAAG,IAAI;AAAA,EACjB;AACA,WAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,aAAS,MAAM,GAAG,MAAM,MAAM,OAAO,GAAG;AACtC,YAAM,OAAO,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,IAAI,IAAI;AACpD,WAAK,GAAG,EAAE,GAAG,IAAI,KAAK;AAAA,QACpB,KAAK,MAAM,CAAC,EAAE,GAAG,IAAI;AAAA,QACrB,KAAK,GAAG,EAAE,MAAM,CAAC,IAAI;AAAA,QACrB,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC;AAChC;",
   "names": []
 }

package/dist/search/index.d.ts

@@ -1,6 +1,6 @@
 export { type AndNode, isLuceneQueryError, LuceneQueryError, type NotNode, type OrNode, type QueryNode, type RangeNode, type SearchTermOperator, type TermNode, } from './ast.js';
 export { CLUSTER_DEFAULT_SEARCH_FIELDS, CLUSTER_SEARCH_FIELDS, } from './cluster-search-fields.js';
-export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, likeArgument, } from './compiler.js';
+export { type CompileContext, type CompiledQuery, compileQuery, type FieldBinding, idSetPredicate, joinIdSet, likeArgument, } from './compiler.js';
 export { findSearchField, type SearchFieldCapability, type SearchFieldSpec, type SearchFieldType, } from './fields.js';
 export { ORG_DEFAULT_SEARCH_FIELDS, ORGANIZATION_SEARCH_FIELDS, } from './organization-search-fields.js';
 export { parseLuceneQuery } from './parser.js';

package/dist/search/index.js

@@ -8,6 +8,8 @@ import {
 } from "./cluster-search-fields.js";
 import {
   compileQuery,
+  idSetPredicate,
+  joinIdSet,
   likeArgument
 } from "./compiler.js";
 import {
@@ -26,7 +28,9 @@ export {
   ORG_DEFAULT_SEARCH_FIELDS,
   compileQuery,
   findSearchField,
+  idSetPredicate,
   isLuceneQueryError,
+  joinIdSet,
   likeArgument,
   parseLuceneQuery
 };

package/dist/search/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/search/index.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  likeArgument,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
-  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport {\n  type AndNode,\n  isLuceneQueryError,\n  LuceneQueryError,\n  type NotNode,\n  type OrNode,\n  type QueryNode,\n  type RangeNode,\n  type SearchTermOperator,\n  type TermNode,\n} from './ast.js'\nexport {\n  CLUSTER_DEFAULT_SEARCH_FIELDS,\n  CLUSTER_SEARCH_FIELDS,\n} from './cluster-search-fields.js'\nexport {\n  type CompileContext,\n  type CompiledQuery,\n  compileQuery,\n  type FieldBinding,\n  idSetPredicate,\n  joinIdSet,\n  likeArgument,\n} from './compiler.js'\nexport {\n  findSearchField,\n  type SearchFieldCapability,\n  type SearchFieldSpec,\n  type SearchFieldType,\n} from './fields.js'\nexport {\n  ORG_DEFAULT_SEARCH_FIELDS,\n  ORGANIZATION_SEARCH_FIELDS,\n} from './organization-search-fields.js'\nexport { parseLuceneQuery } from './parser.js'\n"],
+  "mappings": "AAMA;AAAA,EAEE;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EAGE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;",
   "names": []
 }

package/dist/types/ClusterBulkOperation.type.d.ts

@@ -38,8 +38,28 @@ export interface ClusterBulkOperationGenerationUpdateParameter {
      * the 8h sleep cron then suspends the cluster again. Second, a cluster that
      * already has the target generation gets a forced spec write instead of a
      * skip.
+     *
+     * Needs the permission `canUpgradeGenerationYolo`, on the creation of the
+     * operation and on each acknowledgement and the execution.
      */
     yoloAllClusters?: boolean;
+    /**
+     * Retries a refused generation write with the
+     * `cloud.camunda.io/force-generation-update` annotation of the operator.
+     *
+     * The admission webhook refuses a new generation while the cluster did not
+     * finish the previous generation update. The annotation waives that one
+     * check. Console sends the plain write first, thus only a cluster that the
+     * webhook refuses gets the bypass, and the result of the operation names
+     * the clusters that needed it.
+     *
+     * Different from `yoloAllClusters`, which selects the clusters to patch.
+     * This flag changes what console does when the operator says no.
+     *
+     * Needs the permission `canUpgradeGenerationYolo`, on the creation of the
+     * operation and on each acknowledgement and the execution.
+     */
+    yoloForceUpdate?: boolean;
 }
 export interface ClusterBulkOperationPlanTypeUpdateParameter {
     toPlanTypeUuid: string;

package/dist/utils/camundiPermissionAugmenter.utils.d.ts

@@ -1,5 +1,19 @@
 import { type CamundiPermissionRules, type HibobEmployee } from '../config/camundi-permission-rules.types.js';
 import type { Roles } from '../types/Roles.js';
+/**
+ * Where the HiBob employee list is cached, in the Redis of the fleet.
+ *
+ * accounts-backend writes the entry. Every other service only reads it, and
+ * each one must address it with these two names: a service that reads another
+ * key finds nothing, adds no permission of a role, and says nothing about it.
+ *
+ * They live here, and not in a server package, because both server layers read
+ * them. `shared-backend-server` serves the Express services and
+ * `shared-backend-fastify` serves the Fastify services, and two copies of one
+ * string is how the two engines come apart.
+ */
+export declare const HIBOB_CACHE_NAMESPACE = "hibobUsersCache";
+export declare const HIBOB_CACHE_KEY = "allUsers";
 /**
  * Determines which permission rules apply to a given employee based on their
  * department, division, and subdivision.

package/dist/utils/camundiPermissionAugmenter.utils.js

@@ -5,6 +5,8 @@ import {
   SUB_DIVISION
 } from "../config/camundi-permission-rules.types.js";
 import { expandRolesToPermissions } from "../permissions/roleExpansion.utils.js";
+const HIBOB_CACHE_NAMESPACE = "hibobUsersCache";
+const HIBOB_CACHE_KEY = "allUsers";
 function getApplicableRolesForEmployee(employee, rules = CAMUNDI_PERMISSION_RULES) {
   const applicableRoles = /* @__PURE__ */ new Set();
   const department = employee[DEPARTMENT]?.value || "";
@@ -63,6 +65,8 @@ function isManager(userEmail, employees) {
   );
 }
 export {
+  HIBOB_CACHE_KEY,
+  HIBOB_CACHE_NAMESPACE,
   augmentCamundiPermissions,
   getApplicableRolesForEmployee,
   isManager

package/dist/utils/camundiPermissionAugmenter.utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/utils/camundiPermissionAugmenter.utils.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { default as CAMUNDI_PERMISSION_RULES } from '../config/camundi-permission-rules.js'\nimport {\n  type CamundiPermissionRules,\n  DEPARTMENT,\n  DIVISION,\n  type HibobEmployee,\n  SUB_DIVISION,\n} from '../config/camundi-permission-rules.types.js'\nimport { expandRolesToPermissions } from '../permissions/roleExpansion.utils.js'\nimport type { Roles } from '../types/Roles.js'\n\n/**\n * Determines which permission rules apply to a given employee based on their\n * department, division, and subdivision.\n *\n * @param employee - HiBob employee data\n * @param rules - Permission rules configuration\n * @returns Array of roles that should be granted to the employee\n */\nexport function getApplicableRolesForEmployee(\n  employee: HibobEmployee,\n  rules: CamundiPermissionRules = CAMUNDI_PERMISSION_RULES,\n): Roles[] {\n  const applicableRoles = new Set<Roles>()\n\n  // Extract employee organizational data - use only direct field paths\n  const department = employee[DEPARTMENT]?.value || ''\n  const division = employee[DIVISION]?.value || ''\n  const subdivision = employee[SUB_DIVISION]?.value || ''\n\n  // Check department rules\n  if (department && rules.departmentRules[department]) {\n    for (const role of rules.departmentRules[department]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check division rules\n  if (division && rules.divisionRules[division]) {\n    for (const role of rules.divisionRules[division]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check subdivision rules\n  if (subdivision && rules.subdivisionRules[subdivision]) {\n    for (const role of rules.subdivisionRules[subdivision]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  return Array.from(applicableRoles)\n}\n\n/**\n * Augments user permissions based on their Camunda employee status and organizational position.\n *\n * @param userEmail - Email of the user\n * @param currentPermissions - Current permissions from JWT\n * @param employees - List of all HiBob employees\n * @returns Augmented permissions array (original + new permissions from rules)\n */\nexport function augmentCamundiPermissions(\n  userEmail: string,\n  currentPermissions: string[],\n  employees: HibobEmployee[],\n): {\n  augmentedPermissions: string[]\n  hibobEmployee?: HibobEmployee\n  applicableRoles?: Roles[]\n} {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Find the employee in HiBob data\n  const employee = employees.find((emp) => {\n    const empEmail = emp.email || emp['/root/email']?.value\n    return empEmail?.toLowerCase() === userEmail.toLowerCase()\n  })\n\n  if (!employee) {\n    // Employee not found in HiBob - return original permissions\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Get applicable roles based on organizational structure\n  const applicableRoles = getApplicableRolesForEmployee(employee)\n\n  if (applicableRoles.length === 0) {\n    // No rules apply to this employee\n    return {\n      augmentedPermissions: currentPermissions,\n      hibobEmployee: employee,\n      applicableRoles,\n    }\n  }\n\n  // Expand roles to permissions\n  const newPermissions = expandRolesToPermissions(applicableRoles)\n\n  // Merge with existing permissions (deduplication via Set)\n  const mergedPermissions = new Set([...currentPermissions, ...newPermissions])\n\n  return {\n    augmentedPermissions: Array.from(mergedPermissions),\n    hibobEmployee: employee,\n    applicableRoles,\n  }\n}\n\nexport function isManager(\n  userEmail: string,\n  employees: HibobEmployee[],\n): boolean {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return false\n  }\n  return employees.some(\n    (emp) =>\n      emp['/work/reportsTo']?.value?.email?.toLowerCase() ===\n      userEmail.toLowerCase(),\n  )\n}\n"],
-  "mappings": "AAMA,SAAS,WAAW,gCAAgC;AACpD;AAAA,EAEE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,gCAAgC;AAWlC,SAAS,8BACd,UACA,QAAgC,0BACvB;AACT,QAAM,kBAAkB,oBAAI,IAAW;AAGvC,QAAM,aAAa,SAAS,UAAU,GAAG,SAAS;AAClD,QAAM,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC9C,QAAM,cAAc,SAAS,YAAY,GAAG,SAAS;AAGrD,MAAI,cAAc,MAAM,gBAAgB,UAAU,GAAG;AACnD,eAAW,QAAQ,MAAM,gBAAgB,UAAU,GAAG;AACpD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,YAAY,MAAM,cAAc,QAAQ,GAAG;AAC7C,eAAW,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAChD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,eAAe,MAAM,iBAAiB,WAAW,GAAG;AACtD,eAAW,QAAQ,MAAM,iBAAiB,WAAW,GAAG;AACtD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe;AACnC;AAUO,SAAS,0BACd,WACA,oBACA,WAKA;AAEA,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,WAAW,UAAU,KAAK,CAAC,QAAQ;AACvC,UAAM,WAAW,IAAI,SAAS,IAAI,aAAa,GAAG;AAClD,WAAO,UAAU,YAAY,MAAM,UAAU,YAAY;AAAA,EAC3D,CAAC;AAED,MAAI,CAAC,UAAU;AAEb,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,kBAAkB,8BAA8B,QAAQ;AAE9D,MAAI,gBAAgB,WAAW,GAAG;AAEhC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,yBAAyB,eAAe;AAG/D,QAAM,oBAAoB,oBAAI,IAAI,CAAC,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAE5E,SAAO;AAAA,IACL,sBAAsB,MAAM,KAAK,iBAAiB;AAAA,IAClD,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAEO,SAAS,UACd,WACA,WACS;AAET,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AAAA,IACf,CAAC,QACC,IAAI,iBAAiB,GAAG,OAAO,OAAO,YAAY,MAClD,UAAU,YAAY;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { default as CAMUNDI_PERMISSION_RULES } from '../config/camundi-permission-rules.js'\nimport {\n  type CamundiPermissionRules,\n  DEPARTMENT,\n  DIVISION,\n  type HibobEmployee,\n  SUB_DIVISION,\n} from '../config/camundi-permission-rules.types.js'\nimport { expandRolesToPermissions } from '../permissions/roleExpansion.utils.js'\nimport type { Roles } from '../types/Roles.js'\n\n/**\n * Where the HiBob employee list is cached, in the Redis of the fleet.\n *\n * accounts-backend writes the entry. Every other service only reads it, and\n * each one must address it with these two names: a service that reads another\n * key finds nothing, adds no permission of a role, and says nothing about it.\n *\n * They live here, and not in a server package, because both server layers read\n * them. `shared-backend-server` serves the Express services and\n * `shared-backend-fastify` serves the Fastify services, and two copies of one\n * string is how the two engines come apart.\n */\nexport const HIBOB_CACHE_NAMESPACE = 'hibobUsersCache'\nexport const HIBOB_CACHE_KEY = 'allUsers'\n\n/**\n * Determines which permission rules apply to a given employee based on their\n * department, division, and subdivision.\n *\n * @param employee - HiBob employee data\n * @param rules - Permission rules configuration\n * @returns Array of roles that should be granted to the employee\n */\nexport function getApplicableRolesForEmployee(\n  employee: HibobEmployee,\n  rules: CamundiPermissionRules = CAMUNDI_PERMISSION_RULES,\n): Roles[] {\n  const applicableRoles = new Set<Roles>()\n\n  // Extract employee organizational data - use only direct field paths\n  const department = employee[DEPARTMENT]?.value || ''\n  const division = employee[DIVISION]?.value || ''\n  const subdivision = employee[SUB_DIVISION]?.value || ''\n\n  // Check department rules\n  if (department && rules.departmentRules[department]) {\n    for (const role of rules.departmentRules[department]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check division rules\n  if (division && rules.divisionRules[division]) {\n    for (const role of rules.divisionRules[division]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  // Check subdivision rules\n  if (subdivision && rules.subdivisionRules[subdivision]) {\n    for (const role of rules.subdivisionRules[subdivision]) {\n      applicableRoles.add(role)\n    }\n  }\n\n  return Array.from(applicableRoles)\n}\n\n/**\n * Augments user permissions based on their Camunda employee status and organizational position.\n *\n * @param userEmail - Email of the user\n * @param currentPermissions - Current permissions from JWT\n * @param employees - List of all HiBob employees\n * @returns Augmented permissions array (original + new permissions from rules)\n */\nexport function augmentCamundiPermissions(\n  userEmail: string,\n  currentPermissions: string[],\n  employees: HibobEmployee[],\n): {\n  augmentedPermissions: string[]\n  hibobEmployee?: HibobEmployee\n  applicableRoles?: Roles[]\n} {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Find the employee in HiBob data\n  const employee = employees.find((emp) => {\n    const empEmail = emp.email || emp['/root/email']?.value\n    return empEmail?.toLowerCase() === userEmail.toLowerCase()\n  })\n\n  if (!employee) {\n    // Employee not found in HiBob - return original permissions\n    return { augmentedPermissions: currentPermissions }\n  }\n\n  // Get applicable roles based on organizational structure\n  const applicableRoles = getApplicableRolesForEmployee(employee)\n\n  if (applicableRoles.length === 0) {\n    // No rules apply to this employee\n    return {\n      augmentedPermissions: currentPermissions,\n      hibobEmployee: employee,\n      applicableRoles,\n    }\n  }\n\n  // Expand roles to permissions\n  const newPermissions = expandRolesToPermissions(applicableRoles)\n\n  // Merge with existing permissions (deduplication via Set)\n  const mergedPermissions = new Set([...currentPermissions, ...newPermissions])\n\n  return {\n    augmentedPermissions: Array.from(mergedPermissions),\n    hibobEmployee: employee,\n    applicableRoles,\n  }\n}\n\nexport function isManager(\n  userEmail: string,\n  employees: HibobEmployee[],\n): boolean {\n  // Early return if not a Camundi email\n  if (!userEmail.toLowerCase().endsWith('@camunda.com')) {\n    return false\n  }\n  return employees.some(\n    (emp) =>\n      emp['/work/reportsTo']?.value?.email?.toLowerCase() ===\n      userEmail.toLowerCase(),\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,WAAW,gCAAgC;AACpD;AAAA,EAEE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,gCAAgC;AAelC,MAAM,wBAAwB;AAC9B,MAAM,kBAAkB;AAUxB,SAAS,8BACd,UACA,QAAgC,0BACvB;AACT,QAAM,kBAAkB,oBAAI,IAAW;AAGvC,QAAM,aAAa,SAAS,UAAU,GAAG,SAAS;AAClD,QAAM,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC9C,QAAM,cAAc,SAAS,YAAY,GAAG,SAAS;AAGrD,MAAI,cAAc,MAAM,gBAAgB,UAAU,GAAG;AACnD,eAAW,QAAQ,MAAM,gBAAgB,UAAU,GAAG;AACpD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,YAAY,MAAM,cAAc,QAAQ,GAAG;AAC7C,eAAW,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAChD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAGA,MAAI,eAAe,MAAM,iBAAiB,WAAW,GAAG;AACtD,eAAW,QAAQ,MAAM,iBAAiB,WAAW,GAAG;AACtD,sBAAgB,IAAI,IAAI;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,eAAe;AACnC;AAUO,SAAS,0BACd,WACA,oBACA,WAKA;AAEA,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,WAAW,UAAU,KAAK,CAAC,QAAQ;AACvC,UAAM,WAAW,IAAI,SAAS,IAAI,aAAa,GAAG;AAClD,WAAO,UAAU,YAAY,MAAM,UAAU,YAAY;AAAA,EAC3D,CAAC;AAED,MAAI,CAAC,UAAU;AAEb,WAAO,EAAE,sBAAsB,mBAAmB;AAAA,EACpD;AAGA,QAAM,kBAAkB,8BAA8B,QAAQ;AAE9D,MAAI,gBAAgB,WAAW,GAAG;AAEhC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAGA,QAAM,iBAAiB,yBAAyB,eAAe;AAG/D,QAAM,oBAAoB,oBAAI,IAAI,CAAC,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAE5E,SAAO;AAAA,IACL,sBAAsB,MAAM,KAAK,iBAAiB;AAAA,IAClD,eAAe;AAAA,IACf;AAAA,EACF;AACF;AAEO,SAAS,UACd,WACA,WACS;AAET,MAAI,CAAC,UAAU,YAAY,EAAE,SAAS,cAAc,GAAG;AACrD,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AAAA,IACf,CAAC,QACC,IAAI,iBAAiB,GAAG,OAAO,OAAO,YAAY,MAClD,UAAU,YAAY;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/utils/camundiPermissionAugmenter.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"