@camunda/ccma-shared-types 1.1.0 → 2.0.0

package/dist/_tests/approvals/policy.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/approvals/policy.d.ts

@@ -0,0 +1,109 @@
+import type { ApprovalJobDto, ApprovalUseCaseDto } from '../dtos/ApprovalJob.dto.js';
+/**
+ * The rules of the approval mechanism, as pure functions.
+ *
+ * Three consumers run this file: control-backend decides whether to reject a
+ * request, control-frontend decides whether to disable a button, and cloudbot
+ * decides whether to answer. One copy means the button and the endpoint can
+ * never disagree.
+ *
+ * Two choices in the signatures carry the design:
+ *
+ * - The actor is an interface with a `has` method. The backend holds an array
+ *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of
+ *   booleans. Neither side has to convert to the shape of the other.
+ * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can
+ *   be expired already. A parameter makes a difference between the two clocks
+ *   an input that a test can set, and not a silent disagreement.
+ *
+ * No function here does I/O or returns a promise. The browser call site is what
+ * enforces that, and it also stops a later use case from turning a list of 50
+ * rows into 200 network calls.
+ */
+/** Who is asking. See the note above on why this is an interface. */
+export interface ApprovalActorView {
+    userId: string;
+    /**
+     * The email of the actor. It is the SECOND identity of the four-eyes rule.
+     *
+     * `userId` alone is not enough. One person can hold more than one identity in
+     * Auth0 — a connection through SSO and a connection through a database, or an
+     * account that was made again — and each one carries a different `sub`. The
+     * same human then opens a request with one identity and approves it with the
+     * other, which is the rule defeated.
+     *
+     * It is optional because a token can carry no email. See
+     * `isSameActorEmail` for what that means for the comparison.
+     */
+    email?: string;
+    has(permission: string): boolean;
+}
+/**
+ * Reports whether two email addresses name one person.
+ *
+ * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one
+ * person. A token with no email would otherwise make every actor equal to
+ * every other actor, and the rule would refuse everybody.
+ *
+ * The comparison removes the spaces and the case. Auth0 gives the address as
+ * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`
+ * are one mailbox and must not pass as two people.
+ */
+export declare function isSameActorEmail(one?: string, other?: string): boolean;
+/**
+ * Why an action is not allowed.
+ *
+ * The code is for a program: control-backend maps it to a status, and the
+ * frontend can branch on it. The message is for a person, and it is shown as
+ * written.
+ */
+export type ApprovalDenialCode = 'forbidden' | 'not-pending' | 'self-approval' | 'already-acknowledged' | 'expired' | 'not-creator' | 'not-executable' | 'no-reason';
+export type ApprovalDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    code: ApprovalDenialCode;
+    message: string;
+};
+/**
+ * Reports whether the time to answer a request has passed.
+ *
+ * Only a `pending` request expires. A request that already reached an end state
+ * keeps that state, because "expired" would lose the answer that was given.
+ */
+export declare function isExpired(job: ApprovalJobDto, now: Date): boolean;
+/** Reports the status to show, which is `expired` once the time has passed. */
+export declare function effectiveStatus(job: ApprovalJobDto, now: Date): ApprovalJobDto['status'];
+/** Reports how many more acknowledgements the request needs. */
+export declare function remainingAcks(job: ApprovalJobDto): number;
+export declare function canCreate(actor: ApprovalActorView, useCase: ApprovalUseCaseDto): ApprovalDecision;
+/**
+ * The four-eyes rule.
+ *
+ * The bans are in the order a person meets them, and each one has its own
+ * message: "you already approved this" and "you cannot approve your own
+ * request" are different mistakes, and one message for both helps nobody.
+ *
+ * Each of the two bans on a person reads BOTH identities: the `sub` of the
+ * token, and the email. See `ApprovalActorView.email` for why one of them is
+ * not enough.
+ */
+export declare function canAcknowledge(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto, now: Date): ApprovalDecision;
+/**
+ * A rejection needs the same permission as an acknowledgement, and a reason.
+ *
+ * The creator MAY reject their own request. That is a withdrawal with a reason,
+ * and stopping it would only push the person to the withdraw button, where the
+ * reason is lost.
+ */
+export declare function canReject(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto, now: Date, reason: string): ApprovalDecision;
+/** Only the person who opened a request can take it back. */
+export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorView, now: Date): ApprovalDecision;
+/**
+ * Runs a request that has its approvals.
+ *
+ * This is the button of the explicit mode. `failed` is executable again,
+ * because a failure is often a problem of the system that is now repaired, and
+ * asking for the approvals a second time helps nobody.
+ */
+export declare function canExecute(job: ApprovalJobDto, actor: ApprovalActorView, useCase: ApprovalUseCaseDto): ApprovalDecision;

package/dist/approvals/policy.js

@@ -0,0 +1,123 @@
+import { UNKNOWN_ACTOR_EMAIL } from "../constants/misc.const.js";
+function isSameActorEmail(one, other) {
+  const normalize = (value) => {
+    const trimmed = value?.trim().toLowerCase() ?? "";
+    return trimmed === UNKNOWN_ACTOR_EMAIL ? "" : trimmed;
+  };
+  const left = normalize(one);
+  return left.length > 0 && left === normalize(other);
+}
+const ALLOWED = { allowed: true };
+function deny(code, message) {
+  return { allowed: false, code, message };
+}
+function isExpired(job, now) {
+  return job.status === "pending" && new Date(job.expiresAt).getTime() <= now.getTime();
+}
+function effectiveStatus(job, now) {
+  return isExpired(job, now) ? "expired" : job.status;
+}
+function remainingAcks(job) {
+  return Math.max(0, job.requiredAcks - job.acks.length);
+}
+function canCreate(actor, useCase) {
+  if (useCase.createPermission && !actor.has(useCase.createPermission)) {
+    return deny("forbidden", "You cannot open this request.");
+  }
+  return ALLOWED;
+}
+function canAcknowledge(job, actor, useCase, now) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot approve this request.");
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be approved."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be approved.`
+    );
+  }
+  if (job.createdBy.userId === actor.userId || isSameActorEmail(job.createdBy.email, actor.email)) {
+    return deny(
+      "self-approval",
+      "You opened this request, so you cannot approve it."
+    );
+  }
+  if (job.acks.some(
+    (ack) => ack.userId === actor.userId || isSameActorEmail(ack.email, actor.email)
+  )) {
+    return deny("already-acknowledged", "You already approved this request.");
+  }
+  return ALLOWED;
+}
+function canReject(job, actor, useCase, now, reason) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot reject this request.");
+  }
+  if (reason.trim().length === 0) {
+    return deny("no-reason", "Give a reason to reject this request.");
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be rejected."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be rejected.`
+    );
+  }
+  return ALLOWED;
+}
+function canWithdraw(job, actor, now) {
+  if (job.createdBy.userId !== actor.userId) {
+    return deny(
+      "not-creator",
+      "Only the person who opened a request can withdraw it."
+    );
+  }
+  if (isExpired(job, now)) {
+    return deny(
+      "expired",
+      "This request expired and can no longer be withdrawn."
+    );
+  }
+  if (job.status !== "pending") {
+    return deny(
+      "not-pending",
+      `This request is ${job.status} and can no longer be withdrawn.`
+    );
+  }
+  return ALLOWED;
+}
+function canExecute(job, actor, useCase) {
+  if (!actor.has(useCase.requiredPermission)) {
+    return deny("forbidden", "You cannot run this request.");
+  }
+  if (job.status !== "approved" && job.status !== "failed") {
+    return deny(
+      "not-executable",
+      `This request is ${job.status} and cannot be run.`
+    );
+  }
+  return ALLOWED;
+}
+export {
+  canAcknowledge,
+  canCreate,
+  canExecute,
+  canReject,
+  canWithdraw,
+  effectiveStatus,
+  isExpired,
+  isSameActorEmail,
+  remainingAcks
+};
+//# sourceMappingURL=policy.js.map

package/dist/approvals/policy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/policy.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const normalize = (value?: string): string => {\n    const trimmed = value?.trim().toLowerCase() ?? ''\n    return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n  }\n  const left = normalize(one)\n  return left.length > 0 && left === normalize(other)\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny('forbidden', 'You cannot open this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  now: Date,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (\n    job.createdBy.userId === actor.userId ||\n    isSameActorEmail(job.createdBy.email, actor.email)\n  ) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (\n    job.acks.some(\n      (ack) =>\n        ack.userId === actor.userId || isSameActorEmail(ack.email, actor.email),\n    )\n  ) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * The creator MAY reject their own request. That is a withdrawal with a reason,\n * and stopping it would only push the person to the withdraw button, where the\n * reason is lost.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  return ALLOWED\n}\n\n/** Only the person who opened a request can take it back. */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (job.createdBy.userId !== actor.userId) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (!actor.has(useCase.requiredPermission)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AA0D7B,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,YAAY,CAAC,UAA2B;AAC5C,UAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,WAAO,YAAY,sBAAsB,KAAK;AAAA,EAChD;AACA,QAAM,OAAO,UAAU,GAAG;AAC1B,SAAO,KAAK,SAAS,KAAK,SAAS,UAAU,KAAK;AACpD;AAuBA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAEO,SAAS,UACd,OACA,SACkB;AAClB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO,KAAK,aAAa,+BAA+B;AAAA,EAC1D;AACA,SAAO;AACT;AAaO,SAAS,eACd,KACA,OACA,SACA,KACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MACE,IAAI,UAAU,WAAW,MAAM,UAC/B,iBAAiB,IAAI,UAAU,OAAO,MAAM,KAAK,GACjD;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,IAAI,KAAK;AAAA,IACP,CAAC,QACC,IAAI,WAAW,MAAM,UAAU,iBAAiB,IAAI,OAAO,MAAM,KAAK;AAAA,EAC1E,GACA;AACA,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AASO,SAAS,UACd,KACA,OACA,SACA,KACA,QACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,IAAI,UAAU,WAAW,MAAM,QAAQ;AACzC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,WACd,KACA,OACA,SACkB;AAClB,MAAI,CAAC,MAAM,IAAI,QAAQ,kBAAkB,GAAG;AAC1C,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/config/camundi-permission-rules.js

@@ -22,20 +22,32 @@ const CONFIG = {
       "accounts:trialExtender",
       "accounts:limitExtender",
       "support:agent"
-    ]
+    ],
     // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole
+    // Enterprise Success holds the CSMs and the TAMs. A customer who has
+    // privacy concerns asks them to switch optional telemetry off, thus they
+    // carry the capability. HiBob marks no TAM, thus the division is the
+    // smallest group that holds all of them.
+    "266229124": ["console:optionalTelemetryManager"]
+    // Enterprise Success
   },
   subdivisionRules: {
-    "256909487": ["accounts:admin", "console:admin", "consoleTeam"],
-    // console team
+    // The console team is the "Control plane" subdivision. The id was
+    // `256909487` until a HiBob restructure, and the augmenter matches a
+    // subdivision exactly and stays quiet on a miss, thus the rule granted
+    // nothing to anybody and nobody saw it.
+    "267516827": ["accounts:admin", "console:admin", "consoleTeam"],
+    // Control plane
     "Engineering Management": [
       "accounts:addSafeRoles",
       "accounts:orgCreator",
       "console:C8ReleaseManager"
     ],
     // Engineering Management
-    "258049291": ["console:clusterPlanManager", "console:operationsEngineer"]
-    // controller team
+    // Same story: the id `258049291` is gone. The subdivision carries the name
+    // `Controller` now, and a name is a valid key — `Engineering Management`
+    // above is one too.
+    Controller: ["console:clusterPlanManager", "console:operationsEngineer"]
   }
 };
 var camundi_permission_rules_default = CONFIG;

package/dist/config/camundi-permission-rules.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/config/camundi-permission-rules.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { CamundiPermissionRules } from './camundi-permission-rules.types.js'\n\nconst CONFIG: CamundiPermissionRules = {\n  departmentRules: {\n    '205882305': ['accounts:read', 'accounts:trialExtender'], // CS\n    Marketing: ['accounts:read', 'accounts:trialExtender'],\n    '205882307': ['accounts:read', 'accounts:trialExtender'], // revops\n    Products: ['console:admin:readonly', 'accounts:read'],\n    Executive: ['accounts:read'],\n    '259633605': ['accounts:read', 'accounts:trialExtender'], // Sales\n  },\n  divisionRules: {\n    Engineering: ['console:admin:readonly'],\n    '259633608': [\n      'accounts:connections:create',\n      'accounts:connections:update',\n      'support:agent',\n    ], // Support\n    '259633611': [\n      'accounts:trialExtender',\n      'accounts:limitExtender',\n      'support:agent',\n    ], // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole\n  },\n  subdivisionRules: {\n    '256909487': ['accounts:admin', 'console:admin', 'consoleTeam'], // console team\n    'Engineering Management': [\n      'accounts:addSafeRoles',\n      'accounts:orgCreator',\n      'console:C8ReleaseManager',\n    ], // Engineering Management\n    '258049291': ['console:clusterPlanManager', 'console:operationsEngineer'], // controller team\n  },\n}\nexport default CONFIG\n"],
-  "mappings": "AAQA,MAAM,SAAiC;AAAA,EACrC,iBAAiB;AAAA,IACf,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,WAAW,CAAC,iBAAiB,wBAAwB;AAAA,IACrD,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,UAAU,CAAC,0BAA0B,eAAe;AAAA,IACpD,WAAW,CAAC,eAAe;AAAA,IAC3B,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,EACzD;AAAA,EACA,eAAe;AAAA,IACb,aAAa,CAAC,wBAAwB;AAAA,IACtC,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa,CAAC,kBAAkB,iBAAiB,aAAa;AAAA;AAAA,IAC9D,0BAA0B;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa,CAAC,8BAA8B,4BAA4B;AAAA;AAAA,EAC1E;AACF;AACA,IAAO,mCAAQ;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { CamundiPermissionRules } from './camundi-permission-rules.types.js'\n\nconst CONFIG: CamundiPermissionRules = {\n  departmentRules: {\n    '205882305': ['accounts:read', 'accounts:trialExtender'], // CS\n    Marketing: ['accounts:read', 'accounts:trialExtender'],\n    '205882307': ['accounts:read', 'accounts:trialExtender'], // revops\n    Products: ['console:admin:readonly', 'accounts:read'],\n    Executive: ['accounts:read'],\n    '259633605': ['accounts:read', 'accounts:trialExtender'], // Sales\n  },\n  divisionRules: {\n    Engineering: ['console:admin:readonly'],\n    '259633608': [\n      'accounts:connections:create',\n      'accounts:connections:update',\n      'support:agent',\n    ], // Support\n    '259633611': [\n      'accounts:trialExtender',\n      'accounts:limitExtender',\n      'support:agent',\n    ], // Pre-Sales as per https://confluence.camunda.com/spaces/HAN/pages/168660217/Adjust+C8+SaaS+permissions+and+sales+plan#AdjustC8SaaSpermissionsandsalesplan-DetailsperRole\n    // Enterprise Success holds the CSMs and the TAMs. A customer who has\n    // privacy concerns asks them to switch optional telemetry off, thus they\n    // carry the capability. HiBob marks no TAM, thus the division is the\n    // smallest group that holds all of them.\n    '266229124': ['console:optionalTelemetryManager'], // Enterprise Success\n  },\n  subdivisionRules: {\n    // The console team is the \"Control plane\" subdivision. The id was\n    // `256909487` until a HiBob restructure, and the augmenter matches a\n    // subdivision exactly and stays quiet on a miss, thus the rule granted\n    // nothing to anybody and nobody saw it.\n    '267516827': ['accounts:admin', 'console:admin', 'consoleTeam'], // Control plane\n    'Engineering Management': [\n      'accounts:addSafeRoles',\n      'accounts:orgCreator',\n      'console:C8ReleaseManager',\n    ], // Engineering Management\n    // Same story: the id `258049291` is gone. The subdivision carries the name\n    // `Controller` now, and a name is a valid key \u2014 `Engineering Management`\n    // above is one too.\n    Controller: ['console:clusterPlanManager', 'console:operationsEngineer'],\n  },\n}\nexport default CONFIG\n"],
+  "mappings": "AAQA,MAAM,SAAiC;AAAA,EACrC,iBAAiB;AAAA,IACf,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,WAAW,CAAC,iBAAiB,wBAAwB;AAAA,IACrD,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,IACvD,UAAU,CAAC,0BAA0B,eAAe;AAAA,IACpD,WAAW,CAAC,eAAe;AAAA,IAC3B,aAAa,CAAC,iBAAiB,wBAAwB;AAAA;AAAA,EACzD;AAAA,EACA,eAAe;AAAA,IACb,aAAa,CAAC,wBAAwB;AAAA,IACtC,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA,IACA,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,aAAa,CAAC,kCAAkC;AAAA;AAAA,EAClD;AAAA,EACA,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,aAAa,CAAC,kBAAkB,iBAAiB,aAAa;AAAA;AAAA,IAC9D,0BAA0B;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA,IAIA,YAAY,CAAC,8BAA8B,4BAA4B;AAAA,EACzE;AACF;AACA,IAAO,mCAAQ;",
   "names": []
 }

package/dist/constants/misc.const.d.ts

@@ -1,4 +1,25 @@
 export declare const CONSOLE_API_USER_ID = "console-api";
+/**
+ * The namespace of the custom claims that Auth0 adds to a token of this fleet.
+ *
+ * An Auth0 API access token carries no `email` claim of its own. The rules of
+ * the tenant put the email of the person under this namespace instead, and
+ * every reader of the fleet must look there. A service that reads a top-level
+ * `email` claim gets nothing, and the failure is silent: the identity is still
+ * valid, so the request continues with an empty email.
+ */
+export declare const CAMUNDA_CLAIMS_NAMESPACE = "https://camunda.com/meta";
+/**
+ * The email of an actor whose token carries no email.
+ *
+ * It is a value and not an empty string, because an empty string reads like a
+ * field that nobody wrote. A record that says `unknown` says that the token had
+ * no email, which is a different fact.
+ *
+ * A rule that compares two people MUST NOT treat two of these as one person.
+ * `isSameActorEmail` in `approvals/policy.ts` holds that.
+ */
+export declare const UNKNOWN_ACTOR_EMAIL = "unknown";
 export declare const TEMPORARY_CLUSTER_NAME = "Get Started";
 export type Stage = 'local' | 'dev' | 'int' | 'prod';
 export declare const HOTBACKUP_MIN_CREATE_PERIOD: number;

package/dist/constants/misc.const.js

@@ -1,4 +1,6 @@
 const CONSOLE_API_USER_ID = "console-api";
+const CAMUNDA_CLAIMS_NAMESPACE = "https://camunda.com/meta";
+const UNKNOWN_ACTOR_EMAIL = "unknown";
 const TEMPORARY_CLUSTER_NAME = "Get Started";
 const HOTBACKUP_MIN_CREATE_PERIOD = 1e3 * 60 * 60 * 0.25;
 const SECRETS_MAX_LENGTH = 4096;
@@ -19,6 +21,7 @@ const MINIMUM_EYEPAIRS = {
 };
 const MAX_HARDWARE_PACKAGE_COUNT = 4;
 export {
+  CAMUNDA_CLAIMS_NAMESPACE,
   CONSOLE_API_USER_ID,
   FIRSTNAME_LASTNAME_MAX_LENGTH,
   HOTBACKUP_MIN_CREATE_PERIOD,
@@ -28,6 +31,7 @@ export {
   NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS,
   SECRETS_MAX_LENGTH,
   STARTING_PRICE_PER_MONTH_IN_EURO,
-  TEMPORARY_CLUSTER_NAME
+  TEMPORARY_CLUSTER_NAME,
+  UNKNOWN_ACTOR_EMAIL
 };
 //# sourceMappingURL=misc.const.js.map

package/dist/constants/misc.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/misc.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
-  "mappings": "AAMO,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nexport const CONSOLE_API_USER_ID = 'console-api'\n\n/**\n * The namespace of the custom claims that Auth0 adds to a token of this fleet.\n *\n * An Auth0 API access token carries no `email` claim of its own. The rules of\n * the tenant put the email of the person under this namespace instead, and\n * every reader of the fleet must look there. A service that reads a top-level\n * `email` claim gets nothing, and the failure is silent: the identity is still\n * valid, so the request continues with an empty email.\n */\nexport const CAMUNDA_CLAIMS_NAMESPACE = 'https://camunda.com/meta'\n\n/**\n * The email of an actor whose token carries no email.\n *\n * It is a value and not an empty string, because an empty string reads like a\n * field that nobody wrote. A record that says `unknown` says that the token had\n * no email, which is a different fact.\n *\n * A rule that compares two people MUST NOT treat two of these as one person.\n * `isSameActorEmail` in `approvals/policy.ts` holds that.\n */\nexport const UNKNOWN_ACTOR_EMAIL = 'unknown'\nexport const TEMPORARY_CLUSTER_NAME = 'Get Started'\nexport type Stage = 'local' | 'dev' | 'int' | 'prod'\nexport const HOTBACKUP_MIN_CREATE_PERIOD = 1000 * 60 * 60 * 0.25 // 15 minutes\n\nexport const SECRETS_MAX_LENGTH = 4096\nexport const FIRSTNAME_LASTNAME_MAX_LENGTH = 255\n\nexport const STARTING_PRICE_PER_MONTH_IN_EURO = 99\n\nexport const MAX_LENGTH_CLUSTER_NAME = 50\n\nexport const NAMES_OF_ENTERPRISE_SALESPLANS_WITH_SLEEPING_CLUSTERS = [\n  'CELP with sleeping clusters',\n  'Camunda Partner',\n]\n\nexport const MINIMUM_EYEPAIRS = {\n  CLUSTER_DELETION: 3,\n  CLUSTER_GENERATION_UPDATE: 2,\n  CLUSTER_PLAN_UPDATE: 2,\n  CLUSTER_PLAN_TYPE_UPDATE: 2,\n  CLUSTER_PLAN_MODIFICATION: 1,\n  CLUSTER_MODIFICATION: 1,\n}\n\nexport const MAX_HARDWARE_PACKAGE_COUNT = 4\n"],
+  "mappings": "AAMO,MAAM,sBAAsB;AAW5B,MAAM,2BAA2B;AAYjC,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,8BAA8B,MAAO,KAAK,KAAK;AAErD,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAEtC,MAAM,mCAAmC;AAEzC,MAAM,0BAA0B;AAEhC,MAAM,wDAAwD;AAAA,EACnE;AAAA,EACA;AACF;AAEO,MAAM,mBAAmB;AAAA,EAC9B,kBAAkB;AAAA,EAClB,2BAA2B;AAAA,EAC3B,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,2BAA2B;AAAA,EAC3B,sBAAsB;AACxB;AAEO,MAAM,6BAA6B;",
   "names": []
 }

package/dist/constants/v2-list.const.d.ts

@@ -0,0 +1,12 @@
+/** Largest page a `/v2` list endpoint returns. The backends clamp `limit` to this. */
+export declare const V2_MAX_PAGE_LIMIT = 200;
+/**
+ * Most uuids a `/v2` list endpoint accepts in a comma-list query filter such as
+ * `filter.ids`. The backends drop entries past this count without an error.
+ */
+export declare const V2_FILTER_IDS_MAX = 500;
+/**
+ * Most uuids a `/v2` list endpoint accepts in a POST body list. Over this the
+ * endpoint rejects with 400 instead of a silent cut.
+ */
+export declare const V2_BODY_IDS_MAX = 10000;

package/dist/constants/v2-list.const.js

@@ -0,0 +1,9 @@
+const V2_MAX_PAGE_LIMIT = 200;
+const V2_FILTER_IDS_MAX = 500;
+const V2_BODY_IDS_MAX = 1e4;
+export {
+  V2_BODY_IDS_MAX,
+  V2_FILTER_IDS_MAX,
+  V2_MAX_PAGE_LIMIT
+};
+//# sourceMappingURL=v2-list.const.js.map

package/dist/constants/v2-list.const.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/constants/v2-list.const.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/** Largest page a `/v2` list endpoint returns. The backends clamp `limit` to this. */\nexport const V2_MAX_PAGE_LIMIT = 200\n\n/**\n * Most uuids a `/v2` list endpoint accepts in a comma-list query filter such as\n * `filter.ids`. The backends drop entries past this count without an error.\n */\nexport const V2_FILTER_IDS_MAX = 500\n\n/**\n * Most uuids a `/v2` list endpoint accepts in a POST body list. Over this the\n * endpoint rejects with 400 instead of a silent cut.\n */\nexport const V2_BODY_IDS_MAX = 10_000\n"],
+  "mappings": "AAOO,MAAM,oBAAoB;AAM1B,MAAM,oBAAoB;AAM1B,MAAM,kBAAkB;",
+  "names": []
+}

package/dist/constants/version-gates.const.d.ts

@@ -338,9 +338,16 @@ export declare const APP_INTEGRATIONS_89_STREAM_MINOR = "8.9.0";
  */
 export declare const CLUSTER_SECRETS_LABEL_MIN_VERSION = "8.10.0-alpha5";
 /**
- * Minimum cluster (zeebe) version for the optional telemetry toggle.
+ * Minimum cluster (zeebe) version that runs the analytics exporter, thus the
+ * floor for optional telemetry.
+ *
+ * The number comes from the operator: `AnalyticsExporterSupported` in
+ * `pkg/features/features.go` reads `>= 8.10.0-alpha1`, and below it
+ * `zeebe_statefulset.go` adds no exporter env vars at all. A cluster under the
+ * floor sends no analytics telemetry, OPTIONAL or CONTRACTUAL, thus the row
+ * has no state to show and the toggle has nothing to switch.
  */
-export declare const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha5";
+export declare const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha1";
 /**
  * Lowest ALPHA generation that a suspended cluster can resume from. A cluster
  * on an alpha under this floor stays suspended forever.

package/dist/constants/version-gates.const.js

@@ -50,7 +50,7 @@ const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = "8.9.14";
 const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = "8.9.7";
 const APP_INTEGRATIONS_89_STREAM_MINOR = "8.9.0";
 const CLUSTER_SECRETS_LABEL_MIN_VERSION = CONNECTOR_SECRET_SYNC_MIN_VERSION;
-const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha5";
+const OPTIONAL_TELEMETRY_MIN_VERSION = "8.10.0-alpha1";
 const RESUME_ALPHA_MIN_VERSION = "8.10.0-alpha5";
 export {
   ADMIN_APP_RENAME_MIN_VERSION,

package/dist/constants/version-gates.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/constants/version-gates.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Central list of the cluster version floors that gate features.\n *\n * Every `checkVersion({ versionToCompareTo })` / `checkClusterVersion()` call in\n * the apps and in `packages/c4` reads its floor from here. Put a new floor here\n * before you use it. Do not write a version literal at the call site \u2014 the same\n * feature is usually gated in more than one place (a c4 tile, a console-backend\n * guard, a CRD spec), and two literals drift. Incident #9703 was two copies of\n * one floor that disagreed.\n *\n * `packages/c3` keeps its own copy of the version helpers and is out of scope:\n * it is a public package that this repo must not change.\n *\n * The values compare with semver, so the spelling of a floor decides which\n * prerelease cohort it covers:\n * - `8.10.0-0` and `8.10.0-alpha0` sort below every `8.10.0-alphaN`.\n * - `8.10.0-alpha1` sorts above `alpha0` but below `alpha2`.\n * - `8.10.0` sorts above ALL `8.10.0-*` prereleases.\n *\n * Two constants in this file can hold the same value. Then they gate different\n * features and can move apart. When a name is an alias of another constant, the\n * two answer the same question and must never drift.\n *\n * A call site compares a floor against the zeebe version of the generation,\n * unless the comment of the constant names a different field. Name that field\n * in the comment when you add a floor for one, because the same number means a\n * different thing for `connectorBridge` or for a generation name.\n */\n\n// ---------------------------------------------------------------------------\n// Release-line floors\n//\n// Used where the code asks \"is this generation on the 8.x line?\" and no single\n// feature owns the answer. Both spell the line start as `-0`, so every\n// prerelease of that line is included.\n// ---------------------------------------------------------------------------\n\n/** Start of the 8.9 line, prereleases included. */\nexport const LINE_8_9_MIN_VERSION = '8.9.0-0'\n\n/** Start of the 8.10 line, prereleases included. */\nexport const LINE_8_10_MIN_VERSION = '8.10.0-0'\n\n// ---------------------------------------------------------------------------\n// Backups\n// ---------------------------------------------------------------------------\n\n/** Hot backups are available on the cluster (c4 hot-backups tab). */\nexport const HOT_BACKUP_MIN_VERSION = '8.2.4'\n\n// ---------------------------------------------------------------------------\n// Identity, authorizations and roles\n// ---------------------------------------------------------------------------\n\n/**\n * The \"enforce groups\" toggle is offered (c4 settings tile). The tile also\n * disappears again on 8.8 clusters that run Tasklist V2 \u2014 see\n * `ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION`.\n */\nexport const ENFORCE_GROUPS_TOGGLE_MIN_VERSION = '8.5.0-alpha2'\n\n/** Resource-based authorizations exist. Replaced by identity authorizations. */\nexport const RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION = '8.6.0'\n\n/**\n * Identity-based authorizations replace the resource-based ones. Read as an\n * upper bound by the c4 settings tile: below this the cluster still shows the\n * resource-based section.\n */\nexport const IDENTITY_AUTHORIZATION_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Upper bound of the \"your upgrade turns on identity authorizations\" notice in\n * the c4 overview tab. The notice is for 8.8-line targets only, so an 8.9\n * target does not show it.\n */\nexport const IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION = '8.9.0-alpha1'\n\n/**\n * The cluster uses the 8.8 role model, so the legacy per-cluster roles are\n * gone (c4 user-details and management widgets).\n */\nexport const NEW_CLUSTER_ROLES_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * The authorizations toggle is offered while creating a cluster (c4 create\n * cluster wizard).\n */\nexport const AUTHORIZATION_TOGGLE_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * Identity manages users, groups and tenants. The cluster shows the Identity\n * screens (c4 cluster details, user details, group details, management widget,\n * console-frontend and console-sm-frontend), and the CRD spec sends the\n * internal client IDs to Identity\n * (`K8sSpecUtils.clusterHasEnabledIdentityIntegration`).\n *\n * console-backend used `8.8.0-alpha4` until the gates moved here. That floor\n * was one alpha under the frontend. As a result, an 8.8.0-alpha4 cluster got\n * its `internalClientIDs` sent to an Identity that the UI did not show. There\n * is one floor now, on the version the UI has always used.\n */\nexport const IDENTITY_MANAGEMENT_MIN_VERSION = '8.8.0-alpha5'\n\n/** The multi-tenancy toggle is offered (c4 settings tile). */\nexport const MULTI_TENANCY_TOGGLE_MIN_VERSION = '8.8.0-alpha7'\n\n/** Business-ID uniqueness toggle is offered (c4 settings tile). */\nexport const BUSINESS_ID_UNIQUENESS_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Tasklist\n// ---------------------------------------------------------------------------\n\n/**\n * The current generation is good enough to upgrade to Tasklist V2 (c4 overview\n * tab).\n */\nexport const TASKLIST_V2_UPGRADE_MIN_VERSION = '8.7.0-alpha4'\n\n/**\n * The upgrade target carries Tasklist V2 (c4 overview tab). Pairs with\n * `LINE_8_10_MIN_VERSION` as the upper bound, because from 8.10 on the setting\n * is gone.\n */\nexport const TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * A new cluster gets `tasklistV2Enabled` by default (console-backend cluster\n * creation). Reads the generation's tasklist version when it has one, else\n * zeebe.\n */\nexport const TASKLIST_V2_DEFAULT_ON_MIN_VERSION = '8.8.0'\n\n/**\n * From this version, the c4 settings tile hides the \"enforce groups\" toggle on\n * a cluster that runs Tasklist V2. The tile reads the constant with `>=`, and\n * it also needs `tasklistV2Enabled` to be true.\n *\n * The name says MIN because of that `>=`. The other MAX names in this file mark\n * the version where a gate stops, and their call sites read them with `<`.\n */\nexport const ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION = '8.8.0'\n\n/** The Tasklist upgrade banner is offered (c4 settings tile). */\nexport const TASKLIST_UPGRADE_BANNER_MIN_VERSION = '8.8.0-alpha2'\n\n/**\n * The Tasklist mode toggle is offered while creating a cluster (c4 create\n * cluster wizard). Upper bound is `LINE_8_10_MIN_VERSION`.\n */\nexport const TASKLIST_MODE_TOGGLE_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * Minor-version pair that turns Tasklist V2 on during a generation update\n * (console-backend). Both are read with `VersionCheckOperator.SameMinor`: an\n * 8.7 cluster that moves to an 8.8 generation gets the setting.\n */\nexport const TASKLIST_V2_AUTO_ENABLE_FROM_MINOR = '8.7.0'\nexport const TASKLIST_V2_AUTO_ENABLE_TO_MINOR = '8.8.0'\n\n/**\n * The version where the Tasklist V2 flag stops to mean anything, because there\n * is no Tasklist V1 left to switch away from. Two readers use it. The CRD spec\n * stops to emit the Tasklist V2 mode environment variable\n * (`K8sSpecUtils.shouldSkipTasklistV2ModeEnvVar`). The accounts-frontend\n * support rows stop to show the flag.\n *\n * Spelled `8.10.0` and NOT `LINE_8_10_MIN_VERSION` (`8.10.0-0`). Cluster\n * creation sets the flag on every generation from\n * `TASKLIST_V2_DEFAULT_ON_MIN_VERSION` on. An 8.10 prerelease thus carries a\n * live value, and it must stay under this bound.\n *\n * c4 bounds its own Tasklist V2 checks with `LINE_8_10_MIN_VERSION` instead.\n * That constant answers a different question: can Console still offer the\n * Tasklist upgrade to this cluster. It correctly leaves out the 8.10\n * prereleases.\n */\nexport const TASKLIST_V2_SETTING_MAX_VERSION = '8.10.0'\n\n// ---------------------------------------------------------------------------\n// Connectors\n// ---------------------------------------------------------------------------\n\n/** The internal connectors-management page exists (c4 overview tab link). */\nexport const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = '8.7.0-alpha1'\n\n/**\n * The applications list offers \"Manage\" for connectors (c4 overview tab).\n * Matches what console-frontend has always done.\n */\nexport const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Connector management shows the outbound connectors, the per-connector metrics\n * and the restart button. Under this floor the pages show the inbound-only\n * table.\n *\n * CAUTION: the two readers compare this floor against different version fields.\n * The c4 connector-management widgets compare\n * `generation.versions.connectorBridge`\n * (`useConnectorManagementRuntime.checkClusterVersion`). The\n * console-sm-frontend pages compare the generation name of the cluster\n * (`page.getData().generation`). Both sites had the same literal before the\n * gates moved here, so this constant keeps that. Do not read it as one\n * question until the two readers compare the same field.\n */\nexport const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * The secrets filter mode setting is offered on the 8.6 line (zeebe). Shared by\n * isSecretsFilterModeConfigurable (c4 settings tile + console-backend update\n * guard).\n */\nexport const SECRETS_FILTER_MODE_8_6_MIN_VERSION = '8.6.28'\n\n/** Same setting, floor for the 8.7 line. */\nexport const SECRETS_FILTER_MODE_8_7_MIN_VERSION = '8.7.25'\n\n/** Same setting, floor for the 8.8 line. */\nexport const SECRETS_FILTER_MODE_8_8_MIN_VERSION = '8.8.19'\n\n/**\n * Same setting, floor for the 8.9 line. The env var works from 8.9.7, but the\n * default stays DISABLED until 8.9.10. The floor waits for that default\n * change, so the toggle never shows an unset value with an unknown default.\n */\nexport const SECRETS_FILTER_MODE_8_9_MIN_VERSION = '8.9.10'\n\n/**\n * Same setting, floor for the 8.10 line and every line above it.\n *\n * This is the last floor: isSecretsFilterModeConfigurable applies it to all\n * versions above the 8.9 line, so 8.11 and later need no floor of their own.\n *\n * Two different reasons keep the versions below it out, and the second one is\n * why this floor is alpha6 and not alpha5:\n *\n * - alpha1 to alpha4 shipped the DISABLED default. Same reason as 8.9.7-8.9.9.\n * - alpha5 shipped the STRICT default, but not the Connectors change that this\n *   setting needs. SaaS runs Connectors with legacy.mode=FALLBACK from the 8.10\n *   line on, and the Connectors runtime of alpha5 refuses to start unless\n *   FALLBACK is paired with STRICT\n *   (ConnectorsAutoConfiguration.checkLegacyFallbackSecretFilter). A customer\n *   who selects LAX or DISABLED on alpha5 crashes their own Connectors runtime\n *   at startup, so the toggle must stay hidden there.\n *\n * Connectors removed that check after the alpha5 release (2026-09-03). The\n * removal is in the SNAPSHOT images and lands in the releases from alpha6 on.\n * SNAPSHOT clusters run the newest images, so they get the toggle.\n */\nexport const SECRETS_FILTER_MODE_8_10_MIN_VERSION = '8.10.0-alpha6'\n\n// ---------------------------------------------------------------------------\n// APIs and cluster URLs\n// ---------------------------------------------------------------------------\n\n/** The client details page can transform the cluster URL string (c4). */\nexport const REST_API_URL_TRANSFORM_MIN_VERSION = '8.6.0'\n\n/** The cluster publishes a Zeebe REST URL, so the client details page uses it. */\nexport const ZEEBE_REST_URL_MIN_VERSION = '8.8.0-alpha1'\n\n/** The cluster serves the v2 REST API under `<clusterUrl>/v2` (c4). */\nexport const REST_API_V2_MIN_VERSION = '8.10.0-alpha1'\n\n/** The Swagger toggle and the Swagger link are offered (c4). */\nexport const SWAGGER_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * The Swagger URL moves to its 8.9 shape (c4 `buildClusterSwaggerUrl`).\n * Spelled `8.9.0`, so 8.9 prereleases keep the older URL.\n */\nexport const SWAGGER_URL_8_9_MIN_VERSION = '8.9.0'\n\n/** The MCP toggle and the MCP client tab are offered (c4). */\nexport const MCP_MIN_VERSION = '8.9.0-alpha4'\n\n// ---------------------------------------------------------------------------\n// Apps, tabs and dashboards\n// ---------------------------------------------------------------------------\n\n/**\n * Identity is called \"Admin\" from here on (c4 navigation and overview tab,\n * console-sm-frontend). The URL and the permission still say `identity`.\n */\nexport const ADMIN_APP_RENAME_MIN_VERSION = '8.9.0-alpha5'\n\n/** The job dashboard is offered (c4 overview tab and console-sm-frontend). */\nexport const JOB_DASHBOARD_MIN_VERSION = '8.9.0-alpha5'\n\n/** The cluster serves the statistics config endpoint (c4 cluster details). */\nexport const CLUSTER_STATISTICS_CONFIG_MIN_VERSION = '8.9.0-alpha5'\n\n/** The audit log tab is offered (c4 cluster details). */\nexport const AUDIT_LOG_TAB_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Cluster spec and provisioning\n// ---------------------------------------------------------------------------\n\n/** Only 8.7 and newer generations are offered to AWS-only orgs (console-backend). */\nexport const AWS_ONLY_GENERATION_MIN_VERSION = '8.7.0'\n\n/**\n * The gateway spec takes its 8.9 shape (console-backend\n * `K8sSpecUtils.getGatewaySpec`). Spelled `-alpha0`, so every 8.9 prerelease\n * is included.\n */\nexport const GATEWAY_SPEC_8_9_MIN_VERSION = '8.9.0-alpha0'\n\n/**\n * The operator wires the session idle-timeout config through to Operate,\n * Tasklist and the unified app (camunda-security-library ADR-0042,\n * camunda-operator#5863). This floor matches the `SessionConfigSupported` gate\n * of the operator. The CRD spec and the c4 settings tile both read it, which is\n * why it lives here.\n */\nexport const SESSION_CONFIG_MIN_VERSION = '8.10.0-alpha5'\n\n/** A new cluster gets Optimize turned on by default (console-backend). */\nexport const OPTIMIZE_DEFAULT_ON_MIN_VERSION = '8.10.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Secrets, BYOIDP, Optimize and App Integrations\n//\n// Moved here from misc.const.ts. Same names, same values.\n// ---------------------------------------------------------------------------\n/**\n * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by\n * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate\n * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,\n * where the exporter starts honoring the filters) \u2014 this is the product rollout gate.\n */\nexport const OPTIMIZE_FILTERING_MIN_VERSION = '8.10.0-alpha1'\n\n/**\n * Minimum cluster (zeebe) version at which the operator understands the new\n * cluster-secret CRDs (camunda-operator#5760) \u2014 SecretSource and SecretSync exist and\n * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:\n * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's\n * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef\n * (ByoidpSecretDeliveryController.deliverSecret refuses without one).\n *\n * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP\n * shipped on. Raising it would strand BYOIDP on every alpha below the new value.\n */\nexport const SECRET_SOURCE_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).\n * Shared by the c4 settings tile gate and the console-backend update guard so both\n * stay in lockstep.\n *\n * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP\n * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its\n * clientSecret through the SecretSource), so the two answer the same question and a\n * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION\n * \u2014 that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,\n * where it currently ships to prod.\n */\nexport const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version at which a cluster's *connector and internal*\n * secrets live in the new per-stage secret manager rather than the legacy store.\n *\n * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a\n * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy\n * store and it gets no connector SecretSync. The one thing that must never drift is\n * the pair inside THIS concern: store routing\n * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync\n * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),\n * the pre-8.10-backup mirror check, and the upgrade-copy crossing check\n * (GenerationController.crossesInto810) all read THIS constant. #9703 was those\n * disagreeing \u2014 where Console writes a secret must equal where the cluster reads it.\n *\n * Was the 8.10 GA line (`8.10.0`) until the connector-secret changes landed on\n * `8.10.0-alpha5` (2026-09-02). The floor moved down to that alpha because the\n * ordering requirement below was already met at that time: no\n * `8.10.0-alpha5` cluster existed yet, on any stage. So no cluster's secrets\n * were left in the legacy store under the new floor.\n *\n * Why alphas normally stay out: routing is version-based with no persisted \"which\n * store holds this cluster's secrets\" marker, so a cluster above the floor while the\n * feature gate is off has its secrets in the legacy store, and enabling the gate\n * later reroutes it to a store nobody ever populated. The copy that would fix that\n * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only\n * fires on a generation CHANGE, and alpha generations have no upgrade chain at all\n * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) \u2014 an alpha cluster is\n * created on its generation and stays there. So an alpha cohort above this floor\n * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that\n * cohort, and they stay below THIS floor (`alpha4 < alpha5`), so they are unaffected.\n *\n * The remaining ordering requirement is that a stage's gate be enabled before the\n * first at-floor cluster exists on it \u2014 which for SNAPSHOT-tagged clusters (at-floor\n * by design, since they run the newest operator) still has to be respected by hand. A\n * future move to `8.10.0-alpha6` or higher must check the same thing this move did:\n * no cluster already sitting at that version on any stage.\n */\nexport const CONNECTOR_SECRET_SYNC_MIN_VERSION = '8.10.0-alpha5'\n\n/**\n * Version floors for App Integrations (#8536). The fix landed as patches on\n * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything\n * from 8.10.0-alpha4 on already carries both fixes. Shared by\n * isAppIntegrationsVersionSupported (c4 settings tile + console-backend\n * update guard) so the gate logic and its error message stay in lockstep.\n */\nexport const APP_INTEGRATIONS_MIN_VERSION = '8.10.0-alpha4'\nexport const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = '8.9.14'\nexport const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = '8.9.7'\n\n/**\n * Minor selector for the 8.9 stream, read with `VersionCheckOperator.SameMinor`\n * by `isAppIntegrationsVersionSupported`. It picks the stream, it is not a\n * floor: the floors are the two constants above.\n */\nexport const APP_INTEGRATIONS_89_STREAM_MINOR = '8.9.0'\n\n/**\n * The cluster details header calls the secrets \"cluster secrets\" instead of\n * the legacy name (c4).\n *\n * Aliased to CONNECTOR_SECRET_SYNC_MIN_VERSION rather than repeating the\n * literal: the label must follow the store the cluster actually uses, so the\n * two answer the same question.\n */\nexport const CLUSTER_SECRETS_LABEL_MIN_VERSION =\n  CONNECTOR_SECRET_SYNC_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version for the optional telemetry toggle.\n */\nexport const OPTIONAL_TELEMETRY_MIN_VERSION = '8.10.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Suspend and resume\n// ---------------------------------------------------------------------------\n\n/**\n * Lowest ALPHA generation that a suspended cluster can resume from. A cluster\n * on an alpha under this floor stays suspended forever.\n * `isGenerationResumable` reads this floor. The c4 resume actions and the\n * console-backend wake-up guards share that function.\n *\n * The floor applies to alphas only. A release generation under it, 8.9 or\n * 8.8 for example, resumes as before. Those lines have an upgrade chain, so a\n * customer can move off them. An alpha has no upgrade chain\n * (`upgradeableFrom = []`, `ReleaseTrainController.handleAlpha`). A cluster\n * starts on its alpha generation and stays there, so the only way off an old\n * alpha is a new cluster. A bulk operation suspends that cohort, and this floor\n * then refuses the wake-up.\n *\n * Spelled `8.10.0-alpha5` and not `-0`, because the cohort to retire is every\n * alpha under alpha5. It holds the same value as\n * `CONNECTOR_SECRET_SYNC_MIN_VERSION` today. The alphas under that floor keep\n * their connector secrets in the legacy store, and no migration can move them.\n * It stays a constant of its own, because it answers a different question and\n * the two values can move apart.\n */\nexport const RESUME_ALPHA_MIN_VERSION = '8.10.0-alpha5'\n"],
-  "mappings": "AA4CO,MAAM,uBAAuB;AAG7B,MAAM,wBAAwB;AAO9B,MAAM,yBAAyB;AAW/B,MAAM,oCAAoC;AAG1C,MAAM,4CAA4C;AAOlD,MAAM,qCAAqC;AAO3C,MAAM,4CAA4C;AAMlD,MAAM,gCAAgC;AAMtC,MAAM,mCAAmC;AAczC,MAAM,kCAAkC;AAGxC,MAAM,mCAAmC;AAGzC,MAAM,qCAAqC;AAU3C,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAO/C,MAAM,qCAAqC;AAU3C,MAAM,gDAAgD;AAGtD,MAAM,sCAAsC;AAM5C,MAAM,mCAAmC;AAOzC,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAmBzC,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAM/C,MAAM,6CAA6C;AAgBnD,MAAM,2CAA2C;AAOjD,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAO5C,MAAM,sCAAsC;AAwB5C,MAAM,uCAAuC;AAO7C,MAAM,qCAAqC;AAG3C,MAAM,6BAA6B;AAGnC,MAAM,0BAA0B;AAGhC,MAAM,sBAAsB;AAM5B,MAAM,8BAA8B;AAGpC,MAAM,kBAAkB;AAUxB,MAAM,+BAA+B;AAGrC,MAAM,4BAA4B;AAGlC,MAAM,wCAAwC;AAG9C,MAAM,4BAA4B;AAOlC,MAAM,kCAAkC;AAOxC,MAAM,+BAA+B;AASrC,MAAM,6BAA6B;AAGnC,MAAM,kCAAkC;AAaxC,MAAM,iCAAiC;AAavC,MAAM,4BAA4B;AAclC,MAAM,qBAAqB;AAuC3B,MAAM,oCAAoC;AAS1C,MAAM,+BAA+B;AACrC,MAAM,+CAA+C;AACrD,MAAM,0DAA0D;AAOhE,MAAM,mCAAmC;AAUzC,MAAM,oCACX;AAKK,MAAM,iCAAiC;AA2BvC,MAAM,2BAA2B;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Central list of the cluster version floors that gate features.\n *\n * Every `checkVersion({ versionToCompareTo })` / `checkClusterVersion()` call in\n * the apps and in `packages/c4` reads its floor from here. Put a new floor here\n * before you use it. Do not write a version literal at the call site \u2014 the same\n * feature is usually gated in more than one place (a c4 tile, a console-backend\n * guard, a CRD spec), and two literals drift. Incident #9703 was two copies of\n * one floor that disagreed.\n *\n * `packages/c3` keeps its own copy of the version helpers and is out of scope:\n * it is a public package that this repo must not change.\n *\n * The values compare with semver, so the spelling of a floor decides which\n * prerelease cohort it covers:\n * - `8.10.0-0` and `8.10.0-alpha0` sort below every `8.10.0-alphaN`.\n * - `8.10.0-alpha1` sorts above `alpha0` but below `alpha2`.\n * - `8.10.0` sorts above ALL `8.10.0-*` prereleases.\n *\n * Two constants in this file can hold the same value. Then they gate different\n * features and can move apart. When a name is an alias of another constant, the\n * two answer the same question and must never drift.\n *\n * A call site compares a floor against the zeebe version of the generation,\n * unless the comment of the constant names a different field. Name that field\n * in the comment when you add a floor for one, because the same number means a\n * different thing for `connectorBridge` or for a generation name.\n */\n\n// ---------------------------------------------------------------------------\n// Release-line floors\n//\n// Used where the code asks \"is this generation on the 8.x line?\" and no single\n// feature owns the answer. Both spell the line start as `-0`, so every\n// prerelease of that line is included.\n// ---------------------------------------------------------------------------\n\n/** Start of the 8.9 line, prereleases included. */\nexport const LINE_8_9_MIN_VERSION = '8.9.0-0'\n\n/** Start of the 8.10 line, prereleases included. */\nexport const LINE_8_10_MIN_VERSION = '8.10.0-0'\n\n// ---------------------------------------------------------------------------\n// Backups\n// ---------------------------------------------------------------------------\n\n/** Hot backups are available on the cluster (c4 hot-backups tab). */\nexport const HOT_BACKUP_MIN_VERSION = '8.2.4'\n\n// ---------------------------------------------------------------------------\n// Identity, authorizations and roles\n// ---------------------------------------------------------------------------\n\n/**\n * The \"enforce groups\" toggle is offered (c4 settings tile). The tile also\n * disappears again on 8.8 clusters that run Tasklist V2 \u2014 see\n * `ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION`.\n */\nexport const ENFORCE_GROUPS_TOGGLE_MIN_VERSION = '8.5.0-alpha2'\n\n/** Resource-based authorizations exist. Replaced by identity authorizations. */\nexport const RESOURCE_BASED_AUTHORIZATIONS_MIN_VERSION = '8.6.0'\n\n/**\n * Identity-based authorizations replace the resource-based ones. Read as an\n * upper bound by the c4 settings tile: below this the cluster still shows the\n * resource-based section.\n */\nexport const IDENTITY_AUTHORIZATION_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Upper bound of the \"your upgrade turns on identity authorizations\" notice in\n * the c4 overview tab. The notice is for 8.8-line targets only, so an 8.9\n * target does not show it.\n */\nexport const IDENTITY_AUTHORIZATION_NOTICE_MAX_VERSION = '8.9.0-alpha1'\n\n/**\n * The cluster uses the 8.8 role model, so the legacy per-cluster roles are\n * gone (c4 user-details and management widgets).\n */\nexport const NEW_CLUSTER_ROLES_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * The authorizations toggle is offered while creating a cluster (c4 create\n * cluster wizard).\n */\nexport const AUTHORIZATION_TOGGLE_MIN_VERSION = '8.8.0-alpha4'\n\n/**\n * Identity manages users, groups and tenants. The cluster shows the Identity\n * screens (c4 cluster details, user details, group details, management widget,\n * console-frontend and console-sm-frontend), and the CRD spec sends the\n * internal client IDs to Identity\n * (`K8sSpecUtils.clusterHasEnabledIdentityIntegration`).\n *\n * console-backend used `8.8.0-alpha4` until the gates moved here. That floor\n * was one alpha under the frontend. As a result, an 8.8.0-alpha4 cluster got\n * its `internalClientIDs` sent to an Identity that the UI did not show. There\n * is one floor now, on the version the UI has always used.\n */\nexport const IDENTITY_MANAGEMENT_MIN_VERSION = '8.8.0-alpha5'\n\n/** The multi-tenancy toggle is offered (c4 settings tile). */\nexport const MULTI_TENANCY_TOGGLE_MIN_VERSION = '8.8.0-alpha7'\n\n/** Business-ID uniqueness toggle is offered (c4 settings tile). */\nexport const BUSINESS_ID_UNIQUENESS_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Tasklist\n// ---------------------------------------------------------------------------\n\n/**\n * The current generation is good enough to upgrade to Tasklist V2 (c4 overview\n * tab).\n */\nexport const TASKLIST_V2_UPGRADE_MIN_VERSION = '8.7.0-alpha4'\n\n/**\n * The upgrade target carries Tasklist V2 (c4 overview tab). Pairs with\n * `LINE_8_10_MIN_VERSION` as the upper bound, because from 8.10 on the setting\n * is gone.\n */\nexport const TASKLIST_V2_UPGRADE_TARGET_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * A new cluster gets `tasklistV2Enabled` by default (console-backend cluster\n * creation). Reads the generation's tasklist version when it has one, else\n * zeebe.\n */\nexport const TASKLIST_V2_DEFAULT_ON_MIN_VERSION = '8.8.0'\n\n/**\n * From this version, the c4 settings tile hides the \"enforce groups\" toggle on\n * a cluster that runs Tasklist V2. The tile reads the constant with `>=`, and\n * it also needs `tasklistV2Enabled` to be true.\n *\n * The name says MIN because of that `>=`. The other MAX names in this file mark\n * the version where a gate stops, and their call sites read them with `<`.\n */\nexport const ENFORCE_GROUPS_TASKLIST_V2_HIDDEN_MIN_VERSION = '8.8.0'\n\n/** The Tasklist upgrade banner is offered (c4 settings tile). */\nexport const TASKLIST_UPGRADE_BANNER_MIN_VERSION = '8.8.0-alpha2'\n\n/**\n * The Tasklist mode toggle is offered while creating a cluster (c4 create\n * cluster wizard). Upper bound is `LINE_8_10_MIN_VERSION`.\n */\nexport const TASKLIST_MODE_TOGGLE_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * Minor-version pair that turns Tasklist V2 on during a generation update\n * (console-backend). Both are read with `VersionCheckOperator.SameMinor`: an\n * 8.7 cluster that moves to an 8.8 generation gets the setting.\n */\nexport const TASKLIST_V2_AUTO_ENABLE_FROM_MINOR = '8.7.0'\nexport const TASKLIST_V2_AUTO_ENABLE_TO_MINOR = '8.8.0'\n\n/**\n * The version where the Tasklist V2 flag stops to mean anything, because there\n * is no Tasklist V1 left to switch away from. Two readers use it. The CRD spec\n * stops to emit the Tasklist V2 mode environment variable\n * (`K8sSpecUtils.shouldSkipTasklistV2ModeEnvVar`). The accounts-frontend\n * support rows stop to show the flag.\n *\n * Spelled `8.10.0` and NOT `LINE_8_10_MIN_VERSION` (`8.10.0-0`). Cluster\n * creation sets the flag on every generation from\n * `TASKLIST_V2_DEFAULT_ON_MIN_VERSION` on. An 8.10 prerelease thus carries a\n * live value, and it must stay under this bound.\n *\n * c4 bounds its own Tasklist V2 checks with `LINE_8_10_MIN_VERSION` instead.\n * That constant answers a different question: can Console still offer the\n * Tasklist upgrade to this cluster. It correctly leaves out the 8.10\n * prereleases.\n */\nexport const TASKLIST_V2_SETTING_MAX_VERSION = '8.10.0'\n\n// ---------------------------------------------------------------------------\n// Connectors\n// ---------------------------------------------------------------------------\n\n/** The internal connectors-management page exists (c4 overview tab link). */\nexport const CONNECTORS_MANAGEMENT_LINK_MIN_VERSION = '8.7.0-alpha1'\n\n/**\n * The applications list offers \"Manage\" for connectors (c4 overview tab).\n * Matches what console-frontend has always done.\n */\nexport const INTERNAL_CONNECTORS_MANAGEMENT_MIN_VERSION = '8.8.0-alpha1'\n\n/**\n * Connector management shows the outbound connectors, the per-connector metrics\n * and the restart button. Under this floor the pages show the inbound-only\n * table.\n *\n * CAUTION: the two readers compare this floor against different version fields.\n * The c4 connector-management widgets compare\n * `generation.versions.connectorBridge`\n * (`useConnectorManagementRuntime.checkClusterVersion`). The\n * console-sm-frontend pages compare the generation name of the cluster\n * (`page.getData().generation`). Both sites had the same literal before the\n * gates moved here, so this constant keeps that. Do not read it as one\n * question until the two readers compare the same field.\n */\nexport const CONNECTOR_MANAGEMENT_METRICS_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * The secrets filter mode setting is offered on the 8.6 line (zeebe). Shared by\n * isSecretsFilterModeConfigurable (c4 settings tile + console-backend update\n * guard).\n */\nexport const SECRETS_FILTER_MODE_8_6_MIN_VERSION = '8.6.28'\n\n/** Same setting, floor for the 8.7 line. */\nexport const SECRETS_FILTER_MODE_8_7_MIN_VERSION = '8.7.25'\n\n/** Same setting, floor for the 8.8 line. */\nexport const SECRETS_FILTER_MODE_8_8_MIN_VERSION = '8.8.19'\n\n/**\n * Same setting, floor for the 8.9 line. The env var works from 8.9.7, but the\n * default stays DISABLED until 8.9.10. The floor waits for that default\n * change, so the toggle never shows an unset value with an unknown default.\n */\nexport const SECRETS_FILTER_MODE_8_9_MIN_VERSION = '8.9.10'\n\n/**\n * Same setting, floor for the 8.10 line and every line above it.\n *\n * This is the last floor: isSecretsFilterModeConfigurable applies it to all\n * versions above the 8.9 line, so 8.11 and later need no floor of their own.\n *\n * Two different reasons keep the versions below it out, and the second one is\n * why this floor is alpha6 and not alpha5:\n *\n * - alpha1 to alpha4 shipped the DISABLED default. Same reason as 8.9.7-8.9.9.\n * - alpha5 shipped the STRICT default, but not the Connectors change that this\n *   setting needs. SaaS runs Connectors with legacy.mode=FALLBACK from the 8.10\n *   line on, and the Connectors runtime of alpha5 refuses to start unless\n *   FALLBACK is paired with STRICT\n *   (ConnectorsAutoConfiguration.checkLegacyFallbackSecretFilter). A customer\n *   who selects LAX or DISABLED on alpha5 crashes their own Connectors runtime\n *   at startup, so the toggle must stay hidden there.\n *\n * Connectors removed that check after the alpha5 release (2026-09-03). The\n * removal is in the SNAPSHOT images and lands in the releases from alpha6 on.\n * SNAPSHOT clusters run the newest images, so they get the toggle.\n */\nexport const SECRETS_FILTER_MODE_8_10_MIN_VERSION = '8.10.0-alpha6'\n\n// ---------------------------------------------------------------------------\n// APIs and cluster URLs\n// ---------------------------------------------------------------------------\n\n/** The client details page can transform the cluster URL string (c4). */\nexport const REST_API_URL_TRANSFORM_MIN_VERSION = '8.6.0'\n\n/** The cluster publishes a Zeebe REST URL, so the client details page uses it. */\nexport const ZEEBE_REST_URL_MIN_VERSION = '8.8.0-alpha1'\n\n/** The cluster serves the v2 REST API under `<clusterUrl>/v2` (c4). */\nexport const REST_API_V2_MIN_VERSION = '8.10.0-alpha1'\n\n/** The Swagger toggle and the Swagger link are offered (c4). */\nexport const SWAGGER_MIN_VERSION = '8.8.0-alpha8'\n\n/**\n * The Swagger URL moves to its 8.9 shape (c4 `buildClusterSwaggerUrl`).\n * Spelled `8.9.0`, so 8.9 prereleases keep the older URL.\n */\nexport const SWAGGER_URL_8_9_MIN_VERSION = '8.9.0'\n\n/** The MCP toggle and the MCP client tab are offered (c4). */\nexport const MCP_MIN_VERSION = '8.9.0-alpha4'\n\n// ---------------------------------------------------------------------------\n// Apps, tabs and dashboards\n// ---------------------------------------------------------------------------\n\n/**\n * Identity is called \"Admin\" from here on (c4 navigation and overview tab,\n * console-sm-frontend). The URL and the permission still say `identity`.\n */\nexport const ADMIN_APP_RENAME_MIN_VERSION = '8.9.0-alpha5'\n\n/** The job dashboard is offered (c4 overview tab and console-sm-frontend). */\nexport const JOB_DASHBOARD_MIN_VERSION = '8.9.0-alpha5'\n\n/** The cluster serves the statistics config endpoint (c4 cluster details). */\nexport const CLUSTER_STATISTICS_CONFIG_MIN_VERSION = '8.9.0-alpha5'\n\n/** The audit log tab is offered (c4 cluster details). */\nexport const AUDIT_LOG_TAB_MIN_VERSION = '8.9.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Cluster spec and provisioning\n// ---------------------------------------------------------------------------\n\n/** Only 8.7 and newer generations are offered to AWS-only orgs (console-backend). */\nexport const AWS_ONLY_GENERATION_MIN_VERSION = '8.7.0'\n\n/**\n * The gateway spec takes its 8.9 shape (console-backend\n * `K8sSpecUtils.getGatewaySpec`). Spelled `-alpha0`, so every 8.9 prerelease\n * is included.\n */\nexport const GATEWAY_SPEC_8_9_MIN_VERSION = '8.9.0-alpha0'\n\n/**\n * The operator wires the session idle-timeout config through to Operate,\n * Tasklist and the unified app (camunda-security-library ADR-0042,\n * camunda-operator#5863). This floor matches the `SessionConfigSupported` gate\n * of the operator. The CRD spec and the c4 settings tile both read it, which is\n * why it lives here.\n */\nexport const SESSION_CONFIG_MIN_VERSION = '8.10.0-alpha5'\n\n/** A new cluster gets Optimize turned on by default (console-backend). */\nexport const OPTIMIZE_DEFAULT_ON_MIN_VERSION = '8.10.0-alpha5'\n\n// ---------------------------------------------------------------------------\n// Secrets, BYOIDP, Optimize and App Integrations\n//\n// Moved here from misc.const.ts. Same names, same values.\n// ---------------------------------------------------------------------------\n/**\n * Minimum cluster (zeebe) version for the Optimize data-filters feature. Shared by\n * the c4 settings tile, the new-cluster default, and CRD spec generation so the gate\n * stays consistent. Stricter than the operator's own gate (Camunda >= 8.9.0-alpha1,\n * where the exporter starts honoring the filters) \u2014 this is the product rollout gate.\n */\nexport const OPTIMIZE_FILTERING_MIN_VERSION = '8.10.0-alpha1'\n\n/**\n * Minimum cluster (zeebe) version at which the operator understands the new\n * cluster-secret CRDs (camunda-operator#5760) \u2014 SecretSource and SecretSync exist and\n * reconcile. Governs *provisioning the CRs*, nothing about which store they point at:\n * SecretSource provisioning (K8sClusterController.ensureSecretSource) and BYOIDP's\n * oidcProviders emission, which needs a SecretSource to deliver its clientSecretRef\n * (ByoidpSecretDeliveryController.deliverSecret refuses without one).\n *\n * BYOIDP is live up to prod, so this floor must stay at the generation BYOIDP\n * shipped on. Raising it would strand BYOIDP on every alpha below the new value.\n */\nexport const SECRET_SOURCE_MIN_VERSION = '8.10.0-alpha3'\n\n/**\n * Minimum cluster (zeebe) version for BYOIDP (external identity provider, #3190).\n * Shared by the c4 settings tile gate and the console-backend update guard so both\n * stay in lockstep.\n *\n * Aliased to SECRET_SOURCE_MIN_VERSION rather than repeating the literal: BYOIDP\n * needs the SecretSource/SecretSync CRDs to exist and nothing more (it delivers its\n * clientSecret through the SecretSource), so the two answer the same question and a\n * second literal would only let them drift. It is NOT CONNECTOR_SECRET_SYNC_MIN_VERSION\n * \u2014 that one is higher, and gating BYOIDP on it would strand BYOIDP on every alpha,\n * where it currently ships to prod.\n */\nexport const BYOIDP_MIN_VERSION = SECRET_SOURCE_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version at which a cluster's *connector and internal*\n * secrets live in the new per-stage secret manager rather than the legacy store.\n *\n * Higher than SECRET_SOURCE_MIN_VERSION on purpose: a cluster can have a\n * SecretSource (so BYOIDP works) while its connector secrets are still in the legacy\n * store and it gets no connector SecretSync. The one thing that must never drift is\n * the pair inside THIS concern: store routing\n * (ConnectorSecretsController.resolveSecretManagerTarget), the connector SecretSync\n * and its projection into the broker's file store (K8sSpecUtils.getSecretStoresSpec),\n * the pre-8.10-backup mirror check, and the upgrade-copy crossing check\n * (GenerationController.crossesInto810) all read THIS constant. #9703 was those\n * disagreeing \u2014 where Console writes a secret must equal where the cluster reads it.\n *\n * Was the 8.10 GA line (`8.10.0`) until the connector-secret changes landed on\n * `8.10.0-alpha5` (2026-09-02). The floor moved down to that alpha because the\n * ordering requirement below was already met at that time: no\n * `8.10.0-alpha5` cluster existed yet, on any stage. So no cluster's secrets\n * were left in the legacy store under the new floor.\n *\n * Why alphas normally stay out: routing is version-based with no persisted \"which\n * store holds this cluster's secrets\" marker, so a cluster above the floor while the\n * feature gate is off has its secrets in the legacy store, and enabling the gate\n * later reroutes it to a store nobody ever populated. The copy that would fix that\n * (GenerationController.crossesInto810 -> copyConnectorSecretsToNewManager) only\n * fires on a generation CHANGE, and alpha generations have no upgrade chain at all\n * (`upgradeableFrom = []`, ReleaseTrainController.handleAlpha) \u2014 an alpha cluster is\n * created on its generation and stays there. So an alpha cohort above this floor\n * could never be migrated; the ~200 8.10.0-alpha4 clusters on prod are exactly that\n * cohort, and they stay below THIS floor (`alpha4 < alpha5`), so they are unaffected.\n *\n * The remaining ordering requirement is that a stage's gate be enabled before the\n * first at-floor cluster exists on it \u2014 which for SNAPSHOT-tagged clusters (at-floor\n * by design, since they run the newest operator) still has to be respected by hand. A\n * future move to `8.10.0-alpha6` or higher must check the same thing this move did:\n * no cluster already sitting at that version on any stage.\n */\nexport const CONNECTOR_SECRET_SYNC_MIN_VERSION = '8.10.0-alpha5'\n\n/**\n * Version floors for App Integrations (#8536). The fix landed as patches on\n * the 8.9 stream (zeebe >=8.9.14 AND connectorBridge >=8.9.7), everything\n * from 8.10.0-alpha4 on already carries both fixes. Shared by\n * isAppIntegrationsVersionSupported (c4 settings tile + console-backend\n * update guard) so the gate logic and its error message stay in lockstep.\n */\nexport const APP_INTEGRATIONS_MIN_VERSION = '8.10.0-alpha4'\nexport const APP_INTEGRATIONS_89_STREAM_ZEEBE_MIN_VERSION = '8.9.14'\nexport const APP_INTEGRATIONS_89_STREAM_CONNECTOR_BRIDGE_MIN_VERSION = '8.9.7'\n\n/**\n * Minor selector for the 8.9 stream, read with `VersionCheckOperator.SameMinor`\n * by `isAppIntegrationsVersionSupported`. It picks the stream, it is not a\n * floor: the floors are the two constants above.\n */\nexport const APP_INTEGRATIONS_89_STREAM_MINOR = '8.9.0'\n\n/**\n * The cluster details header calls the secrets \"cluster secrets\" instead of\n * the legacy name (c4).\n *\n * Aliased to CONNECTOR_SECRET_SYNC_MIN_VERSION rather than repeating the\n * literal: the label must follow the store the cluster actually uses, so the\n * two answer the same question.\n */\nexport const CLUSTER_SECRETS_LABEL_MIN_VERSION =\n  CONNECTOR_SECRET_SYNC_MIN_VERSION\n\n/**\n * Minimum cluster (zeebe) version that runs the analytics exporter, thus the\n * floor for optional telemetry.\n *\n * The number comes from the operator: `AnalyticsExporterSupported` in\n * `pkg/features/features.go` reads `>= 8.10.0-alpha1`, and below it\n * `zeebe_statefulset.go` adds no exporter env vars at all. A cluster under the\n * floor sends no analytics telemetry, OPTIONAL or CONTRACTUAL, thus the row\n * has no state to show and the toggle has nothing to switch.\n */\nexport const OPTIONAL_TELEMETRY_MIN_VERSION = '8.10.0-alpha1'\n\n// ---------------------------------------------------------------------------\n// Suspend and resume\n// ---------------------------------------------------------------------------\n\n/**\n * Lowest ALPHA generation that a suspended cluster can resume from. A cluster\n * on an alpha under this floor stays suspended forever.\n * `isGenerationResumable` reads this floor. The c4 resume actions and the\n * console-backend wake-up guards share that function.\n *\n * The floor applies to alphas only. A release generation under it, 8.9 or\n * 8.8 for example, resumes as before. Those lines have an upgrade chain, so a\n * customer can move off them. An alpha has no upgrade chain\n * (`upgradeableFrom = []`, `ReleaseTrainController.handleAlpha`). A cluster\n * starts on its alpha generation and stays there, so the only way off an old\n * alpha is a new cluster. A bulk operation suspends that cohort, and this floor\n * then refuses the wake-up.\n *\n * Spelled `8.10.0-alpha5` and not `-0`, because the cohort to retire is every\n * alpha under alpha5. It holds the same value as\n * `CONNECTOR_SECRET_SYNC_MIN_VERSION` today. The alphas under that floor keep\n * their connector secrets in the legacy store, and no migration can move them.\n * It stays a constant of its own, because it answers a different question and\n * the two values can move apart.\n */\nexport const RESUME_ALPHA_MIN_VERSION = '8.10.0-alpha5'\n"],
+  "mappings": "AA4CO,MAAM,uBAAuB;AAG7B,MAAM,wBAAwB;AAO9B,MAAM,yBAAyB;AAW/B,MAAM,oCAAoC;AAG1C,MAAM,4CAA4C;AAOlD,MAAM,qCAAqC;AAO3C,MAAM,4CAA4C;AAMlD,MAAM,gCAAgC;AAMtC,MAAM,mCAAmC;AAczC,MAAM,kCAAkC;AAGxC,MAAM,mCAAmC;AAGzC,MAAM,qCAAqC;AAU3C,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAO/C,MAAM,qCAAqC;AAU3C,MAAM,gDAAgD;AAGtD,MAAM,sCAAsC;AAM5C,MAAM,mCAAmC;AAOzC,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAmBzC,MAAM,kCAAkC;AAOxC,MAAM,yCAAyC;AAM/C,MAAM,6CAA6C;AAgBnD,MAAM,2CAA2C;AAOjD,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAG5C,MAAM,sCAAsC;AAO5C,MAAM,sCAAsC;AAwB5C,MAAM,uCAAuC;AAO7C,MAAM,qCAAqC;AAG3C,MAAM,6BAA6B;AAGnC,MAAM,0BAA0B;AAGhC,MAAM,sBAAsB;AAM5B,MAAM,8BAA8B;AAGpC,MAAM,kBAAkB;AAUxB,MAAM,+BAA+B;AAGrC,MAAM,4BAA4B;AAGlC,MAAM,wCAAwC;AAG9C,MAAM,4BAA4B;AAOlC,MAAM,kCAAkC;AAOxC,MAAM,+BAA+B;AASrC,MAAM,6BAA6B;AAGnC,MAAM,kCAAkC;AAaxC,MAAM,iCAAiC;AAavC,MAAM,4BAA4B;AAclC,MAAM,qBAAqB;AAuC3B,MAAM,oCAAoC;AAS1C,MAAM,+BAA+B;AACrC,MAAM,+CAA+C;AACrD,MAAM,0DAA0D;AAOhE,MAAM,mCAAmC;AAUzC,MAAM,oCACX;AAYK,MAAM,iCAAiC;AA2BvC,MAAM,2BAA2B;",
   "names": []
 }