@camunda/ccma-shared-types 1.2.0 → 3.0.0

package/dist/dtos/AlertSubscription.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/AlertSubscription.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n}\n\nexport interface AlertSubscriptionEntryDto {\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\n/**\n * Webhook targets a customer may not point an alert at, to limit SSRF.\n *\n * Despite the name, each entry is a URL prefix, scheme included: callers match\n * with `url.href.startsWith(entry)`. So add entries as `https://<host>`, with\n * no trailing slash and no path.\n */\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n  'https://accounts.dev.ultrawombat.com',\n  // Hub and consolelegacy, all stages.\n  // Note: This list contains URL prefixes (`https://<host>`), not bare hostnames.\n  // Callers compare with `url.href.startsWith(...)`.\n  'https://hub.dev.ultrawombat.com',\n  'https://hub.ultrawombat.com',\n  'https://hub.camunda.io',\n  'https://consolelegacy.dev.ultrawombat.com',\n  'https://consolelegacy.ultrawombat.com',\n  'https://consolelegacy.camunda.io',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
-  "mappings": "AAuCO,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAS7B,MAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AlertSubscriptionReportType,\n  AlertSubscriptionType,\n} from '../enums/AlertSubscription.enum.js'\n\nexport interface AlertSubscriptionDto {\n  uuid: string\n  userIdOrWebhook: string\n  type: AlertSubscriptionType\n  report: AlertSubscriptionReportType\n  webhookAuth?: AlertSubscriptionWebhookAuth\n  createdBy: string\n  createdByName: string\n  created: Date\n  updatedBy: string\n  updatedByName: string\n  updated: Date\n  lastTimeTriggered?: Date\n  numberOfTimesTriggered: number\n  /**\n   * The address of an `Email` subscription. alert-distributor adds it from the\n   * user id, which its list endpoint then replaces with the name of the user.\n   * Thus this field is the only reliable way to identify the person.\n   */\n  recepientEmail?: string\n}\n\nexport interface AlertSubscriptionEntryDto {\n  errorMessage?: string\n  errorType?: string\n  flowNodeId?: string\n  jobKey?: string\n  creationTime?: string\n  processInstanceId?: string\n  processName?: string\n  processVersion?: number\n  bpmnProcessId?: string\n}\n\nexport const HMAC_SUPPORTED_ALGORITHM = 'sha256'\nexport const HMAC_HEADER_POSITION = 'X-Camunda-Signature-256'\n\n/**\n * Webhook targets a customer may not point an alert at, to limit SSRF.\n *\n * Despite the name, each entry is a URL prefix, scheme included: callers match\n * with `url.href.startsWith(entry)`. So add entries as `https://<host>`, with\n * no trailing slash and no path.\n */\nexport const FORBIDDEN_HOSTNAMES_FOR_WEBHOOK_ALERTS = [\n  'https://camunda.com',\n  'https://console.cloud.camunda.io',\n  'https://accounts.cloud.camunda.io',\n  'https://console.camunda.io',\n  'https://accounts.camunda.io',\n  'https://console.ultrawombat.com',\n  'https://console.cloud.ultrawombat.com',\n  'https://accounts.cloud.ultrawombat.com',\n  'https://accounts.ultrawombat.com',\n  'https://console.cloud.dev.ultrawombat.com',\n  'https://console.dev.ultrawombat.com',\n  'https://accounts.cloud.dev.ultrawombat.com',\n  'https://accounts.dev.ultrawombat.com',\n  // Hub and consolelegacy, all stages.\n  // Note: This list contains URL prefixes (`https://<host>`), not bare hostnames.\n  // Callers compare with `url.href.startsWith(...)`.\n  'https://hub.dev.ultrawombat.com',\n  'https://hub.ultrawombat.com',\n  'https://hub.camunda.io',\n  'https://consolelegacy.dev.ultrawombat.com',\n  'https://consolelegacy.ultrawombat.com',\n  'https://consolelegacy.camunda.io',\n]\n\nexport type ALERT_SUBSCRIPTION_TYPES = 'ProcessAlert'\nexport type ALERT_SUBSCRIPTION_REPORT_TYPES = 'Email' | 'Webhook'\n\nexport interface AlertSubscriptionWebhookAuth {\n  hmac?: {\n    secret: string\n  }\n}\n\nexport type CheckFailedReason =\n  | 'urlEmpty'\n  | 'urlNoHead'\n  | 'generatedHmacNotAccepted'\n  | 'urlBad'\n  | 'urlPrivate'\n"],
+  "mappings": "AA6CO,MAAM,2BAA2B;AACjC,MAAM,uBAAuB;AAS7B,MAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/dtos/ApprovalJob.dto.d.ts

@@ -19,6 +19,44 @@
  */
 export declare const APPROVAL_JOB_STATUSES: readonly ["pending", "approved", "executing", "executed", "failed", "rejected", "withdrawn", "expired"];
 export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
+/**
+ * The states in which the action of a request is still COMING.
+ *
+ * `pending` waits for approvals, `approved` waits for a person to press the
+ * button, and `executing` is running now. Each of them can still change the
+ * world, so two requests for one target must not be in these states together.
+ * `dedupeKey` reads this set for that reason.
+ *
+ * `failed` is NOT here, although a person can run a failed request again. A
+ * failed request runs only when a person presses the button, and that person
+ * sees the row. Blocking a new request on a failed one would also trap the
+ * key: `canWithdraw` accepts `pending` alone, so nobody could close it.
+ *
+ * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.
+ */
+export declare const APPROVAL_LIVE_STATUSES: readonly ["pending", "approved", "executing"];
+/**
+ * How many requests one page of the list holds when the caller asks for no
+ * number.
+ *
+ * The list is a work queue that a Camundi reads, so the page is large: a
+ * person wants the whole queue and not ten rows at a time. What the number is
+ * for is the ceiling below.
+ */
+export declare const APPROVAL_PAGE_SIZE_DEFAULT = 500;
+/**
+ * The largest page that the service builds, and the largest that a caller may
+ * ask for. The API answers 400 above it.
+ *
+ * The list had no limit at all. One authenticated caller could then make the
+ * service read the whole table into memory, serialize it, and do it again, so
+ * the cost of a request grew with the age of the service and with nothing that
+ * the caller had to pay for. A ceiling turns that into a fixed cost.
+ *
+ * It is HERE and not only in the service, because the view must know it: a
+ * page that asked for more would get a 400 instead of rows.
+ */
+export declare const APPROVAL_PAGE_SIZE_MAX = 2000;
 /**
  * What happens when a request reaches its threshold.
  *
@@ -26,6 +64,22 @@ export type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number];
  * `approved` and waits for a person to run it.
  */
 export type ApprovalExecutionMode = 'auto' | 'explicit';
+/**
+ * WHERE the action runs. It is a separate question from who starts it.
+ *
+ * - `inline` runs the action inside the call that started it, and the answer
+ *   already carries the outcome. Right for one call to another service.
+ * - `background` answers as soon as the request is claimed, and the action
+ *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the
+ *   only place that holds the progress, so a reload and a second person read
+ *   the same numbers. A pod that stops loses the run, and the reconciler of
+ *   control-backend recovers the row.
+ *
+ * An action over thousands of targets MUST be `background`. `inline` would
+ * hold one HTTP request for the whole run, and the ingress, the load balancer
+ * and the browser each have their own deadline before it finishes.
+ */
+export type ApprovalActionMode = 'inline' | 'background';
 /**
  * A person, as an approval request records them.
  *
@@ -41,24 +95,168 @@ export interface ApprovalAck extends ApprovalActor {
     /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */
     date: string;
 }
+/**
+ * What one value of a summary field is.
+ *
+ * `text` is what a person reads. `id` is what a link points at, and it is
+ * absent when the kind names no entity. The two are separate because the text
+ * is a COPY that the request keeps: an organization that gets a new name after
+ * the request was opened must still read as the organization that the person
+ * chose.
+ */
+export interface ApprovalSummaryValue {
+    text: string;
+    id?: string;
+}
+/**
+ * How a reader must render one field of a summary.
+ *
+ * `org`, `cluster` and `user` name an entity, so a reader can link to it and
+ * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,
+ * and `code` is a value that must keep its characters, such as a json fragment.
+ */
+export declare const APPROVAL_SUMMARY_FIELD_KINDS: readonly ["text", "number", "boolean", "date", "org", "cluster", "user", "code"];
+export type ApprovalSummaryFieldKind = (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number];
+/**
+ * One labelled field of the payload of a request.
+ *
+ * This is what makes ONE view able to show EVERY use case. The payload of a
+ * request is an object of anything, so a generic view can only print it as
+ * json. The use case turns it into labelled fields here, and the view renders
+ * a field by its kind: it links an `org`, it formats a `date`, and it lists
+ * 300 clusters as 300 links.
+ *
+ * `values` is always an array. A field that holds one value holds an array of
+ * one, so a reader needs no branch for "one or many".
+ */
+export interface ApprovalSummaryField {
+    label: string;
+    kind: ApprovalSummaryFieldKind;
+    values: ApprovalSummaryValue[];
+}
+/**
+ * How long a run may go quiet before a reader calls it stalled.
+ *
+ * The pod that runs an action writes its progress and renews its lease on one
+ * timer, so a healthy run touches the row well inside this window. A row that
+ * is `executing` and older than this held a pod that stopped, and the
+ * reconciler of control-backend is on its way to it.
+ *
+ * It lives here, and not in the config of the service, because a READER needs
+ * it: the browser must decide what to show without a second call, and a number
+ * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in
+ * `config/index.ts` is held below this on purpose.
+ */
+export declare const APPROVAL_RUN_STALE_MS = 120000;
+/**
+ * What an action reports while it runs.
+ *
+ * This is what makes a long action watchable. Every field is in the DATABASE
+ * and not in the answer to the call that started the run, so three readers see
+ * the same thing: the person who pressed the button, the same person after a
+ * reload, and a second person who opens the request.
+ *
+ * `total` can be 0 while an action counts its targets, and it stays 0 for an
+ * action that cannot count them. A reader must then show that it runs, and no
+ * percentage.
+ */
+export interface ApprovalProgress {
+    /** Targets in total. 0 means the action did not say. */
+    total: number;
+    /** Targets finished, whatever the outcome of each one. */
+    done: number;
+    /** Targets that finished with an error. Part of `done`. */
+    failed: number;
+    /** One short line for a person, such as the step that runs now. */
+    note?: string;
+    /** An ISO timestamp: when the run started. */
+    startedAt: string;
+    /** An ISO timestamp: when the run last wrote anything. */
+    updatedAt: string;
+}
+/** The share of the work that is finished, or `undefined` with no total. */
+export declare function progressFraction(progress: ApprovalProgress | undefined): number | undefined;
+/**
+ * Reports whether a running request went quiet.
+ *
+ * True means that the pod which held the run stopped, or lost the row. It does
+ * NOT mean that the action failed: the reconciler either runs it again, or it
+ * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.
+ */
+export declare function isRunStalled(job: ApprovalJobDto, now: Date): boolean;
 /** One approval request, as the API returns it. */
 export interface ApprovalJobDto {
     id: string;
     type: string;
     dedupeKey?: string;
     payload: Record<string, unknown>;
+    /**
+     * The payload as labelled fields. See `ApprovalSummaryField`.
+     *
+     * The use case builds it when the request is opened AND every time the
+     * request is read, so a field that a later version of the use case adds
+     * appears on a request that is already open.
+     */
+    summary: ApprovalSummaryField[];
+    /** Why the person opened the request. Some use cases demand one. */
+    reason?: string;
     createdBy: ApprovalActor;
     acks: ApprovalAck[];
-    /** Copied from the use case, so a reader can render "1 of 2". */
+    /**
+     * How many approvals THIS request needs.
+     *
+     * It is on the request and not only on the use case, because the person who
+     * opens one can ask for more than the floor of the use case. A bulk
+     * operation over 3000 clusters is the same action as one over 3, and it can
+     * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the
+     * floor that a caller cannot go below.
+     */
     requiredAcks: number;
+    /**
+     * What a person must hold to approve, reject or run THIS request.
+     *
+     * It is on the request and not only on the use case, because a payload can
+     * raise the guard: a generation update with `yoloForceUpdate` needs the yolo
+     * permission on top of the base one, and the same use case without the flag
+     * does not. The set is computed ONE time, when the request is opened, so it
+     * is also the record of what the request was guarded by.
+     *
+     * A person needs EVERY permission in the set, not one of them.
+     */
+    requiredPermissions: string[];
     executionMode: ApprovalExecutionMode;
+    actionMode: ApprovalActionMode;
     status: ApprovalJobStatus;
     closedBy?: ApprovalActor;
     closedReason?: string;
     /** An ISO timestamp. */
     expiresAt: string;
+    /**
+     * An ISO timestamp: when the current run took the request.
+     *
+     * It is set every time a run starts, so a run that the reconciler starts
+     * again moves it. `attempts` says how many runs there were.
+     */
+    executingSince?: string;
+    /** How many times a run started. A recovery raises it. */
+    attempts: number;
+    /**
+     * What the action reports while it runs. See `ApprovalProgress`.
+     *
+     * It stays on the row after the run, so the record of a finished run says
+     * how many targets it touched and how many refused.
+     */
+    progress?: ApprovalProgress;
     executedAt?: string;
     executionError?: string;
+    /**
+     * What the action reported when it ran.
+     *
+     * The shape belongs to the use case. An action over many targets puts the
+     * result of each target here, which is the difference between "it failed"
+     * and "it did 2998 of 3000, and these two refused".
+     */
+    executionResult?: Record<string, unknown>;
     createdAt: string;
     updatedAt: string;
 }
@@ -73,11 +271,67 @@ export interface ApprovalUseCaseDto {
     type: string;
     /** A short name for a person to read. */
     label: string;
-    requiredAcks: number;
+    /** One sentence: what the action does, and what it cannot undo. */
+    description: string;
+    /** The approvals a new request asks for when the caller names no number. */
+    defaultAcks: number;
+    /**
+     * The floor. A caller can ask for more approvals, never for fewer.
+     *
+     * It is a separate number from `defaultAcks` because the two answer
+     * different questions: the default is what the form offers, and the floor is
+     * what the service refuses to go below.
+     */
+    minAcks: number;
     ttlDays: number;
     executionMode: ApprovalExecutionMode;
-    /** The permission that acknowledge, reject and run all need. */
+    /** See `ApprovalActionMode`. An action over many targets is `background`. */
+    actionMode: ApprovalActionMode;
+    /**
+     * True when a run that was interrupted can start again by itself.
+     *
+     * It is a promise about the ACTION, and the reconciler reads it. Set it only
+     * when the action can run a second time over the same payload and do no harm
+     * twice: it must read what the first run already finished, out of
+     * `ApprovalJobDto.executionResult`, and skip it.
+     *
+     * False, the default, is the safe answer. An interrupted run then lands in
+     * `failed`, which a person can run again from the detail page, and a person
+     * decides whether running it twice is safe.
+     */
+    resumable: boolean;
+    /**
+     * The permission that every request of this use case needs to approve,
+     * reject or run. A payload can add more. See
+     * `ApprovalJobDto.requiredPermissions`, which is the effective set.
+     *
+     * It is also the permission to SEE a request of this use case, because a
+     * person who cannot act on one has no reason to read it. The person who
+     * opened a request always sees that request.
+     */
     requiredPermission: string;
-    /** The permission to open a request. Absent means any signed-in user. */
+    /**
+     * The permission to open a request. Absent means any signed-in Camundi.
+     *
+     * Set it when the pool that can ASK must be as small as the pool that can
+     * approve. Leave it absent when the approvals alone are the guard, and the
+     * proposal is not.
+     */
     createPermission?: string;
+    /** True when a request cannot be opened without a reason. */
+    reasonRequired: boolean;
+    /**
+     * True when the ACTION needs the email address of the person who asked.
+     *
+     * A token can carry no address, and the row then stores
+     * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another
+     * service asks it to find a user that does not exist, so the request can
+     * only fail — and it fails at the END, after other people spent their
+     * approvals on it. A use case that carries the creator into its call sets
+     * this, and `canCreate` then refuses such a caller at the start.
+     *
+     * `extend-trial` is one: accounts makes the creator the actor of the
+     * extension, through `onBehalfOf`.
+     */
+    creatorEmailRequired?: boolean;
 }

package/dist/dtos/ApprovalJob.dto.js

@@ -8,7 +8,48 @@ const APPROVAL_JOB_STATUSES = [
   "withdrawn",
   "expired"
 ];
+const APPROVAL_LIVE_STATUSES = [
+  "pending",
+  "approved",
+  "executing"
+];
+const APPROVAL_PAGE_SIZE_DEFAULT = 500;
+const APPROVAL_PAGE_SIZE_MAX = 2e3;
+const APPROVAL_SUMMARY_FIELD_KINDS = [
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "org",
+  "cluster",
+  "user",
+  "code"
+];
+const APPROVAL_RUN_STALE_MS = 12e4;
+function progressFraction(progress) {
+  if (!progress || progress.total <= 0) {
+    return void 0;
+  }
+  return Math.min(1, progress.done / progress.total);
+}
+function isRunStalled(job, now) {
+  if (job.status !== "executing") {
+    return false;
+  }
+  const lastSign = job.progress?.updatedAt ?? job.executingSince;
+  if (!lastSign) {
+    return false;
+  }
+  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS;
+}
 export {
-  APPROVAL_JOB_STATUSES
+  APPROVAL_JOB_STATUSES,
+  APPROVAL_LIVE_STATUSES,
+  APPROVAL_PAGE_SIZE_DEFAULT,
+  APPROVAL_PAGE_SIZE_MAX,
+  APPROVAL_RUN_STALE_MS,
+  APPROVAL_SUMMARY_FIELD_KINDS,
+  isRunStalled,
+  progressFraction
 };
 //# sourceMappingURL=ApprovalJob.dto.js.map

package/dist/dtos/ApprovalJob.dto.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/dtos/ApprovalJob.dto.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /** Copied from the use case, so a reader can render \"1 of 2\". */\n  requiredAcks: number\n  executionMode: ApprovalExecutionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  executedAt?: string\n  executionError?: string\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  requiredAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** The permission that acknowledge, reject and run all need. */\n  requiredPermission: string\n  /** The permission to open a request. Absent means any signed-in user. */\n  createPermission?: string\n}\n"],
-  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The wire types of the generic approval mechanism.\n *\n * This file holds no logic and no dependency, because three consumers read it:\n * control-backend, control-frontend and cloudbot. The rules that read these\n * types are in `../approvals/policy.js`, and they are pure for the same reason.\n */\n\n/**\n * Every state that an approval request can hold.\n *\n * A `const` tuple, not an enum, so it is both the union type and the list that\n * validates a status filter at run time.\n *\n * The path of a request: `pending` until it reaches the threshold. Then\n * `executing` (automatic mode) or `approved` (explicit mode, which waits for a\n * person to press the button). `executed` or `failed` after the action ran. A\n * request that never reaches the threshold ends `rejected`, `withdrawn` or\n * `expired`.\n */\nexport const APPROVAL_JOB_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n  'executed',\n  'failed',\n  'rejected',\n  'withdrawn',\n  'expired',\n] as const\n\nexport type ApprovalJobStatus = (typeof APPROVAL_JOB_STATUSES)[number]\n\n/**\n * The states in which the action of a request is still COMING.\n *\n * `pending` waits for approvals, `approved` waits for a person to press the\n * button, and `executing` is running now. Each of them can still change the\n * world, so two requests for one target must not be in these states together.\n * `dedupeKey` reads this set for that reason.\n *\n * `failed` is NOT here, although a person can run a failed request again. A\n * failed request runs only when a person presses the button, and that person\n * sees the row. Blocking a new request on a failed one would also trap the\n * key: `canWithdraw` accepts `pending` alone, so nobody could close it.\n *\n * `executed`, `rejected`, `withdrawn` and `expired` are the end of a request.\n */\nexport const APPROVAL_LIVE_STATUSES = [\n  'pending',\n  'approved',\n  'executing',\n] as const satisfies readonly ApprovalJobStatus[]\n\n/**\n * How many requests one page of the list holds when the caller asks for no\n * number.\n *\n * The list is a work queue that a Camundi reads, so the page is large: a\n * person wants the whole queue and not ten rows at a time. What the number is\n * for is the ceiling below.\n */\nexport const APPROVAL_PAGE_SIZE_DEFAULT = 500\n\n/**\n * The largest page that the service builds, and the largest that a caller may\n * ask for. The API answers 400 above it.\n *\n * The list had no limit at all. One authenticated caller could then make the\n * service read the whole table into memory, serialize it, and do it again, so\n * the cost of a request grew with the age of the service and with nothing that\n * the caller had to pay for. A ceiling turns that into a fixed cost.\n *\n * It is HERE and not only in the service, because the view must know it: a\n * page that asked for more would get a 400 instead of rows.\n */\nexport const APPROVAL_PAGE_SIZE_MAX = 2000\n\n/**\n * What happens when a request reaches its threshold.\n *\n * `auto` runs the action immediately. `explicit` holds the request at\n * `approved` and waits for a person to run it.\n */\nexport type ApprovalExecutionMode = 'auto' | 'explicit'\n\n/**\n * WHERE the action runs. It is a separate question from who starts it.\n *\n * - `inline` runs the action inside the call that started it, and the answer\n *   already carries the outcome. Right for one call to another service.\n * - `background` answers as soon as the request is claimed, and the action\n *   runs on. It reports into `ApprovalJobDto.progress`, and the row is the\n *   only place that holds the progress, so a reload and a second person read\n *   the same numbers. A pod that stops loses the run, and the reconciler of\n *   control-backend recovers the row.\n *\n * An action over thousands of targets MUST be `background`. `inline` would\n * hold one HTTP request for the whole run, and the ingress, the load balancer\n * and the browser each have their own deadline before it finishes.\n */\nexport type ApprovalActionMode = 'inline' | 'background'\n\n/**\n * A person, as an approval request records them.\n *\n * Both keys are kept. The machine then never has to choose one identity key,\n * which is what split the earlier acknowledgement flows: some held an email and\n * some held a user id, and the two could not be compared.\n */\nexport interface ApprovalActor {\n  userId: string\n  email: string\n}\n\nexport interface ApprovalAck extends ApprovalActor {\n  /** An ISO timestamp. It is in a json column, so it is a string, not a Date. */\n  date: string\n}\n\n/**\n * What one value of a summary field is.\n *\n * `text` is what a person reads. `id` is what a link points at, and it is\n * absent when the kind names no entity. The two are separate because the text\n * is a COPY that the request keeps: an organization that gets a new name after\n * the request was opened must still read as the organization that the person\n * chose.\n */\nexport interface ApprovalSummaryValue {\n  text: string\n  id?: string\n}\n\n/**\n * How a reader must render one field of a summary.\n *\n * `org`, `cluster` and `user` name an entity, so a reader can link to it and\n * can resolve a fresh name. The others are plain: `date` is an ISO timestamp,\n * and `code` is a value that must keep its characters, such as a json fragment.\n */\nexport const APPROVAL_SUMMARY_FIELD_KINDS = [\n  'text',\n  'number',\n  'boolean',\n  'date',\n  'org',\n  'cluster',\n  'user',\n  'code',\n] as const\n\nexport type ApprovalSummaryFieldKind =\n  (typeof APPROVAL_SUMMARY_FIELD_KINDS)[number]\n\n/**\n * One labelled field of the payload of a request.\n *\n * This is what makes ONE view able to show EVERY use case. The payload of a\n * request is an object of anything, so a generic view can only print it as\n * json. The use case turns it into labelled fields here, and the view renders\n * a field by its kind: it links an `org`, it formats a `date`, and it lists\n * 300 clusters as 300 links.\n *\n * `values` is always an array. A field that holds one value holds an array of\n * one, so a reader needs no branch for \"one or many\".\n */\nexport interface ApprovalSummaryField {\n  label: string\n  kind: ApprovalSummaryFieldKind\n  values: ApprovalSummaryValue[]\n}\n\n/**\n * How long a run may go quiet before a reader calls it stalled.\n *\n * The pod that runs an action writes its progress and renews its lease on one\n * timer, so a healthy run touches the row well inside this window. A row that\n * is `executing` and older than this held a pod that stopped, and the\n * reconciler of control-backend is on its way to it.\n *\n * It lives here, and not in the config of the service, because a READER needs\n * it: the browser must decide what to show without a second call, and a number\n * that only the backend knew would make the two disagree. `ACTION_LEASE_MS` in\n * `config/index.ts` is held below this on purpose.\n */\nexport const APPROVAL_RUN_STALE_MS = 120_000\n\n/**\n * What an action reports while it runs.\n *\n * This is what makes a long action watchable. Every field is in the DATABASE\n * and not in the answer to the call that started the run, so three readers see\n * the same thing: the person who pressed the button, the same person after a\n * reload, and a second person who opens the request.\n *\n * `total` can be 0 while an action counts its targets, and it stays 0 for an\n * action that cannot count them. A reader must then show that it runs, and no\n * percentage.\n */\nexport interface ApprovalProgress {\n  /** Targets in total. 0 means the action did not say. */\n  total: number\n  /** Targets finished, whatever the outcome of each one. */\n  done: number\n  /** Targets that finished with an error. Part of `done`. */\n  failed: number\n  /** One short line for a person, such as the step that runs now. */\n  note?: string\n  /** An ISO timestamp: when the run started. */\n  startedAt: string\n  /** An ISO timestamp: when the run last wrote anything. */\n  updatedAt: string\n}\n\n/** The share of the work that is finished, or `undefined` with no total. */\nexport function progressFraction(\n  progress: ApprovalProgress | undefined,\n): number | undefined {\n  if (!progress || progress.total <= 0) {\n    return undefined\n  }\n  return Math.min(1, progress.done / progress.total)\n}\n\n/**\n * Reports whether a running request went quiet.\n *\n * True means that the pod which held the run stopped, or lost the row. It does\n * NOT mean that the action failed: the reconciler either runs it again, or it\n * writes `failed` so that a person can. See `APPROVAL_RUN_STALE_MS`.\n */\nexport function isRunStalled(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'executing') {\n    return false\n  }\n  const lastSign = job.progress?.updatedAt ?? job.executingSince\n  if (!lastSign) {\n    return false\n  }\n  return now.getTime() - new Date(lastSign).getTime() > APPROVAL_RUN_STALE_MS\n}\n\n/** One approval request, as the API returns it. */\nexport interface ApprovalJobDto {\n  id: string\n  type: string\n  dedupeKey?: string\n  payload: Record<string, unknown>\n  /**\n   * The payload as labelled fields. See `ApprovalSummaryField`.\n   *\n   * The use case builds it when the request is opened AND every time the\n   * request is read, so a field that a later version of the use case adds\n   * appears on a request that is already open.\n   */\n  summary: ApprovalSummaryField[]\n  /** Why the person opened the request. Some use cases demand one. */\n  reason?: string\n  createdBy: ApprovalActor\n  acks: ApprovalAck[]\n  /**\n   * How many approvals THIS request needs.\n   *\n   * It is on the request and not only on the use case, because the person who\n   * opens one can ask for more than the floor of the use case. A bulk\n   * operation over 3000 clusters is the same action as one over 3, and it can\n   * still deserve a third pair of eyes. `ApprovalUseCaseDto.minAcks` is the\n   * floor that a caller cannot go below.\n   */\n  requiredAcks: number\n  /**\n   * What a person must hold to approve, reject or run THIS request.\n   *\n   * It is on the request and not only on the use case, because a payload can\n   * raise the guard: a generation update with `yoloForceUpdate` needs the yolo\n   * permission on top of the base one, and the same use case without the flag\n   * does not. The set is computed ONE time, when the request is opened, so it\n   * is also the record of what the request was guarded by.\n   *\n   * A person needs EVERY permission in the set, not one of them.\n   */\n  requiredPermissions: string[]\n  executionMode: ApprovalExecutionMode\n  actionMode: ApprovalActionMode\n  status: ApprovalJobStatus\n  closedBy?: ApprovalActor\n  closedReason?: string\n  /** An ISO timestamp. */\n  expiresAt: string\n  /**\n   * An ISO timestamp: when the current run took the request.\n   *\n   * It is set every time a run starts, so a run that the reconciler starts\n   * again moves it. `attempts` says how many runs there were.\n   */\n  executingSince?: string\n  /** How many times a run started. A recovery raises it. */\n  attempts: number\n  /**\n   * What the action reports while it runs. See `ApprovalProgress`.\n   *\n   * It stays on the row after the run, so the record of a finished run says\n   * how many targets it touched and how many refused.\n   */\n  progress?: ApprovalProgress\n  executedAt?: string\n  executionError?: string\n  /**\n   * What the action reported when it ran.\n   *\n   * The shape belongs to the use case. An action over many targets puts the\n   * result of each target here, which is the difference between \"it failed\"\n   * and \"it did 2998 of 3000, and these two refused\".\n   */\n  executionResult?: Record<string, unknown>\n  createdAt: string\n  updatedAt: string\n}\n\n/**\n * What a use case is, as the API reports it.\n *\n * The frontend needs `requiredPermission` to run the same rule as the backend.\n * PR #9301 kept this registry a second time, by hand, in the frontend. A\n * registry that the server owns means a new use case needs no frontend deploy.\n */\nexport interface ApprovalUseCaseDto {\n  type: string\n  /** A short name for a person to read. */\n  label: string\n  /** One sentence: what the action does, and what it cannot undo. */\n  description: string\n  /** The approvals a new request asks for when the caller names no number. */\n  defaultAcks: number\n  /**\n   * The floor. A caller can ask for more approvals, never for fewer.\n   *\n   * It is a separate number from `defaultAcks` because the two answer\n   * different questions: the default is what the form offers, and the floor is\n   * what the service refuses to go below.\n   */\n  minAcks: number\n  ttlDays: number\n  executionMode: ApprovalExecutionMode\n  /** See `ApprovalActionMode`. An action over many targets is `background`. */\n  actionMode: ApprovalActionMode\n  /**\n   * True when a run that was interrupted can start again by itself.\n   *\n   * It is a promise about the ACTION, and the reconciler reads it. Set it only\n   * when the action can run a second time over the same payload and do no harm\n   * twice: it must read what the first run already finished, out of\n   * `ApprovalJobDto.executionResult`, and skip it.\n   *\n   * False, the default, is the safe answer. An interrupted run then lands in\n   * `failed`, which a person can run again from the detail page, and a person\n   * decides whether running it twice is safe.\n   */\n  resumable: boolean\n  /**\n   * The permission that every request of this use case needs to approve,\n   * reject or run. A payload can add more. See\n   * `ApprovalJobDto.requiredPermissions`, which is the effective set.\n   *\n   * It is also the permission to SEE a request of this use case, because a\n   * person who cannot act on one has no reason to read it. The person who\n   * opened a request always sees that request.\n   */\n  requiredPermission: string\n  /**\n   * The permission to open a request. Absent means any signed-in Camundi.\n   *\n   * Set it when the pool that can ASK must be as small as the pool that can\n   * approve. Leave it absent when the approvals alone are the guard, and the\n   * proposal is not.\n   */\n  createPermission?: string\n  /** True when a request cannot be opened without a reason. */\n  reasonRequired: boolean\n  /**\n   * True when the ACTION needs the email address of the person who asked.\n   *\n   * A token can carry no address, and the row then stores\n   * `UNKNOWN_ACTOR_EMAIL`. An action that sends that placeholder to another\n   * service asks it to find a user that does not exist, so the request can\n   * only fail \u2014 and it fails at the END, after other people spent their\n   * approvals on it. A use case that carries the creator into its call sets\n   * this, and `canCreate` then refuses such a caller at the start.\n   *\n   * `extend-trial` is one: accounts makes the creator the actor of the\n   * extension, through `onBehalfOf`.\n   */\n  creatorEmailRequired?: boolean\n}\n"],
+  "mappings": "AA0BO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAmBO,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,6BAA6B;AAcnC,MAAM,yBAAyB;AAiE/B,MAAM,+BAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoCO,MAAM,wBAAwB;AA8B9B,SAAS,iBACd,UACoB;AACpB,MAAI,CAAC,YAAY,SAAS,SAAS,GAAG;AACpC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,GAAG,SAAS,OAAO,SAAS,KAAK;AACnD;AASO,SAAS,aAAa,KAAqB,KAAoB;AACpE,MAAI,IAAI,WAAW,aAAa;AAC9B,WAAO;AAAA,EACT;AACA,QAAM,WAAW,IAAI,UAAU,aAAa,IAAI;AAChD,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,SAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,QAAQ,IAAI;AACxD;",
   "names": []
 }

package/dist/dtos/ClusterCreationDefaults.dto.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Cluster settings for which an organization can hold a default value.
+ *
+ * A field that is absent keeps the value that the `Cluster` constructor
+ * writes. The defaults apply at creation only: they seed the new row, and
+ * nothing applies them again. A cluster that exists keeps its own values.
+ *
+ * A value on the cluster changes afterwards through the surface of that
+ * setting, with the permissions of that setting — thus the customer changes
+ * most of them alone, and a Camunda-managed setting such as the optional
+ * telemetry needs a Camundi (#9732).
+ */
+export interface ClusterCreationDefaults {
+    autoUpdate?: boolean;
+    businessIdUniquenessEnabled?: boolean;
+    enforceGroups?: boolean;
+    mcpEnabled?: boolean;
+    multiTenancyEnabled?: boolean;
+    optionalTelemetryEnabled?: boolean;
+    rba?: boolean;
+    sessionHeartbeatEnabled?: boolean;
+    sessionMaxInactiveIntervalMinutes?: number;
+}
+export type ClusterCreationDefaultKey = keyof ClusterCreationDefaults;
+/**
+ * Who can write the default of a field today.
+ *
+ * - `planned`: nobody. The backend accepts the field, and Control shows the
+ *   row without a control. The mechanism is there, and the field waits for
+ *   the team that owns the setting.
+ * - `control`: a Camundi in Control, after a support request.
+ * - `customer`: a Camundi in Control, and the organization itself in the
+ *   Console settings.
+ *
+ * The accounts route refuses what this value does not permit, thus a widened
+ * value is the whole rollout of a field.
+ */
+export type ClusterCreationDefaultAvailability = 'planned' | 'control' | 'customer';
+export interface ClusterCreationDefaultField {
+    key: ClusterCreationDefaultKey;
+    /** Name of the field on the Control panel. */
+    label: string;
+    kind: 'boolean' | 'number';
+    availability: ClusterCreationDefaultAvailability;
+    /**
+     * Value that a new cluster gets when the organization holds no default.
+     * It must agree with the `Cluster` constructor, because the panel shows it
+     * as the value that applies.
+     */
+    fallback: boolean | number;
+    /** Bounds of a number field. They mirror the operator CRD validation. */
+    min?: number;
+    max?: number;
+    /**
+     * Console permissions that permit a write of this default. The user needs
+     * ALL of them, in addition to the base permission of the route.
+     *
+     * Each path is a path into `ConsolePermissions.Features`. The frontend adds
+     * the `console.` prefix that the session endpoint uses; the backend reads
+     * the path from `res.locals.permissions`.
+     *
+     * A field without a list is a setting that the customer can change without
+     * help. The default of such a field gives no more power than the customer
+     * has, thus the base permission is sufficient.
+     *
+     * The per-cluster route of a setting can ask for a different permission for
+     * each direction — `autoUpdate` is such a route. A default holds both
+     * directions over time, and one entry cannot say which, thus the list asks
+     * for all permissions of that route. The default is then never easier to
+     * write than the setting itself.
+     */
+    permissionAllOf?: readonly string[];
+    /**
+     * Permissions of accounts that a Camundi needs for this field, in addition
+     * to the permission of the route. The user needs ALL of them.
+     *
+     * Each path is a path into `AccountsPermissions.Features`. The frontend
+     * reads the path as it is, because the session endpoint carries the
+     * accounts keys without a prefix.
+     *
+     * The permission of the route is `admin.readAll`, which is a read
+     * permission that many roles hold. A field that a Camundi may write names
+     * the write permission here, thus the read of the surface and the write of
+     * a value stay two different questions.
+     */
+    accountsPermissionAllOf?: readonly string[];
+}
+/**
+ * The defaultable fields, in the order that the Control panel shows them.
+ *
+ * This list is the only place that knows a field is defaultable. The route
+ * builds its validation from it, the creation path reads it to merge, and the
+ * panel builds its controls from it. A new cluster setting becomes
+ * defaultable through one entry here.
+ */
+export declare const CLUSTER_CREATION_DEFAULT_FIELDS: readonly ClusterCreationDefaultField[];

package/dist/dtos/ClusterCreationDefaults.dto.js

@@ -0,0 +1,93 @@
+const CLUSTER_CREATION_DEFAULT_FIELDS = [
+  {
+    key: "optionalTelemetryEnabled",
+    label: "Optional telemetry",
+    kind: "boolean",
+    // Camunda-managed: the customer asked for a toggle, and the answer is
+    // a support request. The org default follows that rule.
+    availability: "control",
+    fallback: true,
+    permissionAllOf: ["clusters.canUpdateOptionalTelemetry"]
+  },
+  {
+    key: "sessionMaxInactiveIntervalMinutes",
+    label: "Session idle timeout (minutes)",
+    kind: "number",
+    // The first field that the organization sets itself. A security
+    // posture is the reason for an org-wide idle timeout, and the customer
+    // owns that posture.
+    availability: "customer",
+    // The same permission that a limit of the organization asks for. A
+    // default of a cluster setting is org-wide configuration, thus it
+    // follows the Limits tab and not the read permission of the route.
+    accountsPermissionAllOf: ["admin.mayChangeOrgLimits"],
+    fallback: 30,
+    min: 1,
+    max: 1440
+  },
+  {
+    key: "sessionHeartbeatEnabled",
+    availability: "planned",
+    label: "Session heartbeat",
+    kind: "boolean",
+    fallback: false
+  },
+  {
+    key: "multiTenancyEnabled",
+    availability: "planned",
+    label: "Multi-tenancy",
+    kind: "boolean",
+    fallback: false
+  },
+  {
+    key: "rba",
+    availability: "planned",
+    label: "Resource-based authorizations",
+    kind: "boolean",
+    fallback: false
+  },
+  {
+    key: "enforceGroups",
+    availability: "planned",
+    label: "Enforce groups",
+    kind: "boolean",
+    fallback: true
+  },
+  {
+    key: "mcpEnabled",
+    availability: "planned",
+    label: "MCP",
+    kind: "boolean",
+    fallback: false
+  },
+  {
+    key: "businessIdUniquenessEnabled",
+    availability: "planned",
+    label: "Business ID uniqueness",
+    kind: "boolean",
+    fallback: false
+  },
+  {
+    key: "autoUpdate",
+    availability: "planned",
+    label: "Auto-update",
+    kind: "boolean",
+    // The creation path resolves an absent value to false, and the channel
+    // condition can still remove it: a cluster on a channel that is not
+    // Stable never gets auto-update. The `true` of the `Cluster`
+    // constructor never applies here, because every caller of
+    // `createNewCluster` gives the field a value.
+    fallback: false,
+    // The per-cluster route asks for `canSendToSleep` to turn auto-update
+    // off and for `canUpgradeGenerationYolo` to turn it on. A default holds
+    // both directions, thus it asks for both permissions.
+    permissionAllOf: [
+      "clusters.canSendToSleep",
+      "clusters.canUpgradeGenerationYolo"
+    ]
+  }
+];
+export {
+  CLUSTER_CREATION_DEFAULT_FIELDS
+};
+//# sourceMappingURL=ClusterCreationDefaults.dto.js.map

package/dist/dtos/ClusterCreationDefaults.dto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/dtos/ClusterCreationDefaults.dto.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * Cluster settings for which an organization can hold a default value.\n *\n * A field that is absent keeps the value that the `Cluster` constructor\n * writes. The defaults apply at creation only: they seed the new row, and\n * nothing applies them again. A cluster that exists keeps its own values.\n *\n * A value on the cluster changes afterwards through the surface of that\n * setting, with the permissions of that setting \u2014 thus the customer changes\n * most of them alone, and a Camunda-managed setting such as the optional\n * telemetry needs a Camundi (#9732).\n */\nexport interface ClusterCreationDefaults {\n  autoUpdate?: boolean\n  businessIdUniquenessEnabled?: boolean\n  enforceGroups?: boolean\n  mcpEnabled?: boolean\n  multiTenancyEnabled?: boolean\n  optionalTelemetryEnabled?: boolean\n  rba?: boolean\n  sessionHeartbeatEnabled?: boolean\n  sessionMaxInactiveIntervalMinutes?: number\n}\n\nexport type ClusterCreationDefaultKey = keyof ClusterCreationDefaults\n\n/**\n * Who can write the default of a field today.\n *\n * - `planned`: nobody. The backend accepts the field, and Control shows the\n *   row without a control. The mechanism is there, and the field waits for\n *   the team that owns the setting.\n * - `control`: a Camundi in Control, after a support request.\n * - `customer`: a Camundi in Control, and the organization itself in the\n *   Console settings.\n *\n * The accounts route refuses what this value does not permit, thus a widened\n * value is the whole rollout of a field.\n */\nexport type ClusterCreationDefaultAvailability =\n  | 'planned'\n  | 'control'\n  | 'customer'\n\nexport interface ClusterCreationDefaultField {\n  key: ClusterCreationDefaultKey\n  /** Name of the field on the Control panel. */\n  label: string\n  kind: 'boolean' | 'number'\n  availability: ClusterCreationDefaultAvailability\n  /**\n   * Value that a new cluster gets when the organization holds no default.\n   * It must agree with the `Cluster` constructor, because the panel shows it\n   * as the value that applies.\n   */\n  fallback: boolean | number\n  /** Bounds of a number field. They mirror the operator CRD validation. */\n  min?: number\n  max?: number\n  /**\n   * Console permissions that permit a write of this default. The user needs\n   * ALL of them, in addition to the base permission of the route.\n   *\n   * Each path is a path into `ConsolePermissions.Features`. The frontend adds\n   * the `console.` prefix that the session endpoint uses; the backend reads\n   * the path from `res.locals.permissions`.\n   *\n   * A field without a list is a setting that the customer can change without\n   * help. The default of such a field gives no more power than the customer\n   * has, thus the base permission is sufficient.\n   *\n   * The per-cluster route of a setting can ask for a different permission for\n   * each direction \u2014 `autoUpdate` is such a route. A default holds both\n   * directions over time, and one entry cannot say which, thus the list asks\n   * for all permissions of that route. The default is then never easier to\n   * write than the setting itself.\n   */\n  permissionAllOf?: readonly string[]\n  /**\n   * Permissions of accounts that a Camundi needs for this field, in addition\n   * to the permission of the route. The user needs ALL of them.\n   *\n   * Each path is a path into `AccountsPermissions.Features`. The frontend\n   * reads the path as it is, because the session endpoint carries the\n   * accounts keys without a prefix.\n   *\n   * The permission of the route is `admin.readAll`, which is a read\n   * permission that many roles hold. A field that a Camundi may write names\n   * the write permission here, thus the read of the surface and the write of\n   * a value stay two different questions.\n   */\n  accountsPermissionAllOf?: readonly string[]\n}\n\n/**\n * The defaultable fields, in the order that the Control panel shows them.\n *\n * This list is the only place that knows a field is defaultable. The route\n * builds its validation from it, the creation path reads it to merge, and the\n * panel builds its controls from it. A new cluster setting becomes\n * defaultable through one entry here.\n */\nexport const CLUSTER_CREATION_DEFAULT_FIELDS: readonly ClusterCreationDefaultField[] =\n  [\n    {\n      key: 'optionalTelemetryEnabled',\n      label: 'Optional telemetry',\n      kind: 'boolean',\n      // Camunda-managed: the customer asked for a toggle, and the answer is\n      // a support request. The org default follows that rule.\n      availability: 'control',\n      fallback: true,\n      permissionAllOf: ['clusters.canUpdateOptionalTelemetry'],\n    },\n    {\n      key: 'sessionMaxInactiveIntervalMinutes',\n      label: 'Session idle timeout (minutes)',\n      kind: 'number',\n      // The first field that the organization sets itself. A security\n      // posture is the reason for an org-wide idle timeout, and the customer\n      // owns that posture.\n      availability: 'customer',\n      // The same permission that a limit of the organization asks for. A\n      // default of a cluster setting is org-wide configuration, thus it\n      // follows the Limits tab and not the read permission of the route.\n      accountsPermissionAllOf: ['admin.mayChangeOrgLimits'],\n      fallback: 30,\n      min: 1,\n      max: 1440,\n    },\n    {\n      key: 'sessionHeartbeatEnabled',\n      availability: 'planned',\n      label: 'Session heartbeat',\n      kind: 'boolean',\n      fallback: false,\n    },\n    {\n      key: 'multiTenancyEnabled',\n      availability: 'planned',\n      label: 'Multi-tenancy',\n      kind: 'boolean',\n      fallback: false,\n    },\n    {\n      key: 'rba',\n      availability: 'planned',\n      label: 'Resource-based authorizations',\n      kind: 'boolean',\n      fallback: false,\n    },\n    {\n      key: 'enforceGroups',\n      availability: 'planned',\n      label: 'Enforce groups',\n      kind: 'boolean',\n      fallback: true,\n    },\n    {\n      key: 'mcpEnabled',\n      availability: 'planned',\n      label: 'MCP',\n      kind: 'boolean',\n      fallback: false,\n    },\n    {\n      key: 'businessIdUniquenessEnabled',\n      availability: 'planned',\n      label: 'Business ID uniqueness',\n      kind: 'boolean',\n      fallback: false,\n    },\n    {\n      key: 'autoUpdate',\n      availability: 'planned',\n      label: 'Auto-update',\n      kind: 'boolean',\n      // The creation path resolves an absent value to false, and the channel\n      // condition can still remove it: a cluster on a channel that is not\n      // Stable never gets auto-update. The `true` of the `Cluster`\n      // constructor never applies here, because every caller of\n      // `createNewCluster` gives the field a value.\n      fallback: false,\n      // The per-cluster route asks for `canSendToSleep` to turn auto-update\n      // off and for `canUpgradeGenerationYolo` to turn it on. A default holds\n      // both directions, thus it asks for both permissions.\n      permissionAllOf: [\n        'clusters.canSendToSleep',\n        'clusters.canUpgradeGenerationYolo',\n      ],\n    },\n  ]\n"],
+  "mappings": "AA4GO,MAAM,kCACX;AAAA,EACE;AAAA,IACE,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA;AAAA;AAAA,IAGN,cAAc;AAAA,IACd,UAAU;AAAA,IACV,iBAAiB,CAAC,qCAAqC;AAAA,EACzD;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA;AAAA;AAAA;AAAA,IAIN,cAAc;AAAA;AAAA;AAAA;AAAA,IAId,yBAAyB,CAAC,0BAA0B;AAAA,IACpD,UAAU;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,KAAK;AAAA,IACL,cAAc;AAAA,IACd,OAAO;AAAA,IACP,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMN,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,iBAAiB;AAAA,MACf;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}