@camunda/ccma-shared-types 10.2.0 → 10.3.0

package/dist/permissions/accounts.permissions.js

@@ -62,6 +62,8 @@ var AccountsPermissions;
   AccountsPermissions2.ROLE_SUPPORT_AGENT = "support:agent";
   AccountsPermissions2.FORCE_SALES_PLAN_ON_ORG = "aafs";
   AccountsPermissions2.ADMIN_FEATURE_FLAGS_WRITE = "aafw";
+  AccountsPermissions2.CONTROL_AGENT_TOKENS_MANAGE_OWN = "aato";
+  AccountsPermissions2.CONTROL_AGENT_TOKENS_ADMIN = "aata";
   function createEmptyFeatures() {
     return {
       admin: {
@@ -173,34 +175,39 @@ var AccountsPermissions;
       },
       featureFlags: {
         write: false
+      },
+      agentTokens: {
+        manageOwn: false,
+        admin: false
       }
     };
   }
   AccountsPermissions2.createEmptyFeatures = createEmptyFeatures;
+  const READ_ALL_INITIAL_ROLES = [
+    "accounts:read",
+    "accounts:onboard",
+    "accounts:orgCreator",
+    "accounts:admin",
+    "accounts:editSalesPlans",
+    "console:admin",
+    "console:admin:readonly",
+    "support:agent",
+    "supersupport:agent",
+    "accounts:trialExtender",
+    "accounts:limitExtender",
+    "accounts:enterpriseAdmin",
+    "accounts:enterpriseOffboarding",
+    "console:C8ReleaseManager",
+    "console:C8UpdateEnforcer",
+    "accounts:addSafeRoles",
+    "accounts:consultingManager",
+    "accounts:earlyAccessEditor"
+  ];
   AccountsPermissions2.PermissionsAtAuth0 = [
     {
       value: AccountsPermissions2.READ_ALL,
       description: "read access to all orgs and users",
-      initialRoles: [
-        "accounts:read",
-        "accounts:onboard",
-        "accounts:orgCreator",
-        "accounts:admin",
-        "accounts:editSalesPlans",
-        "console:admin",
-        "console:admin:readonly",
-        "support:agent",
-        "supersupport:agent",
-        "accounts:trialExtender",
-        "accounts:limitExtender",
-        "accounts:enterpriseAdmin",
-        "accounts:enterpriseOffboarding",
-        "console:C8ReleaseManager",
-        "console:C8UpdateEnforcer",
-        "accounts:addSafeRoles",
-        "accounts:consultingManager",
-        "accounts:earlyAccessEditor"
-      ]
+      initialRoles: READ_ALL_INITIAL_ROLES
     },
     {
       value: AccountsPermissions2.CREATE_ORG,
@@ -601,6 +608,16 @@ var AccountsPermissions;
       // thus the role gets a permission of its own.
       initialRoles: ["accounts:admin"]
     },
+    {
+      value: AccountsPermissions2.CONTROL_AGENT_TOKENS_MANAGE_OWN,
+      description: "may create, rotate and revoke own read-only agent tokens in Camunda Control",
+      initialRoles: READ_ALL_INITIAL_ROLES
+    },
+    {
+      value: AccountsPermissions2.CONTROL_AGENT_TOKENS_ADMIN,
+      description: "may list every agent token in Camunda Control, and revoke any of them",
+      initialRoles: ["accounts:admin"]
+    },
     {
       value: AccountsPermissions2.ADMIN_CHANGE_EMAIL,
       description: "can change the email of an user",

package/dist/permissions/accounts.permissions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/accounts.permissions.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace AccountsPermissions {\n  export const READ_ALL = 'aara'\n  export const CREATE_ORG = 'aaco'\n  export const CHANGE_ORG_NAME = 'aacn'\n  export const DELETE_ORG = 'aado'\n  export const RESET_TOKEN_VERIFICATION = 'aart'\n  export const DELETE_USER = 'aadu'\n  export const DELETE_NOT_ACTIVATED_USER = 'aadn'\n  export const ADD_TO_ORG = 'aaao'\n  export const REMOVE_FROM_ORG = 'aaro'\n  export const SET_DEFAULT_ORG = 'aasd'\n  export const CANCEL_INVITE = 'aaci'\n  export const CHANGE_ROLE = 'aacr'\n  export const CHANGE_SAFE_ROLE = 'aacs'\n  // The org roles of a member of any organization. `CHANGE_ROLE` and\n  // `CHANGE_SAFE_ROLE` are for the platform roles.\n  export const CHANGE_ORG_MEMBER_ROLE = 'aacm'\n  export const EXTEND_TRIAL = 'aaet'\n  export const INVALIDATE_TOKEN = 'aait'\n  export const SALES_PLAN_CREATE = 'asc'\n  export const SALES_PLAN_MODIFY = 'asm'\n  export const SALES_PLAN_FORCE_MODIFY = 'asfm'\n  export const SALES_PLAN_SWITCH = 'ass'\n  export const SALES_PLAN_DELETE = 'asd'\n  export const SALES_PLAN_DELETE_AS_GOD = 'asdg'\n  export const SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG = 'asar'\n  export const SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS = 'asas'\n  export const SUPPORT_AGENT_ADD_TO_ORG = 'asaa'\n  export const MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS = 'acpm'\n  export const M2M_SALESPLAN_GET = 'amsg'\n  export const M2M_SALESPLAN_SWITCH = 'amss'\n\n  // The routes of `api/admin/approvals` read `ConsolePermissions.M2M_CONTROL_APPROVALS`,\n  // the one m2m permission of control-backend for accounts and console.\n\n  export const ENTERPRISE_ORG_CONVERT = 'aeoc'\n\n  export const ENTERPRISE_ORG_MODIFY = 'aeom'\n\n  export const ENTERPRISE_ORG_MODIFY_START_DATE = 'aeos'\n\n  export const TRIAL_TO_IN_NEGOTIATION_CONVERT = 'atin'\n\n  export const EXTERNAL_M2M_GET_ORG_MEMBERS = 'amog'\n  export const EXTERNAL_M2M_SEARCH_ORGS = 'amos'\n  export const EXTERNAL_M2M_QA_ORG_CREATE = 'amqc'\n  export const EXTERNAL_M2M_OFFBOARD_CAMUNDI = 'amoc'\n\n  export const ORG_MAY_CHANGE_LIMITS = 'alc'\n  export const ORG_MAY_CHANGE_GENERATION_WHITELIST = 'algw'\n  export const ORG_CANCEL_PAID = 'aacp'\n\n  export const ADMIN_SQL = 'aasq'\n\n  export const ADMIN_AUTH0_CONNECTIONS_CREATE = 'aa0c'\n  export const ADMIN_AUTH0_CONNECTIONS_READ = 'aa0r'\n  export const ADMIN_AUTH0_CONNECTIONS_UPDATE = 'aa0u'\n  export const ADMIN_AUTH0_CONNECTIONS_DELETE = 'aa0d'\n  export const UNBLOCK_USER = 'aaub'\n\n  export const ADMIN_CHANGE_EMAIL = 'aace'\n  export const ADMIN_CHANGE_USER_NAME = 'aacu'\n\n  export const BOT = 'abot'\n\n  // OBACHT: NOT THIS ONE\n  export const MODELER_DELETE_USER = 'mdu'\n\n  export const GOD_CRON = 'gcr'\n  export const GOD_SIGNUP_SPAM_PATTERNS = 'gsp'\n  export const GOD_PURGE_USERS = 'gpu'\n  export const GOD_UPDATE_USER_METADATA = 'gum'\n\n  export const ADMIN_EARLY_ACCESS_FEATURES_READ = 'aaer'\n  export const ADMIN_EARLY_ACCESS_FEATURES_CREATE = 'aaec'\n  export const ADMIN_EARLY_ACCESS_FEATURES_DELETE = 'aaed'\n  export const ADMIN_EARLY_ACCESS_FEATURES_UPDATE = 'aaeu'\n  export const PDF_WATERMARK_READ = 'awmr'\n  export const PDF_WATERMARK_WRITE = 'awmw'\n  export const ROLE_SUPPORT_AGENT = 'support:agent'\n  export const FORCE_SALES_PLAN_ON_ORG = 'aafs'\n\n  /**\n   * May create, edit and delete a feature flag on the page of Camunda Control.\n   *\n   * A row of the table of control-backend is the value of the flag on its\n   * stage, and no approval stands in front of a write. Reading the rows takes\n   * `READ_ALL`. Do not reuse `acfo`: it still exists at Auth0 with the meaning\n   * of the reverted override design.\n   */\n  export const ADMIN_FEATURE_FLAGS_WRITE = 'aafw'\n\n  export interface Features {\n    admin: {\n      readAll: boolean\n      createOrg: boolean\n      changeOrgName: boolean\n      deleteOrg: boolean\n      resetTokenVerification: boolean\n      deleteUser: boolean\n      deleteNotActivatedUser: boolean\n      addToOrg: boolean\n      removeFromOrg: boolean\n      setDefaultOrg: boolean\n      cancelInvite: boolean\n      changeRole: boolean\n      addSafeRole: boolean\n      changeOrgMemberRole: boolean\n      deleteClusters: boolean\n      extendTrial: boolean\n      invalidateToken: boolean\n      cancelPaid: boolean\n      searchForOrgs: boolean\n      readAudit: boolean\n      modifyClusterPlanTypeReservations: boolean\n      mayChangeOrgLimits: boolean\n      mayChangeGenerationWhiteList: boolean\n      sql: boolean\n      modelerDeleteUser: boolean\n      unblockUser: boolean\n      god: {\n        triggerCrons: boolean\n        forceSalesPlanOnOrg: boolean\n        changeSignupSpamPatterns: boolean\n        purgeUsers: boolean\n        updateUserMetadata: boolean\n      }\n      bot: boolean\n      changeEmail: boolean\n      changeUserName: boolean\n    }\n    salesPlan: {\n      create: boolean\n      modify: boolean\n      forceModify: boolean\n      switch: boolean\n      delete: boolean\n      godDelete: boolean\n    }\n    enterprise: {\n      org: {\n        convert: boolean\n        modify: boolean\n        modifyStartDate: boolean\n      }\n    }\n    trial: {\n      convertToInNegotiation: boolean\n    }\n    supportAgent: {\n      removeAgentsFromOrg: boolean\n      seeOrgMemberships: boolean\n      addAgentsToOrg: boolean\n    }\n    m2m: {\n      salesplan: {\n        get: boolean\n        switch: boolean\n      }\n\n      fetchMigrationData: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n    externalM2m: {\n      org: {\n        members: {\n          get: boolean\n        }\n        search: boolean\n      }\n      qa: {\n        org: {\n          create: boolean\n        }\n      }\n      offboarding: {\n        camundi: boolean\n      }\n    }\n    auth0: {\n      connections: {\n        create: boolean\n        read: boolean\n        update: boolean\n        delete: boolean\n      }\n    }\n    notifications: {\n      global: {\n        read: boolean\n        delete: boolean\n        create: boolean\n      }\n    }\n    earlyAccessFeatures: {\n      read: boolean\n      create: boolean\n      delete: boolean\n      update: boolean\n    }\n    pdfWatermark: {\n      read: boolean\n      write: boolean\n    }\n    featureFlags: {\n      write: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      admin: {\n        readAll: false,\n        createOrg: false,\n        changeOrgName: false,\n        deleteOrg: false,\n        resetTokenVerification: false,\n        deleteUser: false,\n        deleteNotActivatedUser: false,\n        addToOrg: false,\n        removeFromOrg: false,\n        setDefaultOrg: false,\n        cancelInvite: false,\n        changeRole: false,\n        addSafeRole: false,\n        changeOrgMemberRole: false,\n        deleteClusters: false,\n        extendTrial: false,\n        invalidateToken: false,\n        cancelPaid: false,\n        searchForOrgs: false,\n        readAudit: false,\n        modifyClusterPlanTypeReservations: false,\n        mayChangeOrgLimits: false,\n        mayChangeGenerationWhiteList: false,\n        sql: false,\n        modelerDeleteUser: false,\n        unblockUser: false,\n        god: {\n          triggerCrons: false,\n          forceSalesPlanOnOrg: false,\n          changeSignupSpamPatterns: false,\n          purgeUsers: false,\n          updateUserMetadata: false,\n        },\n        bot: false,\n        changeEmail: false,\n        changeUserName: false,\n      },\n      salesPlan: {\n        create: false,\n        modify: false,\n        forceModify: false,\n        switch: false,\n        delete: false,\n        godDelete: false,\n      },\n      enterprise: {\n        org: { convert: false, modify: false, modifyStartDate: false },\n      },\n      trial: {\n        convertToInNegotiation: false,\n      },\n      supportAgent: {\n        removeAgentsFromOrg: false,\n        seeOrgMemberships: false,\n        addAgentsToOrg: false,\n      },\n      m2m: {\n        salesplan: {\n          get: false,\n          switch: false,\n        },\n        fetchMigrationData: false,\n        approvals: false,\n      },\n      externalM2m: {\n        org: {\n          members: {\n            get: false,\n          },\n          search: false,\n        },\n        // eslint-disable-next-line id-length\n        qa: {\n          org: {\n            create: false,\n          },\n        },\n        offboarding: {\n          camundi: false,\n        },\n      },\n      auth0: {\n        connections: {\n          create: false,\n          read: false,\n          update: false,\n          delete: false,\n        },\n      },\n      notifications: {\n        global: {\n          read: false,\n          delete: false,\n          create: false,\n        },\n      },\n      earlyAccessFeatures: {\n        read: false,\n        create: false,\n        delete: false,\n        update: false,\n      },\n      pdfWatermark: {\n        read: false,\n        write: false,\n      },\n      featureFlags: {\n        write: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: READ_ALL,\n      description: 'read access to all orgs and users',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:trialExtender',\n        'accounts:limitExtender',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n        'accounts:addSafeRoles',\n        'accounts:consultingManager',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: CREATE_ORG,\n      description: 'can create organisations',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ORG_NAME,\n      description: 'can change name of organisations',\n      initialRoles: [\n        'accounts:admin',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_ORG,\n      description: 'can delete organisations',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: RESET_TOKEN_VERIFICATION,\n      description: 'can reset a verification token of a pending user',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_USER,\n      description: 'can delete users',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: DELETE_NOT_ACTIVATED_USER,\n      description: 'can delete users that are not activated yet',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ADD_TO_ORG,\n      description: 'can add someone to an org',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: REMOVE_FROM_ORG,\n      description: 'can remove someone from an org',\n      initialRoles: [\n        'accounts:admin',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: SET_DEFAULT_ORG,\n      description: 'can set an org as default for any user',\n      initialRoles: [\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n      ],\n    },\n    {\n      value: CANCEL_INVITE,\n      description: 'can cancelpending invites',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ROLE,\n      description: 'can change the role of a user',\n      // `CHANGE_ROLE` reaches every platform role, also `accounts:admin`, so\n      // only `accounts:admin` holds it.\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: EXTEND_TRIAL,\n      description: 'can extend the trial period of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: INVALIDATE_TOKEN,\n      description: 'can invalidate tokens in TokenIssuer',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_CREATE,\n      description: 'can create a SalesPlan',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_MODIFY,\n      description: 'can modify a SalesPlan',\n      initialRoles: ['accounts:admin', 'accounts:editSalesPlans'],\n    },\n    {\n      value: SALES_PLAN_FORCE_MODIFY,\n      description:\n        'can force modify a SalesPlan without caring about the orgs actual reservations/cluster usage',\n      initialRoles: [],\n    },\n    {\n      value: SALES_PLAN_SWITCH,\n      description: 'can switch an organization to another SalesPlan',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseOffboarding',\n        'accounts:consultingManager',\n      ],\n    },\n    {\n      value: SALES_PLAN_DELETE,\n      description:\n        'can delete a SalesPlan if it is not used by any Organization',\n      initialRoles: ['accounts:admin'],\n    },\n\n    {\n      value: SALES_PLAN_DELETE_AS_GOD,\n      description: `can delete salesplans even if there is no replacement salesplan for this type. use with great caution`,\n      initialRoles: [],\n    },\n    {\n      value: SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      description: 'can remove support agents from organizations',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      description: 'can see all org memberships of support agents',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_ADD_TO_ORG,\n      description: 'can add users as support agent to an organization',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      description: 'can modify cluster plan type reservations of an org',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_GET,\n      description: 'm2m can get salesplans',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_SWITCH,\n      description: 'm2m can switch salesplans',\n      initialRoles: [],\n    },\n    {\n      value: ENTERPRISE_ORG_CONVERT,\n      description: 'can convert orgs to enterprise plans',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY,\n      description:\n        'can modify value metrics and contract duration of enterprise orgs',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY_START_DATE,\n      description: 'can modify start date of enterprise orgs',\n      initialRoles: [\n        'accounts:god',\n        'accounts:enterpriseOffboarding',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      description: 'can convert trial orgs to in-negotiation plans',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseAdmin'],\n    },\n    {\n      value: EXTERNAL_M2M_GET_ORG_MEMBERS,\n      description: 'external m2m can get all members of all orgs',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_QA_ORG_CREATE,\n      description:\n        'external m2m can create orgs, initially add users to org and assign sales plan',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n      description:\n        'external m2m can trigger offboarding process for Camunda employees',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: EXTERNAL_M2M_SEARCH_ORGS,\n      description: 'external m2m can search organizations',\n      initialRoles: [],\n    },\n    {\n      value: ORG_MAY_CHANGE_LIMITS,\n      description: 'may change limits of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:limitExtender',\n      ],\n    },\n    {\n      value: ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      description: 'may change the generation whitelist of an organization',\n      initialRoles: ['accounts:admin', 'accounts:clusterUpdates'],\n    },\n    {\n      value: ORG_CANCEL_PAID,\n      description: 'may terminate a running paid organisation',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseOffboarding'],\n    },\n    {\n      value: ADMIN_SQL,\n      description: 'may query the DB',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_READ,\n      description: 'may read connections from auth0',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_CREATE,\n      description: 'may create new connections at auth0',\n      initialRoles: ['accounts:connections:create', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_UPDATE,\n      description: 'may update connections at auth0',\n      initialRoles: ['accounts:connections:update', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_DELETE,\n      description: 'may delete connections at auth0',\n      initialRoles: ['accounts:connections:delete', 'accounts:god'],\n    },\n    {\n      value: MODELER_DELETE_USER,\n      description: 'can delete a user within the modeler',\n      initialRoles: ['modeler:admin'],\n    },\n    {\n      value: UNBLOCK_USER,\n      description: 'can unblock a user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: GOD_CRON,\n      description: 'can run cron jobs',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: GOD_SIGNUP_SPAM_PATTERNS,\n      description: 'can read and change signup spam patterns',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_PURGE_USERS,\n      description: 'can purge user records based on create date / name pattern',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_UPDATE_USER_METADATA,\n      description: 'can update auth0 user_metadata and app_metadata',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: FORCE_SALES_PLAN_ON_ORG,\n      description: 'can force a sales plan on an org',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: CHANGE_SAFE_ROLE,\n      description: 'Can assign/unassign safe roles',\n      initialRoles: [\n        'accounts:addSafeRoles',\n        'accounts:consultingManager',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: CHANGE_ORG_MEMBER_ROLE,\n      description: 'can change the org roles of a member of any organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: BOT,\n      description: 'Can execute bot commands',\n      initialRoles: [],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_READ,\n      description: 'may read Alpha Features',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      description: 'may create new Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_READ,\n      description: 'may read PDF watermark projects and the audit log',\n      initialRoles: [\n        'accounts:pdfWatermarkReader',\n        'accounts:pdfWatermarkWriter',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_WRITE,\n      description: 'may create, update and delete PDF watermark projects',\n      initialRoles: ['accounts:pdfWatermarkWriter'],\n    },\n    {\n      value: ADMIN_FEATURE_FLAGS_WRITE,\n      description:\n        'may create, edit and delete a feature flag in Camunda Control',\n      // `accounts:admin` is a ROLE, and control-backend checks permissions,\n      // thus the role gets a permission of its own.\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_EMAIL,\n      description: 'can change the email of an user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_USER_NAME,\n      description: 'can change the name of an user',\n      initialRoles: ['accounts:admin'],\n    },\n  ]\n}\n"],
-  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,yBAAV;AACE,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,4BAA4B;AAClC,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,gBAAgB;AACtB,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,mBAAmB;AAGzB,EAAMA,qBAAA,yBAAyB;AAC/B,EAAMA,qBAAA,eAAe;AACrB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,0BAA0B;AAChC,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,uCAAuC;AAC7C,EAAMA,qBAAA,oCAAoC;AAC1C,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,wCAAwC;AAC9C,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,uBAAuB;AAK7B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,wBAAwB;AAE9B,EAAMA,qBAAA,mCAAmC;AAEzC,EAAMA,qBAAA,kCAAkC;AAExC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,6BAA6B;AACnC,EAAMA,qBAAA,gCAAgC;AAEtC,EAAMA,qBAAA,wBAAwB;AAC9B,EAAMA,qBAAA,sCAAsC;AAC5C,EAAMA,qBAAA,kBAAkB;AAExB,EAAMA,qBAAA,YAAY;AAElB,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,eAAe;AAErB,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,MAAM;AAGZ,EAAMA,qBAAA,sBAAsB;AAE5B,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,2BAA2B;AAEjC,EAAMA,qBAAA,mCAAmC;AACzC,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,sBAAsB;AAC5B,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,0BAA0B;AAUhC,EAAMA,qBAAA,4BAA4B;AAwHlC,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,YAAY;AAAA,QACZ,wBAAwB;AAAA,QACxB,UAAU;AAAA,QACV,eAAe;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,mCAAmC;AAAA,QACnC,oBAAoB;AAAA,QACpB,8BAA8B;AAAA,QAC9B,KAAK;AAAA,QACL,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,KAAK;AAAA,UACH,cAAc;AAAA,UACd,qBAAqB;AAAA,UACrB,0BAA0B;AAAA,UAC1B,YAAY;AAAA,UACZ,oBAAoB;AAAA,QACtB;AAAA,QACA,KAAK;AAAA,QACL,aAAa;AAAA,QACb,gBAAgB;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,YAAY;AAAA,QACV,KAAK,EAAE,SAAS,OAAO,QAAQ,OAAO,iBAAiB,MAAM;AAAA,MAC/D;AAAA,MACA,OAAO;AAAA,QACL,wBAAwB;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,MAClB;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,UACT,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,oBAAoB;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,KAAK;AAAA,UACH,SAAS;AAAA,YACP,KAAK;AAAA,UACP;AAAA,UACA,QAAQ;AAAA,QACV;AAAA;AAAA,QAEA,IAAI;AAAA,UACF,KAAK;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,QACA,aAAa;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAjHO,EAAAA,qBAAS;AAmHT,EAAMA,qBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA;AAAA;AAAA,MAGb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IAEA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,gCAAgC;AAAA,IACnE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,6BAA6B;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA,MAGF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,EACF;AAAA,GAlwBe;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace AccountsPermissions {\n  export const READ_ALL = 'aara'\n  export const CREATE_ORG = 'aaco'\n  export const CHANGE_ORG_NAME = 'aacn'\n  export const DELETE_ORG = 'aado'\n  export const RESET_TOKEN_VERIFICATION = 'aart'\n  export const DELETE_USER = 'aadu'\n  export const DELETE_NOT_ACTIVATED_USER = 'aadn'\n  export const ADD_TO_ORG = 'aaao'\n  export const REMOVE_FROM_ORG = 'aaro'\n  export const SET_DEFAULT_ORG = 'aasd'\n  export const CANCEL_INVITE = 'aaci'\n  export const CHANGE_ROLE = 'aacr'\n  export const CHANGE_SAFE_ROLE = 'aacs'\n  // The org roles of a member of any organization. `CHANGE_ROLE` and\n  // `CHANGE_SAFE_ROLE` are for the platform roles.\n  export const CHANGE_ORG_MEMBER_ROLE = 'aacm'\n  export const EXTEND_TRIAL = 'aaet'\n  export const INVALIDATE_TOKEN = 'aait'\n  export const SALES_PLAN_CREATE = 'asc'\n  export const SALES_PLAN_MODIFY = 'asm'\n  export const SALES_PLAN_FORCE_MODIFY = 'asfm'\n  export const SALES_PLAN_SWITCH = 'ass'\n  export const SALES_PLAN_DELETE = 'asd'\n  export const SALES_PLAN_DELETE_AS_GOD = 'asdg'\n  export const SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG = 'asar'\n  export const SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS = 'asas'\n  export const SUPPORT_AGENT_ADD_TO_ORG = 'asaa'\n  export const MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS = 'acpm'\n  export const M2M_SALESPLAN_GET = 'amsg'\n  export const M2M_SALESPLAN_SWITCH = 'amss'\n\n  // The routes of `api/admin/approvals` read `ConsolePermissions.M2M_CONTROL_APPROVALS`,\n  // the one m2m permission of control-backend for accounts and console.\n\n  export const ENTERPRISE_ORG_CONVERT = 'aeoc'\n\n  export const ENTERPRISE_ORG_MODIFY = 'aeom'\n\n  export const ENTERPRISE_ORG_MODIFY_START_DATE = 'aeos'\n\n  export const TRIAL_TO_IN_NEGOTIATION_CONVERT = 'atin'\n\n  export const EXTERNAL_M2M_GET_ORG_MEMBERS = 'amog'\n  export const EXTERNAL_M2M_SEARCH_ORGS = 'amos'\n  export const EXTERNAL_M2M_QA_ORG_CREATE = 'amqc'\n  export const EXTERNAL_M2M_OFFBOARD_CAMUNDI = 'amoc'\n\n  export const ORG_MAY_CHANGE_LIMITS = 'alc'\n  export const ORG_MAY_CHANGE_GENERATION_WHITELIST = 'algw'\n  export const ORG_CANCEL_PAID = 'aacp'\n\n  export const ADMIN_SQL = 'aasq'\n\n  export const ADMIN_AUTH0_CONNECTIONS_CREATE = 'aa0c'\n  export const ADMIN_AUTH0_CONNECTIONS_READ = 'aa0r'\n  export const ADMIN_AUTH0_CONNECTIONS_UPDATE = 'aa0u'\n  export const ADMIN_AUTH0_CONNECTIONS_DELETE = 'aa0d'\n  export const UNBLOCK_USER = 'aaub'\n\n  export const ADMIN_CHANGE_EMAIL = 'aace'\n  export const ADMIN_CHANGE_USER_NAME = 'aacu'\n\n  export const BOT = 'abot'\n\n  // OBACHT: NOT THIS ONE\n  export const MODELER_DELETE_USER = 'mdu'\n\n  export const GOD_CRON = 'gcr'\n  export const GOD_SIGNUP_SPAM_PATTERNS = 'gsp'\n  export const GOD_PURGE_USERS = 'gpu'\n  export const GOD_UPDATE_USER_METADATA = 'gum'\n\n  export const ADMIN_EARLY_ACCESS_FEATURES_READ = 'aaer'\n  export const ADMIN_EARLY_ACCESS_FEATURES_CREATE = 'aaec'\n  export const ADMIN_EARLY_ACCESS_FEATURES_DELETE = 'aaed'\n  export const ADMIN_EARLY_ACCESS_FEATURES_UPDATE = 'aaeu'\n  export const PDF_WATERMARK_READ = 'awmr'\n  export const PDF_WATERMARK_WRITE = 'awmw'\n  export const ROLE_SUPPORT_AGENT = 'support:agent'\n  export const FORCE_SALES_PLAN_ON_ORG = 'aafs'\n\n  /**\n   * May create, edit and delete a feature flag on the page of Camunda Control.\n   *\n   * A row of the table of control-backend is the value of the flag on its\n   * stage, and no approval stands in front of a write. Reading the rows takes\n   * `READ_ALL`. Do not reuse `acfo`: it still exists at Auth0 with the meaning\n   * of the reverted override design.\n   */\n  export const ADMIN_FEATURE_FLAGS_WRITE = 'aafw'\n\n  /**\n   * May create, list, rotate and revoke OWN agent tokens in Camunda Control.\n   *\n   * An agent token reads with the permissions of its creator, cut to the\n   * read set of each backend. A creator without `READ_ALL` thus makes a token\n   * that can read nothing in control-backend, so this permission goes to the\n   * same roles.\n   */\n  export const CONTROL_AGENT_TOKENS_MANAGE_OWN = 'aato'\n\n  /** May list every agent token of the stage, and revoke any of them. */\n  export const CONTROL_AGENT_TOKENS_ADMIN = 'aata'\n\n  export interface Features {\n    admin: {\n      readAll: boolean\n      createOrg: boolean\n      changeOrgName: boolean\n      deleteOrg: boolean\n      resetTokenVerification: boolean\n      deleteUser: boolean\n      deleteNotActivatedUser: boolean\n      addToOrg: boolean\n      removeFromOrg: boolean\n      setDefaultOrg: boolean\n      cancelInvite: boolean\n      changeRole: boolean\n      addSafeRole: boolean\n      changeOrgMemberRole: boolean\n      deleteClusters: boolean\n      extendTrial: boolean\n      invalidateToken: boolean\n      cancelPaid: boolean\n      searchForOrgs: boolean\n      readAudit: boolean\n      modifyClusterPlanTypeReservations: boolean\n      mayChangeOrgLimits: boolean\n      mayChangeGenerationWhiteList: boolean\n      sql: boolean\n      modelerDeleteUser: boolean\n      unblockUser: boolean\n      god: {\n        triggerCrons: boolean\n        forceSalesPlanOnOrg: boolean\n        changeSignupSpamPatterns: boolean\n        purgeUsers: boolean\n        updateUserMetadata: boolean\n      }\n      bot: boolean\n      changeEmail: boolean\n      changeUserName: boolean\n    }\n    salesPlan: {\n      create: boolean\n      modify: boolean\n      forceModify: boolean\n      switch: boolean\n      delete: boolean\n      godDelete: boolean\n    }\n    enterprise: {\n      org: {\n        convert: boolean\n        modify: boolean\n        modifyStartDate: boolean\n      }\n    }\n    trial: {\n      convertToInNegotiation: boolean\n    }\n    supportAgent: {\n      removeAgentsFromOrg: boolean\n      seeOrgMemberships: boolean\n      addAgentsToOrg: boolean\n    }\n    m2m: {\n      salesplan: {\n        get: boolean\n        switch: boolean\n      }\n\n      fetchMigrationData: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n    externalM2m: {\n      org: {\n        members: {\n          get: boolean\n        }\n        search: boolean\n      }\n      qa: {\n        org: {\n          create: boolean\n        }\n      }\n      offboarding: {\n        camundi: boolean\n      }\n    }\n    auth0: {\n      connections: {\n        create: boolean\n        read: boolean\n        update: boolean\n        delete: boolean\n      }\n    }\n    notifications: {\n      global: {\n        read: boolean\n        delete: boolean\n        create: boolean\n      }\n    }\n    earlyAccessFeatures: {\n      read: boolean\n      create: boolean\n      delete: boolean\n      update: boolean\n    }\n    pdfWatermark: {\n      read: boolean\n      write: boolean\n    }\n    featureFlags: {\n      write: boolean\n    }\n    agentTokens: {\n      manageOwn: boolean\n      admin: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      admin: {\n        readAll: false,\n        createOrg: false,\n        changeOrgName: false,\n        deleteOrg: false,\n        resetTokenVerification: false,\n        deleteUser: false,\n        deleteNotActivatedUser: false,\n        addToOrg: false,\n        removeFromOrg: false,\n        setDefaultOrg: false,\n        cancelInvite: false,\n        changeRole: false,\n        addSafeRole: false,\n        changeOrgMemberRole: false,\n        deleteClusters: false,\n        extendTrial: false,\n        invalidateToken: false,\n        cancelPaid: false,\n        searchForOrgs: false,\n        readAudit: false,\n        modifyClusterPlanTypeReservations: false,\n        mayChangeOrgLimits: false,\n        mayChangeGenerationWhiteList: false,\n        sql: false,\n        modelerDeleteUser: false,\n        unblockUser: false,\n        god: {\n          triggerCrons: false,\n          forceSalesPlanOnOrg: false,\n          changeSignupSpamPatterns: false,\n          purgeUsers: false,\n          updateUserMetadata: false,\n        },\n        bot: false,\n        changeEmail: false,\n        changeUserName: false,\n      },\n      salesPlan: {\n        create: false,\n        modify: false,\n        forceModify: false,\n        switch: false,\n        delete: false,\n        godDelete: false,\n      },\n      enterprise: {\n        org: { convert: false, modify: false, modifyStartDate: false },\n      },\n      trial: {\n        convertToInNegotiation: false,\n      },\n      supportAgent: {\n        removeAgentsFromOrg: false,\n        seeOrgMemberships: false,\n        addAgentsToOrg: false,\n      },\n      m2m: {\n        salesplan: {\n          get: false,\n          switch: false,\n        },\n        fetchMigrationData: false,\n        approvals: false,\n      },\n      externalM2m: {\n        org: {\n          members: {\n            get: false,\n          },\n          search: false,\n        },\n        // eslint-disable-next-line id-length\n        qa: {\n          org: {\n            create: false,\n          },\n        },\n        offboarding: {\n          camundi: false,\n        },\n      },\n      auth0: {\n        connections: {\n          create: false,\n          read: false,\n          update: false,\n          delete: false,\n        },\n      },\n      notifications: {\n        global: {\n          read: false,\n          delete: false,\n          create: false,\n        },\n      },\n      earlyAccessFeatures: {\n        read: false,\n        create: false,\n        delete: false,\n        update: false,\n      },\n      pdfWatermark: {\n        read: false,\n        write: false,\n      },\n      featureFlags: {\n        write: false,\n      },\n      agentTokens: {\n        manageOwn: false,\n        admin: false,\n      },\n    }\n  }\n\n  /**\n   * The roles that hold `READ_ALL`. `CONTROL_AGENT_TOKENS_MANAGE_OWN` goes to\n   * the same roles, so the two lists cannot drift.\n   */\n  const READ_ALL_INITIAL_ROLES: Roles[] = [\n    'accounts:read',\n    'accounts:onboard',\n    'accounts:orgCreator',\n    'accounts:admin',\n    'accounts:editSalesPlans',\n    'console:admin',\n    'console:admin:readonly',\n    'support:agent',\n    'supersupport:agent',\n    'accounts:trialExtender',\n    'accounts:limitExtender',\n    'accounts:enterpriseAdmin',\n    'accounts:enterpriseOffboarding',\n    'console:C8ReleaseManager',\n    'console:C8UpdateEnforcer',\n    'accounts:addSafeRoles',\n    'accounts:consultingManager',\n    'accounts:earlyAccessEditor',\n  ]\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: READ_ALL,\n      description: 'read access to all orgs and users',\n      initialRoles: READ_ALL_INITIAL_ROLES,\n    },\n    {\n      value: CREATE_ORG,\n      description: 'can create organisations',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ORG_NAME,\n      description: 'can change name of organisations',\n      initialRoles: [\n        'accounts:admin',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_ORG,\n      description: 'can delete organisations',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: RESET_TOKEN_VERIFICATION,\n      description: 'can reset a verification token of a pending user',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: DELETE_USER,\n      description: 'can delete users',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: DELETE_NOT_ACTIVATED_USER,\n      description: 'can delete users that are not activated yet',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ADD_TO_ORG,\n      description: 'can add someone to an org',\n      initialRoles: [\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: REMOVE_FROM_ORG,\n      description: 'can remove someone from an org',\n      initialRoles: [\n        'accounts:admin',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: SET_DEFAULT_ORG,\n      description: 'can set an org as default for any user',\n      initialRoles: [\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n      ],\n    },\n    {\n      value: CANCEL_INVITE,\n      description: 'can cancelpending invites',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CHANGE_ROLE,\n      description: 'can change the role of a user',\n      // `CHANGE_ROLE` reaches every platform role, also `accounts:admin`, so\n      // only `accounts:admin` holds it.\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: EXTEND_TRIAL,\n      description: 'can extend the trial period of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: INVALIDATE_TOKEN,\n      description: 'can invalidate tokens in TokenIssuer',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_CREATE,\n      description: 'can create a SalesPlan',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: SALES_PLAN_MODIFY,\n      description: 'can modify a SalesPlan',\n      initialRoles: ['accounts:admin', 'accounts:editSalesPlans'],\n    },\n    {\n      value: SALES_PLAN_FORCE_MODIFY,\n      description:\n        'can force modify a SalesPlan without caring about the orgs actual reservations/cluster usage',\n      initialRoles: [],\n    },\n    {\n      value: SALES_PLAN_SWITCH,\n      description: 'can switch an organization to another SalesPlan',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseOffboarding',\n        'accounts:consultingManager',\n      ],\n    },\n    {\n      value: SALES_PLAN_DELETE,\n      description:\n        'can delete a SalesPlan if it is not used by any Organization',\n      initialRoles: ['accounts:admin'],\n    },\n\n    {\n      value: SALES_PLAN_DELETE_AS_GOD,\n      description: `can delete salesplans even if there is no replacement salesplan for this type. use with great caution`,\n      initialRoles: [],\n    },\n    {\n      value: SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      description: 'can remove support agents from organizations',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      description: 'can see all org memberships of support agents',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: SUPPORT_AGENT_ADD_TO_ORG,\n      description: 'can add users as support agent to an organization',\n      initialRoles: ['support:agent', 'supersupport:agent'],\n    },\n    {\n      value: MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      description: 'can modify cluster plan type reservations of an org',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_GET,\n      description: 'm2m can get salesplans',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SALESPLAN_SWITCH,\n      description: 'm2m can switch salesplans',\n      initialRoles: [],\n    },\n    {\n      value: ENTERPRISE_ORG_CONVERT,\n      description: 'can convert orgs to enterprise plans',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY,\n      description:\n        'can modify value metrics and contract duration of enterprise orgs',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:enterpriseOffboarding',\n      ],\n    },\n    {\n      value: ENTERPRISE_ORG_MODIFY_START_DATE,\n      description: 'can modify start date of enterprise orgs',\n      initialRoles: [\n        'accounts:god',\n        'accounts:enterpriseOffboarding',\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      description: 'can convert trial orgs to in-negotiation plans',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseAdmin'],\n    },\n    {\n      value: EXTERNAL_M2M_GET_ORG_MEMBERS,\n      description: 'external m2m can get all members of all orgs',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_QA_ORG_CREATE,\n      description:\n        'external m2m can create orgs, initially add users to org and assign sales plan',\n      initialRoles: [],\n    },\n    {\n      value: EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n      description:\n        'external m2m can trigger offboarding process for Camunda employees',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: EXTERNAL_M2M_SEARCH_ORGS,\n      description: 'external m2m can search organizations',\n      initialRoles: [],\n    },\n    {\n      value: ORG_MAY_CHANGE_LIMITS,\n      description: 'may change limits of an organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:enterpriseAdmin',\n        'accounts:limitExtender',\n      ],\n    },\n    {\n      value: ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      description: 'may change the generation whitelist of an organization',\n      initialRoles: ['accounts:admin', 'accounts:clusterUpdates'],\n    },\n    {\n      value: ORG_CANCEL_PAID,\n      description: 'may terminate a running paid organisation',\n      initialRoles: ['accounts:admin', 'accounts:enterpriseOffboarding'],\n    },\n    {\n      value: ADMIN_SQL,\n      description: 'may query the DB',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_READ,\n      description: 'may read connections from auth0',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_CREATE,\n      description: 'may create new connections at auth0',\n      initialRoles: ['accounts:connections:create', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_UPDATE,\n      description: 'may update connections at auth0',\n      initialRoles: ['accounts:connections:update', 'accounts:god'],\n    },\n    {\n      value: ADMIN_AUTH0_CONNECTIONS_DELETE,\n      description: 'may delete connections at auth0',\n      initialRoles: ['accounts:connections:delete', 'accounts:god'],\n    },\n    {\n      value: MODELER_DELETE_USER,\n      description: 'can delete a user within the modeler',\n      initialRoles: ['modeler:admin'],\n    },\n    {\n      value: UNBLOCK_USER,\n      description: 'can unblock a user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: GOD_CRON,\n      description: 'can run cron jobs',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: GOD_SIGNUP_SPAM_PATTERNS,\n      description: 'can read and change signup spam patterns',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_PURGE_USERS,\n      description: 'can purge user records based on create date / name pattern',\n      initialRoles: ['consoleTeam', 'accounts:god'],\n    },\n    {\n      value: GOD_UPDATE_USER_METADATA,\n      description: 'can update auth0 user_metadata and app_metadata',\n      initialRoles: ['accounts:god'],\n    },\n    {\n      value: FORCE_SALES_PLAN_ON_ORG,\n      description: 'can force a sales plan on an org',\n      initialRoles: ['consoleTeam'],\n    },\n    {\n      value: CHANGE_SAFE_ROLE,\n      description: 'Can assign/unassign safe roles',\n      initialRoles: [\n        'accounts:addSafeRoles',\n        'accounts:consultingManager',\n        'accounts:enterpriseAdmin',\n        'accounts:onboard',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: CHANGE_ORG_MEMBER_ROLE,\n      description: 'can change the org roles of a member of any organization',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:onboard',\n        'accounts:enterpriseAdmin',\n        'supersupport:agent',\n      ],\n    },\n    {\n      value: BOT,\n      description: 'Can execute bot commands',\n      initialRoles: [],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_READ,\n      description: 'may read Alpha Features',\n      initialRoles: [\n        'accounts:read',\n        'accounts:orgCreator',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:admin',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      description: 'may create new Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      description: 'may delete Alpha Features',\n      initialRoles: [\n        'accounts:admin',\n        'accounts:god',\n        'accounts:earlyAccessEditor',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_READ,\n      description: 'may read PDF watermark projects and the audit log',\n      initialRoles: [\n        'accounts:pdfWatermarkReader',\n        'accounts:pdfWatermarkWriter',\n      ],\n    },\n    {\n      value: PDF_WATERMARK_WRITE,\n      description: 'may create, update and delete PDF watermark projects',\n      initialRoles: ['accounts:pdfWatermarkWriter'],\n    },\n    {\n      value: ADMIN_FEATURE_FLAGS_WRITE,\n      description:\n        'may create, edit and delete a feature flag in Camunda Control',\n      // `accounts:admin` is a ROLE, and control-backend checks permissions,\n      // thus the role gets a permission of its own.\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: CONTROL_AGENT_TOKENS_MANAGE_OWN,\n      description:\n        'may create, rotate and revoke own read-only agent tokens in Camunda Control',\n      initialRoles: READ_ALL_INITIAL_ROLES,\n    },\n    {\n      value: CONTROL_AGENT_TOKENS_ADMIN,\n      description:\n        'may list every agent token in Camunda Control, and revoke any of them',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_EMAIL,\n      description: 'can change the email of an user',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: ADMIN_CHANGE_USER_NAME,\n      description: 'can change the name of an user',\n      initialRoles: ['accounts:admin'],\n    },\n  ]\n}\n"],
+  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,yBAAV;AACE,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,4BAA4B;AAClC,EAAMA,qBAAA,aAAa;AACnB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,gBAAgB;AACtB,EAAMA,qBAAA,cAAc;AACpB,EAAMA,qBAAA,mBAAmB;AAGzB,EAAMA,qBAAA,yBAAyB;AAC/B,EAAMA,qBAAA,eAAe;AACrB,EAAMA,qBAAA,mBAAmB;AACzB,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,0BAA0B;AAChC,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,uCAAuC;AAC7C,EAAMA,qBAAA,oCAAoC;AAC1C,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,wCAAwC;AAC9C,EAAMA,qBAAA,oBAAoB;AAC1B,EAAMA,qBAAA,uBAAuB;AAK7B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,wBAAwB;AAE9B,EAAMA,qBAAA,mCAAmC;AAEzC,EAAMA,qBAAA,kCAAkC;AAExC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,6BAA6B;AACnC,EAAMA,qBAAA,gCAAgC;AAEtC,EAAMA,qBAAA,wBAAwB;AAC9B,EAAMA,qBAAA,sCAAsC;AAC5C,EAAMA,qBAAA,kBAAkB;AAExB,EAAMA,qBAAA,YAAY;AAElB,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,+BAA+B;AACrC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,iCAAiC;AACvC,EAAMA,qBAAA,eAAe;AAErB,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,yBAAyB;AAE/B,EAAMA,qBAAA,MAAM;AAGZ,EAAMA,qBAAA,sBAAsB;AAE5B,EAAMA,qBAAA,WAAW;AACjB,EAAMA,qBAAA,2BAA2B;AACjC,EAAMA,qBAAA,kBAAkB;AACxB,EAAMA,qBAAA,2BAA2B;AAEjC,EAAMA,qBAAA,mCAAmC;AACzC,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qCAAqC;AAC3C,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,sBAAsB;AAC5B,EAAMA,qBAAA,qBAAqB;AAC3B,EAAMA,qBAAA,0BAA0B;AAUhC,EAAMA,qBAAA,4BAA4B;AAUlC,EAAMA,qBAAA,kCAAkC;AAGxC,EAAMA,qBAAA,6BAA6B;AA4HnC,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,OAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,eAAe;AAAA,QACf,WAAW;AAAA,QACX,wBAAwB;AAAA,QACxB,YAAY;AAAA,QACZ,wBAAwB;AAAA,QACxB,UAAU;AAAA,QACV,eAAe;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,qBAAqB;AAAA,QACrB,gBAAgB;AAAA,QAChB,aAAa;AAAA,QACb,iBAAiB;AAAA,QACjB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,QACX,mCAAmC;AAAA,QACnC,oBAAoB;AAAA,QACpB,8BAA8B;AAAA,QAC9B,KAAK;AAAA,QACL,mBAAmB;AAAA,QACnB,aAAa;AAAA,QACb,KAAK;AAAA,UACH,cAAc;AAAA,UACd,qBAAqB;AAAA,UACrB,0BAA0B;AAAA,UAC1B,YAAY;AAAA,UACZ,oBAAoB;AAAA,QACtB;AAAA,QACA,KAAK;AAAA,QACL,aAAa;AAAA,QACb,gBAAgB;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,MACA,YAAY;AAAA,QACV,KAAK,EAAE,SAAS,OAAO,QAAQ,OAAO,iBAAiB,MAAM;AAAA,MAC/D;AAAA,MACA,OAAO;AAAA,QACL,wBAAwB;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,QACZ,qBAAqB;AAAA,QACrB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,MAClB;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,UACT,KAAK;AAAA,UACL,QAAQ;AAAA,QACV;AAAA,QACA,oBAAoB;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,MACA,aAAa;AAAA,QACX,KAAK;AAAA,UACH,SAAS;AAAA,YACP,KAAK;AAAA,UACP;AAAA,UACA,QAAQ;AAAA,QACV;AAAA;AAAA,QAEA,IAAI;AAAA,UACF,KAAK;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,QACA,aAAa;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,eAAe;AAAA,QACb,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,OAAO;AAAA,MACT;AAAA,MACA,cAAc;AAAA,QACZ,OAAO;AAAA,MACT;AAAA,MACA,aAAa;AAAA,QACX,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AArHO,EAAAA,qBAAS;AA2HhB,QAAM,yBAAkC;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEO,EAAMA,qBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA;AAAA;AAAA,MAGb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IAEA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,oBAAoB;AAAA,IACtD;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,yBAAyB;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,kBAAkB,gCAAgC;AAAA,IACnE;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,+BAA+B,cAAc;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe,cAAc;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,6BAA6B;AAAA,IAC9C;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA,MAGF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,qBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,EACF;AAAA,GAzyBe;",
   "names": ["AccountsPermissions"]
 }

package/dist/permissions/combo.js

@@ -189,6 +189,14 @@ function accountsUserFeaturesFromPermissions(permissions) {
       write: permissions.includes(
         AccountsPermissions.ADMIN_FEATURE_FLAGS_WRITE
       )
+    },
+    agentTokens: {
+      manageOwn: permissions.includes(
+        AccountsPermissions.CONTROL_AGENT_TOKENS_MANAGE_OWN
+      ),
+      admin: permissions.includes(
+        AccountsPermissions.CONTROL_AGENT_TOKENS_ADMIN
+      )
     }
   };
   return newFeatures;
@@ -316,7 +324,10 @@ function consoleUserFeaturesFromPermissions(permissions) {
       manageGenerationUpgradePath: permissions.includes(
         ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH
       ),
-      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS)
+      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),
+      controlAgentStatus: permissions.includes(
+        ConsolePermissions.M2M_CONTROL_AGENT_STATUS
+      )
     }
   };
   return newFeatures;

package/dist/permissions/combo.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/combo.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      changeOrgMemberRole: permissions.includes(\n        AccountsPermissions.CHANGE_ORG_MEMBER_ROLE,\n      ),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n    featureFlags: {\n      write: permissions.includes(\n        AccountsPermissions.ADMIN_FEATURE_FLAGS_WRITE,\n      ),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n  }\n  return newFeatures\n}\n\n/**\n * Flattens a feature tree into the dotted keys of the Control session.\n *\n * `buildSession` in accounts-backend writes the session with exactly this\n * shape, under the prefixes `` (accounts), `console` and `notifications`.\n */\nfunction flattenFeatureBooleans(\n  value: unknown,\n  prefix = '',\n): Record<string, boolean> {\n  const out: Record<string, boolean> = {}\n  if (!value || typeof value !== 'object') {\n    return out\n  }\n  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n    const flatKey = prefix ? `${prefix}.${key}` : key\n    if (typeof entry === 'boolean') {\n      out[flatKey] = entry\n    } else if (entry && typeof entry === 'object') {\n      Object.assign(out, flattenFeatureBooleans(entry, flatKey))\n    }\n  }\n  return out\n}\n\n/**\n * The session keys that ONE raw Auth0 permission turns on.\n *\n * The Control session holds a flat record of feature booleans, such as\n * `admin.extendTrial` and `console.clusters.canUpgradeGenerationYolo`. An\n * approval use case names the raw Auth0 short code instead, such as `aaet`,\n * because that is what the token carries and what a backend compares.\n *\n * This function bridges the two, and it bridges them by RUNNING the same\n * mappers that build the session. A hand-written table of code to key would be\n * a third copy of the permission model, and a code that gained a key would\n * silently stop gating anything in the browser.\n *\n * It answers an array, because one code can turn on more than one key. An\n * unknown code answers an empty array, and the caller decides what that means.\n *\n * The answer is CACHED, because the work is three feature trees and a flatten\n * of each one. `ApprovalActorView.has` of the browser runs this, and the rules\n * call `has` for every row of the queue: a page of 2000 requests turned one\n * cheap question into thousands of tree builds. The answer of a code never\n * changes inside one bundle, so the cache needs no invalidation, and the keys\n * are the permission codes of the use cases, which is a short list.\n *\n * The answer is `readonly`, and frozen, because every caller of one code gets\n * the SAME array: a caller that sorted or pushed in place would change what\n * the next reader of that code sees.\n */\nconst keysByPermissionCode = new Map<string, readonly string[]>()\n\nexport function sessionPermissionKeysFor(\n  permissionCode: string,\n): readonly string[] {\n  const cached = keysByPermissionCode.get(permissionCode)\n  if (cached) {\n    return cached\n  }\n  const answer = Object.freeze(buildSessionPermissionKeys(permissionCode))\n  keysByPermissionCode.set(permissionCode, answer)\n  return answer\n}\n\nfunction buildSessionPermissionKeys(permissionCode: string): string[] {\n  const trees: [unknown, string][] = [\n    [accountsUserFeaturesFromPermissions([permissionCode]), ''],\n    [consoleUserFeaturesFromPermissions([permissionCode]), 'console'],\n    [\n      NotificationPermissions.userFeaturesFromPermissions([permissionCode]),\n      'notifications',\n    ],\n  ]\n  const keys: string[] = []\n  for (const [tree, prefix] of trees) {\n    for (const [key, on] of Object.entries(\n      flattenFeatureBooleans(tree, prefix),\n    )) {\n      if (on) {\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Reports whether a Control session holds one raw Auth0 permission.\n *\n * It is what `ApprovalActorView.has` runs in the browser. An unknown code\n * answers false: a permission that nothing maps is a permission that nobody\n * holds, and the alternative would open a button that the backend refuses.\n */\nexport function sessionHasPermission(\n  sessionPermissions: Record<string, boolean>,\n  permissionCode: string,\n): boolean {\n  return sessionPermissionKeysFor(permissionCode).some(\n    (key) => sessionPermissions[key] === true,\n  )\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY;AAAA,QACjB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,SAAS,IACgB;AACzB,QAAM,MAA+B,CAAC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,QAAI,OAAO,UAAU,WAAW;AAC9B,UAAI,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,aAAO,OAAO,KAAK,uBAAuB,OAAO,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BA,MAAM,uBAAuB,oBAAI,IAA+B;AAEzD,SAAS,yBACd,gBACmB;AACnB,QAAM,SAAS,qBAAqB,IAAI,cAAc;AACtD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,OAAO,2BAA2B,cAAc,CAAC;AACvE,uBAAqB,IAAI,gBAAgB,MAAM;AAC/C,SAAO;AACT;AAEA,SAAS,2BAA2B,gBAAkC;AACpE,QAAM,QAA6B;AAAA,IACjC,CAAC,oCAAoC,CAAC,cAAc,CAAC,GAAG,EAAE;AAAA,IAC1D,CAAC,mCAAmC,CAAC,cAAc,CAAC,GAAG,SAAS;AAAA,IAChE;AAAA,MACE,wBAAwB,4BAA4B,CAAC,cAAc,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO;AAClC,eAAW,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,MAC7B,uBAAuB,MAAM,MAAM;AAAA,IACrC,GAAG;AACD,UAAI,IAAI;AACN,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,qBACd,oBACA,gBACS;AACT,SAAO,yBAAyB,cAAc,EAAE;AAAA,IAC9C,CAAC,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EACvC;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from './accounts.permissions.js'\nimport { AuditLoggerPermissions } from './auditlogger.permissions.js'\nimport { ConsolePermissions } from './console.permissions.js'\nimport { NotificationPermissions } from './notification.permissions.js'\n\nexport function accountsUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: AccountsPermissions.Features = {\n    admin: {\n      readAll: permissions.includes(AccountsPermissions.READ_ALL),\n      createOrg: permissions.includes(AccountsPermissions.CREATE_ORG),\n      changeOrgName: permissions.includes(AccountsPermissions.CHANGE_ORG_NAME),\n\n      deleteOrg: permissions.includes(AccountsPermissions.DELETE_ORG),\n      resetTokenVerification: permissions.includes(\n        AccountsPermissions.RESET_TOKEN_VERIFICATION,\n      ),\n      deleteUser: permissions.includes(AccountsPermissions.DELETE_USER),\n      deleteNotActivatedUser: permissions.includes(\n        AccountsPermissions.DELETE_NOT_ACTIVATED_USER,\n      ),\n      addToOrg: permissions.includes(AccountsPermissions.ADD_TO_ORG),\n      removeFromOrg: permissions.includes(AccountsPermissions.REMOVE_FROM_ORG),\n      setDefaultOrg: permissions.includes(AccountsPermissions.SET_DEFAULT_ORG),\n      cancelInvite: permissions.includes(AccountsPermissions.CANCEL_INVITE),\n      changeRole: permissions.includes(AccountsPermissions.CHANGE_ROLE),\n      addSafeRole: permissions.includes(AccountsPermissions.CHANGE_SAFE_ROLE),\n      changeOrgMemberRole: permissions.includes(\n        AccountsPermissions.CHANGE_ORG_MEMBER_ROLE,\n      ),\n      deleteClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      extendTrial: permissions.includes(AccountsPermissions.EXTEND_TRIAL),\n      invalidateToken: permissions.includes(\n        AccountsPermissions.INVALIDATE_TOKEN,\n      ),\n      cancelPaid: permissions.includes(AccountsPermissions.ORG_CANCEL_PAID),\n      searchForOrgs: permissions.includes(\n        ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n      ),\n      readAudit: permissions.includes(AuditLoggerPermissions.READ),\n      modifyClusterPlanTypeReservations: permissions.includes(\n        AccountsPermissions.MODIFY_CLUSTER_PLAN_TYPE_RESERVATIONS,\n      ),\n      mayChangeOrgLimits: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_LIMITS,\n      ),\n      mayChangeGenerationWhiteList: permissions.includes(\n        AccountsPermissions.ORG_MAY_CHANGE_GENERATION_WHITELIST,\n      ),\n      sql: permissions.includes(AccountsPermissions.ADMIN_SQL),\n      modelerDeleteUser: permissions.includes(\n        AccountsPermissions.MODELER_DELETE_USER,\n      ),\n      unblockUser: permissions.includes(AccountsPermissions.UNBLOCK_USER),\n      god: {\n        triggerCrons: permissions.includes(AccountsPermissions.GOD_CRON),\n        forceSalesPlanOnOrg: permissions.includes(\n          AccountsPermissions.FORCE_SALES_PLAN_ON_ORG,\n        ),\n        changeSignupSpamPatterns: permissions.includes(\n          AccountsPermissions.GOD_SIGNUP_SPAM_PATTERNS,\n        ),\n        purgeUsers: permissions.includes(AccountsPermissions.GOD_PURGE_USERS),\n        updateUserMetadata: permissions.includes(\n          AccountsPermissions.GOD_UPDATE_USER_METADATA,\n        ),\n      },\n      bot: permissions.includes(AccountsPermissions.BOT),\n      changeEmail: permissions.includes(AccountsPermissions.ADMIN_CHANGE_EMAIL),\n      changeUserName: permissions.includes(\n        AccountsPermissions.ADMIN_CHANGE_USER_NAME,\n      ),\n    },\n    salesPlan: {\n      create: permissions.includes(AccountsPermissions.SALES_PLAN_CREATE),\n      modify: permissions.includes(AccountsPermissions.SALES_PLAN_MODIFY),\n      forceModify: permissions.includes(\n        AccountsPermissions.SALES_PLAN_FORCE_MODIFY,\n      ),\n      switch: permissions.includes(AccountsPermissions.SALES_PLAN_SWITCH),\n      delete: permissions.includes(AccountsPermissions.SALES_PLAN_DELETE),\n      godDelete: permissions.includes(\n        AccountsPermissions.SALES_PLAN_DELETE_AS_GOD,\n      ),\n    },\n    enterprise: {\n      org: {\n        convert: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_CONVERT,\n        ),\n        modify: permissions.includes(AccountsPermissions.ENTERPRISE_ORG_MODIFY),\n        modifyStartDate: permissions.includes(\n          AccountsPermissions.ENTERPRISE_ORG_MODIFY_START_DATE,\n        ),\n      },\n    },\n    trial: {\n      convertToInNegotiation: permissions.includes(\n        AccountsPermissions.TRIAL_TO_IN_NEGOTIATION_CONVERT,\n      ),\n    },\n    supportAgent: {\n      removeAgentsFromOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_REMOVE_AGENTS_FROM_ORG,\n      ),\n      seeOrgMemberships: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_SEE_ORG_MEMBERSHIPS,\n      ),\n      addAgentsToOrg: permissions.includes(\n        AccountsPermissions.SUPPORT_AGENT_ADD_TO_ORG,\n      ),\n    },\n    m2m: {\n      salesplan: {\n        get: permissions.includes(AccountsPermissions.M2M_SALESPLAN_GET),\n        switch: permissions.includes(AccountsPermissions.M2M_SALESPLAN_SWITCH),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n    },\n    externalM2m: {\n      org: {\n        members: {\n          get: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_GET_ORG_MEMBERS,\n          ),\n        },\n        search: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_SEARCH_ORGS,\n        ),\n      },\n      // eslint-disable-next-line id-length\n      qa: {\n        org: {\n          create: permissions.includes(\n            AccountsPermissions.EXTERNAL_M2M_QA_ORG_CREATE,\n          ),\n        },\n      },\n      offboarding: {\n        camundi: permissions.includes(\n          AccountsPermissions.EXTERNAL_M2M_OFFBOARD_CAMUNDI,\n        ),\n      },\n    },\n    auth0: {\n      connections: {\n        create: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_CREATE,\n        ),\n        read: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_READ,\n        ),\n        update: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_UPDATE,\n        ),\n        delete: permissions.includes(\n          AccountsPermissions.ADMIN_AUTH0_CONNECTIONS_DELETE,\n        ),\n      },\n    },\n    notifications: {\n      global: {\n        read: permissions.includes(NotificationPermissions.READ_GLOBAL),\n        delete: permissions.includes(NotificationPermissions.DELETE_GLOBAL),\n        create: permissions.includes(NotificationPermissions.CREATE_GLOBAL),\n      },\n    },\n    earlyAccessFeatures: {\n      read: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_READ,\n      ),\n      create: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_CREATE,\n      ),\n      delete: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_DELETE,\n      ),\n      update: permissions.includes(\n        AccountsPermissions.ADMIN_EARLY_ACCESS_FEATURES_UPDATE,\n      ),\n    },\n    pdfWatermark: {\n      read: permissions.includes(AccountsPermissions.PDF_WATERMARK_READ),\n      write: permissions.includes(AccountsPermissions.PDF_WATERMARK_WRITE),\n    },\n    featureFlags: {\n      write: permissions.includes(\n        AccountsPermissions.ADMIN_FEATURE_FLAGS_WRITE,\n      ),\n    },\n    agentTokens: {\n      manageOwn: permissions.includes(\n        AccountsPermissions.CONTROL_AGENT_TOKENS_MANAGE_OWN,\n      ),\n      admin: permissions.includes(\n        AccountsPermissions.CONTROL_AGENT_TOKENS_ADMIN,\n      ),\n    },\n  }\n  return newFeatures\n}\n\nexport function consoleUserFeaturesFromPermissions(permissions: string[]) {\n  const newFeatures: ConsolePermissions.Features = {\n    apiClient: {\n      read: permissions.includes(ConsolePermissions.APICLIENT_READ),\n      delete: permissions.includes(ConsolePermissions.APICLIENT_DELETE),\n    },\n    multiCluster: {\n      admin: permissions.includes(ConsolePermissions.MULTICLUSTER_ADMIN),\n    },\n    multiGen: {\n      admin: {\n        see: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN,\n        ),\n        patchExistingChannel: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n        ),\n        migrate: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n        ),\n        deleteAllClustersOfGeneration: permissions.includes(\n          ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n        ),\n      },\n      releaseTrain: {\n        publish: permissions.includes(ConsolePermissions.RELEASE_TRAIN_PUBLISH),\n      },\n    },\n    clusters: {\n      canReadAllClusterInfo: permissions.includes(\n        ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n      ),\n      canDeleteAllClusters: permissions.includes(\n        ConsolePermissions.CLUSTERS_DELETE_CLUSTER,\n      ),\n      canMoveToOtherOrg: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      ),\n      createOnBehalf: permissions.includes(\n        ConsolePermissions.CLUSTER_CREATE_ON_BEHALF,\n      ),\n      canSendToSleep: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_SEND_TO_SLEEP,\n      ),\n      canCreateInternalBackup: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      ),\n      canUpdateClusterPlanType: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      ),\n      canOverrideEnvVars: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      ),\n      canCreateModificationConfig: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      ),\n      canUpgradeGeneration: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION,\n      ),\n      canUpgradeGenerationYolo: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      ),\n      canUpdateOptionalTelemetry: permissions.includes(\n        ConsolePermissions.CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      ),\n    },\n    clusterPlan: {\n      seeAll: permissions.includes(ConsolePermissions.CLUSTER_PLAN_SEE_ALL),\n      create: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CREATE),\n      delete: permissions.includes(ConsolePermissions.CLUSTER_PLAN_DELETE),\n      type: {\n        create: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_CREATE,\n        ),\n        modify: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_MODIFY,\n        ),\n        delete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_DELETE,\n        ),\n        forceDelete: permissions.includes(\n          ConsolePermissions.CLUSTER_PLAN_TYPE_FORCE_DELETE,\n        ),\n      },\n      migrate: permissions.includes(ConsolePermissions.CLUSTER_PLAN_MIGRATE),\n      modify: permissions.includes(ConsolePermissions.CLUSTER_PLAN_CAN_MODIFY),\n    },\n    features: {\n      newHome: permissions.includes(ConsolePermissions.FEATURE_NEW_HOME),\n      templatePicker: permissions.includes(\n        ConsolePermissions.FEATURE_TEMPLATE_PICKER,\n      ),\n      userSettings: permissions.includes(ConsolePermissions.USER_SETTINGS),\n      debug: permissions.includes(ConsolePermissions.DEBUG),\n    },\n    m2m: {\n      updateCrd: permissions.includes(ConsolePermissions.M2M_UPDATE_CRD),\n      signup: permissions.includes(ConsolePermissions.M2M_SIGNUP),\n      triggerAlert: permissions.includes(ConsolePermissions.M2M_TRIGGER_ALERT),\n      deleteOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_DELETE_ORG_CLUSTERS,\n      ),\n      updateOrgClusters: permissions.includes(\n        ConsolePermissions.M2M_UPDATE_ORG_CLUSTERS,\n      ),\n      addUsageMetrics: permissions.includes(\n        ConsolePermissions.M2M_ADD_CLUSTER_USAGE_METRICS,\n      ),\n      sendSseEvent: permissions.includes(ConsolePermissions.M2M_SEND_SSE_EVENT),\n      external: {\n        internalClient: permissions.includes(\n          ConsolePermissions.M2M_EXTERNAL_INTERNAL_CLIENT,\n        ),\n      },\n      fetchMigrationData: permissions.includes(\n        ConsolePermissions.M2M_FETCH_MIGRATION_DATA,\n      ),\n      manageGenerationUpgradePath: permissions.includes(\n        ConsolePermissions.M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      ),\n      approvals: permissions.includes(ConsolePermissions.M2M_CONTROL_APPROVALS),\n      controlAgentStatus: permissions.includes(\n        ConsolePermissions.M2M_CONTROL_AGENT_STATUS,\n      ),\n    },\n  }\n  return newFeatures\n}\n\n/**\n * Flattens a feature tree into the dotted keys of the Control session.\n *\n * `buildSession` in accounts-backend writes the session with exactly this\n * shape, under the prefixes `` (accounts), `console` and `notifications`.\n */\nfunction flattenFeatureBooleans(\n  value: unknown,\n  prefix = '',\n): Record<string, boolean> {\n  const out: Record<string, boolean> = {}\n  if (!value || typeof value !== 'object') {\n    return out\n  }\n  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {\n    const flatKey = prefix ? `${prefix}.${key}` : key\n    if (typeof entry === 'boolean') {\n      out[flatKey] = entry\n    } else if (entry && typeof entry === 'object') {\n      Object.assign(out, flattenFeatureBooleans(entry, flatKey))\n    }\n  }\n  return out\n}\n\n/**\n * The session keys that ONE raw Auth0 permission turns on.\n *\n * The Control session holds a flat record of feature booleans, such as\n * `admin.extendTrial` and `console.clusters.canUpgradeGenerationYolo`. An\n * approval use case names the raw Auth0 short code instead, such as `aaet`,\n * because that is what the token carries and what a backend compares.\n *\n * This function bridges the two, and it bridges them by RUNNING the same\n * mappers that build the session. A hand-written table of code to key would be\n * a third copy of the permission model, and a code that gained a key would\n * silently stop gating anything in the browser.\n *\n * It answers an array, because one code can turn on more than one key. An\n * unknown code answers an empty array, and the caller decides what that means.\n *\n * The answer is CACHED, because the work is three feature trees and a flatten\n * of each one. `ApprovalActorView.has` of the browser runs this, and the rules\n * call `has` for every row of the queue: a page of 2000 requests turned one\n * cheap question into thousands of tree builds. The answer of a code never\n * changes inside one bundle, so the cache needs no invalidation, and the keys\n * are the permission codes of the use cases, which is a short list.\n *\n * The answer is `readonly`, and frozen, because every caller of one code gets\n * the SAME array: a caller that sorted or pushed in place would change what\n * the next reader of that code sees.\n */\nconst keysByPermissionCode = new Map<string, readonly string[]>()\n\nexport function sessionPermissionKeysFor(\n  permissionCode: string,\n): readonly string[] {\n  const cached = keysByPermissionCode.get(permissionCode)\n  if (cached) {\n    return cached\n  }\n  const answer = Object.freeze(buildSessionPermissionKeys(permissionCode))\n  keysByPermissionCode.set(permissionCode, answer)\n  return answer\n}\n\nfunction buildSessionPermissionKeys(permissionCode: string): string[] {\n  const trees: [unknown, string][] = [\n    [accountsUserFeaturesFromPermissions([permissionCode]), ''],\n    [consoleUserFeaturesFromPermissions([permissionCode]), 'console'],\n    [\n      NotificationPermissions.userFeaturesFromPermissions([permissionCode]),\n      'notifications',\n    ],\n  ]\n  const keys: string[] = []\n  for (const [tree, prefix] of trees) {\n    for (const [key, on] of Object.entries(\n      flattenFeatureBooleans(tree, prefix),\n    )) {\n      if (on) {\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Reports whether a Control session holds one raw Auth0 permission.\n *\n * It is what `ApprovalActorView.has` runs in the browser. An unknown code\n * answers false: a permission that nothing maps is a permission that nobody\n * holds, and the alternative would open a button that the backend refuses.\n */\nexport function sessionHasPermission(\n  sessionPermissions: Record<string, boolean>,\n  permissionCode: string,\n): boolean {\n  return sessionPermissionKeysFor(permissionCode).some(\n    (key) => sessionPermissions[key] === true,\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAEjC,SAAS,oCAAoC,aAAuB;AACzE,QAAM,cAA4C;AAAA,IAChD,OAAO;AAAA,MACL,SAAS,YAAY,SAAS,oBAAoB,QAAQ;AAAA,MAC1D,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MAEvE,WAAW,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC9D,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,MACA,UAAU,YAAY,SAAS,oBAAoB,UAAU;AAAA,MAC7D,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,eAAe,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACvE,cAAc,YAAY,SAAS,oBAAoB,aAAa;AAAA,MACpE,YAAY,YAAY,SAAS,oBAAoB,WAAW;AAAA,MAChE,aAAa,YAAY,SAAS,oBAAoB,gBAAgB;AAAA,MACtE,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,iBAAiB,YAAY;AAAA,QAC3B,oBAAoB;AAAA,MACtB;AAAA,MACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,MACpE,eAAe,YAAY;AAAA,QACzB,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,uBAAuB,IAAI;AAAA,MAC3D,mCAAmC,YAAY;AAAA,QAC7C,oBAAoB;AAAA,MACtB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,oBAAoB;AAAA,MACtB;AAAA,MACA,8BAA8B,YAAY;AAAA,QACxC,oBAAoB;AAAA,MACtB;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,SAAS;AAAA,MACvD,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,aAAa,YAAY,SAAS,oBAAoB,YAAY;AAAA,MAClE,KAAK;AAAA,QACH,cAAc,YAAY,SAAS,oBAAoB,QAAQ;AAAA,QAC/D,qBAAqB,YAAY;AAAA,UAC/B,oBAAoB;AAAA,QACtB;AAAA,QACA,0BAA0B,YAAY;AAAA,UACpC,oBAAoB;AAAA,QACtB;AAAA,QACA,YAAY,YAAY,SAAS,oBAAoB,eAAe;AAAA,QACpE,oBAAoB,YAAY;AAAA,UAC9B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,MACA,KAAK,YAAY,SAAS,oBAAoB,GAAG;AAAA,MACjD,aAAa,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACxE,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,aAAa,YAAY;AAAA,QACvB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,QAAQ,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,MAClE,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,YAAY;AAAA,MACV,KAAK;AAAA,QACH,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY,SAAS,oBAAoB,qBAAqB;AAAA,QACtE,iBAAiB,YAAY;AAAA,UAC3B,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,wBAAwB,YAAY;AAAA,QAClC,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,qBAAqB,YAAY;AAAA,QAC/B,oBAAoB;AAAA,MACtB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,oBAAoB;AAAA,MACtB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,WAAW;AAAA,QACT,KAAK,YAAY,SAAS,oBAAoB,iBAAiB;AAAA,QAC/D,QAAQ,YAAY,SAAS,oBAAoB,oBAAoB;AAAA,MACvE;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,IAC1E;AAAA,IACA,aAAa;AAAA,MACX,KAAK;AAAA,QACH,SAAS;AAAA,UACP,KAAK,YAAY;AAAA,YACf,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA;AAAA,MAEA,IAAI;AAAA,QACF,KAAK;AAAA,UACH,QAAQ,YAAY;AAAA,YAClB,oBAAoB;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,MACA,aAAa;AAAA,QACX,SAAS,YAAY;AAAA,UACnB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,MAAM,YAAY;AAAA,UAChB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,oBAAoB;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,QAAQ;AAAA,QACN,MAAM,YAAY,SAAS,wBAAwB,WAAW;AAAA,QAC9D,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,QAClE,QAAQ,YAAY,SAAS,wBAAwB,aAAa;AAAA,MACpE;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM,YAAY;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,MACA,QAAQ,YAAY;AAAA,QAClB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,MAAM,YAAY,SAAS,oBAAoB,kBAAkB;AAAA,MACjE,OAAO,YAAY,SAAS,oBAAoB,mBAAmB;AAAA,IACrE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY;AAAA,QACjB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,WAAW,YAAY;AAAA,QACrB,oBAAoB;AAAA,MACtB;AAAA,MACA,OAAO,YAAY;AAAA,QACjB,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCAAmC,aAAuB;AACxE,QAAM,cAA2C;AAAA,IAC/C,WAAW;AAAA,MACT,MAAM,YAAY,SAAS,mBAAmB,cAAc;AAAA,MAC5D,QAAQ,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,IAClE;AAAA,IACA,cAAc;AAAA,MACZ,OAAO,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,IACnE;AAAA,IACA,UAAU;AAAA,MACR,OAAO;AAAA,QACL,KAAK,YAAY;AAAA,UACf,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,sBAAsB,YAAY;AAAA,UAChC,mBAAmB;AAAA,QACrB;AAAA,QACA,SAAS,YAAY;AAAA,UACnB,mBAAmB;AAAA,QACrB;AAAA,QACA,+BAA+B,YAAY;AAAA,UACzC,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,SAAS,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,uBAAuB,YAAY;AAAA,QACjC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,yBAAyB,YAAY;AAAA,QACnC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,sBAAsB,YAAY;AAAA,QAChC,mBAAmB;AAAA,MACrB;AAAA,MACA,0BAA0B,YAAY;AAAA,QACpC,mBAAmB;AAAA,MACrB;AAAA,MACA,4BAA4B,YAAY;AAAA,QACtC,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,QAAQ,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACpE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,QAAQ,YAAY,SAAS,mBAAmB,mBAAmB;AAAA,MACnE,MAAM;AAAA,QACJ,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAAA,UAClB,mBAAmB;AAAA,QACrB;AAAA,QACA,aAAa,YAAY;AAAA,UACvB,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,SAAS,YAAY,SAAS,mBAAmB,oBAAoB;AAAA,MACrE,QAAQ,YAAY,SAAS,mBAAmB,uBAAuB;AAAA,IACzE;AAAA,IACA,UAAU;AAAA,MACR,SAAS,YAAY,SAAS,mBAAmB,gBAAgB;AAAA,MACjE,gBAAgB,YAAY;AAAA,QAC1B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,aAAa;AAAA,MACnE,OAAO,YAAY,SAAS,mBAAmB,KAAK;AAAA,IACtD;AAAA,IACA,KAAK;AAAA,MACH,WAAW,YAAY,SAAS,mBAAmB,cAAc;AAAA,MACjE,QAAQ,YAAY,SAAS,mBAAmB,UAAU;AAAA,MAC1D,cAAc,YAAY,SAAS,mBAAmB,iBAAiB;AAAA,MACvE,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,mBAAmB,YAAY;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,MACA,iBAAiB,YAAY;AAAA,QAC3B,mBAAmB;AAAA,MACrB;AAAA,MACA,cAAc,YAAY,SAAS,mBAAmB,kBAAkB;AAAA,MACxE,UAAU;AAAA,QACR,gBAAgB,YAAY;AAAA,UAC1B,mBAAmB;AAAA,QACrB;AAAA,MACF;AAAA,MACA,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,MACA,6BAA6B,YAAY;AAAA,QACvC,mBAAmB;AAAA,MACrB;AAAA,MACA,WAAW,YAAY,SAAS,mBAAmB,qBAAqB;AAAA,MACxE,oBAAoB,YAAY;AAAA,QAC9B,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,uBACP,OACA,SAAS,IACgB;AACzB,QAAM,MAA+B,CAAC;AACtC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC3E,UAAM,UAAU,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC9C,QAAI,OAAO,UAAU,WAAW;AAC9B,UAAI,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO,UAAU,UAAU;AAC7C,aAAO,OAAO,KAAK,uBAAuB,OAAO,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AA6BA,MAAM,uBAAuB,oBAAI,IAA+B;AAEzD,SAAS,yBACd,gBACmB;AACnB,QAAM,SAAS,qBAAqB,IAAI,cAAc;AACtD,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AACA,QAAM,SAAS,OAAO,OAAO,2BAA2B,cAAc,CAAC;AACvE,uBAAqB,IAAI,gBAAgB,MAAM;AAC/C,SAAO;AACT;AAEA,SAAS,2BAA2B,gBAAkC;AACpE,QAAM,QAA6B;AAAA,IACjC,CAAC,oCAAoC,CAAC,cAAc,CAAC,GAAG,EAAE;AAAA,IAC1D,CAAC,mCAAmC,CAAC,cAAc,CAAC,GAAG,SAAS;AAAA,IAChE;AAAA,MACE,wBAAwB,4BAA4B,CAAC,cAAc,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO;AAClC,eAAW,CAAC,KAAK,EAAE,KAAK,OAAO;AAAA,MAC7B,uBAAuB,MAAM,MAAM;AAAA,IACrC,GAAG;AACD,UAAI,IAAI;AACN,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,qBACd,oBACA,gBACS;AACT,SAAO,yBAAyB,cAAc,EAAE;AAAA,IAC9C,CAAC,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EACvC;AACF;",
   "names": []
 }

package/dist/permissions/console.permissions.d.ts

@@ -59,6 +59,13 @@ export declare namespace ConsolePermissions {
      * client.
      */
     const M2M_CLUSTER_TTL_DELETION = "cmctd";
+    /**
+     * Lets console-backend and accounts-backend ask control-backend whether an
+     * agent token is still active, and which read permissions it holds. The
+     * permission goes to the m2m applications of those two services and to no
+     * other client.
+     */
+    const M2M_CONTROL_AGENT_STATUS = "ctas";
     /**
      * Stands in for the permission of EVERY approval use case of
      * control-backend, for a person who tests the approval flow.
@@ -152,6 +159,8 @@ export declare namespace ConsolePermissions {
             manageGenerationUpgradePath: boolean;
             /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */
             approvals: boolean;
+            /** The status route of an agent client. See `M2M_CONTROL_AGENT_STATUS`. */
+            controlAgentStatus: boolean;
         };
     }
     function createEmptyFeatures(): Features;

package/dist/permissions/console.permissions.js

@@ -42,6 +42,7 @@ var ConsolePermissions;
   ConsolePermissions2.M2M_MANAGE_GENERATION_UPGRADE_PATH = "cmmgup";
   ConsolePermissions2.M2M_CONTROL_APPROVALS = "ctam";
   ConsolePermissions2.M2M_CLUSTER_TTL_DELETION = "cmctd";
+  ConsolePermissions2.M2M_CONTROL_AGENT_STATUS = "ctas";
   ConsolePermissions2.APPROVALS_ALL_USE_CASES = "caauc";
   ConsolePermissions2.CLUSTER_CREATE_ON_BEHALF = "cccob";
   ConsolePermissions2.FEATURE_NEW_HOME = "cfnh";
@@ -119,7 +120,8 @@ var ConsolePermissions;
         },
         fetchMigrationData: false,
         manageGenerationUpgradePath: false,
-        approvals: false
+        approvals: false,
+        controlAgentStatus: false
       }
     };
   }
@@ -310,6 +312,12 @@ var ConsolePermissions;
       description: "m2m can open the request of control-backend that deletes a cluster whose TTL ran out",
       initialRoles: []
     },
+    // No role: a machine holds a grant on its application. See the note above.
+    {
+      value: ConsolePermissions2.M2M_CONTROL_AGENT_STATUS,
+      description: "m2m can read from control-backend whether an agent token is active, and its read permissions",
+      initialRoles: []
+    },
     // No role, on purpose. This permission opens every approval use case, so
     // a person with access to the tenant grants it by hand, for testing.
     {

package/dist/permissions/console.permissions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/permissions/console.permissions.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace ConsolePermissions {\n  export const MULTICLUSTER_ADMIN = 'cmca'\n\n  export const CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS = 'cmgda'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_SEE = 'cmgas'\n  export const CHANNELS_AND_GENERATIONS_ADMIN = 'cmga'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL = 'cmgap'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE = 'cmgam'\n  export const CHANNELS_AND_GENERATIONS_MIGRATE = 'cmgm'\n  export const ALL_CHANNELS_AND_GENERATIONS: string[] = [\n    CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    CHANNELS_AND_GENERATIONS_ADMIN,\n    CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n  ]\n  export const CLUSTERS_READALLCLUSTERINFO = 'ccrai'\n  export const CLUSTERS_DELETE_CLUSTER = 'ccda'\n  export const CLUSTERS_CAN_MOVE_TO_OTHER_ORG = 'ccmoo'\n  export const CLUSTERS_CAN_SEND_TO_SLEEP = 'ccsts'\n  export const CLUSTERS_CAN_CREATE_INTERNAL_BACKUP = 'cccib'\n  export const CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE = 'ccucp'\n  export const CLUSTERS_CAN_UPDATE_GENERATION = 'ccug'\n  export const CLUSTERS_CAN_UPDATE_GENERATION_YOLO = 'ccugy'\n  export const CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY = 'ccuot'\n\n  export const CLUSTER_PLAN_SEE_ALL = 'ccpa'\n  export const CLUSTER_PLAN_CREATE = 'ccpc'\n  export const CLUSTER_PLAN_DELETE = 'ccpd'\n\n  export const CLUSTER_PLAN_TYPE_CREATE = 'cptc'\n  export const CLUSTER_PLAN_TYPE_MODIFY = 'cptm'\n  export const CLUSTER_PLAN_TYPE_DELETE = 'cptd'\n  export const CLUSTER_PLAN_TYPE_FORCE_DELETE = 'cptfd'\n\n  export const CLUSTER_PLAN_MIGRATE = 'ccpm'\n  export const CLUSTER_PLAN_CAN_MODIFY = 'ccpmo'\n\n  export const M2M_UPDATE_CRD = 'cmuc'\n  export const M2M_SIGNUP = 'cms'\n  export const M2M_TRIGGER_ALERT = 'cmta'\n  export const M2M_DELETE_ORG_CLUSTERS = 'cmdoc'\n  export const M2M_UPDATE_ORG_CLUSTERS = 'cmuoc'\n  export const M2M_ADD_CLUSTER_USAGE_METRICS = 'cmacm'\n  export const M2M_SEND_SSE_EVENT = 'cmsse'\n  export const M2M_EXTERNAL_INTERNAL_CLIENT = 'cmeic'\n  export const M2M_FETCH_MIGRATION_DATA = 'cmfmd'\n  export const M2M_MANAGE_GENERATION_UPGRADE_PATH = 'cmmgup'\n\n  /**\n   * The one m2m permission of control-backend. It opens every route of\n   * `api/admin/approvals` in accounts-backend and in console-backend, which\n   * control-backend calls when a four-eyes request has the approvals that it\n   * needs.\n   *\n   * One permission for all of them, by a decision of the team: one grant at\n   * Auth0 for the whole approval surface of control-backend. A route that\n   * reads it runs an action that people already approved, so the permission\n   * goes to the m2m application of control-backend and to no other client.\n   *\n   * It is NOT the permission that a Camundi needs. A person needs the\n   * permission of the action, such as `CLUSTERS_CAN_MOVE_TO_OTHER_ORG`, and\n   * control-backend asks for that one before it accepts an approval.\n   */\n  export const M2M_CONTROL_APPROVALS = 'ctam'\n  /**\n   * Lets the delete cron of console-backend open a `cluster-ttl-deletion`\n   * request in control-backend. That request needs no approval, so the\n   * permission goes to the m2m application of console-backend and to no other\n   * client.\n   */\n  export const M2M_CLUSTER_TTL_DELETION = 'cmctd'\n  /**\n   * Stands in for the permission of EVERY approval use case of\n   * control-backend, for a person who tests the approval flow.\n   *\n   * A holder can open, approve, reject and run each use case, including one\n   * that a later change adds, with no grant of its own permission. The four-eyes\n   * rule still holds: nobody approves their own request.\n   *\n   * It is a permission of a PERSON. No machine route reads it, because a token\n   * that a Camundi can get must not run an action with no approval. It goes to\n   * no role at Auth0: a person with access to the tenant grants it by hand, and\n   * only on a stage where the approval flow is under test.\n   */\n  export const APPROVALS_ALL_USE_CASES = 'caauc'\n  export const CLUSTER_CREATE_ON_BEHALF = 'cccob'\n  export const FEATURE_NEW_HOME = 'cfnh'\n  export const FEATURE_TEMPLATE_PICKER = 'cftp'\n  export const USER_SETTINGS = 'cus'\n  export const CLUSTERS_CAN_OVERRIDE_ENV_VARS = 'ccoev'\n  export const CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG = 'ccccmc'\n\n  export const DEBUG = 'cdbg'\n  export const GOD_TRIGGER_CRONS = 'gtc'\n\n  export const RELEASE_TRAIN_PUBLISH = 'crtp'\n\n  export const APICLIENT_READ = 'capr'\n  export const APICLIENT_DELETE = 'capd'\n\n  export interface Features {\n    apiClient: {\n      read: boolean\n      delete: boolean\n    }\n    multiCluster: {\n      admin: boolean\n    }\n    multiGen: {\n      admin: {\n        see: boolean\n        modify: boolean\n        patchExistingChannel: boolean\n        migrate: boolean\n        deleteAllClustersOfGeneration: boolean\n      }\n      releaseTrain: {\n        publish: boolean\n      }\n    }\n    clusters: {\n      canReadAllClusterInfo: boolean\n      canDeleteAllClusters: boolean\n      canMoveToOtherOrg: boolean\n      createOnBehalf: boolean\n      canSendToSleep: boolean\n      canCreateInternalBackup: boolean\n      canUpdateClusterPlanType: boolean\n      canOverrideEnvVars: boolean\n      canCreateModificationConfig: boolean\n      canUpgradeGeneration: boolean\n      canUpgradeGenerationYolo: boolean\n      canUpdateOptionalTelemetry: boolean\n    }\n    clusterPlan: {\n      seeAll: boolean\n      create: boolean\n      delete: boolean\n      type: {\n        create: boolean\n        modify: boolean\n        delete: boolean\n        forceDelete: boolean\n      }\n      migrate: boolean\n      modify: boolean\n    }\n    features: {\n      newHome: boolean\n      templatePicker: boolean\n      userSettings: boolean\n      debug: boolean\n    }\n    m2m: {\n      updateCrd: boolean\n      signup: boolean\n      triggerAlert: boolean\n      deleteOrgClusters: boolean\n      updateOrgClusters: boolean\n      addUsageMetrics: boolean\n      sendSseEvent: boolean\n      external: {\n        internalClient: boolean\n      }\n      fetchMigrationData: boolean\n      manageGenerationUpgradePath: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      apiClient: {\n        read: false,\n        delete: false,\n      },\n      multiCluster: { admin: false },\n      multiGen: {\n        admin: {\n          migrate: false,\n          modify: false,\n          patchExistingChannel: false,\n          see: false,\n          deleteAllClustersOfGeneration: false,\n        },\n        releaseTrain: {\n          publish: false,\n        },\n      },\n      clusters: {\n        canReadAllClusterInfo: false,\n        canDeleteAllClusters: false,\n        canMoveToOtherOrg: false,\n        createOnBehalf: false,\n        canSendToSleep: false,\n        canCreateInternalBackup: false,\n        canUpdateClusterPlanType: false,\n        canOverrideEnvVars: false,\n        canCreateModificationConfig: false,\n        canUpgradeGeneration: false,\n        canUpgradeGenerationYolo: false,\n        canUpdateOptionalTelemetry: false,\n      },\n      clusterPlan: {\n        seeAll: false,\n        create: false,\n        delete: false,\n        type: {\n          create: false,\n          modify: false,\n          delete: false,\n          forceDelete: false,\n        },\n        migrate: false,\n        modify: false,\n      },\n      features: {\n        newHome: false,\n        templatePicker: false,\n        userSettings: false,\n        debug: false,\n      },\n      m2m: {\n        updateCrd: false,\n        signup: false,\n        triggerAlert: false,\n        deleteOrgClusters: false,\n        updateOrgClusters: false,\n        addUsageMetrics: false,\n        sendSseEvent: false,\n        external: {\n          internalClient: false,\n        },\n        fetchMigrationData: false,\n        manageGenerationUpgradePath: false,\n        approvals: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: MULTICLUSTER_ADMIN,\n      description: 'can create and delete k8s clusters',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n      description: 'can go to the admin section for MultiGen, but no touch!',\n      initialRoles: [\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN,\n      description: 'can create channels, generations and combine them',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n      description: 'can modify existing channels and combine them',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n      description:\n        'can migrate clusters of generations to supported other generations',\n      initialRoles: ['console:admin', 'console:C8UpdateEnforcer'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n      description: 'can delete all clusters of a generation',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_MIGRATE,\n      description:\n        'can migrate owned clusters of generations to supported other generations',\n      initialRoles: [],\n    },\n    {\n      value: CLUSTERS_READALLCLUSTERINFO,\n      description: 'can read clusterInfo for all clusters',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'console:admin',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_DELETE_CLUSTER,\n      description: 'can delete clusters in all orgs',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      description: 'can move a cluster to another org the user is part of',\n      // CSMs, TAMs and consultants move a cluster to another org for a\n      // customer, thus the capability goes to `console:clusterMover`. The\n      // population that holds the role lives in the Camundi permission\n      // rules, not in the name of the role.\n      initialRoles: ['console:admin', 'console:clusterMover'],\n    },\n    {\n      value: CLUSTER_PLAN_SEE_ALL,\n      description: 'can see all ClusterPlans',\n      initialRoles: [\n        'console:admin',\n        'accounts:read',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:editSalesPlans',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTER_PLAN_CREATE,\n      description: 'can create ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_DELETE,\n      description: 'can delete ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_CREATE,\n      description: 'can create ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_FORCE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_MODIFY,\n      description: 'can modify ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_MIGRATE,\n      description: 'can migrate Clusters from one plan to another',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_CREATE_ON_BEHALF,\n      description:\n        'enables accounts to create clusters on signup (not a user permission)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SIGNUP,\n      description: 'allows to signal to Console new user signups',\n      initialRoles: [],\n    },\n    { value: M2M_UPDATE_CRD, description: 'may update crds', initialRoles: [] },\n    {\n      value: M2M_TRIGGER_ALERT,\n      description: 'allows Infra and Operate to trigger alerts',\n      initialRoles: [],\n    },\n    {\n      value: M2M_DELETE_ORG_CLUSTERS,\n      description:\n        'allows trigger console to delete all clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_UPDATE_ORG_CLUSTERS,\n      description: 'allows to update clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_ADD_CLUSTER_USAGE_METRICS,\n      description: 'allows to trigger update of value metrics',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SEND_SSE_EVENT,\n      description: 'allows to trigger SSE events',\n      initialRoles: [],\n    },\n    {\n      value: M2M_EXTERNAL_INTERNAL_CLIENT,\n      description: 'allows to fetch internal clients',\n      initialRoles: [],\n    },\n    // `initialRoles` is empty, and it must stay empty. A machine client holds\n    // a grant on its Auth0 application, and never a role. An entry here with a\n    // role would give the permission to every person in that role.\n    {\n      value: M2M_CONTROL_APPROVALS,\n      description:\n        'm2m can run the approved actions of control-backend in accounts and console',\n      initialRoles: [],\n    },\n    // No role: a machine holds a grant on its application. See the note above.\n    {\n      value: M2M_CLUSTER_TTL_DELETION,\n      description:\n        'm2m can open the request of control-backend that deletes a cluster whose TTL ran out',\n      initialRoles: [],\n    },\n    // No role, on purpose. This permission opens every approval use case, so\n    // a person with access to the tenant grants it by hand, for testing.\n    {\n      value: APPROVALS_ALL_USE_CASES,\n      description:\n        'can open, approve, reject and run every approval use case of Control (for testing)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_FETCH_MIGRATION_DATA,\n      description: 'allows to fetch migration data',\n      initialRoles: [],\n    },\n    {\n      value: M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      description:\n        'allows to manage upgrade paths for generations via external API',\n      initialRoles: [],\n    },\n    {\n      value: FEATURE_NEW_HOME,\n      description: 'allows users to see new home',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: USER_SETTINGS,\n      description: 'allows users to see user settings',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: FEATURE_TEMPLATE_PICKER,\n      description: 'allows users to see template picker',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: CLUSTERS_CAN_SEND_TO_SLEEP,\n      description: 'may send a cluster to sleep and wake up',\n      initialRoles: [\n        'console:admin',\n        'accounts:admin',\n        'console:operationsEngineer',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      description: 'may create and delete internal (incident) backups',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: DEBUG,\n      description: 'can see additional debugging tools',\n      initialRoles: ['console:admin:readonly', 'console:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      description:\n        'can set Env Vars on cluster level that override all ClusterPlan Env Vars',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      description: 'can create cluster modification configs',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      description: 'can update clusterplantype of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:onboard',\n        'console:operationsEngineer',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION,\n      description: 'can update generation of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      description:\n        'can update generation of a running cluster even if the generation is not reachable',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      description:\n        'can enable or disable optional product telemetry for a cluster',\n      // A customer asks their CSM or TAM to switch the category off, thus the\n      // capability goes to `console:optionalTelemetryManager`. The population\n      // that holds the role lives in the Camundi permission rules, not in the\n      // name of the role. The console team keeps the permission, to help when\n      // a change does not take effect.\n      initialRoles: ['console:admin', 'console:optionalTelemetryManager'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_MODIFY,\n      description: 'can trigger modifications of a clusterplan',\n      initialRoles: ['console:admin', 'console:clusterPlanManager'],\n    },\n    {\n      value: RELEASE_TRAIN_PUBLISH,\n      description: 'can publish new generations via the release train endpoint',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: APICLIENT_READ,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:read', 'accounts:orgCreator'],\n    },\n    {\n      value: APICLIENT_DELETE,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:god'],\n    },\n  ]\n}\n"],
-  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,wBAAV;AACE,EAAMA,oBAAA,qBAAqB;AAE3B,EAAMA,oBAAA,qDAAqD;AAC3D,EAAMA,oBAAA,qCAAqC;AAC3C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,wDAAwD;AAC9D,EAAMA,oBAAA,yCAAyC;AAC/C,EAAMA,oBAAA,mCAAmC;AACzC,EAAMA,oBAAA,+BAAyC;AAAA,IACpDA,oBAAA;AAAA,IACAA,oBAAA;AAAA,IACAA,oBAAA;AAAA,EACF;AACO,EAAMA,oBAAA,8BAA8B;AACpC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,6BAA6B;AACnC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,yCAAyC;AAE/C,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,sBAAsB;AAC5B,EAAMA,oBAAA,sBAAsB;AAE5B,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,iCAAiC;AAEvC,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,0BAA0B;AAEhC,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,aAAa;AACnB,EAAMA,oBAAA,oBAAoB;AAC1B,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gCAAgC;AACtC,EAAMA,oBAAA,qBAAqB;AAC3B,EAAMA,oBAAA,+BAA+B;AACrC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,qCAAqC;AAiB3C,EAAMA,oBAAA,wBAAwB;AAO9B,EAAMA,oBAAA,2BAA2B;AAcjC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,mBAAmB;AACzB,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gBAAgB;AACtB,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,0CAA0C;AAEhD,EAAMA,oBAAA,QAAQ;AACd,EAAMA,oBAAA,oBAAoB;AAE1B,EAAMA,oBAAA,wBAAwB;AAE9B,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,mBAAmB;AAyEzB,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,WAAW;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,OAAO,MAAM;AAAA,MAC7B,UAAU;AAAA,QACR,OAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,sBAAsB;AAAA,UACtB,KAAK;AAAA,UACL,+BAA+B;AAAA,QACjC;AAAA,QACA,cAAc;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,uBAAuB;AAAA,QACvB,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,0BAA0B;AAAA,QAC1B,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,sBAAsB;AAAA,QACtB,0BAA0B;AAAA,QAC1B,4BAA4B;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,OAAO;AAAA,MACT;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,iBAAiB;AAAA,QACjB,cAAc;AAAA,QACd,UAAU;AAAA,UACR,gBAAgB;AAAA,QAClB;AAAA,QACA,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,WAAW;AAAA,MACb;AAAA,IACF;AAAA,EACF;AApEO,EAAAA,oBAAS;AAsET,EAAMA,oBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,cAAc,CAAC,iBAAiB,sBAAsB;AAAA,IACxD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,EAAE,OAAOA,oBAAA,gBAAgB,aAAa,mBAAmB,cAAc,CAAC,EAAE;AAAA,IAC1E;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA,IAEA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA,IAGA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,0BAA0B,eAAe;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMF,cAAc,CAAC,iBAAiB,kCAAkC;AAAA,IACpE;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,qBAAqB;AAAA,IACvD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,GA5iBe;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type { Roles } from '../types/Roles.js'\n\nexport namespace ConsolePermissions {\n  export const MULTICLUSTER_ADMIN = 'cmca'\n\n  export const CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS = 'cmgda'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_SEE = 'cmgas'\n  export const CHANNELS_AND_GENERATIONS_ADMIN = 'cmga'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL = 'cmgap'\n  export const CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE = 'cmgam'\n  export const CHANNELS_AND_GENERATIONS_MIGRATE = 'cmgm'\n  export const ALL_CHANNELS_AND_GENERATIONS: string[] = [\n    CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    CHANNELS_AND_GENERATIONS_ADMIN,\n    CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n  ]\n  export const CLUSTERS_READALLCLUSTERINFO = 'ccrai'\n  export const CLUSTERS_DELETE_CLUSTER = 'ccda'\n  export const CLUSTERS_CAN_MOVE_TO_OTHER_ORG = 'ccmoo'\n  export const CLUSTERS_CAN_SEND_TO_SLEEP = 'ccsts'\n  export const CLUSTERS_CAN_CREATE_INTERNAL_BACKUP = 'cccib'\n  export const CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE = 'ccucp'\n  export const CLUSTERS_CAN_UPDATE_GENERATION = 'ccug'\n  export const CLUSTERS_CAN_UPDATE_GENERATION_YOLO = 'ccugy'\n  export const CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY = 'ccuot'\n\n  export const CLUSTER_PLAN_SEE_ALL = 'ccpa'\n  export const CLUSTER_PLAN_CREATE = 'ccpc'\n  export const CLUSTER_PLAN_DELETE = 'ccpd'\n\n  export const CLUSTER_PLAN_TYPE_CREATE = 'cptc'\n  export const CLUSTER_PLAN_TYPE_MODIFY = 'cptm'\n  export const CLUSTER_PLAN_TYPE_DELETE = 'cptd'\n  export const CLUSTER_PLAN_TYPE_FORCE_DELETE = 'cptfd'\n\n  export const CLUSTER_PLAN_MIGRATE = 'ccpm'\n  export const CLUSTER_PLAN_CAN_MODIFY = 'ccpmo'\n\n  export const M2M_UPDATE_CRD = 'cmuc'\n  export const M2M_SIGNUP = 'cms'\n  export const M2M_TRIGGER_ALERT = 'cmta'\n  export const M2M_DELETE_ORG_CLUSTERS = 'cmdoc'\n  export const M2M_UPDATE_ORG_CLUSTERS = 'cmuoc'\n  export const M2M_ADD_CLUSTER_USAGE_METRICS = 'cmacm'\n  export const M2M_SEND_SSE_EVENT = 'cmsse'\n  export const M2M_EXTERNAL_INTERNAL_CLIENT = 'cmeic'\n  export const M2M_FETCH_MIGRATION_DATA = 'cmfmd'\n  export const M2M_MANAGE_GENERATION_UPGRADE_PATH = 'cmmgup'\n\n  /**\n   * The one m2m permission of control-backend. It opens every route of\n   * `api/admin/approvals` in accounts-backend and in console-backend, which\n   * control-backend calls when a four-eyes request has the approvals that it\n   * needs.\n   *\n   * One permission for all of them, by a decision of the team: one grant at\n   * Auth0 for the whole approval surface of control-backend. A route that\n   * reads it runs an action that people already approved, so the permission\n   * goes to the m2m application of control-backend and to no other client.\n   *\n   * It is NOT the permission that a Camundi needs. A person needs the\n   * permission of the action, such as `CLUSTERS_CAN_MOVE_TO_OTHER_ORG`, and\n   * control-backend asks for that one before it accepts an approval.\n   */\n  export const M2M_CONTROL_APPROVALS = 'ctam'\n  /**\n   * Lets the delete cron of console-backend open a `cluster-ttl-deletion`\n   * request in control-backend. That request needs no approval, so the\n   * permission goes to the m2m application of console-backend and to no other\n   * client.\n   */\n  export const M2M_CLUSTER_TTL_DELETION = 'cmctd'\n  /**\n   * Lets console-backend and accounts-backend ask control-backend whether an\n   * agent token is still active, and which read permissions it holds. The\n   * permission goes to the m2m applications of those two services and to no\n   * other client.\n   */\n  export const M2M_CONTROL_AGENT_STATUS = 'ctas'\n  /**\n   * Stands in for the permission of EVERY approval use case of\n   * control-backend, for a person who tests the approval flow.\n   *\n   * A holder can open, approve, reject and run each use case, including one\n   * that a later change adds, with no grant of its own permission. The four-eyes\n   * rule still holds: nobody approves their own request.\n   *\n   * It is a permission of a PERSON. No machine route reads it, because a token\n   * that a Camundi can get must not run an action with no approval. It goes to\n   * no role at Auth0: a person with access to the tenant grants it by hand, and\n   * only on a stage where the approval flow is under test.\n   */\n  export const APPROVALS_ALL_USE_CASES = 'caauc'\n  export const CLUSTER_CREATE_ON_BEHALF = 'cccob'\n  export const FEATURE_NEW_HOME = 'cfnh'\n  export const FEATURE_TEMPLATE_PICKER = 'cftp'\n  export const USER_SETTINGS = 'cus'\n  export const CLUSTERS_CAN_OVERRIDE_ENV_VARS = 'ccoev'\n  export const CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG = 'ccccmc'\n\n  export const DEBUG = 'cdbg'\n  export const GOD_TRIGGER_CRONS = 'gtc'\n\n  export const RELEASE_TRAIN_PUBLISH = 'crtp'\n\n  export const APICLIENT_READ = 'capr'\n  export const APICLIENT_DELETE = 'capd'\n\n  export interface Features {\n    apiClient: {\n      read: boolean\n      delete: boolean\n    }\n    multiCluster: {\n      admin: boolean\n    }\n    multiGen: {\n      admin: {\n        see: boolean\n        modify: boolean\n        patchExistingChannel: boolean\n        migrate: boolean\n        deleteAllClustersOfGeneration: boolean\n      }\n      releaseTrain: {\n        publish: boolean\n      }\n    }\n    clusters: {\n      canReadAllClusterInfo: boolean\n      canDeleteAllClusters: boolean\n      canMoveToOtherOrg: boolean\n      createOnBehalf: boolean\n      canSendToSleep: boolean\n      canCreateInternalBackup: boolean\n      canUpdateClusterPlanType: boolean\n      canOverrideEnvVars: boolean\n      canCreateModificationConfig: boolean\n      canUpgradeGeneration: boolean\n      canUpgradeGenerationYolo: boolean\n      canUpdateOptionalTelemetry: boolean\n    }\n    clusterPlan: {\n      seeAll: boolean\n      create: boolean\n      delete: boolean\n      type: {\n        create: boolean\n        modify: boolean\n        delete: boolean\n        forceDelete: boolean\n      }\n      migrate: boolean\n      modify: boolean\n    }\n    features: {\n      newHome: boolean\n      templatePicker: boolean\n      userSettings: boolean\n      debug: boolean\n    }\n    m2m: {\n      updateCrd: boolean\n      signup: boolean\n      triggerAlert: boolean\n      deleteOrgClusters: boolean\n      updateOrgClusters: boolean\n      addUsageMetrics: boolean\n      sendSseEvent: boolean\n      external: {\n        internalClient: boolean\n      }\n      fetchMigrationData: boolean\n      manageGenerationUpgradePath: boolean\n      /** Every route of `api/admin/approvals`. See `M2M_CONTROL_APPROVALS`. */\n      approvals: boolean\n      /** The status route of an agent client. See `M2M_CONTROL_AGENT_STATUS`. */\n      controlAgentStatus: boolean\n    }\n  }\n\n  export function createEmptyFeatures(): Features {\n    return {\n      apiClient: {\n        read: false,\n        delete: false,\n      },\n      multiCluster: { admin: false },\n      multiGen: {\n        admin: {\n          migrate: false,\n          modify: false,\n          patchExistingChannel: false,\n          see: false,\n          deleteAllClustersOfGeneration: false,\n        },\n        releaseTrain: {\n          publish: false,\n        },\n      },\n      clusters: {\n        canReadAllClusterInfo: false,\n        canDeleteAllClusters: false,\n        canMoveToOtherOrg: false,\n        createOnBehalf: false,\n        canSendToSleep: false,\n        canCreateInternalBackup: false,\n        canUpdateClusterPlanType: false,\n        canOverrideEnvVars: false,\n        canCreateModificationConfig: false,\n        canUpgradeGeneration: false,\n        canUpgradeGenerationYolo: false,\n        canUpdateOptionalTelemetry: false,\n      },\n      clusterPlan: {\n        seeAll: false,\n        create: false,\n        delete: false,\n        type: {\n          create: false,\n          modify: false,\n          delete: false,\n          forceDelete: false,\n        },\n        migrate: false,\n        modify: false,\n      },\n      features: {\n        newHome: false,\n        templatePicker: false,\n        userSettings: false,\n        debug: false,\n      },\n      m2m: {\n        updateCrd: false,\n        signup: false,\n        triggerAlert: false,\n        deleteOrgClusters: false,\n        updateOrgClusters: false,\n        addUsageMetrics: false,\n        sendSseEvent: false,\n        external: {\n          internalClient: false,\n        },\n        fetchMigrationData: false,\n        manageGenerationUpgradePath: false,\n        approvals: false,\n        controlAgentStatus: false,\n      },\n    }\n  }\n\n  export const PermissionsAtAuth0: Array<{\n    value: string\n    description: string\n    initialRoles: Roles[]\n  }> = [\n    {\n      value: MULTICLUSTER_ADMIN,\n      description: 'can create and delete k8s clusters',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n      description: 'can go to the admin section for MultiGen, but no touch!',\n      initialRoles: [\n        'console:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n        'console:C8UpdateEnforcer',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN,\n      description: 'can create channels, generations and combine them',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_PATCH_EXISTING_CHANNEL,\n      description: 'can modify existing channels and combine them',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_MIGRATE,\n      description:\n        'can migrate clusters of generations to supported other generations',\n      initialRoles: ['console:admin', 'console:C8UpdateEnforcer'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_ADMIN_DELETE_ALL_CLUSTERS,\n      description: 'can delete all clusters of a generation',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CHANNELS_AND_GENERATIONS_MIGRATE,\n      description:\n        'can migrate owned clusters of generations to supported other generations',\n      initialRoles: [],\n    },\n    {\n      value: CLUSTERS_READALLCLUSTERINFO,\n      description: 'can read clusterInfo for all clusters',\n      initialRoles: [\n        'accounts:read',\n        'accounts:onboard',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'accounts:editSalesPlans',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'console:admin',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_DELETE_CLUSTER,\n      description: 'can delete clusters in all orgs',\n      initialRoles: ['accounts:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_MOVE_TO_OTHER_ORG,\n      description: 'can move a cluster to another org the user is part of',\n      // CSMs, TAMs and consultants move a cluster to another org for a\n      // customer, thus the capability goes to `console:clusterMover`. The\n      // population that holds the role lives in the Camundi permission\n      // rules, not in the name of the role.\n      initialRoles: ['console:admin', 'console:clusterMover'],\n    },\n    {\n      value: CLUSTER_PLAN_SEE_ALL,\n      description: 'can see all ClusterPlans',\n      initialRoles: [\n        'console:admin',\n        'accounts:read',\n        'accounts:orgCreator',\n        'accounts:admin',\n        'console:admin:readonly',\n        'support:agent',\n        'supersupport:agent',\n        'accounts:onboard',\n        'accounts:editSalesPlans',\n        'accounts:trialExtender',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTER_PLAN_CREATE,\n      description: 'can create ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_DELETE,\n      description: 'can delete ClusterPlans',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_CREATE,\n      description: 'can create ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_FORCE_DELETE,\n      description: 'can delete ClusterPlanTypes',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTER_PLAN_TYPE_MODIFY,\n      description: 'can modify ClusterPlanTypes',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_PLAN_MIGRATE,\n      description: 'can migrate Clusters from one plan to another',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: CLUSTER_CREATE_ON_BEHALF,\n      description:\n        'enables accounts to create clusters on signup (not a user permission)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SIGNUP,\n      description: 'allows to signal to Console new user signups',\n      initialRoles: [],\n    },\n    { value: M2M_UPDATE_CRD, description: 'may update crds', initialRoles: [] },\n    {\n      value: M2M_TRIGGER_ALERT,\n      description: 'allows Infra and Operate to trigger alerts',\n      initialRoles: [],\n    },\n    {\n      value: M2M_DELETE_ORG_CLUSTERS,\n      description:\n        'allows trigger console to delete all clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_UPDATE_ORG_CLUSTERS,\n      description: 'allows to update clusters of an Organization',\n      initialRoles: [],\n    },\n    {\n      value: M2M_ADD_CLUSTER_USAGE_METRICS,\n      description: 'allows to trigger update of value metrics',\n      initialRoles: [],\n    },\n    {\n      value: M2M_SEND_SSE_EVENT,\n      description: 'allows to trigger SSE events',\n      initialRoles: [],\n    },\n    {\n      value: M2M_EXTERNAL_INTERNAL_CLIENT,\n      description: 'allows to fetch internal clients',\n      initialRoles: [],\n    },\n    // `initialRoles` is empty, and it must stay empty. A machine client holds\n    // a grant on its Auth0 application, and never a role. An entry here with a\n    // role would give the permission to every person in that role.\n    {\n      value: M2M_CONTROL_APPROVALS,\n      description:\n        'm2m can run the approved actions of control-backend in accounts and console',\n      initialRoles: [],\n    },\n    // No role: a machine holds a grant on its application. See the note above.\n    {\n      value: M2M_CLUSTER_TTL_DELETION,\n      description:\n        'm2m can open the request of control-backend that deletes a cluster whose TTL ran out',\n      initialRoles: [],\n    },\n    // No role: a machine holds a grant on its application. See the note above.\n    {\n      value: M2M_CONTROL_AGENT_STATUS,\n      description:\n        'm2m can read from control-backend whether an agent token is active, and its read permissions',\n      initialRoles: [],\n    },\n    // No role, on purpose. This permission opens every approval use case, so\n    // a person with access to the tenant grants it by hand, for testing.\n    {\n      value: APPROVALS_ALL_USE_CASES,\n      description:\n        'can open, approve, reject and run every approval use case of Control (for testing)',\n      initialRoles: [],\n    },\n    {\n      value: M2M_FETCH_MIGRATION_DATA,\n      description: 'allows to fetch migration data',\n      initialRoles: [],\n    },\n    {\n      value: M2M_MANAGE_GENERATION_UPGRADE_PATH,\n      description:\n        'allows to manage upgrade paths for generations via external API',\n      initialRoles: [],\n    },\n    {\n      value: FEATURE_NEW_HOME,\n      description: 'allows users to see new home',\n      initialRoles: ['console:admin'],\n    },\n    {\n      value: USER_SETTINGS,\n      description: 'allows users to see user settings',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: FEATURE_TEMPLATE_PICKER,\n      description: 'allows users to see template picker',\n      initialRoles: ['console:admin', 'betatester:true'],\n    },\n    {\n      value: CLUSTERS_CAN_SEND_TO_SLEEP,\n      description: 'may send a cluster to sleep and wake up',\n      initialRoles: [\n        'console:admin',\n        'accounts:admin',\n        'console:operationsEngineer',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_INTERNAL_BACKUP,\n      description: 'may create and delete internal (incident) backups',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: DEBUG,\n      description: 'can see additional debugging tools',\n      initialRoles: ['console:admin:readonly', 'console:admin'],\n    },\n    {\n      value: CLUSTERS_CAN_OVERRIDE_ENV_VARS,\n      description:\n        'can set Env Vars on cluster level that override all ClusterPlan Env Vars',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_CREATE_MODIFICATION_CONFIG,\n      description: 'can create cluster modification configs',\n      initialRoles: ['console:admin', 'console:operationsEngineer'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_CLUSTERPLANTYPE,\n      description: 'can update clusterplantype of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:onboard',\n        'console:operationsEngineer',\n        'accounts:enterpriseAdmin',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION,\n      description: 'can update generation of a running cluster',\n      initialRoles: [\n        'console:admin',\n        'accounts:clusterUpdates',\n        'console:C8ReleaseManager',\n      ],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_GENERATION_YOLO,\n      description:\n        'can update generation of a running cluster even if the generation is not reachable',\n      initialRoles: ['console:god'],\n    },\n    {\n      value: CLUSTERS_CAN_UPDATE_OPTIONAL_TELEMETRY,\n      description:\n        'can enable or disable optional product telemetry for a cluster',\n      // A customer asks their CSM or TAM to switch the category off, thus the\n      // capability goes to `console:optionalTelemetryManager`. The population\n      // that holds the role lives in the Camundi permission rules, not in the\n      // name of the role. The console team keeps the permission, to help when\n      // a change does not take effect.\n      initialRoles: ['console:admin', 'console:optionalTelemetryManager'],\n    },\n    {\n      value: CLUSTER_PLAN_CAN_MODIFY,\n      description: 'can trigger modifications of a clusterplan',\n      initialRoles: ['console:admin', 'console:clusterPlanManager'],\n    },\n    {\n      value: RELEASE_TRAIN_PUBLISH,\n      description: 'can publish new generations via the release train endpoint',\n      initialRoles: ['console:admin', 'console:C8ReleaseManager'],\n    },\n    {\n      value: APICLIENT_READ,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:read', 'accounts:orgCreator'],\n    },\n    {\n      value: APICLIENT_DELETE,\n      description: 'can read API Clients Names of Organizations',\n      initialRoles: ['accounts:god'],\n    },\n  ]\n}\n"],
+  "mappings": "AAQO,IAAU;AAAA,CAAV,CAAUA,wBAAV;AACE,EAAMA,oBAAA,qBAAqB;AAE3B,EAAMA,oBAAA,qDAAqD;AAC3D,EAAMA,oBAAA,qCAAqC;AAC3C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,wDAAwD;AAC9D,EAAMA,oBAAA,yCAAyC;AAC/C,EAAMA,oBAAA,mCAAmC;AACzC,EAAMA,oBAAA,+BAAyC;AAAA,IACpDA,oBAAA;AAAA,IACAA,oBAAA;AAAA,IACAA,oBAAA;AAAA,EACF;AACO,EAAMA,oBAAA,8BAA8B;AACpC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,6BAA6B;AACnC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,sCAAsC;AAC5C,EAAMA,oBAAA,yCAAyC;AAE/C,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,sBAAsB;AAC5B,EAAMA,oBAAA,sBAAsB;AAE5B,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,iCAAiC;AAEvC,EAAMA,oBAAA,uBAAuB;AAC7B,EAAMA,oBAAA,0BAA0B;AAEhC,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,aAAa;AACnB,EAAMA,oBAAA,oBAAoB;AAC1B,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gCAAgC;AACtC,EAAMA,oBAAA,qBAAqB;AAC3B,EAAMA,oBAAA,+BAA+B;AACrC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,qCAAqC;AAiB3C,EAAMA,oBAAA,wBAAwB;AAO9B,EAAMA,oBAAA,2BAA2B;AAOjC,EAAMA,oBAAA,2BAA2B;AAcjC,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,2BAA2B;AACjC,EAAMA,oBAAA,mBAAmB;AACzB,EAAMA,oBAAA,0BAA0B;AAChC,EAAMA,oBAAA,gBAAgB;AACtB,EAAMA,oBAAA,iCAAiC;AACvC,EAAMA,oBAAA,0CAA0C;AAEhD,EAAMA,oBAAA,QAAQ;AACd,EAAMA,oBAAA,oBAAoB;AAE1B,EAAMA,oBAAA,wBAAwB;AAE9B,EAAMA,oBAAA,iBAAiB;AACvB,EAAMA,oBAAA,mBAAmB;AA2EzB,WAAS,sBAAgC;AAC9C,WAAO;AAAA,MACL,WAAW;AAAA,QACT,MAAM;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,MACA,cAAc,EAAE,OAAO,MAAM;AAAA,MAC7B,UAAU;AAAA,QACR,OAAO;AAAA,UACL,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,sBAAsB;AAAA,UACtB,KAAK;AAAA,UACL,+BAA+B;AAAA,QACjC;AAAA,QACA,cAAc;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA,UAAU;AAAA,QACR,uBAAuB;AAAA,QACvB,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,QACnB,gBAAgB;AAAA,QAChB,gBAAgB;AAAA,QAChB,yBAAyB;AAAA,QACzB,0BAA0B;AAAA,QAC1B,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,sBAAsB;AAAA,QACtB,0BAA0B;AAAA,QAC1B,4BAA4B;AAAA,MAC9B;AAAA,MACA,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA,SAAS;AAAA,QACT,QAAQ;AAAA,MACV;AAAA,MACA,UAAU;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,OAAO;AAAA,MACT;AAAA,MACA,KAAK;AAAA,QACH,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,mBAAmB;AAAA,QACnB,mBAAmB;AAAA,QACnB,iBAAiB;AAAA,QACjB,cAAc;AAAA,QACd,UAAU;AAAA,UACR,gBAAgB;AAAA,QAClB;AAAA,QACA,oBAAoB;AAAA,QACpB,6BAA6B;AAAA,QAC7B,WAAW;AAAA,QACX,oBAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AArEO,EAAAA,oBAAS;AAuET,EAAMA,oBAAA,qBAIR;AAAA,IACH;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,gBAAgB;AAAA,IACjC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKb,cAAc,CAAC,iBAAiB,sBAAsB;AAAA,IACxD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,EAAE,OAAOA,oBAAA,gBAAgB,aAAa,mBAAmB,cAAc,CAAC,EAAE;AAAA,IAC1E;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA,IAEA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA,IAEA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA;AAAA;AAAA,IAGA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC;AAAA,IACjB;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,eAAe;AAAA,IAChC;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,iBAAiB;AAAA,IACnD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,0BAA0B,eAAe;AAAA,IAC1D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA,MACF,cAAc,CAAC,aAAa;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aACE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMF,cAAc,CAAC,iBAAiB,kCAAkC;AAAA,IACpE;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,4BAA4B;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,0BAA0B;AAAA,IAC5D;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,iBAAiB,qBAAqB;AAAA,IACvD;AAAA,IACA;AAAA,MACE,OAAOA,oBAAA;AAAA,MACP,aAAa;AAAA,MACb,cAAc,CAAC,cAAc;AAAA,IAC/B;AAAA,EACF;AAAA,GA7jBe;",
   "names": ["ConsolePermissions"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/ccma-shared-types",
-  "version": "10.2.0",
+  "version": "10.3.0",
   "description": "Shared TypeScript types for Camunda Cloud Management Apps",
   "bugs": {
     "url": "https://github.com/camunda/camunda-cloud-management-apps/issues"